Daily Drop (1105)

08-08-25

Friday, Aug 08, 2025 // (IG): BB // GITHUB // SN R&D

PROJECTS:

NEWS:

U.S. Sanctions Global Procurement Network Supporting Iran’s Military Drone Program

Bottom Line Up Front (BLUF): The U.S. Treasury Department sanctioned a transnational procurement network across Iran, Hong Kong, Taiwan, and China for supplying Iran’s drone manufacturing sector. The entities allegedly circumvented export controls to deliver aerospace manufacturing technology to HESA, a key state-owned defense firm linked to Iran’s Ministry of Defense and the Islamic Revolutionary Guard Corps (IRGC).

Analyst Comments: The U.S. aims to restrict Iran’s access to critical components for scaling drone production by targeting upstream suppliers of precision manufacturing tools like CNC machines. These measures also signal a broader effort to deter third-party facilitators and enforce secondary sanctions, putting additional compliance pressure on foreign firms, especially in Asia. With asymmetric drone warfare now central to Iran’s defense and foreign policy toolkit, sanctions enforcement will remain a key pillar of U.S. containment strategy.

FROM THE MEDIA: The U.S. Office of Foreign Assets Control (OFAC) sanctioned five companies and one individual accused of supporting Iran's military drone development through illicit technology procurement. The network funneled high-end CNC machines—used in defense and aerospace manufacturing—to Iran Aircraft Manufacturing Industrial Company (HESA), a key drone producer for the IRGC. Designated parties include Control Afzar Tabriz Co Ltd (Iran), its CEO Javad Alizadeh Hoshyar, Clifton Trading Limited (Hong Kong), Mecatron Machinery Co Ltd, Joemars Machinery and Electric Industrial Co Ltd (Taiwan), and Changzhou Joemars Industrial Automation Co Ltd (China). The sanctions, issued under Executive Order 13382, freeze U.S.-linked assets and expose foreign banks to secondary sanctions. HESA has long been sanctioned for its military role, with Iranian drones linked to operations in Ukraine and across the Middle East.

READ THE STORY: WORLDecr

Ukraine Gamifies Drone Warfare with Data-Driven Points System to Target Russian Forces

Bottom Line Up Front (BLUF): Ukraine has transformed its drone warfare strategy into a tech-driven model, using FPV drones and a points-based rewards system to optimize battlefield effectiveness. The system logs combat data, incentivizes high-impact strikes, and channels supplies to the most effective drone units, turning drone warfare into a quantifiable and iterative process.

Analyst Comments: Ukraine’s digitization of its drone campaign marks a significant evolution in modern warfare, blending military innovation with startup agility. Using combat data to guide tactical decisions and resource allocation enhances efficiency and introduces gamification elements that foster unit competition. This approach could serve as a template for future conflicts where asymmetric forces leverage agility, data, and automation to offset conventional disadvantages. However, it may also entrench disparities between elite and newer units, raising strategic and ethical questions about warfighting incentives.

FROM THE MEDIA: Since 2024, FPV drone pilots have logged and verified their strikes using video footage, earning points based on the value of targets, such as T-90M tanks or enemy drone pilots. These points can be exchanged for equipment and drones, streamlining procurement and fostering internal competition. The initiative, integrated with the Brave 1 Market platform in April 2025, allows frontline units to bypass bureaucracy and receive gear based on performance. Using this model, elite units like “Birds of Magyar” have destroyed up to 8% of Russian armored vehicles. The system is dynamic, recently shifting focus to prioritize eliminating enemy drone operators in response to battlefield trends.

READ THE STORY: RealClearDefense

Putin Has Already Lost in Ukraine — But the Final Cost Depends on the West

Bottom Line Up Front (BLUF): Despite continued Russian offensives, Vladimir Putin has effectively lost the war in Ukraine — militarily, economically, and geopolitically. While Russia clings to marginal territorial gains, the toll of over one million casualties, depleted air and naval forces, and NATO expansion has reversed nearly all of Putin’s strategic aims. The only question now is whether the West, particularly the U.S. under President Trump, will press hard enough to ensure that Russia sues for peace on Ukraine’s terms.

