Matthias Schulze

After a series of fatal strikes involving civilians in Iraq and Afghanistan, Congress directed the Pentagon to reduce civilian casualties as part of a 2019 law. During the Biden administration, the Defense Department created the Civilian Harm Mitigation and Response initiative. The civilian mitigation teams – cut by 90% by Hegseth – work with military commanders on target planning, and making sure that targets are actually military sites. The teams help come up with "no strike" lists, including religious and cultural sites and schools

I knew that the Department of War shot a missile into a school & killed 175 civilians, mostly children.

This is learned today:

Secretary of War Hegseth had cut the teams assigned to prevent such tragedies by 90%.
www.npr.org/2026/03/11/n...

Teens Are Using AI-Fueled ‘Slander Pages’ to Mock Their Teachers Viral student-run TikTok and Instagram accounts are using AI to make memes of school faculty comparing them to figures like Jeffrey Epstein and Benjamin Netanyahu.

Teens Are Using AI-Fueled ‘Slander Pages’ to Mock Their Teachers #cybersecurity #infosec

Iranian influence operation using fake personas to deceive US Instagram users disrupted, Meta says Meta said it disrupted an influence operation linked to Iran that used “sophisticated fake personas” on Instagram to build relationships with U.S. users before introducing political messaging.

Iranian influence operation using fake personas to deceive US Instagram users disrupted, Meta says #cybersecurity #infosec

AI nonsense finds new home as Meta acquires Moltbook Think it's hard to tell bot from human on Facebook now? The biggest generator of AI slop on the internet has a new home, as Meta has reportedly acquired Moltbook and hired the team behind the social network for AI agents.…

AI nonsense finds new home as Meta acquires Moltbook #cybersecurity #infosec

The political effects of X's feed algorithm https://doi.org/10.1038/s41586-026-10098-2 Received: 16 December 2024 Accepted: 4 January 2026 Published online: 18 February 2026 Open access • Check for updates Germain Gauthier,5, Roland Hodler?5, Philine Widmer35 & Ekaterina Zhuravskaya3,4,5 m Feed algorithms are widely suspected to influence political attitudes. However, previous evidence from switching off the algorithm on Meta platforms found no political effects'. Here we present results from a 2023 field experiment on Elon Musk's platform X shedding light on this puzzle. We assigned active US-based users randomly to either an algorithmic or a chronological feed for 7 weeks, measuring political attitudes and online behaviour. Switching from a chronological to an algorithmic feed increased engagement and shifted political opinion towards more conservative positions, particularly regarding policy priorities, perceptions of criminal investigations into Donald Trump and views on the war in Ukraine. In contrast, switching from the algorithmic to the chronological feed had no comparable effects. Neither switching the algorithm on nor switching it off significantly affected affective polarization or self-reported partisanship. To investigate the mechanism, we analysed users' feed content and behaviour. We found that the algorithm promotes conservative content and demotes posts by traditional media. Exposure to algorithmic content leads users to follow conservative political activist accounts, which they continue to follow even after switching off the algorithm, helping explain the asymmetry in effects. These results suggest that initial exposure to X's algorithm has persistent effects on users' current political attitudes and account-following behaviour, even in the absence of a detectable effect on partisanship.

A new paper shows that less than 2 months of exposure to Twitter’s algorithmic feed significantly shifts people’s political views to the right.

Moving from chronological feed to the algorithmic feed also increases engagement.

This is one of the most concerning papers I’ve read in awhile.

Iranian-linked cyberattack cripples global medical technology company A crippling cyberattack on Stryker, a global medical technology company is linked to an Iranian hacker group.

Iranian-linked cyberattack cripples global medical technology company | Read full article at san.com/cc/iranian-l...

AI has made the Command Line Interface more important and powerful than ever before Google knows asking agents to navigate GUIs designed for humans is ridiculous. Microsoft might not Opinion  The command line interface is making a comeback because graphical user interfaces are a poor fit for autonomous agents, which could spell trouble for a lot of software – and software makers.…

AI has made the Command Line Interface more important and powerful than ever before #cybersecurity #infosec

-Gen. Joshua Rudd confirmed as next CyberCom and NSA head
-US to establish new inter-agency cyber cell
-UK to launch Online Crime Centre in April
-Coruna exploit kit traced back to L3Harris
-New Salesforce hacking campaign

Newsletter: news.risky.biz/risky-bullet...
Podcast: risky.biz/RBNEWS536/

Iranian influence operation using fake personas to deceive US Instagram users disrupted, Meta says Meta said it disrupted an influence operation linked to Iran that used “sophisticated fake personas” on Instagram to build relationships with U.S. users before introducing political messaging.

Meta said Wednesday it disrupted an influence operation linked to Iran that used “sophisticated fake personas” on Instagram to build relationships with U.S. users before introducing political messaging.

US Navy tells shipping industry Hormuz escorts not possible for now The U.S. Navy has refused near-daily requests from the shipping industry for military escorts through the Strait of Hormuz since ​the start of the war on Iran, saying the risk of attacks is too high f...

Whoa. This is big. "The U.S. Navy has refused near-daily requests from the shipping industry for military escorts through the Strait of Hormuz since the start of the war on Iran, saying the risk of attacks is too high for now." www.reuters.com/world/middle...

Kremlin backs covert campaign to keep Orbán in power Vladimir Putin endorses plan drawn up by Russian consultancy that is under western sanctions

