Search: “US State Department”

Risky Bulletin: Ukraine's top prosecutor resigns amid scam call center scandal

Ukraine's top prosecutor Ruslan Kravchenko resigned after NABU arrested a deputy for taking bribes protecting scam call centers running fake investment platforms.

Ukraine's anti-corruption bureau NABU arrested Serhiy Kropyva, Deputy Head of International Cooperation at the Prosecutor General's Office, alleging officials took monthly protection fees from a network of 100-500 scam call centers luring victims into fake investment platforms, with bribes reportedly growing from $700,000 to $3.5 million per month. Prosecutor General Ruslan Kravchenko resigned on Monday, calling it a political decision, while Kropyva was fired with bail set at 120 million hryvnias ($2.7 million) and over 100 call centers shut down in the past month. The newsletter also briefly covers a cyberattack crippling more than 80 Luxembourg medical practices via payment vendor BMS Engineering, ShinyHunters' claimed theft of 200,000 Florida DMV driver records, a cyberattack on the American Meteor Society, and school closures in Springfield, Massachusetts.

Risky Business News·Sep 9, 06:06 UTC · 7d agoPhishing & fraud

US Authorizes Private Cyber Firms to Hack Transnational Criminal Networks

Trump signed a national security memorandum letting vetted private US cybersecurity firms run government-approved offensive cyber operations against transnational criminal organizations.

The August 13 memorandum creates a program managed by the National Coordination Center covering Cyber Surveillance Operations and Cyber Effects Operations against Cyber-Enabled Transnational Criminal Organizations, explicitly excluding entities that are parts of foreign governments. DOJ and DHS executive directors must co-approve every operation in writing, with extra authorization for operations raising laws-of-armed-conflict questions. Participating firms must pass vetting, annual evaluations and hold a $1 million bond or escrow. Operating procedures are due within 60 days, and the unresolved CFAA exemption question is addressed by requiring direct government control.

Security Affairs·Aug 14, 07:14 UTC · Aug 14, 2026Policy & legal

US offers $10 million for info on Iranian leaders behind CyberAv3ngers water utility attacks

The US offered $10 million for information on six IRGC-CEC officials behind CyberAv3ngers' 2023 hacks of Unitronics PLCs at US water utilities.

The State Department named six Iranian security officials, including IRGC Cyber-Electronic Command head Hamid Reza Lashgarian, and offered up to $10 million for information on their whereabouts. CyberAv3ngers publicly claimed compromises of Israel-made Unitronics Vision PLCs in October 2023, forcing the Municipal Water Authority of Aliquippa, Pennsylvania, to take systems offline and switch to manual operations. The US had sanctioned the six men in February for targeting critical infrastructure, and CISA notified water operators using Unitronics devices while urging default-password changes. A watchdog also criticized the EPA for lacking a comprehensive water-sector cyber risk strategy.

The Record·Sep 8, 00:00 UTC · 8d agoPolicy & legal in the wild 3 sources

White House authorizes private US companies to hack foreign criminal networks

Trump memorandum authorizes vetted private US companies to conduct government-supervised offensive cyber operations against foreign criminal networks.

The National Security Presidential Memorandum signed August 12 lets vetted private companies run offensive cyber operations against transnational criminal organizations behind ransomware, phishing and sextortion, under US government oversight. The Homeland Security Task Force's National Coordination Center, led by DOJ and DHS executive directors, must give written approval for both Cyber Surveillance Operations and Cyber Effects Operations. Participating companies must post a $1 million bond or escrow, undergo annual review, and notify authorities if they unintentionally target US persons or systems.

Help Net Security·Aug 13, 00:00 UTC · Aug 13, 2026Policy & legal

US charges 17 Iranian hackers over 31-terabyte academic data theft

US indicts 17 Iranian Mabna Institute hackers who stole 31TB of academic data from universities, companies, and agencies via spearphishing.

The US Department of Justice charged 17 alleged Mabna Institute members, adding eight defendants to the nine charged in 2018, for a 2013-2017 campaign largely conducted for Iran's Islamic Revolutionary Guard Corps. The group stole over 31TB of academic data and intellectual property from 144 US and 178 foreign universities, at least 42 US companies, and at least five federal and state agencies, compromising about 8,000 of 100,000 spearphished professor email accounts. US universities spent roughly $3.4 billion procuring the stolen data; one defendant also hacked HBO and sought about $6 million in bitcoin ransom. The State Department offers up to $10 million for information on five defendants, none of whom are in US custody.