Analyst Comments: Ryan Maness provides a compelling assessment that Russia’s full-scale invasion has backfired catastrophically. Ukraine’s military, though smaller, has achieved near-technological parity through Western support and indigenous innovation, particularly in drone warfare and electronic/cyber operations. Putin’s regime is increasingly reliant on Iranian drones, North Korean troops, and Chinese technology — signs of desperation rather than strength.

FROM THE MEDIA: Ukraine, leveraging drones, Western electronic warfare systems, and space-based reconnaissance, has achieved technological parity despite its smaller size. President Trump’s recent July 15 announcement to send more Patriot missile systems and impose secondary tariffs on Russian oil buyers aims to pressure Moscow toward peace. However, the article warns that without increased and sustained support, Ukraine may be unable to retake occupied territory or counter Russian forces effectively.

READ THE STORY: Small Wars Journal

Chinese Cyberattack on U.S. Nuclear Agency Exposes Gaps in Critical Infrastructure Security

Bottom Line Up Front (BLUF): In July 2025, a China-sponsored cyberattack targeted the U.S. National Nuclear Security Administration (NNSA), an agency responsible for managing America’s nuclear weapons and naval reactors. The breach highlights the vulnerability of nuclear infrastructure to digital intrusions and underscores the urgent need for enhanced cyber hygiene and incident response protocols.

Analyst Comments: Beyond data theft, such intrusions risk undermining public trust, introducing operational confusion, and potentially compromising nuclear deterrence posture. The fact that Microsoft’s infrastructure was also involved raises concerns about third-party vulnerabilities and supply chain risks. Expect increased calls for segmentation of critical data, zero-trust architectures, and stricter personnel vetting, including contractors in high-assurance environments.

FROM THE MEDIA: The attack reportedly exploited vulnerabilities in Microsoft’s infrastructure, prompting the tech giant to cease reliance on China-based engineers for Pentagon-related services. Experts warn that such intrusions can lead to manipulation of safety systems, loss of sensitive data, and potential disruption of nuclear response protocols. Analysts argue that complacency and insufficient segmentation of sensitive data contributed to the breach, which may also have strategic implications by allowing adversaries to assess and counter U.S. nuclear capabilities. The event has triggered renewed emphasis on insider threat mitigation, regular risk assessments, and cross-sector threat intelligence sharing.

READ THE STORY: ASPI

Google Confirms Salesforce Breach Linked to ShinyHunters Social Engineering Campaign

Bottom Line Up Front (BLUF): On August 7, 2025, Google disclosed that it suffered a data breach via a compromised Salesforce CRM instance targeted by the ShinyHunters (UNC6040) threat group. The attack, attributed to sophisticated voice phishing (vishing), led to unauthorized access to small and medium-sized clients' business contact data, raising concerns over Google’s cloud security posture and delay in public disclosure.

Analyst Comments: Vishing to infiltrate Salesforce environments is becoming a preferred tactic for threat actors like ShinyHunters, who continue to exploit human factors as a systemic weak point in cloud-based enterprise infrastructure. Google’s delayed disclosure and vague reassurances highlight the broader transparency crisis in data breach incidents. Given the attackers’ history of data extortion, it is plausible this breach may yet escalate in scope or impact, especially if sensitive metadata or internal notes were exfiltrated.

FROM THE MEDIA: The attackers used vishing—phone-based phishing tactics—to engineer social access to the platform, exposing contact and account-related information. While Google insists the data mainly was public business details accessed during a limited window, the breach remained undisclosed for weeks. This attack is part of a broader campaign against Salesforce users, previously targeting Cisco, Qantas, and others. Analysts speculate that ShinyHunters may be preparing to escalate by leaking the data, though no ransom has been publicly reported.