Kremlin backs covert campaign to keep Orbán in power ft.trib.al/daSmFU9

Tarnung als Taktik: Warum Ransomware-Angriffe raffinierter werden Statt eines kurzen, aber sehr schmerzhaften Stiches setzen Cyberkrimelle zunehmend darauf, sich in ihren Opfern festzubeißen und beständig auszusaugen. mycteria – shutterstock.com Ransomware-Angreifer ändern zunehmend ihre Taktik und setzen vermehrt auf unauffällige Infiltration. Dies liegt daran, dass die Drohung mit der Veröffentlichung sensibler Unternehmensdaten zum Hauptdruckmittel bei Erpressungen geworden ist. Der jährliche Red-Teaming-Bericht von Picus Security zeigt, dass Angreifer zunehmen von auffälligen Störungen zu stillen, langfristigen Zugriffen übergehen, also weg von „räuberischen“ Smash-and-Grab-Methoden hin zu einer „parasitären“ Strategie mit verdeckter Dauerpräsenz. So seien vier von fünf der häufigsten Angriffstechniken von Ransomware-Varianten darauf ausgelegt, nach dem ersten Angriff unentdeckt zu bleiben. Laut Picus Security setzen Ransomware-Angreifer zunehmend darauf, Sicherheitsvorkehrungen zu umgehen und sich im Netzwerk festzusetzen, da sich ihr Vorgehen kontinuierlich weiterentwickelt hat. Zudem leiteten Angreifer Command-and-Control-Verkehr (C2) immer häufiger über vertrauenswürdige Unternehmensdienste wie OpenAI und AWS, damit ihre schädlichen Aktivitäten stärker wie normalen Geschäftsdatenverkehr erscheinen. Verkettung als Strategie Die Schlussfolgerungen von Picus Security basieren auf Angriffssimulationen sowie die Analyse von 1,1 Millionen Schadsoftware-Dateien und 15,5 Millionen Angriffsaktionen, die dem MITRE ATT&CK-Framework zugeordnet wurden. MIt der Erkenntnis, dass Angreifer Tarnung und Beharrlichkeit gegenüber auffälligen Störungen bevorzugen, ist Picus nicht allein. Sie deckt sich mit den Ergebnissen der Ransomware-Forschung von Securin (Download gegen Daten). Wie das Unternehmen berichtet, verketten Angreifer zunehmend mehrere Schwachstellen in ihren Angriffen auf Unternehmenssysteme miteinander. „Ransomware-Gruppen betrachten Schwachstellen nicht mehr als isolierte Einfallstore“, erklärt Aviral Verma, leitende Analystin für Bedrohungsanalysen von Securin. „Sie verknüpfen sie zu gezielten Angriffsketten und wählen Schwachstellen nicht nur nach deren Schweregrad aus, sondern auch danach, wie effektiv sie damit Vertrauen, Persistenz und operative Kontrolle über ganze Plattformen hinweg untergraben können.“ KI verstärkt Ransomware Wenngleich Angreifer immer stärker mit KI vertraut sind, fungiert sie bei Ransomware-Angriffen primär als Verstärker und nicht als treibende Kraft. Ransomware-Banden bevorzugen häufig, ihre Opfer doppelt zu erpressen: Zum einen drohen sie damit, die gestohlenen Informationen zu veröffentlichen, zum anderen mit dem Chaos, dass die Verschlüsselung der Daten nach dem Eindringen in Unternehmensnetzwerke verursacht. Mittlerweile sind diese Attacken allerdings weniger geworden, wie Picus berichtet. Konkret spricht das Unternehmen von einem Rückgang der Verschlüsselungen um 38 Prozent in den letzten 12 Monaten. Der Hintergrund: Immer mehr Cyberkriminelle würden dazu übergehen, Daten unbemerkt zu exfiltrieren, um die Opfer zu erpressen. Kein Rückgang, eher Zunahme Picus’ Behauptung, die Anzahl der Ransomware-Angriffe gehe zurück, ist allerdings umstritten. So vertritt Tony Anscombe, Chief Security Evangelist bei ESET, einem Anbieter von Endpoint-Security-Lösungen, eine gegenteilige Meinung: „Im aktuellen ESET-Threat-Report für das zweite Halbjahr 2025 zeigen die Erkennungsdaten einen Anstieg von 13 Prozent zwischen dem ersten und zweiten Halbjahr“, erklärt der Experte gegenüber unserer US-amerikanischen Schwester. „Gleichzeitig stieg die Zahl der öffentlich gemeldeten Opfer laut ecrime.ch um 40 Prozent. Daher scheint Ransomware nicht rückläufig zu sein.“ Mehr Opfer durch Optimierung Auch der Cybersicherheitsdienstleister GuidePoint Security sieht keinen Rückgang – ganz im Gegenteil. Wie das Unternehmen darstellt, erreichte die Zahl der aktiven Ransomware-Gruppen im vergangenen Jahr einen neuen Höchststand. So gibt Nick Hyatt, Senior Threat Intelligence Consultant bei GuidePoint Security, an, dass im vergangenen Jahr die Daten von über 7.000 Opfern veröffentlicht wurden. Diese Zahl schließt wahrscheinlich diejenigen aus, die zwar Lösegeld zahlten, deren Daten aber nie von den Angreifern veröffentlicht wurden. „Die Angreifer haben ihre Angriffsfähigkeiten optimiert und setzen auf eine Mischung aus etablierten Techniken, der Ausnutzung von Sicherheitslücken und neuartigen Angriffen, um ihre Ziele zu erreichen“, so Hyatt. Obenauf die üblichen Verdächtigen Die von CSO befragten Experten stuften Qilin, Cl0p und Akira allgemein als die aktivsten Ransomware-Gruppen ein, allerdings gab es zahlreiche weitere Konkurrenten. „Laut den Huntress-Daten für 2025 ist Akira heute die führende Ransomware-Gruppe“, erklärt Dray Agha, Senior Manager of Security Operations beim Managed Detection and Response-Anbieter Huntress. „Ihre Vorgehensweise entwickelt sich rasant weiter, insbesondere um bestehende Sicherheitslösungen zu neutralisieren. Wir beobachten, dass sie aggressiv die Hypervisor-Ebene angreifen, um herkömmliche Endpoint-Sicherheitsmaßnahmen vollständig zu umgehen.“ Collin Hogue-Spears, leitender Direktor und technischer Experte beim Sicherheitsunternehmen Black Duck Software, erklärt, dass Ransomware-Betreiber nicht mehr wie organisierte Verbrecher, sondern wie ein Plattformunternehmen agieren. So verzeichnete Qilin 2025 „über 1.000 Opfer, eine Versiebenfachung gegenüber dem Vorjahr“, wie der Experte erläutert. „LockBit 5.0 hat, nachdem es abgeschaltet wurde, seine Einsatzfähigkeit wiedererlangt.“ Cybercrime-Dienstleitung befeuert das Verbrechen Unterdessen bietet die Föderation aus Scattered Spider, Lapsus$ und ShinyHunters, kurz SLSH, Extortion-as-a-Service an – ein Ansatz, der es auch technisch weniger versierten Cyberkriminellen erleichtert, sich auf betrügerische Weise ihren Lebensunterhalt zu verdienen. „Innerhalb von sechs Monaten sind 73 neue Gruppen entstanden, weil sie ihre Tools nicht mehr selbst entwickeln müssen“, so Hogue-Spears. „Sie mieten sie.“ Vasileios Mourtzinos, Mitglied des Bedrohungsteams beim Managed-Detection-and-Response-Unternehmen Quorum Cyber, erklärt, dass immer mehr Gruppen von wirksamer Verschlüsselung zu erpressungsbasierten Modellen übergehen. Dabei stünden Datendiebstahl und ein langanhaltender, unauffälliger Zugriff im Vordergrund. Gefahr kommt von innen „Diese Vorgehensweise, die durch Akteure wie Cl0p bekannt wurde, indem sie Schwachstellen in Drittanbietersystemen und Lieferketten großflächig ausnutzen, findet nun immer breitere Anwendung“, so Mourtzinos. „Hinzu kommt der zunehmende Missbrauch gültiger Konten und legitimer administrativer Tools, um sich in den normalen Geschäftsbetrieb einzufügen. In einigen Fällen werden sogar Insider rekrutiert oder mit Anreizen bestochen, um den Zugriff zu ermöglichen.“ Diese sich stetig weiterentwickelnden Methoden von Ransomware-Gruppen erfordern ein Überdenken der Abwehrstrategien. „Für CISOs sollte die Priorität darin bestehen, die Identitätskontrollen zu stärken, vertrauenswürdige Anwendungen und Integrationen von Drittanbietern genau zu überwachen und sicherzustellen, dass sich die Erkennungsstrategien auf Persistenz und Datenexfiltration konzentrieren“, rät er. (tf)