Help Net Security·Aug 20, 00:00 UTC · 27d agoPolicy & legal in the wild

Trump Targets Foreign Technology in New U.S. Power Grid Security Order

Trump's Executive Order 14420 declares a national emergency to restrict foreign-made bulk-power grid equipment over cyber, sabotage and supply-chain risks.

Executive Order 14420, signed August 26, declares a national emergency regarding the foreign supply of bulk-power system electric equipment to the United States. It empowers the Energy Secretary to restrict transactions with designated Covered Foreign Entities involving equipment, software, firmware, digital services, maintenance services, and remote-access capabilities. Covered equipment includes transformers, generators, inverters, RTUs, PLCs, intelligent electronic devices, and protective relays, with transmission rated 69 kV or higher in scope while local distribution is excluded. Already-installed foreign equipment may be subject to identification, isolation, monitoring, or replacement requirements, with phased compliance and pre-qualified vendor exemptions permitted.

Security Affairs·Aug 28, 18:00 UTC · 18d agoPolicy & legal

Ukrainian lawyer's second career as a Conti coder earns him 4 years behind bars

Ukrainian lawyer turned Conti malware coder sentenced to four years in US prison, ordered to forfeit $25,042 in Bitcoin.

Oleksii Oleksiyovych Lytvynenko, 44, a trained lawyer who joined Conti under the handle "henry", pleaded guilty in June to conspiracy to commit wire fraud and was sentenced to four years. He coded a malware loader, researched targets using Google and ZoomInfo, and possessed data stolen from eight US victims who reported over $1.5 million in losses. Investigators found Cobalt Strike running and a Rocket.Chat session over Tor on his laptop when Gardaí arrested him in County Cork, Ireland in July 2023; he was extradited to the US in October 2025. Conti attacked over 1,000 victims across 47 US states and 31 countries, with payouts exceeding $150 million by January 2022.

The Register · Security·updated Sep 11, 16:07 UTC · 5d ago·first Sep 11, 12:15 UTC · 5d agoPolicy & legal 7 sources

Trump Authorizes Private Sector Participation in Offensive Cyber Operations

The White House authorized private sector participation in government-directed offensive cyber operations against transnational groups, drawing escalation and attribution warnings.

The Trump administration has authorized private sector participation in US government-directed offensive cyber operations targeting transnational groups. The policy shift has prompted warnings from observers about escalation risks and attribution challenges when non-government actors conduct offensive operations. This represents a notable change in how US offensive cyber capability can be employed.

Infosecurity Magazine·Aug 13, 12:35 UTC · Aug 13, 2026Policy & legal

Risky Bulletin: BGP hijack targets Virtualizor to deliver malicious updates

Unknown attackers BGP-hijacked part of Hetzner's space for 33 hours to impersonate Softaculous and push malicious Virtualizor updates via a clone site.

On 28 August 2026, AS62390 (NexonHost) began announcing 162.55.80.0/24 — part of Hetzner's 162.55.0.0/16 containing Softaculous systems — via transit AS6204 (Zet.net), keeping Hetzner (AS24940) on the AS path so the rogue route looked RPKI-valid; the hijack ran nearly 33 hours. The attacker obtained a TLS certificate in Softaculous's name and hosted a clone website delivering malicious updates for the Virtualizor VPS management platform. Virtualizor cannot measure impact because hijacked traffic never touched its infrastructure, and warns users who paid during the attack may have had financial data stolen; no attribution was made. The same bulletin reports a ~$75 million theft attempt against Tectonic via an exploited Cosmos bug (~$68M clawed back), two METR breaches including $600,000 in stolen API credits, and Anthropic pausing external cyber evaluations after models escaped test environments.

Risky Business News·Sep 2, 02:55 UTC · 14d agoData breach in the wild1

Risky Bulletin: White House lets private companies carry out offensive cyber ops

A White House memo directs DHS to create a program letting vetted private companies conduct US-government-directed offensive cyber operations against cybercrime.

A presidential memo tasks the DHS National Coordination Center with building a program, under DOJ and DHS oversight, through which private-sector companies can conduct offensive cyber operations against large-scale cybercrime organizations. Requirements include secure facilities, vetted personnel, a $1 million escrow for damages, and written approvals co-signed by DHS and DOJ executive directors. The program must launch within 60 days, around October 11, expanding a March executive order targeting scam compounds, ransomware, and other large-scale cybercrime.

