Daily Drop (1322)

06-21-26

Sunday, Jun 21, 2026 // Buy Bob a Coffee // Ghostwire

Pentagon Commits $1.2 Billion to Rare Earth Supply Chain as Defense Production Concerns Mount

Bottom Line Up Front (BLUF): The Pentagon's Office of Strategic Capital (OSC) has signed two conditional loans totaling $1.225 billion to expand domestic rare earth processing and magnet production capabilities. Energy Fuels will receive a $725 million loan to develop a U.S.-based rare earth separation and metallization facility, while Phoenix Tailings secured $500 million for its planned "Freedom Facility." The investments are part of a broader Trump administration effort to reduce U.S. dependence on foreign critical mineral supply chains essential for defense production.

Analyst Comments: Rare earths, gallium, and germanium are foundational materials for modern military systems, including precision-guided munitions, fighter aircraft, radars, electronic warfare systems, and advanced semiconductors. The Pentagon is increasingly treating access to these materials as a strategic vulnerability on par with munitions production capacity itself. Michael Cadenazzi’s comment that weapons scaling is a “pipe dream” without critical minerals reflects growing concern that the defense industrial base cannot surge production during a major conflict if upstream supply chains remain concentrated overseas. China’s dominance in rare earth mining and processing has repeatedly exposed the fragility of Western supply chains and demonstrated how resource dependencies can become geopolitical leverage.

READ THE STORY: Breaking Defense

China's MSS Warns Foreign Intelligence Services Are Using Pop-Up Ads for Surveillance and Ideological Infiltration

NOTE:

A core stated goal is to recruit the public as counterintelligence eyes and ears. China has a citizen-reporting apparatus (hotlines, reward systems for reporting suspected spies), and these warnings function as a steady drumbeat reminding people that threats are everywhere and that vigilance is a civic duty. The MSS even runs public-facing channels—it opened a WeChat account in 2023 partly to push this kind of content.

Bottom Line Up Front (BLUF): China's Ministry of State Security (MSS) has warned that foreign intelligence agencies are allegedly exploiting online pop-up advertisements for intelligence collection, target identification, and ideological infiltration activities. According to the MSS, foreign services are collaborating with advertising companies to aggregate user data, social media information, and precise geolocation data to build detailed profiles of individuals inside China and deliver tailored influence content.

Analyst Comments: While the MSS statement should be viewed through the lens of China's broader information security and censorship policies, the underlying tradecraft described is technically plausible. Digital advertising ecosystems have long been scrutinized for their ability to collect granular behavioral data, including device identifiers, location information, browsing habits, and demographic profiles. Multiple governments and researchers have previously warned that advertising data can be leveraged for surveillance, influence operations, and intelligence targeting.

READ THE STORY: GT (CN)

Trump Threatens Renewed Military Action Against Iran Amid Switzerland Negotiations

Bottom Line Up Front (BLUF): U.S. President Donald Trump threatened additional military action against Iran if Tehran does not restrain Hezbollah and other Iran-backed groups in Lebanon, warning that the United States would strike Iran "even harder" than previous operations. The comments come as Iran, the United States, Pakistan, and Qatar have launched mediated negotiations in Switzerland under a reported 60-day framework outlined in the 14-point Islamabad Memorandum of Understanding.

Analyst Comments: Trump's remarks underscore the fragile nature of the current diplomatic process. While negotiations are formally underway, Washington is simultaneously signaling that it remains prepared to use military pressure if it believes Iran is failing to curb the activities of its regional proxies. The messaging reflects a dual-track strategy of diplomacy backed by coercive leverage.

READ THE STORY: MEHR

U.S. Disputes Iranian Claims of Strait of Hormuz Closure as Negotiators Convene in Switzerland

Bottom Line Up Front (BLUF): U.S. and Iranian negotiators are set to begin talks in Switzerland under a 60-day ceasefire framework, even as Washington disputes Iranian claims that the Strait of Hormuz has been closed. Iran's Islamic Revolutionary Guard Corps (IRGC) warned commercial vessels away from the waterway, citing Israeli operations in Lebanon, but U.S. Central Command reported that 55 merchant ships carrying more than 17 million barrels of oil transited the strait on Saturday. The conflicting narratives underscore the fragility of the ceasefire and the potential for renewed regional escalation.