Tarnung als Taktik: Warum Ransomware-Angriffe raffinierter werden #cybersecurity #infosec

Tencent reportedly tests QClaw AI agent with one-click OpenClaw deployment Tencent is internally testing an AI agent tool called QClaw that allows users to control computers through natural language commands, according to people familiar with the matter. The product focuses on one-click deployment, packaging the open-source framework OpenClaw into a local startup bundle so users can launch it quickly without complex configuration. QClaw will support connections to major large language models including Kimi and MiniMax. The tool also integrates with WeChat and QQ, enabling users to send natural language instructions from chat windows to remotely operate their computers, such as organizing files or executing automated tasks. [IThome, in Chinese]

Tencent reportedly tests QClaw AI agent with one-click OpenClaw deployment #cybersecurity #infosec

4 ways to prepare your SOC for agentic AI a way to automate alert triage, threat investigation and eventually higher-level functions. According to IDC, agentic AI is on track to become mainstream infrastructure. The analyst firm expects 45% of organizations to have autonomous agents operating at scale across critical business functions by 2030. In enterprise SOCs, AI is already reshaping functions like alert triage, enrichment, data correlation, IOC validation and initial containment. It could soon move up the stack to take on more complex tasks like incident investigation, root cause analysis, and response. “AI acts as a force multiplier in the SOC,” says Nicole Carignan, senior VP, security and AI strategy at Darktrace. But harnessing that promise will require organizations to invest now in reskilling analysts, redesigning processes, building new technical roles, and establishing guardrails and governance frameworks to ensure autonomous AI agents operate safely. “It’s not enough to simply deploy an AI solution. Security practitioners must understand how the underlying machine learning techniques function, what their strengths and limitations are, and how to evaluate their outputs,” Carignan says. “Without explainability and trust, AI risks are exacerbating alert fatigue rather than solving it.” Here is what security leaders need to know — and do — to prepare their SOCs for the agentic AI era. Reskill analysts to become AI collaborators and overseers Increasingly, human roles in the SOC will shift from hands-on execution to supervision, governance, design, and oversight. As AI agents take on more operational tasks, analysts will need to focus on managing AI systems, interpreting outputs, and resolving the nuanced challenges machines cannot handle, says Casey Ellis, founder of Bugcrowd. “Jobs won’t disappear, they’ll adapt. The key is ensuring that SOC professionals are prepared for this shift through ongoing education, training, and tooling.” Few expect the transition will occur organically or without friction. Many SOC leaders will need to reskill existing staff to manage AI effectively; to interrogate AI reasoning; enrich investigations with contextual insight; and apply informed human analysis to AI-driven outputs. When acting on an AI tool’s recommendation, analysts must understand what questions the agent asked, which data sources it queried, and what evidence informed its decision, according to Dov Yoran, co-founder and CEO of Command Zero. From there, they need to be able to pivot to additional data sources, pursue new artifacts, and extend the investigative timeline as needed. “Junior analysts who might not know how to start an investigation from scratch can become effective by learning how to extend and refine what the agent produced,” Yoran says. “It’s a different skill set from traditional SOC work, and in many ways, a more accessible one.” In the SOC of the future, analysts must also act as adversarial reviewers of AI-driven conclusions. That’s because AI systems can introduce hallucinations, training-data bias, and other vulnerabilities while also being vulnerable to adversarial manipulation. Analysts need to recognize these risks to ensure decisions remain grounded and defensible, says Ensar Seker, CISO at SOCRadar. “Analysts need to be trained less as button-pushers and more as adversarial reviewers of AI output. That means understanding how models reason, where they fail, how bias and data gaps surface, and how to interrogate confidence levels and assumptions. The goal isn’t to ‘trust AI faster,’ but to develop the instinct to ask: What would make this conclusion wrong?” Seker says. Analysts will also play a critical role in enabling organization-specific context into AI-driven workflows. Without that context, agents risk missing threats, amplifying noise, or triggering risky actions based on incomplete information. SOC leaders need to remember that “AI agents are only as smart as the context they have access to,” Yoran says. Analysts must learn to annotate identities, maintain watch lists, document recurring false-positive patterns, and build enrichment layers that strengthen future investigations, he said, “This is knowledge work, not data work.” Ultimately, the objective is not to outperform AI, but to do better where AI falls short. For example, “accept that autonomous alert triage will become table stakes,” Yoran says. “Your processes need to shift from ‘how do we triage every alert’ to ‘how do we handle escalations from autonomous investigations’.” Build capabilities for AI governance, content and quality Upskilling existing analysts alone is not enough. As AI agents begin operating across tools, making decisions and triggering actions with minimal human involvement, the demands on the SOC will extend well beyond traditional analyst capabilities, experts say. Content engineering, for instance, is one emerging requirement. In an AI-enabled SOC, detection engineers will no longer write only static rules. They must design dynamic content such as questions, prompts and investigation templates that agents can use to reason, enrich data, correlate signals and act autonomously. These content engineers curate the structured inputs that power agents, including telemetry, threat models, and playbooks. “This is the most underappreciated role in AI-powered security operations,” Yoran notes. “These are people who build and maintain the questions that agents can ask, the investigation plans that guide autonomous work, and the knowledge bases that provide context,”. Organizations need someone who can translate detection logic from their SIEM, import best practices from frameworks like MITRE ATT&CK, and encode institutional knowledge into the platform. “This isn’t traditional security engineering, it’s closer to knowledge management combined with threat intelligence,” he says. Mature SOCs will also require clear ownership of AI governance and