Daily Drop (1245)
02-13-26
Friday, Feb 13, 2025 // (IG): BB // GITHUB // SN R&D
Chinese Cyber Operations Emphasize “Quiet Access” Over Disruption
Bottom Line Up Front (BLUF): New analysis argues that Chinese cyber operations prioritize long-term “quiet access” to foreign networks rather than immediate disruption. The strategy centers on persistence, prepositioning, and intelligence collection—positioning Beijing for strategic advantage in both peacetime competition and potential crisis scenarios.
Analyst Comments: “Quiet access” serves multiple purposes. First, it enables sustained intelligence collection. Second, it builds optionality. If geopolitical tensions escalate, previously established footholds can be activated for disruption or coercion. That dual-use posture complicates response thresholds—when does espionage become preparation for sabotage? Unlike ransomware groups, PRC-affiliated actors rarely seek visibility. The most mature campaigns focus on supply chain compromise, identity abuse, and living-off-the-land techniques. Dwell time is measured in months or years, not days.
READ THE STORY: SWJ
The CN Gov Uses Neighbor Networks as Cyber Testbeds
Bottom Line Up Front (BLUF): Leaked internal Chinese documents indicate that state-linked operators have been systematically “testing” cyber capabilities against neighboring countries’ networks, including government, telecom, and critical infrastructure targets. That turns regional states into live-fire labs for tooling and TTPs that can later be repurposed against higher-priority adversaries.
Analyst Comments: Using nearby governments and providers as test ranges is low-cost for Beijing: it yields real intelligence, sharpens operator tradecraft, and carries less geopolitical risk than going straight after Tier-1 Western targets with unproven tools. For neighbors, the message is harsh but clear—you’re not just collateral in China’s global cyber posture; you’re integrated into its capability-development cycle.
READ THE STORY: The Record
Israel’s Wartime Brain Drain Raises Risk to Tech-Driven Economy
Bottom Line Up Front (BLUF): Israel is facing a sustained outflow of highly skilled workers—particularly in tech, medicine, and scientific fields—amid political division and prolonged conflict. Tens of thousands have left since 2023, with economists warning of long-term structural impact if departures continue. While headline economic indicators remain resilient, the loss of high-income, innovation-driven talent presents a strategic risk to Israel’s growth model.
Analyst Comments: When three-quarters of emigrants are under 40 and include engineers, doctors, and computer science graduates, the concern isn’t short-term GDP—it’s compounding innovation loss. Tech accounts for roughly 60% of exports and a third of income tax revenue. That concentration amplifies risk. If even a modest percentage of elite engineers and founders relocate permanently, network effects weaken: startups form elsewhere, capital follows talent, and academic pipelines thin out.
READ THE STORY: Bloomberg
Anti-UAS weapon “Sunray”
Bottom Line Up Front (BLUF): Ukraine has reportedly deployed a domestically developed laser weapon system dubbed “Sunray” designed to counter aerial threats, particularly drones. The system represents a continued shift toward directed-energy defenses in response to persistent UAV attacks. While operational details remain limited, the move underscores Kyiv’s push for lower-cost, scalable counter-drone solutions amid sustained battlefield pressure.
Analyst Comments: Directed-energy weapons are attractive in drone-heavy conflicts for one simple reason: cost asymmetry. Shooting down a low-cost UAV with a missile is economically unsustainable over time. A laser, once deployed and powered, offers near-zero cost per shot relative to kinetic interceptors. The real question is maturity. Laser systems historically struggle with weather, atmospheric interference, power requirements, and sustained output under battlefield conditions. If “Sunray” is operationally effective—even in limited roles such as short-range UAV neutralization—that’s a meaningful milestone for Ukraine’s domestic defense industry.
READ THE STORY: The Defense Post
Ukraine Disrupts Russian Starlink Use with Cyber Operation Targeting Registration and Location Data
Bottom Line Up Front (BLUF): Ukraine reportedly conducted a cyber operation aimed at disrupting Russian military use of Starlink by manipulating registration and location data. The effort appears designed to interfere with connectivity and degrade battlefield communications without directly attacking the satellite infrastructure itself. The operation underscores the growing role of cyber-enabled counterspace tactics in modern warfare.
