Daily Drop (1345)

08-12-26

Wednesday, Aug 12, 2026 // Buy Bob a Coffee // Ghostwire

Marine Corps University Reworks Military Education Around AI, Wargaming, and Classified All-Domain Operations

Bottom Line Up Front (BLUF): Marine Corps University is restructuring professional military education to better prepare officers for AI-enabled, multidomain warfare. The reforms shift more instruction into classified environments, expand advanced wargaming and battle labs, integrate artificial intelligence into military planning, and increase emphasis on cyber, space, electromagnetic operations, contested logistics, and joint fires. The authors argue that traditional seminar-heavy military education has not kept pace with the technical realities of modern conflict and that officers need more direct exposure to contemporary capabilities and operational problems.

Analyst Comments: The key issue is the widening gap between how modern wars are fought and how officers are traditionally educated. AI-enabled drones, cyber operations, long-range precision fires, space systems, electronic warfare, and distributed logistics increasingly have to be coordinated as one operational problem. Officers who understand strategy but cannot reason through how those systems interact risk becoming consumers of technical expertise rather than commanders capable of integrating it. Marine Corps University’s response is notable because it treats classified access, wargaming, and AI experimentation as core educational requirements rather than electives. The university is moving beyond conceptual discussion toward environments where officers can work with actual capabilities, current threat models, operational plans, and joint warfighting concepts.

READ THE STORY: War on The Rocks

Signal Adds Automatic Key Verification to Detect Man-in-the-Middle Tampering

Bottom Line Up Front (BLUF): Signal has introduced Automatic Key Verification (AKV), a new key-transparency feature designed to detect whether an attacker has tampered with the public encryption keys associated with a user account. AKV supplements Signal’s existing safety numbers by checking contact keys against an open-source transparency ledger and using third-party auditors, including Cloudflare and Trail of Bits, to verify that users are seeing consistent key data. The feature reduces the risk of a compromised account directory silently redirecting encrypted conversations to an attacker.

Analyst Comments: Signal already provides end-to-end encryption, but encryption alone does not guarantee that users are encrypting messages to the intended recipient. If an attacker compromised the centralized directory that maps accounts to public keys, they could theoretically substitute their own key and create a man-in-the-middle condition while both sides still see an encrypted session. AKV addresses that trust problem by adding transparency and independent verification around key changes. Signal records account and identity changes in an append-style ledger, while users and auditors verify that those records remain consistent. That is a meaningful improvement because it creates additional evidence if a key is maliciously substituted or if the key-transparency infrastructure itself is manipulated.

READ THE STORY: The Register

Lazarus Exploits Windows AFD.sys Zero-Day to Gain SYSTEM Access and Blind EDR

Bottom Line Up Front (BLUF): North Korea-linked Lazarus Group is exploiting CVE-2026-68820, an actively exploited Windows AFD.sys privilege-escalation zero-day, as part of its long-running Operation Dream Job campaign. The flaw allows attackers with an existing foothold to gain kernel read/write capabilities and escalate to SYSTEM, after which Lazarus deploys an updated FudModule rootkit to weaken endpoint telemetry and interfere with Windows security controls. Microsoft patched the vulnerability in its August 2026 Patch Tuesday release.

Analyst Comments: The important point is where this vulnerability sits in the attack chain. CVE-2026-68820 is not an initial-access bug; it is a post-compromise accelerator. Lazarus still has to get onto the endpoint first, typically through fake recruiting lures, trojanized PDF tooling, DLL sideloading, or impersonation websites. Once there, the AFD.sys exploit converts a normal user foothold into SYSTEM-level control and gives the actor a much stronger position to tamper with EDR and security telemetry. The updated FudModule capability raises the severity. Kernel-level access lets the actor interfere with callbacks, filters, event tracing, and newer controls such as Smart App Control. That creates the exact conditions Lazarus wants: persistence and execution with reduced defender visibility.

READ THE STORY: Ghostwire

Microsoft Patches 398 Vulnerabilities as AI-Driven Bug Discovery Floods Patch Tuesday

Bottom Line Up Front (BLUF): Microsoft released fixes for 398 vulnerabilities in its August 2026 Patch Tuesday update, including 42 critical flaws, one actively exploited zero-day, and two vulnerabilities that were publicly disclosed before patches became available. The actively exploited issue, CVE-2026-68820, is a privilege-escalation flaw in the Windows afd.sys networking driver that attackers can use after gaining an initial foothold. The growing volume of vulnerabilities—following more than 570 Microsoft fixes in July—shows how AI-assisted vulnerability discovery is rapidly increasing patch-management workloads for defenders.