agent oversight. That includes roles that have oversight over model risk evaluation, prompt and policy management, continuous performance validation, and even red teaming the agents themselves, Seker says. “You don’t need a massive new team, but you do need clear accountability for how autonomous decisions are made, tested, and constrained.” Another emerging need is analysts with deep fluency in data management. An AI-driven SOC will require professionals who understand how information should be classified, protected, normalized, and monitored to ensure reliable conclusions. “With 64% of organizations planning to add AI-powered solutions to their security stack in the next year, it is critical for professionals to cross-skill in AI,” Carignan says. “Cybersecurity professionals must become fluent in AI and data, developing a deeper understanding of data classification, governance, and model behavior.” Cross-skills in data science, machine learning, and cybersecurity enable analysts to critically evaluate AI outputs, tune models for security use cases, and adapt defenses as threats evolve, making them indispensable in an AI-augmented SOC. Frank Dickson, an analyst at IDC, urged organizations to think of this capability as similar to a data architect role. “The key to getting value from AI is having data located in a place where you can get to it, having it formatted in a homogeneous way so you can do analysis on it, and then manage the data,” he says. “The success of your AI initiative is going to be tied to the effectiveness of your ability to get data. A data architect manages that.” Dickson also emphasized the need for an “orchestration platform engineer” role responsible for ensuring effective communication and workflow integration across security tools. The SOC of the future will not hinge on a single platform but on an interconnected ecosystem of SIEM, EDR, SOAR, identity, cloud and other systems that must operate in concert to support AI-driven, agentic investigations and automation, Dickson tells. Dedicated orchestration expertise will become essential to maintain reliable data flows and automation logic in such an environment, he noted. Redesign SOC processes and playbooks where needed Organizations will need to review and rework SOC processes and playbooks to ensure their AI-augmented SOC is consistent, efficient and continuously learning. Yoran recommends that SOC leaders focus on codifying institutional knowledge into AI agent-accessible questions and plans. Translate playbooks into investigation plans that AI agents can follow on a repeatable basis. In situations where an agent might hit a wall, have processes in place for a smooth handoff to a human analyst and build feedback loops for continuous improvement, Yoran adds. “Playbooks must shift from step-by-step human procedures to intent-based guardrails,” Seker points out. “Instead of telling analysts how to investigate, define what outcomes are allowed, what actions are prohibited, and when human approval is mandatory.”. The objective is not to micromanage every alert but to assume AI agents operate continuously across tools, with humans only supervising exceptions, edge cases, and strategic decisions. SOCs also need to rethink metrics, accountability, and documentation within the SOC. Traditional performance indicators, such as ticket closure rates or mean time to resolution, may need to broaden to include model accuracy, escalation quality, and the effectiveness of automated containment actions. “The biggest mistake is optimizing for speed metrics instead of investigation quality,” Yoran says. “I see this constantly: vendors promising 90% faster time to resolution or reduce tier-one workload by 80% or close alerts in seconds instead of hours. These metrics while seductive are dangerous,” he cautions. “Making the same mistake faster benefits no one. An incomplete investigation that closes in two minutes isn’t better than a thorough investigation that takes 30 minutes.” Auditability too becomes critical. All AI-driven decisions should be traceable, explainable, and reviewable from both an internal governance standpoint and for external compliance requirements.  “If you can’t explain why an AI took an action to an auditor, regulator, or executive, it shouldn’t be allowed to take that action. Explainability isn’t a nice-to-have; it’s a prerequisite for autonomy,” Seker says. Implement AI guardrails and principles Formal guardrails and operating principles are going to be critical in SOCs where AI agents influence decisions, initiate responses and help prioritize threats. That means setting defined boundaries around data access and model behavior, having processes to validate responses and making sure humans remain in the loop on all high-impact decisions. Focus areas should include approval thresholds for autonomous actions, figuring out allowed and disallowed actions for an agent, protecting against prompt injection attacks, testing and red-teaming of agentic workflows and ensuring IR policies are updated for AI-driven actions. “Require transparent decision trails, rate limiting, least-privilege, and instant override,” Seker advises. “Hard limits on action scope, blast radius, and privilege are non-negotiable. Agents should operate under least-privilege identities, with explicit kill-switches, change-control boundaries, and environment awareness. The key is to ensure that AI is never allowed to silently escalate its own authority or modify guardrails without human approval.” IDC analyst Dickson pointed to identity and access as two other areas to focus on by way of guardrails and policies. “In the past, when we gave humans access, we often over-provisioned by default. That approach does not work with agents. With agentic AI, permissions must start at least privilege, defined precisely from day one.” The focus should be on ensuring no standing privileges, implementing dynamic authorization and establishing clear role definitions, Dickson says. “Agentic AI is enormously powerful. Constraining access correctly is non-negotiable.”

4 ways to prepare your SOC for agentic AI #cybersecurity #infosec

Had to doublecheck the date on this

Update from Adam Sella

Trump blames deadly strike on school on Iran. "We think it was done by Iran." But Hegseth does not back him up when asked if that was so. "We're investigating," he says. A @nytimes.com analysis indicates it was likely hit by US airstrike. @shawnmccreesh.bsky.social www.nytimes.com/live/2026/03...

This is no different from Putin saying MH17 was shot down by Ukraine or Assad saying rebels gassed themselves.

Alleged India-linked espionage campaign targeted Pakistan, Bangladesh, Sri Lanka An espionage campaign last year targeted government agencies and critical infrastructure operators in Pakistan, Bangladesh and Sri Lanka, the cybersecurity firm Arctic Wolf said.