Analyst Comments: This is a notable evolution in cyber operations tied to space-based services. Rather than attempting to jam or kinetically target satellites, the operation reportedly focused on backend systems—registration workflows and geolocation controls that determine service eligibility. That’s smart tradecraft. Space infrastructure is hardened and politically sensitive. But service-layer dependencies—account provisioning, firmware controls, location enforcement—are softer targets. Disrupt those, and you achieve battlefield impact without escalating into overt anti-satellite conflict.
READ THE STORY: BI
Dutch Telecom Odido Confirms Breach Impacting 6 Million Accounts
Bottom Line Up Front (BLUF): Dutch telecom provider Odido has confirmed a data breach affecting approximately 6 million customer accounts. The incident reportedly exposed personal information, raising concerns about follow-on phishing, SIM-swapping attempts, and identity fraud. Customers and enterprises relying on Odido services should prepare for secondary exploitation activity.
Analyst Comments: Telecom breaches carry outsized downstream risk. Even when financial data isn’t directly exposed, subscriber information—names, contact details, dates of birth, customer IDs—provides everything needed to fuel targeted phishing or social engineering. The bigger issue is SIM-swapping. Threat actors routinely use stolen telecom data to impersonate victims and port phone numbers, bypassing SMS-based MFA. If identity verification procedures at customer support aren’t airtight, this breach could cascade into account takeovers across banking, crypto, and SaaS platforms.
READ THE STORY: Decca Chronicle
Russia Tightens Internet Controls, Expands Pressure on VPNs and Circumvention Tools
Bottom Line Up Front (BLUF): Russia is intensifying regulation of internet infrastructure and targeting VPN services as part of an ongoing effort to restrict access to blocked content and suppress dissent. Authorities are increasing technical controls, legal pressure, and enforcement actions aimed at limiting circumvention tools. The move signals continued consolidation of state control over Russia’s digital ecosystem.
Analyst Comments: The crackdown on VPNs is predictable. Circumvention tools undermine the core objective of sovereign internet architecture—control over information flow. By restricting VPN advertising, app store listings, and payment mechanisms, authorities can shrink mainstream access without fully eliminating underground usage. Technically, blocking VPNs at scale is difficult. Obfuscation protocols, domain fronting, and rapidly rotating infrastructure complicate enforcement. But regulatory pressure on domestic ISPs and app platforms increases friction enough to deter casual users.
READ THE STORY: RFE
Iran’s Digital Crackdown and Beijing’s Role
Bottom Line Up Front (BLUF): A new report alleges that Chinese firms and technology played a significant role in enabling Iran’s digital repression of protesters. The findings suggest Chinese-origin surveillance platforms, network monitoring tools, and censorship infrastructure supported Tehran’s efforts to track, identify, and silence dissent. The case underscores the expanding export of digital authoritarianism and the geopolitical risks tied to surveillance technology supply chains.
Analyst Comments: China has long positioned itself as a global supplier of “public security” technology. In politically volatile environments, that translates directly into protest monitoring, device tracking, and internet suppression. Iran’s repeated internet blackouts and protest crackdowns show how digital infrastructure can be weaponized at scale. From a cybersecurity standpoint, this blurs lines between commercial technology exports and state-aligned strategic influence. Surveillance tooling, once deployed, becomes part of a regime’s permanent security architecture. It also creates potential intelligence-sharing channels and long-term technical dependencies.
READ THE STORY: Algemeiner
IcedID Developer Allegedly Faked His Death to Evade FBI
Bottom Line Up Front (BLUF): Risky Business indicates that a suspected developer behind the IcedID banking trojan allegedly faked his own death in an apparent attempt to evade U.S. law enforcement. The case highlights the continued disruption pressure on major malware operations—and the lengths operators may go to avoid prosecution.
Analyst Comments: Faking a death suggests fear of extradition or sealed indictments. We’ve seen similar panic moves before when operators sense proximity to arrest. Whether the deception holds legally is another matter—financial records, travel history, and digital traces tend to surface eventually. From a threat landscape perspective, the more important question is operational continuity. If the developer was central to maintenance or infrastructure management, we may see code stagnation, forks, or rebranding. If the operation was already decentralized, impact may be minimal.