Analyst Comments: The headline number is ugly, but defenders should not treat all 398 vulnerabilities equally. CVE-2026-68820 deserves immediate attention because exploitation is already occurring. The flaw sits in afd.sys, a core Windows networking component present across endpoints, and appears useful as the second stage of an attack chain: gain low-privilege access first, then escalate to take control of the system. The broader problem is vulnerability throughput. Microsoft, Adobe, Cisco, Google, Mozilla, and others are all shipping larger and more frequent security updates as AI accelerates bug discovery. That is good for finding latent security defects, but it creates a patching bottleneck on the defensive side. Security teams still have to test updates, assess operational impact, prioritize deployment, and recover from bad patches.

READ THE STORY: Krebs on Security

Kimwolf Botnet Rebuilds C2 Infrastructure to Resist Takedowns and Mimic Chrome Traffic

Bottom Line Up Front (BLUF): Palo Alto Networks Unit 42 identified a new version of the Kimwolf/AISURU Android and IoT botnet that adds HTTP/2 DDoS capabilities designed to closely mimic legitimate browser traffic. Kimwolf v7 also hardens its command-and-control infrastructure through Ethereum Name Service lookups, a Tor hidden-service fallback, and a local proxy architecture, while removing built-in scanning and exploitation features. The changes suggest operators are separating initial compromise from the botnet payload and focusing Kimwolf on resilient DDoS execution and traffic relay.

Analyst Comments: The important evolution is traffic realism. HTTP/2 floods that reproduce complete browser fingerprints make simple protocol- or header-based filtering much less effective. Defenders can no longer assume obvious malformed requests or crude user-agent strings will distinguish bot traffic from normal sessions. Mitigation will increasingly depend on behavioral indicators such as request timing, connection reuse, traffic bursts, ASN and device reputation, and deviations from normal application usage. The C2 design also shows deliberate resilience planning. Resolving infrastructure through legitimate Ethereum RPC services, keeping a hard-coded Tor fallback, and routing all command traffic through a local proxy gives operators multiple recovery options if one layer is disrupted. That architecture complicates takedowns because defenders are no longer dealing with a single static domain or IP address.

READ THE STORY: Cyberscoop

Project CAV3RN Uses Google Apps Script and DNS Steering to Hide Cyberespionage C2 Traffic

Bottom Line Up Front (BLUF): Project CAV3RN, a modular cyberespionage framework targeting Israeli organizations, has evolved into a multi-channel command-and-control platform that dynamically shifts between direct HTTPS and Google Apps Script relays. The malware uses DNS responses as a control plane to decide which transport to use and can recover or rotate its Google relay configuration through DNS-based chunking. The design gives operators resilient, disposable C2 infrastructure that blends with legitimate cloud traffic and is harder to block using conventional domain reputation controls.

Analyst Comments: The notable development is not merely abuse of Google Apps Script—it is the way CAV3RN combines legitimate cloud services, attacker infrastructure, and DNS into a coordinated resilience mechanism. Before each C2 transaction, the malware queries DNS and interprets the final octet of the returned IP address as an instruction that determines whether it should use direct HTTPS, pivot through Google, or terminate the request. That gives the operator remote traffic steering without changing the malware on disk. If the Google Apps Script deployment ID becomes invalid or is taken down, the framework can retrieve a replacement through specially formatted DNS queries and update its own configuration. This makes the relay infrastructure both rotatable and recoverable.

READ THE STORY: GBhackers

Fake CCleaner Campaign Installs GhostDesk Chrome Spyware to Steal Credentials and Hijack Browser Activity

Bottom Line Up Front (BLUF): Malwarebytes uncovered a malware campaign distributing a fake CCleaner installer from a lookalike website that modifies Chrome and installs a malicious extension called GhostDesk. The spyware can log keystrokes, steal cookies, capture screenshots, intercept submitted credentials, alter cryptocurrency clipboard contents, inject JavaScript into active tabs, and exfiltrate data through WebSocket-based command-and-control infrastructure. Researchers also found fake 7-Zip and Adobe Acrobat installers using the same delivery chain, indicating the operation is not limited to CCleaner impersonation.