READ THE STORY: Security Boulevard

Silver Fox APT Merges Espionage with Cybercrime in Expanding China-Linked Campaigns

Bottom Line Up Front (BLUF): Chinese threat actor Silver Fox is conducting both espionage and cybercrime operations, targeting Taiwanese, Japanese, and North American entities. Researchers suggest the group’s dual-purpose attacks signal a strategic evolution in China's cyber capabilities, blending intelligence gathering with self-financing criminal activity.

Analyst Comments: Silver Fox's operational model reflects a growing shift among Chinese APTs toward hybridized threat activity that blurs the lines between state-sponsored espionage and financially motivated crime. This offers attackers plausible deniability, broader target access, and financial autonomy. The group’s tactics mirror those of APT41, indicating a systemic change in China's cyber doctrine—one that could create new challenges for defenders unable to categorize threats as purely nation-state or criminal. This evolution demands updated threat models and cross-domain response strategies.

FROM THE MEDIA: Its tactics range from phishing emails with malicious attachments to SEO-poisoned websites distributing Trojanized apps. Once inside, the group deploys tools like ValleyRAT, Winos 4.0, Gh0stCringe, and HoldingHands RAT, and often activates cryptominers or keyloggers. Analysts from Picus Security and Trustwave highlight Silver Fox’s links to Chinese state interests, particularly due to its targeting of Taiwan’s infrastructure and government organizations. However, its simultaneous attacks on healthcare, finance, and gaming sectors—many of which are financially motivated—complicate attribution. Experts warn that this hybrid approach provides Silver Fox greater flexibility, resilience, and deniability.

READ THE STORY: DR

FCC Adopts Submarine Cable Security Rules to Counter China Espionage Threat

Bottom Line Up Front (BLUF): The Federal Communications Commission (FCC) approved new regulations to strengthen the security of subsea data cables, a critical part of global internet infrastructure. The rules aim to reduce threats from foreign adversaries, particularly China, by tightening licensing processes, limiting foreign participation, and mandating new cybersecurity requirements.

Analyst Comments: This policy shift signals a growing recognition that subsea cables are not just commercial assets but national security vulnerabilities. With China expanding its role in global cable infrastructure and Russia showcasing its capability to map and monitor these routes, the U.S. is moving to assert greater control over its digital lifelines. The new rules will likely delay or block future cable partnerships with Chinese firms and could accelerate Western efforts to establish alternative, secure infrastructure. Expect these tensions to polarize global internet governance further and deepen the divide between allied and adversarial tech ecosystems.

FROM THE MEDIA: The regulations will expedite cable deployments while simultaneously enforcing stricter security reviews, especially for projects involving companies tied to adversarial governments. Applications from such entities will face a presumption of denial unless they can prove no national security risk. Commissioner Olivia Trusty emphasized the vulnerability of cables to espionage and sabotage, citing both China’s expanding investments and Russia’s military tracking capabilities as evidence of strategic risks.

READ THE STORY: Bloomberg

Nigeria’s Terra Industries Leads Africa’s Drone Innovation in Civil Infrastructure Security

Bottom Line Up Front (BLUF): Nigerian startup Terra Industries has emerged as Africa’s first major developer of autonomous drone systems focused on civilian infrastructure protection. It has secured contracts to protect energy facilities using locally built UAVs. Its modular “Iroko” drones and ArtemisOS software platform offer a scalable, non-lethal alternative to imported security technologies, marking a shift in Africa’s tech sovereignty.

Analyst Comments: By focusing on unarmed, infrastructure-focused UAVs and AI-driven automation, Terra reduces dependency on foreign surveillance technologies and creates a new model of ethical autonomy. Its rise highlights a shift toward African-led innovation in hard tech, which has strategic implications for regional governance and global supply chain diversification. With growing demand and geopolitical interest in secure, ethical infrastructure protection, Terra’s model may inspire similar ventures across the Global South.