Alleged India-linked espionage campaign targeted Pakistan, Bangladesh, Sri Lanka #cybersecurity #infosec

The Maduro raid will encourage the dangerous notion that daring operations and decapitation strikes can help conclude a major conflict. Capturing or killing an enemy leader, the theory goes, will trigger chaos and collapse resistance. History, however, suggests otherwise.‘

Exclusive: US investigation points to likely US responsibility in Iran school strike, sources say Military investigators believe it is likely that U.S. forces were responsible for an apparent strike on an Iranian girls' school that killed scores of children on Saturday, two U.S. officials told Reu...

Reuters Exclusive

"U.S. military investigators believe it is likely that U.S. forces were responsible for an apparent strike on an Iranian girls' school."

"The strike would rank among the worst cases of civilian casualties in decades of U.S. conflicts in the ​Middle East."

Nancy Youssef, ..guil @ X.com @nancyayoussef The preliminary Pentagon cost estimate of the war in Iran is $1 billion a day, a congressional official told me. 12:20 PM • 3/4/26 • 44K Views

Preliminary Pentagon cost estimate of the war in Iran is $1 BILLION a day. So far.

Russia weaponizes MEGA and EU rifts in its information operation to spread Union collapse narrative Two coordinated campaigns and five tiers of distribution. More than thirty outlets across fourteen countries. One goal: convince Europeans their union is already finished, that the EU is collapsing, and incite hatred toward Brussels. The information operation started with ‘pseudo-analytical’ articles in Russian state media (sanctioned in the EU), followed by disinformation websites (like Pravda and Front) and amplified by pro-Kremlin media in Europe and anti-EU posts on multiple Telegram channels. When a new alliance under the MEGA (Make Europe Great Again) banner gathered in Brussels on February 2, 2026, the event was real. The politicians were real. The speeches were real. What happened in the 72 hours that followed was a planned information operation of foreign influence. A precisely timed, multilingual, cross-platform amplification campaign pushed one specific reading of that conference into living rooms across Germany, Slovakia, France, Hungary, Poland, Spain, the Netherlands, Finland, Estonia, Belgium, and the Czech Republic. At the same time, a second campaign was feeding those same audiences a story about the EU’s top leadership tearing itself apart from the inside. The two campaigns ran in parallel, targeted different anxieties, and were carried by many of the same outlets. This is not a story about invented facts. The MEGA conference did take place. The friction between Ursula von der Leyen and Kaja Kallas is real and has been reported by mainstream European media. What makes this a disinformation operation is something more precise: real events were selected, stripped of context, and amplified through a network of outlets that disguised where the content came from. The facts were twisted to suit the Kremlin’s agenda. The goal was not to fabricate reality but to reshape how people understand it — to turn a fringe political conference into proof that the EU is illegitimate and to turn a management disagreement between two officials into evidence of imminent collapse. And to make Russia’s role in any of this completely invisible. On February 6, 2026, the Russian state news agency RIA Novosti published an opinion piece by Petr Akopov, a Russian propagandist and political commentator who writes regularly for the outlet. The article was titled “Europe Against the European Union: Brussels Knows What It Is Doing.” Its opening line was the slogan that would travel across more than twenty websites in six languages over the following three days: “We love Europe and therefore despise the European Union.” Akopov attributed the line to Filip Dewinter, the leader of the Belgian far-right party Vlaams Belang, who had co-hosted the MEGA founding conference in Brussels. Dewinter’s actual statement at the event was that “the future of Europe lies in nation states, not in liberal globalism.” Around that statement, Akopov built a political argument presented as analysis: that the EU’s support for Ukraine in the Russian-Ukrainian war is not about values or security but about manufactured fear, an “artificially inflated fear” designed by European elites to hold together a bloc that would otherwise fall apart on its own. Those at the MEGA conference, he wrote, “advocate for true European unity, including all of Greater Europe — from Russians to Portuguese.” EU leaders, by contrast, want to “unite Europeans on the basis of fear and hatred.” This framing does specific political work. It erases Russia’s responsibility for the Russian-Ukrainian war entirely. It reframes European support for Ukraine as elite manipulation. And it positions a far-right Brussels conference as the authentic voice of European civilisation. RIA Novosti published the piece, and it was simultaneously promoted through RT DE, the German-language branch of the Russian state broadcaster RT, which is banned across the EU. RT DE published it on its website and, to get around its YouTube ban, distributed the accompanying video through Odysee, a platform RT uses specifically as a workaround to spread its video reports. The video opened with the same words as the article. * https://ria.ru/20260206/evropa-2072575129.html  * https://de.rt.com/meinung/269542-mega-europa-gegen-eu/  * https://odysee.com/@RTDE:e/MEGA-ein-Europa-gegen-die-EU:0  What happened next is the most visible evidence of coordination. Within hours of the RIA Novosti article going live, the Russian outlet News Front published translations of Akopov’s piece in six languages across its network of country-specific websites. The French version appeared at 14:00, Slovak at 15:00, Polish at 16:00, Hungarian at 17:00, German at 18:00, and Spanish at 19:00. Six languages, five consecutive hours, all carrying the same text, all crediting “Petr Akopov, RIA Novosti” at the bottom. No independent newsroom publishes the same article in six languages within five hours. This was not journalism. It was an anti-EU information operation disguised as journalism. * https://sk.news-front.su/2026/02/06/mega-europa-vs-eu/  * https://fr.news-front.su/2026/02/06/rendre-sa-grandeur-a-leurope-leurope-contre-lunion-europeenne/  * https://pl.news-front.su/2026/02/06/make-europe-great-again-europa-przeciwko-unii-europejskie j/  * https://hu.news-front.su/2026/02/06/tegyuk-ujra-naggya-europat-europa-az-eupai-unio-ellen/  * https://de.news-front.su/2026/02/06/make-europe-great-again-europa-gegen-die-europaische-union/  * https://es.news-front.su/2026/02/06/hacer-que-europa-vuelva-a-ser-grande-europa-contra-la-union-europea/  Two days later, on February 8, a second Russian network joined the operation. News Pravda runs under country-specific domain names — germany.news-pravda.com, francais.news-pravda.com, belgium.news-pravda.com, poland.news-pravda.com — designed to read as local news to anyone who encounters them without prior knowledge. The German edition published the full Akopov article with a note buried at the bottom: “Translated from Russian. The article was originally published by RIA Novosti on February 6, 2026. That disclosure existed. But a reader arriving at a site called deutsch.news-pravda.com is not primed to look for it. * https://germany.news-pravda.com/world/2026/02/08/230325.html  * https://francais.news-pravda.com/world/2026/02/08/721220.html  * https://deutsch.news-pravda.com/world/2026/02/08/603759.html  * https://belgium.news-pravda.com/fr/world/2026/02/08/10478.html  * https://poland.news-pravda.com/world/2026/02/06/228652.html  * https://news-pravda.com/world/2026/02/06/2059447.html  * https://deutsch.news-pravda.com/world/2026/02/06/601778.html  The Belgium edition of News Pravda added content from the X account Brainless Partisans, which has 113,900 followers. That account published its version of the anti-EU framing sourced from a Telegram channel, and it spread directly on X as well. “Brussels is no longer a capital, it is an ideological archive center,” Brainless Partisans wrote. And further: “Permanent conflict with Russia makes no strategic sense for Europe, except to artificially maintain a Union held together only by fear. And fear, like any drug, requires ever-stronger doses. Until the overdose.” * https://x.com/BPartisans/status/2020484702017044907  * https://x.com/BPartisans/status/2020484852542312532  By February 9, the Akopov article had arrived at a set of websites that present themselves as ‘alternative’ European media. The German site Krisenfrei published the full piece under the byline “Von Pjotr Akopow (rtdeutsch)” and included a detailed author biography identifying Akopov as a RIA Novosti political observer. The two Slovak pro-Kremlin sites Infovojna and Slovanské Noviny published identical versions of the article, both crediting “Autor: Pjotr Akopov / Zdroj: ria.ru / sk.news-front.su” at the bottom of the page. Three steps in the chain, printed in plain sight, invisible to anyone who did not know what to look for. * https://krisenfrei.com/mega-ein-europa-gegen-die-eu/  * https://www.infovojna.com/article/mega-europa-vs-eu  * https://slovanskenoviny.sk/mega-europa-vs-eu/  The final distribution layer was Telegram, where content moved fastest and its origin was least visible. At least eleven channels distributed the Akopov article in German, Polish, and Slovak between February 7 and 9, with subscriber counts ranging from a few hundred to over eleven thousand. The largest, Spravy Slovakia, had 11,346 subscribers and was linked directly to the News Front Slovak edition. The RT DE Live Newsticker had 1,150 subscribers and was linked to rt.com directly. MT News Deutsch had 3,086 subscribers. Fresse Frei, with 1,464 subscribers, described itself as publishing RT DE podcasts, its name being a crude wordplay on the German word for press freedom. RT Deutsch had 4,844 subscribers. Matroschka Today, with 598 subscribers, posted the full RT article text alongside a link to the Odysee video. Echte Nachrichten had 1,550 subscribers. Just Now News had 1,107. Prawda PL, with 386 subscribers, carried the Polish version. Zwischenspeicher had 216. At the other end of the scale, a channel called Kremllieferservice—which translates directly as “Kremlin Delivery Service”—posted the same article with a link to an RT mirror domain. That a channel would name itself after its own function is either unusual self-awareness or a complete absence of concern about being identified. Either way, the name is accurate. Every channel in this network is linked to an RT domain, a News Front page, or a European proxy site. None linked to independent reporting. * https://t.me/spravy_slovakia/25643  * https://t.me/rt_de_live_newsticker/22665  * https://t.me/MTnews_Deutsch/26513  * https://t.me/fresse_frei/4966  * https://t.me/echtenachrichten/43102  * https://t.me/matroschka_today/86946  * https://t.me/pravdaplcom/52432  * https://t.me/rtdeutsch_rtde/33151  * https://t.me/kremllieferservice/33154  * https://t.me/zwischenspeicher/176112  * https://t.me/justnow_news/40096  The operation also had a version built for a different audience. On February 7, the journal InterAffairs.ru, published by the Russian International Affairs Council — a think tank with close state ties — released an English-language conference report on MEGA, presenting it as a legitimate political development. The piece described the alliance as “dedicated to defending Western civilisation” and repeated the claim that Starmer, Macron, and Merz had “repeatedly jeopardized” Trump’s efforts regarding the Russian-Ukrainian war, citing conference speakers as its source. Nothing was framed as contested. This was the version of the operation built for policy circles and analytical audiences who would dismiss RT but might forward an InterAffairs.ru link to a colleague without checking where the journal sits institutionally. * https://en.interaffairs.ru/article/europe-is-waking-up-from-its-liberal-slumber-a-make-europe-great-again-mega-inaugural-conferen/  While the MEGA content was moving through its network, a second operation was running in parallel. Its target was the working relationship between European Commission President Ursula von der Leyen and EU foreign policy chief Kaja Kallas. The tensions between the two are real. Western mainstream outlets reported on friction over institutional authority, including a dispute about the Mediterranean region portfolio. But the version of this story that circulated through Russian and pro-Kremlin-position media was built on a single anonymous claim that appeared first on a platform linked to Russian intelligence services. On January 31, 2026, the Strategic Culture Foundation published a lengthy article by Dutch writer Sonja van den Ende. The Strategic Culture Foundation has been designated by both the EU and the United States as a channel linked to Russian intelligence, used to give disinformation the appearance of geopolitical analysis. Van den Ende’s piece described the EU as a “self-imposed island of isolation where the appearance of a good life and democracy is maintained by politically funded media.” It argued that the friction between von der Leyen and Kallas “usually means the end of a bloc, organisation, or country.” And it quoted an anonymous senior EU official saying that Kallas “privately calls von der Leyen a dictator, but she can do little about it.” That anonymous claim, on that platform, became the factual anchor for everything that followed. One detail in the text travelled intact to every site that republished it. Throughout the article, von der Leyen is referred to not by her name or title but as “Führerin” — a German word with direct and unmistakable associations with the Nazi period. The word appeared repeatedly and was copied verbatim across Switzerland, Germany, the Czech Republic, Finland, and Estonia. It was designed to trigger a specific emotional response in