Analyst Comments: This campaign is effective because it abuses two trust assumptions at once: users trust recognizable software brands, and browsers are increasingly treated as trusted workspaces holding credentials, session cookies, cloud access, and sensitive application data. Once GhostDesk is embedded in Chrome, the attacker no longer needs to attack every web service individually—the browser becomes the collection point. The Chrome-extension abuse is especially concerning. By patching the Chrome Security Extension manifest and loading malicious background.js and content.js components, the malware gains persistent visibility into user activity while blending into normal browser behavior. Cookie theft can enable session hijacking, form interception captures credentials before they ever reach a website, and arbitrary JavaScript execution gives the operator a flexible mechanism for manipulating active sessions.

READ THE STORY: Malwarebytes

ICS Patch Tuesday Fixes Critical Flaws Across Siemens, Schneider Electric, and Phoenix Contact Products

Bottom Line Up Front (BLUF): Siemens, Schneider Electric, and Phoenix Contact released August 2026 security advisories addressing multiple vulnerabilities across industrial control and operational technology products. The most serious issue is a maximum-severity missing-authentication flaw in Siemens Simatic IoT2050 Advanced devices that could allow an unauthenticated remote attacker to execute arbitrary code with elevated privileges. Additional flaws affect Siemens Siveillance, Solid Edge, Simcenter, Ruggedcom, Desigo, Schneider NetBotz and PowerChute products, and Phoenix Contact PLCnext firmware.

Analyst Comments: The main concern is exposure of remotely reachable industrial management components where authentication weaknesses or code-execution flaws can translate into direct control of OT-adjacent systems. The Simatic IoT2050 issue is especially important because it combines unauthenticated access with elevated code execution, removing two barriers attackers would normally need to overcome. The broader pattern is familiar: industrial environments continue to accumulate security debt across gateways, engineering software, building-management products, and controller firmware. Even when individual flaws do not directly manipulate physical processes, compromise of these systems can provide staging points into more sensitive OT networks.

READ THE STORY: Security Week

Items of interest

OT Network Reconnaissance Requires Passive-First Discovery to Avoid Production Disruption

Bottom Line Up Front (BLUF): A Codeby technical guide argues that reconnaissance and asset inventory inside operational technology environments should begin with passive monitoring rather than conventional IT-style scanning. The author warns that aggressive tools and service-detection techniques can destabilize legacy PLCs, RTUs, HMIs, and industrial protocols, potentially causing process interruptions. The recommended approach combines external OSINT through services such as Shodan and Censys, passive collection through TAP or SPAN infrastructure, protocol analysis in Wireshark or GRASSMARLIN, and only tightly controlled active probing during approved maintenance windows.

Analyst Comments: The central point is sound: OT reconnaissance cannot be treated like ordinary enterprise network discovery. Industrial devices often run old firmware, proprietary protocol stacks, and real-time control loops that were never designed to tolerate aggressive scanning, malformed probes, or high connection rates. In this environment, a discovery mistake can affect physical operations rather than simply crash a service. The article’s strongest recommendation is to build the asset map passively first. Observing mirrored traffic allows defenders or authorized testers to identify IP and MAC addresses, vendors, industrial protocols, communication patterns, write operations, and unusual traffic without introducing new packets into the control network. That gives operators a baseline before any active interrogation begins.

READ THE STORY: Codeby

Your Water Could Be Next - How State-Sponsored Hackers Target Critical Infrastructure (Video)

FROM THE MEDIA: Foreign APTs exploit supply chains to disrupt critical infrastructure. From water supply hacks to compromised meters, the threat is escalating. Learn from history's preparedness.

Episode 21 | Hacking Critical Infrastructure Explained with CyberLab (Video)

FROM THE MEDIA: In this episode of Tales from the CyberLab, Adam Myers is joined by Steve Clarke, Head of Penetration Testing at CyberLab, to unpack the reality of hacking Critical National Infrastructure. From energy and transport to water and healthcare, they explore how Operational Technology systems work, why they are such attractive targets, and what makes securing them so different from traditional IT environments.

The selected stories cover a broad range of cyber threats and are intended to help readers frame key publicly discussed threats and improve overall situational awareness. InfoDom Securities does not endorse any third-party claims made in its original material or related links on its sites; the opinions expressed by third parties are theirs alone. For further questions, don’t hesitate to get in touch with InfoDom Securities at dominanceinformation@gmail.com.