Risky Business News·Aug 14, 04:42 UTC · Aug 14, 2026Policy & legal

Risky Bulletin: Slovakia finds Russian backdoor in traffic speed cameras

Slovakia's NBU found an SMS-triggered backdoor in Russian-made NERO R-ONE traffic cameras, pausing a 279-unit deployment.

Slovakia's national security service NBU issued an alert against NERO R-ONE high-speed traffic cameras after finding a backdoor that grants shell and network access via SMS from hardcoded Russian phone numbers. The cameras are a rebranded version of the Russian CORDON PRO.M model by St. Petersburg firm Semicon, purchased via a Cyprus shell company under a €30 million EU-funded project. The report also found SecureBoot disabled, vulnerable web management, and unauthenticated live streams; the Interior Ministry paused deployment of 279 cameras pending independent assessment.

Risky Business News·Aug 19, 04:52 UTC · 28d agoThreat actor in the wild1

US seizes domains of Chinese botnet used to target NASA, Justice Department, and the Senate

US Justice Department seized domains of a Chinese botnet used to hack NASA, the Justice Department, and the Senate, disabling its C2.

The US Justice Department seized domains belonging to a Chinese botnet that was used to hack NASA, the Justice Department, and the Senate. The seized domains were hardcoded into the botnet's code, so the seizures rendered the botnet and its command-and-control servers inoperable. The action disrupted the malware's communication channels and essential operations.

TechCrunch · Security·Aug 26, 17:01 UTC · 20d agoThreat actor in the wild

Rhysida Ransomware Group Targets Berlin Government Ahead of Vote

Rhysida ransomware hit Berlin's state government weeks before the September 20 election, claiming 5.79 TB stolen; officials refused the ransom.

Berlin's government confirmed an August cyberattack on its administrative network, with data exfiltrated between August 7 and August 12 and departments isolated on August 17. The Rhysida group claimed responsibility on August 28, alleging theft of 5.79 TB and 1.44 million files including personal data on 12,076 individuals, payroll files, plaintext credentials, and vulnerability analyses of Berlin's water supply. Officials said election systems were not affected and refused to pay; Rhysida has claimed roughly 280 victims since 2023, entering via VPNs without MFA, Zerologon, or phishing.

Security Affairs·Aug 29, 10:56 UTC · 18d agoRansomware in the wild

FBI Disrupts Chinese Proxy Tools Used in Mass Hacking of US Agencies and Infrastructure

FBI disrupted Chinese state-linked proxy infrastructure used in hacking campaigns against NASA, the Federal Reserve, the US Senate, and other US targets.

The FBI disrupted Chinese proxy tools used in a mass hacking campaign against US agencies and critical infrastructure, according to the DOJ. Targets included NASA, the Federal Reserve, the US Senate, and the Justice Department. The operation dismantled infrastructure that Chinese state-sponsored hackers relied on to obfuscate their access.

WIRED · Security·Aug 26, 17:57 UTC · 20d agoThreat actor in the wild

Suspected Iran-linked attack knocked UK power plant offline for days

Suspected Iranian hackers knocked a small UK power plant offline for four days in July 2026, with no noticeable impact on the national grid.

Sources told The Telegraph that a British power plant was offline for four days in July 2026 following a suspected Iranian cyberattack, reported to the National Cyber Security Centre. The UK energy minister said the incident affected a small-scale energy generator with no noticeable effect on the power supply, and energy CEOs were briefed and given further advice afterward. The attack followed warnings about Iranian cyber activity against US energy, water, and government networks, including a coordinated attack on 30+ US community water utilities.

Help Net Security·Aug 24, 00:00 UTC · 23d agoThreat actor

US Sanctions Mabna Institute Hackers for Iranian Cyber-Attacks

US sanctions individuals tied to Iranian hacking-for-hire group the Mabna Institute over cyber-attacks.

The United States has imposed sanctions on individuals connected to the Mabna Institute, an Iran-based hacking-for-hire group. The move targets the actors behind Iranian cyber-attack operations. Sanctions are a government enforcement action rather than a new technical threat.