German-speaking audiences, and it worked as designed every time it was republished. * https://strategic-culture.su/news/2026/01/31/how-eu-politicians-live-in-own-bubble-enemies-their-isolated-eu-island/  On February 1, 2026, the day after the Strategic Culture publication, three major Russian state outlets published the story within hours of each other. None had conducted independent reporting. All three cited Strategic Culture as their source. RIA Novosti described the disagreement between von der Leyen and Kallas as evidence of “the approaching collapse of the EU.” Izvestia ran the headline “Strategic Culture Points to the Harm for the EU of the Von der Leyen and Kallas Disagreements,” naming the source in the headline itself — an editorial choice that functions as a public legitimisation signal for the platform. Lenta.ru wrote that the conflict had pushed Europe to live on a “voluntary island of isolation, inventing countless enemies around itself.” A platform linked to Russian intelligence published a claim on January 31. Three state outlets amplified it the next day. The direction of travel is clear. * https://ria.ru/20260201/ssora-2071495442.html  * https://iz.ru/2035066/2026-02-01/sc-ukazala-na-vred-dlia-es-raznoglasii-fon-der-liaien-i-kallas  * https://lenta.ru/news/2026/02/01/es-predrekli-raskol-iz-za-konflikta-kallas-i-fon-der-lyayen/  From the Russian state layer, the campaign moved into Europe through the same network that had carried the MEGA content and through several additional sites. News Front SK published the Slovak translation on February 1 at 15:00, within hours of the Russian state wave. The Slovak site Oral.sk republished the same content the same day. * https://sk.news-front.su/2026/02/01/strategic-culture-nevrazivost-medzi-von-der-leyen-a-kallas-by-mohla-znicit-eu/   * https://oral.sk/nevrazivost-medzi-von-der-leyen-a-kallas-by-mohla-znicit-eu/  The story then spread through the Slovak and Czech cluster. Slovanské Noviny, Infovojna, CZ24.news, and Infokuryr all published versions crediting Strategic Culture or News Front as their source. * https://slovanskenoviny.sk/staty-eu-na-cele-s-eurokomisiou-su-coraz-viac-izolovane-od-zvysku-sveta-a-vytvaraju-si-nespocetne-mnozstvo-nepriatelov-po-celej-planete/  * https://www.infovojna.com/article/staty-eu-na-cele-s-eurokomisiou-su-coraz-viac-izolovane-od-zvysku-sveta-a-vytvaraju-si-nespocetne-mnozstvo-nepriatelov  * https://cz24.news/nevrazivost-medzi-von-der-leyen-a-kallas-by-mohla-znicit-eu-strategic-culture/  * https://www.infokuryr.cz/n/2026/02/10/jak-politici-eu-ziji-ve-vlastni-nepratelske-bubline-na-svem-izolovanem-ostrove-eu/  In the German-language zone, three sites published texts that were identical word for word. Uncutnews in Switzerland, Krisenfrei in Germany, and DDBnews in Germany ran the same article, with the only difference being that DDBnews attributed it to an author named simply “Uwe” with no surname. Three outlets, one text, zero original journalism. * https://uncutnews.ch/wie-eu-politiker-in-ihrer-eigenen-feindesblase-auf-ihrer-isolierten-eu-insel-leben/  * https://krisenfrei.com/wie-eu-politiker-in-ihrer-eigenen-blase-von-feinden-auf-ihrer-isolierten-eu-insel-leben/  * https://www.ddbnews.de/wie-eu-politiker-in-ihrer-eigenen-feindesblase-auf-ihrer-isolierten-eu-insel-leben/  In France, the piece appeared on Newsnet. In Hungary, Pestisracok published it under the headline “Catfight — The Von der Leyen and Kallas Brawl Foreshadows the End of the EU,” adding a local editorial voice while keeping the core narrative intact. In the Netherlands, Sonja van den Ende—the same author who had written the original Strategic Culture piece—published an expanded Dutch version on Indignatie.nl under the headline “Europe’s Submission to Uncle Sam,” adding anti-American material while keeping the EU disintegration framing at the centre. * http://www.newsnet.fr/302926  * https://pestisracok.hu/vilagugar/2026/02/cicaharc-von-der-leyen-kallas-balheja-eu-veget  * https://indignatie.nl/europas-onderwerping-aan-uncle-sam/  Van den Ende’s reach across European outlets tells its story. The same author supplied content to at least seven outlets across six countries: Uncutnews in Switzerland, Indignatie in the Netherlands, Krisenfrei and DDBnews in Germany, Infokuryr in the Czech Republic, and the Finnish and Estonian editions of eestieest.com. One author, one original text, seven outlets, and six languages are all served by the same author. That is a distribution network with a house author. The Finnish publication fi.eestieest.com and the Estonian publication eestieest.com both translated the article in full and published it for audiences in two NATO members on Russia’s immediate border. And the claim at the centre — that Kallas privately called von der Leyen a dictator — was published in Estonian. Kaja Kallas is Estonian. Her standing in her home country, where she is most known and where reputational damage would land hardest, was not an incidental choice of target. That was the point. * https://fi.eestieest.com/Kuinka-EU-poliitikot-elävät-oman-vihollisensa-kuplassa-eristyneellä-EU-saarellaan/  * https://eestieest.com/kuidas-el-i-poliitikud-elavad-omaenda-vaenlase-mullis-oma-isoleeritud-el-i-saarel/   Looked at separately, each campaign could be explained away. Fringe websites covering a political conference. Some editorial overlap between small alternative outlets. A story about EU leadership tensions that spread across a few countries. Taken alone, the coincidences could be dismissed. Looking at them together, the picture is different. The same Slovak sites — News Front SK, Infovojna, Slovanské Noviny, Oral.sk — amplified both campaigns. The same German sites — Krisenfrei, DDBnews — amplified both. These are not outlets that happened to cover two overlapping stories. They are standing relay infrastructure that activates whenever a Russian narrative needs European distribution, regardless of the topic. The timelines are not coincidental. In the MEGA campaign, RIA Novosti publishes on February 6, News Front follows in six languages the same day, News Pravda follows on February 8, and European proxy sites follow on February 9. In the Kallas and von der Leyen campaign, Strategic Culture publishes on January 31, Russian state media follows on February 1, and European amplifiers follow within 24 to 72 hours. In both cases the direction of travel is always the same — from Moscow outward, not from European civil society inward. And both campaigns pointed to the same conclusion. The MEGA campaign told European audiences that their leadership is the enemy of real European values and that the Russian-Ukrainian war is a manufactured crisis. The von der Leyen and Kallas campaign told those same audiences that the institution is already tearing itself apart from the inside. Together they constructed a single message: the EU is antidemocratic, isolated, and collapsing. The question of what should come instead was left carefully unanswered. It did not need to be asked. Sowing the doubt was enough.