FROM THE MEDIA: Founded in Abuja just over a year ago, Terra Industries has quickly become a pioneer in autonomous infrastructure security with its domestically manufactured drones and surveillance systems. The company’s flagship drone, the Iroko, is equipped with thermal sensors and HD cameras and integrated with a proprietary software platform, ArtemisOS. In June 2025, Terra won a $1.2 million contract to protect two Nigerian hydroelectric plants, outperforming an Israeli consortium. The firm now safeguards over $6 billion in critical infrastructure across Nigeria, Ghana, Kenya, and Mozambique. With local manufacturing, cost advantages, and a non-lethal approach to drone use, Terra is positioning itself as a geopolitical player in a space long dominated by foreign firms.

READ THE STORY: Rjaura

China’s Salt Typhoon Hack of U.S. National Guard Raises Fears of Another Major Defense Breach

Bottom Line Up Front (BLUF): A Department of Homeland Security memo has revealed that the Chinese APT group Salt Typhoon extensively compromised a U.S. Army National Guard network between March and December 2024, exfiltrating sensitive data, including network maps, admin credentials, and traffic across all 50 states and several U.S. territories. The breach has raised alarms over China’s continued efforts to undermine U.S. critical infrastructure and may parallel past espionage efforts allegedly linked to the theft of F-35 stealth fighter technology.

Analyst Comments: Beyond surveillance, the operation appears to position China for potential cyber-sabotage in a future conflict. With direct access to administrator credentials, network topologies, and inter-state communications, the attackers could map vulnerabilities across state-level cybersecurity frameworks. This intrusion—like the suspected F-35 technology theft—underscores the importance of securing lower-tier defense entities and third-party infrastructure. The event also exposes systemic underinvestment in cyber defenses across the National Guard and fusion centers that serve as cyber threat intelligence hubs.

FROM THE MEDIA: According to a DHS memo obtained via FOIA by Property of the People and reported by NBC News, China-linked Salt Typhoon actors infiltrated a U.S. state's Army National Guard network for nearly a year, extracting sensitive data tied to state-level and inter-state defense communications. The breach involved administrator credentials, network traffic diagrams, and service member PII. Officials warn this could degrade the cybersecurity posture of fusion centers—regional hubs for threat sharing and infrastructure defense. The document stated that Salt Typhoon’s access might facilitate follow-on compromises across the U.S. critical infrastructure ecosystem. The breach echoes accusations that China stole F-35 design data, now allegedly reflected in its J-20 stealth fighter.

READ THE STORY: ET

Middle East Cyber War Escalates: Iran and Israel Amplify Digital Hostilities Post-Conflict

Bottom Line Up Front (BLUF): Following the cessation of primary kinetic operations in the Iran-Israel War, the region has entered an era of intensified cyber conflict. Iranian state-sponsored attacks on Israeli infrastructure have surged by 700% since June 13, 2025, while Israel’s cyber doctrine continues to support offensive campaigns aimed at degrading Tehran’s digital and military capabilities.

Analyst Comments: Iran’s asymmetric reliance on disruption tactics is filling the void left by its degraded military capability, while Israel’s cyber posture continues to blur legal boundaries to preserve deterrence and operational advantage. As regional actors like Saudi Arabia and the UAE expand their digital arsenals—backed by foreign partnerships and AI ambitions—the absence of enforceable international norms may entrench a persistent cycle of cyber instability. Without a regional legal consensus or binding frameworks, cyberspace in the Middle East may remain a volatile domain defined by deniability, asymmetry, and escalating risk.

FROM THE MEDIA: Iran has launched extensive campaigns targeting Israeli civilian infrastructure—power grids, hospitals, and communication platforms—using groups like APT33, APT34, and MuddyWater. In response, Israel is believed to have ramped up cyber operations targeting Iranian defense systems and proxy networks in Lebanon, Syria, and Iraq. Although not directly belligerent, Saudi Arabia and the UAE have faced collateral ransomware attacks, further entrenching their investment in offensive and defensive cyber capabilities. The resurgence of cyber confrontation comes in the wake of Israel’s aerial bombardment campaign and the partial dismantling of Iran’s military command, making digital retaliation a more viable path for Tehran. Legal attribution remains murky, and international response mechanisms—particularly under peacetime law—remain inadequate to address the frequency and scope of current operations.