Analyst Comments: The Strait of Hormuz remains one of the world’s most strategically important maritime chokepoints, and even disputed claims of its closure carry immediate geopolitical and economic implications. Tehran appears to be leveraging the threat of disrupting global energy flows as diplomatic pressure during negotiations, while Washington is signaling that freedom of navigation remains intact and enforceable. The talks are beginning against a backdrop of unresolved tensions in Lebanon, where Israeli and Hezbollah exchanges continue despite the ceasefire framework. Both sides are effectively negotiating while simultaneously maintaining coercive leverage. For Iran, the ability to threaten maritime disruption and proxy activity remains a bargaining chip. For the United States, demonstrating continued commercial transit through Hormuz and maintaining military presence serves as proof that Iranian pressure tactics have not materially altered regional realities.

READ THE STORY: Reuters

Israeli Airstrikes in Lebanon Raise Questions Over Ceasefire Durability

Bottom Line Up Front (BLUF): Lebanese authorities report that Israeli airstrikes killed seven people and wounded one in eastern and southern Lebanon, marking another alleged violation of the recently established ceasefire framework tied to the June 18 Iran-U.S. memorandum. The strikes add pressure to an already fragile truce and risk complicating ongoing diplomatic negotiations between Washington and Tehran.

Analyst Comments: From a strategic perspective, Lebanon remains a critical pressure point in broader regional negotiations. Tehran has explicitly linked ceasefire compliance in Lebanon to the credibility of U.S. commitments under the memorandum, raising the possibility that sustained violence could spill over into the ongoing Switzerland talks. The risk is not necessarily an immediate collapse of diplomacy but rather a gradual erosion of trust that complicates efforts to address larger issues, including regional security arrangements and nuclear negotiations.

READ THE STORY: MEHR

Unpatchable 'usbliter8' Exploit Breaks Apple A12 and A13 SecureROM, Permanently Compromising Boot Chain Security

Bottom Line Up Front (BLUF): Researchers at Paradigm Shift have released usbliter8, a working exploit that achieves arbitrary code execution inside the SecureROM of Apple's A12 and A13 chips. Because the vulnerability resides in immutable BootROM code burned into silicon, it cannot be patched through software updates. The exploit requires physical access, DFU mode, and a dedicated RP2350-based USB device, but ultimately grants attackers privileged EL1 execution before Apple's signed boot chain loads, allowing unsigned iBoot images and temporary demotion of production security controls.

Analyst Comments: While the practical risk to average users remains low due to the physical access requirement, the implications for high-value targets, forensic workflows, and government environments are substantial. Once a BootROM vulnerability becomes public, it effectively becomes a permanent characteristic of every affected device. The exploit also reinforces an uncomfortable reality about hardware trust boundaries: some vulnerabilities simply cannot be patched. Organizations using A12- and A13-based devices in sensitive roles now face a hardware lifecycle problem rather than a vulnerability management problem. Device custody, physical access controls, and accelerated hardware refresh cycles become the primary mitigations.

READ THE STORY: THN

AWS Launches Continuum and Context to Address AI Agent Security and Business Context Gaps

Bottom Line Up Front (BLUF): Amazon Web Services (AWS) unveiled two new services—AWS Continuum and AWS Context—designed to make AI agents more secure and operationally reliable in enterprise environments. Continuum automates vulnerability discovery, validation, and remediation of AI-generated code, while Context provides agents with business knowledge through a shared knowledge graph to improve decision-making and reduce hallucinations. The announcements reflect growing industry concerns that AI-generated code and autonomous agents are evolving faster than traditional security and governance models can manage.

Analyst Comments: AWS is effectively acknowledging two of the biggest barriers to enterprise agent adoption: security and context. The company explicitly states that AI-powered threats and specialized models like Anthropic's Mythos can identify vulnerabilities and attack paths faster than traditional defensive workflows can respond. That is a significant admission from one of the world's largest cloud providers and reinforces a broader industry shift toward AI-assisted defensive automation.