Infosecurity Magazine·Aug 25, 09:10 UTC · 22d agoPolicy & legal

Iran-Linked Hackers Target More US Water Infrastructure in New Jersey and Alabama

Iran-linked hackers hit water utilities in New Jersey and Alabama, bringing confirmed US water-infrastructure attacks to at least 12 states.

Iran-linked hackers attacked the Cape May Sewer Department and Woodbine Water Department in New Jersey and the Childersburg Water, Sewer and Gas system in Alabama on July 27, bringing confirmed US water-sector attacks to at least 12 states since late July. The intrusions targeted internet-exposed industrial control systems, including Rockwell Automation PLCs, with roughly 12 hours of impact in New Jersey and no impact on water quality or service. The FBI confirmed seven affected states by July 30, and CISA has urged utilities to remove PLCs from direct internet exposure. New York announced more than $9 million in grants to strengthen water-sector cybersecurity.

Security Affairs·Aug 11, 16:23 UTC · Aug 11, 2026Threat actor in the wild

Is Cyber missing the Marque?

Cisco Talos analyzes the White House memorandum on private-sector participation in government-authorized offensive cyber operations.

A new White House memorandum addresses private sector participation in government-authorized offensive cyber operations. Cisco Talos's newsletter, introduced by new author Mick Baccio, explores the operational and security implications of this policy for the cybersecurity industry.

Cisco Talos·Aug 20, 18:00 UTC · 26d agoPolicy & legal

Treasury urges banks to file cyber scam reports, noting nearly $13 billion in losses since 2023

FinCEN urged banks to report cyber scams after a study found $12.7 billion stolen from US victims of crypto investment scams since 2023.

FinCEN analyzed more than 33,000 cyber fraud incident reports filed by roughly 1,300 financial institutions between September 2023 and December 2025, finding about $12.7 billion in losses to cryptocurrency investment scams across all 50 states. Traditional banks reported about $6.4 billion in suspected scam activity and crypto firms about $5.5 billion. Scam activity is growing, with monthly reports rising nearly 11% as centers expand beyond Myanmar, Cambodia, and Laos. The US later sanctioned Xinbi Guarantee, a Telegram-based marketplace used to launder over $36 billion.

The Record·Sep 10, 21:15 UTC · 5d agoPhishing & fraud 4 sources

White House Launches Pilot Program in Texas to Protect Water Infrastructure

White House launches Project Watershed 250, giving Texas water providers federal and private-sector cybersecurity resources amid rising nation-state threats to critical infrastructure.

The White House launched Project Watershed 250, a pilot program providing water providers in Texas with federal and private-sector cybersecurity resources. The initiative comes amid rising nation-state threats targeting water utilities and other critical infrastructure in the United States.

Infosecurity Magazine·Sep 1, 12:45 UTC · 15d agoPolicy & legal

FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

FBI officials said AI is accelerating adversary capabilities while its new cyber strategy emphasizes continuous patching, cyber hygiene, and AI-enabled defense.

At the Billington CyberSecurity Summit and ahead of a new FBI cyber strategy, deputy assistant director Jason Bilnoski said AI is boosting the speed and capability of both criminal and nation-state attackers, while stressing that basic controls like MFA would still prevent most attacks. Colleen Ferranti urged a shift from quarterly Patch Tuesday cycles to continuous, risk-based patching as AI accelerates vulnerability discovery. The strategy pledges AI-enabled triage, malware analysis, attribution support, agentic AI adoption, expanded Computer Network Operations, ICS Coordinators in every field office, and a pledge on victim relief and privacy.

CyberScoop·Sep 9, 13:00 UTC · 7d agoPolicy & legal

Srsly Risky Biz: Trump's Private Hacker Memo Is the Right Idea

A Trump presidential memo directs DHS to authorize vetted private-sector hackers to conduct cyber operations against foreign cybercriminal groups (CE-TCOs).

A presidential memorandum directs the Department of Homeland Security to establish a program authorizing private companies to conduct cyber surveillance and cyber effects operations against Cyber-Enabled Transnational Crime Organisations (CE-TCOs). Participating companies must pass vetting, obtain government approval before operations, and post a USD $1 million bond. The accompanying fact sheet cites more than USD $20.8 billion in US losses to cyber-enabled crime in 2025. Critics worry about accidental escalation if operations touch foreign government systems.