READ THE STORY: RISKYBIZ
Apple Patches iOS 26.3 Zero-Day Under Active Exploitation
Bottom Line Up Front (BLUF): Apple has released iOS 26.3 to patch a zero-day vulnerability reportedly exploited in the wild. The flaw affects core system components and could allow attackers to execute code or escalate privileges on affected devices. Users and enterprises should update immediately—Apple zero-days tend to signal targeted operations already underway.
Analyst Comments: When Apple labels something as “actively exploited,” it usually means the exploit wasn’t theoretical. Historically, these patches correlate with targeted surveillance campaigns—often involving spyware vendors or state-aligned operators. Mobile zero-days are high-value assets. They’re expensive to develop and rarely burned casually. That suggests either a highly targeted campaign or exploitation discovered mid-operation. Either way, defenders shouldn’t assume this is mass exploitation—but high-risk individuals (journalists, executives, government officials) should treat it seriously.
READ THE STORY: The Register
Dutch Authorities Confirm Ivanti Zero-Day Exploited in the Wild
Bottom Line Up Front (BLUF): Investigators in the Netherlands have confirmed that a new Ivanti zero-day vulnerability was used in real-world attacks, including against Dutch organizations, before patches were available. That puts yet another critical edge appliance in the “actively exploited before fix” category and reinforces that VPN/remote access gear remains prime initial-access real estate for state and high-end criminal actors.
Analyst Comments: Ivanti edge appliances have effectively become the new perimeter soft spot. Over the past two years, attackers—particularly China-linked espionage groups—have repeatedly weaponized zero-days in Ivanti Connect Secure and related products. This latest incident confirms what defenders already suspect: if there’s a remotely reachable Ivanti service exposed to the internet, it’s being probed.
READ THE STORY: THN
Single Clandestine IP Linked to Ongoing Exploitation of Ivanti EPMM Vulnerabilities
Bottom Line Up Front (BLUF): Security researchers report that a single, previously unidentified IP address is primarily responsible for active exploitation attempts targeting Ivanti Endpoint Manager Mobile (EPMM) vulnerabilities. The activity suggests coordinated scanning and exploitation infrastructure rather than broad opportunistic noise. Organizations running vulnerable Ivanti EPMM instances should assume targeting and immediately validate patch status and compromise indicators.
Analyst Comments: When exploitation traffic consolidates around a small set of infrastructure, it usually means one of two things: a focused campaign or a staging node used to test and validate exploit reliability before wider rollout. Either way, this isn’t background internet radiation. Ivanti products have been repeatedly targeted over the past two years, and EPMM is particularly sensitive given its role managing mobile devices and enforcing enterprise access controls. Compromise here doesn’t just expose a server—it potentially exposes managed device trust relationships.
READ THE STORY: SC MEDIA
“EvilMouse” Malware Framework Can Autonomously Execute Commands and Compromise Systems
Bottom Line Up Front (BLUF): Researchers have identified a malware framework dubbed “EvilMouse” capable of autonomously executing commands and compromising systems with minimal operator interaction. The tool appears designed for post-exploitation automation, enabling attackers to maintain persistence, execute tasks, and potentially pivot across environments without continuous hands-on control. Organizations should treat this as a reminder that modern malware increasingly blends automation with traditional C2 tradecraft.
Analyst Comments: Autonomous post-exploitation tooling isn’t new—but it’s becoming more polished and accessible. “EvilMouse” reflects a broader shift: malware that doesn’t just beacon and wait for commands, but carries built-in logic to execute tasks, adapt to environments, and operate semi-independently. That matters for defenders because dwell time shrinks. The faster malware can enumerate systems, escalate privileges, and establish persistence on its own, the less opportunity there is for SOC teams to interrupt the kill chain between initial access and impact.
READ THE STORY: Cyber Press
Bloody Wolf and Stan Ghouls Target Uzbekistan and Russia With NetSupport RAT
Bottom Line Up Front (BLUF): Leaked internal Chinese documents indicate that state-linked operators have been systematically “testing” cyber capabilities against neighboring countries’ networks, including government, telecom, and critical infrastructure targets. That turns regional states into live-fire labs for tooling and TTPs that can later be repurposed against higher-priority adversaries.