Russia weaponizes MEGA and EU rifts in its information operation to spread Union collapse narrative #cybersecurity #infosec

When Red Lines Cross Blue Lines: Cyber Attacks on Poland’s Water Infrastructure – Part I The post When Red Lines Cross Blue Lines: Cyber Attacks on Poland’s Water Infrastructure – Part I appeared first on Lieber Institute West Point.

When Red Lines Cross Blue Lines: Cyber Attacks on Poland’s Water Infrastructure – Part I #cybersecurity #infosec

Vulnerability monitoring service secures public-sector websites faster An automated scanning system has cut the time it takes to fix cybersecurity vulnerabilities across public sector IT systems, reducing median remediation time for general cyber vulnerabilities from 53 days to 32, and slashing DNS-specific average fix times from 50 days to eight. The results come from the UK government’s newly launched vulnerability monitoring service (VMS), which continuously scans more than 6,000 public bodies from doctors’ offices and ambulance trusts to hospitals and the Legal Aid Agency, tracking every identified weakness until it is resolved. The service detects around 1,000 types of vulnerabilities and processes approximately 400 confirmed findings a month, the government said. “Cyber-attacks aren’t abstract threats, they delay National Health Service appointments, disrupt essential services, and put people’s most sensitive data at risk,” said UK Minister for Digital Government Ian Murray in a statement announcing the results at the annual Government Cyber Security and Digital Resilience conference. “When public services struggle it’s families, patients and frontline workers that feel it.” Murray also unveiled a £210 million ($266 million) Cyber Action Plan and the launch of a first-ever government Cyber Profession, a program to recruit, train, and retain security talent across public services. Favorable comparison Paul McKay, VP principal analyst at Forrester, said the numbers compare favorably against private sector benchmarks. “These median fix times are generally better than the figures vulnerability management vendors publish in benchmark studies, which log average fix time ranging from a few weeks to several months depending on vulnerability criticality and whether it is known to be exploited in other organizations,” McKay said. The bigger problem in most organizations is not detection speed but communication, McKay said. Security teams that can’t explain why a specific finding matters tend to see vulnerabilities pile up unresolved. “Lots of security teams struggle to do this, overwhelming technology teams with lists of thousands of vulnerabilities with unrealistic SLA timeframes to fix them,” he said. The gap between average and best-in-class performance, he added, comes down to one thing: “The ability to cleanly articulate why vulnerabilities matter in terms of the business impact and show real rather than theoretical risk exposure.” That clarity of communication, McKay said, matters more than the tools an organization deploys. Tools good, talk better The UK government’s VMS uses a combination of commercial and proprietary scanning tools to detect vulnerabilities in internet-facing assets. But McKay cautions against drawing the wrong conclusion from the results. “Process, accountability and taking ownership for explaining why this matters to the resilience of the business is far more important than the technical tooling,” he said. “Building a robust prioritization approach and a strong trusted relationship with peer stakeholders responsible for doing the work of patching and applying fixes, matters far more than the specific tooling chosen.” The UK’s VMS alerts responsible organizations with “specific, actionable guidance” on each finding, rather than generating raw vulnerability feeds, and tracks progress until the issue is closed. The government cited DNS vulnerabilities as a specific example. Before the VMS, a weakness in a government DNS record could sit undetected for nearly two months. The service has closed that window to eight days. The statement also added that the service will expand to cover additional vulnerability categories, with fix times expected to fall further as it matures. The UK’s National Audit Office (NAO), however, flagged a challenge the VMS alone cannot fix. The workforce challenge Word of the success of VMS comes a month after the NAO reported that the cyber threat to government is “severe and advancing quickly,” concluding that resilience levels were lower than previously estimated, and determined the government would not meet its own 2025 cyber resilience targets. It identified skills gaps as the single biggest risk to building lasting cyber resilience. The government said the new Cyber Profession is a direct response to those findings. Co-branded with the National Cyber Security Centre (NCSC) and the Department for Science, Innovation and Technology (DSIT), it will “establish a dedicated Cyber Resourcing Hub, a government Cyber Academy, an apprenticeship scheme, and structured career pathways” aligned with UK Cyber Security Council standards. Manchester will serve as the primary hub, the statement added. “The launch of the government Cyber Profession will help attract and retain the most talented professionals with the top-tier skills needed to keep the UK safe online,” NCSC CEO Richard Horne said in the statement. DSIT did not respond to requests for additional technical detail on the VMS by the time of publication.

Vulnerability monitoring service secures public-sector websites faster #cybersecurity #infosec

Iran's cyberwar has begun 'Expect elevated activity for the foreseeable future' Iranian hackers have launched spying expeditions, digital probes, and distributed denial of service (DDoS) attacks in the wake of the US and Israel launching missile strikes over the weekend, and security researchers urge organizations to expect more cyber intrusions as the war continues.…

Iran's cyberwar has begun #cybersecurity #infosec

Cyber Command disrupted Iranian comms, sensors, top general says U.S. Cyber Command conducted online attacks against Iranian communications systems that the country’s top general said set the stage for the joint bombing campaign with Israel.

Cyber Command disrupted Iranian comms, sensors, top general says #cybersecurity #infosec

Cyber, Space Commands were among 'first movers' in strikes on Iran: top general ]]>

Cyber, Space Commands were among 'first movers' in strikes on Iran: top general #cybersecurity #infosec

Aeternum Botnet Loader Employs Polygon Blockchain C&C to Boost Resilience Aeternum operates on smart contracts, making its command-and-control (C&C) infrastructure difficult to disrupt. The post Aeternum Botnet Loader Employs Polygon Blockchain C&C to Boost Resilience appeared first on SecurityWeek.

Aeternum Botnet Loader Employs Polygon Blockchain C&C to Boost Resilience #cybersecurity #infosec

APT37 hackers use new malware to breach air-gapped networks North Korean hackers are deploying newly uncovered tools to move data between internet-connected and air-gapped systems, spread via removable drives, and conduct covert surveillance. [...]

APT37 hackers use new malware to breach air-gapped networks #cybersecurity #infosec