READ THE STORY: Lieber Institute

China’s Tech ‘Kill Switch’: Cybersecurity Expert Warns of Critical Infrastructure Backdoors in U.S. Systems

Bottom Line Up Front (BLUF): A cybersecurity expert has warned that Chinese-manufactured equipment embedded in U.S. infrastructure contains covert backdoors and “kill switches” capable of disabling power grids, water systems, and surveillance networks. This revelation has prompted the U.S. government to probe cranes, transformers, robot systems, and solar inverters suspected of enabling remote access by Beijing.

Analyst Comments: The concept of embedded “call home” capabilities in hardware like robot dogs and shipping cranes suggests that China could exploit these devices during a future geopolitical conflict. As the U.S. intensifies scrutiny of foreign tech dependencies, expect greater pushback against Chinese vendors and calls for reshoring key manufacturing sectors. If these claims are validated, the West could face a long-term digital infiltration campaign beyond espionage into sabotage readiness.

FROM THE MEDIA: Bellini cited examples such as transformers, surveillance cameras, port cranes from ZPMC, and robot dogs by Unitree Robotics that were found to have hidden backdoors. In one case, the Go1 robot dog model automatically connected to a Chinese cloud service, creating a covert remote access channel. According to Bellini, Chinese companies often operate under the direct influence of the Communist Party, raising the likelihood of state-enabled espionage or sabotage. U.S. officials have responded by investigating Chinese-manufactured cranes and solar inverters used at military and civilian facilities. Despite these concerns, many U.S. firms continue to import such technology, citing cost pressures and a lack of alternatives. Bellini supports Trump-era efforts to revive domestic tech manufacturing to reduce reliance on hostile foreign suppliers.

READ THE STORY: Daily Express U.S.

NSA Expands Support for Small Defense Contractors Amid Rising Chinese Cyber Threats

Bottom Line Up Front (BLUF): The NSA is partnering with private cybersecurity firms to bolster the cyber defenses of small U.S. defense contractors targeted by China's expansive hacking operations. Through the Cybersecurity Collaboration Center, the agency offers free services like classified threat sharing, protective DNS, and penetration testing to under-resourced companies in the defense industrial base (DIB).

Analyst Comments: China's use of mass scanning and exploitation means no contractor is too small to target, especially as emerging firms in AI, logistics, and infrastructure support military operations globally. The NSA’s proactive engagement with startups like Horizon3.ai is a necessary step to scale defense capabilities across the entire DIB. However, success will depend on sustaining long-term funding, addressing regulatory compliance burdens, and fostering trust among firms traditionally wary of federal oversight.

FROM THE MEDIA: NSA official Bailey Bickley warned that China’s cyber capabilities now outmatch those of the U.S. and its allies combined, enabling it to target even the smallest defense contractors. Bickley emphasized that 80% of the U.S. defense industrial base consists of small businesses, many lacking basic cybersecurity awareness or resources. To close this gap, the NSA has expanded its offerings through the Cybersecurity Collaboration Center, providing services like free penetration tests in partnership with Horizon3.ai. The agency focuses on emerging sectors such as AI and foreign-owned infrastructure companies that now play vital roles in military logistics and operations.

READ THE STORY: CyberSecDiv

DEF CON Franklin Expands Volunteer Cybersecurity Program to Shield U.S. Water Utilities from Nation-State Attacks

Bottom Line Up Front (BLUF): Facing escalating cyberattacks from China and Iran, DEF CON Franklin has launched a nationwide, volunteer-powered initiative to provide free cybersecurity support to vulnerable U.S. water utilities. With deployments already active in four states, the project aims to close critical infrastructure security gaps without federal mandates or bureaucracy.