Analyst Comments: Two threat clusters tracked as Bloody Wolf and Stan Ghouls are using the legitimate NetSupport remote access tool as malware to gain control of systems in Uzbekistan and Russia. The campaigns rely on classic phishing and loader chains to turn a commercial remote support product into a fully featured RAT for espionage, surveillance, and data theft.
READ THE STORY: SC WORLD
Microsoft Zero-Day Under Active Exploitation — Organizations Urged to Patch Immediately
Bottom Line Up Front (BLUF): A newly disclosed Microsoft zero-day vulnerability is being actively exploited in the wild, prompting urgent patch guidance. The flaw affects core Windows components and allows attackers to gain elevated privileges or execute code under certain conditions. Organizations should prioritize patching and assume active scanning and opportunistic exploitation are already underway.
Analyst Comments: When exploitation is confirmed before or at disclosure, it typically means attackers have had a head start—sometimes weeks or months. The real question isn’t whether exploitation is happening; it’s how widely it’s spreading. If the vulnerability enables privilege escalation, expect it to be chained with phishing or initial access brokers. If it allows remote code execution, internet-facing services become the primary concern. Either way, zero-days against Windows ecosystems are reliable building blocks in ransomware and state-sponsored playbooks.
READ THE STORY: GBhackers
BeyondTrust Flaw Under Active Exploitation — Immediate Patching Urged
Bottom Line Up Front (BLUF): A critical vulnerability in BeyondTrust has been flagged as actively exploited in the wild. The flaw impacts remote access and privileged access management deployments, creating a high-risk exposure for enterprises that rely on BeyondTrust for administrative control. Organizations should treat this as an active compromise risk, patch immediately, and conduct follow-on threat hunting to rule out persistence.
Analyst Comments: The flaw affects certain deployments of BeyondTrust’s remote support or privileged access management products, though specific technical details remain limited. Security experts emphasize that organizations must apply vendor patches immediately. Because BeyondTrust systems often sit at the core of administrative access workflows, exploitation could allow attackers to escalate privileges, pivot into internal systems, or harvest sensitive credentials.
READ THE STORY: Cyber Press
Items of interest
Muddled Libra Playbook: Social Engineering, MFA Fatigue, and Cloud Persistence
Bottom Line Up Front (BLUF): Palo Alto Networks’ Unit 42 has detailed the operational playbook of “Muddled Libra,” a financially motivated threat group leveraging aggressive social engineering, MFA fatigue attacks, and cloud persistence techniques to compromise enterprise environments. The group blends helpdesk impersonation with identity abuse and SaaS exploitation, reinforcing that identity—not malware—is now the primary battleground.
Analyst Comments: Muddled Libra isn’t breaking in with zero-days—they’re talking their way through the front door. Their operations hinge on social engineering helpdesks, overwhelming users with MFA push requests, and exploiting weak identity governance. It’s effective because it targets process failures, not technical ones. This is the same playbook that’s fueled multiple high-profile breaches over the past two years: impersonate IT, reset credentials, enroll new MFA devices, pivot into cloud apps, and establish persistence through federated identity or OAuth abuse. Once inside, attackers move fast—harvesting data, accessing source repositories, or monetizing access through extortion.
READ THE STORY: UNIT42
Exposing Muddled Libra’s meticulous tactics (Video)
FROM THE MEDIA: Muddled Libra is executing disciplined, identity-focused intrusion campaigns built on social engineering, MFA fatigue, and cloud persistence. Rather than relying on zero-days or custom malware, the group exploits helpdesk workflows, weak identity verification, and SaaS misconfigurations to gain and maintain access.
What is MFA Fatigue Attack (Video)
FROM THE MEDIA: Not All MFA is secure, learn how MFA Fatigue works and how unphishable credentials stop it and protect your organization from phishing attacks.
The selected stories cover a broad range of cyber threats and are intended to help readers frame key publicly discussed threats and improve overall situational awareness. InfoDom Securities does not endorse any third-party claims made in its original material or related links on its sites; the opinions expressed by third parties are theirs alone. For further questions, don't hesitate to get in touch with InfoDom Securities at dominanceinformation@gmail.com.