READ THE STORY: The Decoder

Virus vs. Worm: Why Understanding the Difference Still Matters for Defenders

Bottom Line Up Front (BLUF): Although "virus" and "worm" are often used interchangeably, the distinction remains operationally important because propagation models dictate both defensive priorities and potential impact. Viruses require user interaction and a host file to spread, while worms are autonomous, self-replicating malware that can move across networks without user action. History shows that worm outbreaks such as SQL Slammer and WannaCry can escalate from initial compromise to global disruption in minutes or hours, often outpacing traditional response processes.

Analyst Comments: The propagation mechanism determines the blast radius. Viruses generally provide defenders with opportunities to interrupt the attack chain through user awareness, email filtering, and application controls because they rely on human interaction. Worms remove that dependency entirely. Once execution begins, they can spread at machine speed, turning unpatched vulnerabilities and flat networks into force multipliers.

READ THE STORY: LHN

FortiBleed Campaign Demonstrates How Cheap AI Infrastructure Has Democratized Supercomputing for Cybercriminals

Bottom Line Up Front (BLUF): Hudson Rock's latest analysis of the FortiBleed campaign reveals that threat actors leveraged rented GPU infrastructure from decentralized cloud provider Vast.ai to conduct industrial-scale password cracking operations against compromised Fortinet devices. Using a 36-GPU cluster managed via Telegram and supported by AI-assisted tooling, the operators achieved hundreds of billions of hashes per second at an estimated cost of less than $350 per day, transforming credential attacks into a low-cost, highly scalable business model. The findings highlight how the AI compute boom has inadvertently lowered the barrier to entry for advanced cryptographic attacks and large-scale initial access operations.

Analyst Comments: Capabilities once reserved for nation-state intelligence services can now be rented on demand with a credit card. The commoditization of enterprise-grade GPU infrastructure has fundamentally changed the threat landscape by allowing financially motivated actors to perform computationally intensive attacks at negligible cost. FortiBleed demonstrates a modern cybercrime pipeline that is highly optimized and almost entirely automated. The operators reportedly used AI-assisted code editors to build management tools, Telegram bots to orchestrate GPU resources, Hashtopolis to distribute cracking workloads, and agentic penetration testing frameworks to automate internal reconnaissance. The attack chain reflects a mature, capital-efficient operating model rather than a technically novel exploit.

READ THE STORY: InfoStealers

Items of interest

Go Security Pitfalls Persist: GolangConf Presentation Highlights Injection, Request Smuggling, and Authentication Risks

Bottom Line Up Front (BLUF): A presentation by MTS Web Services Application Security Engineer Georgy Fateev warns that Go’s simplicity and strong standard library do not inherently produce secure applications. Common vulnerabilities—including command injection, SQL injection, HTTP request smuggling, insecure logging, and authentication flaws—continue to affect production Go environments. The presentation emphasizes that secure development depends more on engineering discipline, testing, and security culture than on language choice.

Analyst Comments: The presentation’s emphasis on “never trust user input” remains highly relevant, as injection-based vulnerabilities continue to drive breaches despite decades of awareness. The recommendation to use reachability-based dependency analysis tools such as govulncheck is particularly noteworthy because it reduces alert fatigue by prioritizing vulnerabilities that are actually exploitable within an application’s code path. The discussion of HTTP request smuggling is also timely. Misconfigurations between reverse proxies and backend services remain a frequent source of high-impact vulnerabilities capable of enabling authentication bypass and request desynchronization attacks. Likewise, insecure logging practices continue to be an underappreciated source of credential exposure and compliance violations.

READ THE STORY: HABR

The GO Situation Is CRAZY... (Video)

FROM THE MEDIA: The video correctly identifies a real concern—software supply-chain attacks in the Go ecosystem

What is LLM Distillation?(Video)

FROM THE MEDIA: Welcome to another Software Architecture in Go/Golang video, in today's episode I'm discussing Security, specifically in the context of Dependencies, this is narrowed down to Standard Library Packages and Third Party Packages.

The selected stories cover a broad range of cyber threats and are intended to help readers frame key publicly discussed threats and improve overall situational awareness. InfoDom Securities does not endorse any third-party claims made in its original material or related links on its sites; the opinions expressed by third parties are theirs alone. For further questions, don’t hesitate to get in touch with InfoDom Securities at dominanceinformation@gmail.com.