Analyst Comments: Water utilities, often under-resourced and overlooked in federal cybersecurity efforts, are among the most exposed critical infrastructure sectors. DEF CON Franklin’s model may improve water sector security outcomes and inspire similar community-led responses in other infrastructure areas, such as healthcare or education. As federal efforts remain slow, grassroots solutions like Franklin are proving agile and impactful.

FROM THE MEDIA: Announced at DEF CON 2025 in Las Vegas, the expanded mission of DEF CON Franklin brings hacker-volunteers to assist at-risk U.S. water utilities. The effort follows a nine-month pilot across Indiana, Oregon, Utah, and Vermont, where teams provided no-cost support, including network mapping, password protocol enhancement, and OT vulnerability assessments. Led by co-founder Jake Braun and backed by organizations such as the National Rural Water Association, Aspen Digital, and the Cyber Resilience Corps, the initiative addresses the chronic underfunding and cyber unpreparedness of over 50,000 U.S. water systems. Franklin’s approach bypasses traditional red tape and includes tools from Dragos' Community Defense Program. The group also publishes the Hackers’ Almanack, a report translating DEF CON findings into actionable national policy guidance.

READ THE STORY: DEFCON Franklin

Items of interest

US Army Faces Growing Pains as Drone Warfare Becomes Central to Modern Combat

Bottom Line Up Front (BLUF): The U.S. Army is rapidly scaling up its drone capabilities but faces critical challenges in deploying small, soldier-built FPV drones, as revealed during recent training exercises in Germany. Connectivity failures, hardware malfunctions, and lack of field-ready logistics highlight the steep learning curve as the Army prepares for drone-centric warfare.

Analyst Comments: The Army’s struggles with off-the-shelf components, improvised designs, and signal issues reflect its drone transformation effort's urgency and improvisational nature. While the commitment to field innovation is commendable, the gaps in standardization, ruggedization, and supply chain readiness must be closed quickly if the service is to catch up with adversaries who have operationalized drone warfare at scale, most notably in Ukraine. The Army’s projected $36 billion investment over five years is a strong signal of intent, but it must be matched by streamlined procurement, rigorous training, and domestic drone manufacturing resilience.

FROM THE MEDIA: During training in Germany’s Hohenfels Training Area, U.S. Army soldiers from the 2nd Cavalry Regiment tested low-cost FPV drones built in-house. Despite successful live grenade drops and reconnaissance runs, the drills exposed multiple failures, including tangled propellers, damaged cords, signal disruptions, and missing screws. Off-the-shelf Chinese drones were ruled out for security reasons, forcing soldiers to develop and print their own parts. As the Army pushes to field 1,000 drones per division within two years, these setbacks highlight the need for rapid adaptation, logistics planning, and industry support. Leaders stress that while the current issues are frustrating, they are valuable lessons in an era where drone warfare has become mission-critical.

READ THE STORY: Business Insider

Inside the U.S. Military’s New Drone Warfare School (Video)

FROM THE MEDIA: Small, inexpensive “off the shelf” drones, like those Ukraine is using against Russia and Hamas is deploying against Israel, are transforming modern warfare. To train American soldiers to counter the threat of civilian drones modified with explosives, the U.S. military recently opened a specialized drone warfare school.

The U.S. is behind in drone warfare – Can it catch up? (Video)

FROM THE MEDIA: Cheap drones are winning wars, and the Pentagon is scrambling to catch up. On July 10, Defense Secretary Pete Hegseth signed a directive changing how the U.S. military builds and fields small drones. For the first time, the Pentagon says drones should be treated like munitions: cheap, expendable, and rapidly replaceable.

The selected stories cover a broad array of cyber threats and are intended to aid readers in framing key publicly discussed threats and overall situational awareness. InfoDom Securities does not endorse any third-party claims made in its original material or related links on its sites; the opinions expressed by third parties are theirs alone. For further questions, please contact InfoDom Securities at dominanceinformation@gmail.com.