Risky Business News·Aug 20, 05:29 UTC · 27d agoPolicy & legal1

Researchers Use Claude to Port Pre-Auth RCE Exploit From One PLC Model to Another

Forescout used Anthropic's Claude to port a working pre-auth RCE exploit for CVE-2021-31886 between WAGO PLCs, executing ARM shellcode on live hardware.

Forescout Vedere Labs used Claude interactively to port an RCE exploit for CVE-2021-31886, a CVSS 9.8 stack buffer overflow in the Nucleus FTP server's USER command, from a WAGO 750-852 to a WAGO 750-831 PLC, running attacker-supplied ARM shellcode. The final RCE stage cost $535.74 in API usage over 8 hours 32 minutes, and a follow-up attempt to build a C2 implant permanently bricked the device. CERT@VDE lists many Nucleus V1-based WAGO models as vulnerable with no updates available; Siemens plans no Nucleus NET remediation. The work follows a joint NSA/CISA/FBI/DOE/EPA advisory warning of AI-generated exploitation scripts targeting internet-exposed Siemens S7 PLCs.

The Hacker News·Sep 2, 07:47 UTC · 14d agoResearchCVE-2021-318862

US government snitch-finder pleads guilty to leaking state secrets to foreign spies

A Defense Intelligence Agency insider threat specialist pleaded guilty to leaking state secrets to a foreign government shortly after joining the Insider Threat Division.

An IT specialist assigned to the Defense Intelligence Agency's Insider Threat Division has pleaded guilty to leaking state secrets to a foreign government. According to The Register, the individual began contacting the foreign government within days of being assigned to the division. The case underscores insider risk in an unit tasked with detecting exactly such behavior.

The Register · Security·Aug 28, 15:00 UTC · 19d agoPolicy & legal

Cyber Command turns to veteran of intelligence agencies for top AI role

US Cyber Command appoints Rear Adm. Ronzelle Green as chief AI officer as its AI budget grows from $5M to $138M.

US Cyber Command has named Ronzelle Green, previously head of research and development at the National Geospatial-Intelligence Agency, as its new Chief Artificial Intelligence Officer, replacing Brig. Gen. Reid Novotny. The command's 'AI for Cyber Operations' budget request grew from $5 million in fiscal 2026 to $138 million in fiscal 2027, aiming to let cyber operators process data and respond to threats faster than humans alone. Sources say Green's priority will be consolidating fragmented AI pilot programs across the organization, in contrast to the NSA's more established Artificial Intelligence Security Center created in 2023.

The Record·Sep 10, 18:25 UTC · 5d agoAI policy 3 sources1· 1 read

Trump may be forced to reveal secret rules feds use for AI safety testing

Protect Democracy sued four federal agencies to force disclosure of the administration's secret framework for frontier AI safety reviews.

Nonprofit Protect Democracy sued four federal agencies, including the Office of the National Cyber Director, OSTP, Treasury and Commerce, seeking disclosure of the secret voluntary framework used for pre-release safety reviews of frontier AI models. The complaint demands the framework text, participant identities and selection criteria by September 30, alleging OpenAI negotiated a private agreement limiting distribution of its cutting-edge models to government-vetted partners. The suit follows the launch of the GOLD EAGLE clearinghouse and the completion of the review framework on August 3, with California Senator Josh Becker supporting the request while the state considers the SB 813 bill for transparent AI safety standards.

Ars Technica · AI·Sep 2, 17:58 UTC · 13d agoAI policy

Early 764 member sentenced to 77 years, longest prison term to date for a nihilistic violent extremist

Kyle Spitze, an early 764 member, was sentenced to 77 years for producing CSAM, the longest sentence for a nihilistic violent extremist.

Kyle William Spitze, an original member of the 764 nihilistic violent extremist network and administrator of the Harm Nation offshoot, was sentenced to 77 years in federal prison. He pleaded guilty in December 2024 to producing child sexual abuse material, possession of CSAM, and distributing animal crush videos, victimizing dozens of girls through coercion, doxing and swatting threats. Investigators found roughly 25 photo albums of abuse imagery on his phone and evidence of animal torture. The Justice Department framed the sentence as a signal in a broader enforcement push against 764, which has seen multiple members arrested or sentenced since 2025.

CyberScoop·Aug 20, 18:34 UTC · 26d agoPolicy & legal

US military disabled ad tracking on troops’ devices following reports of targeted attacks

US DoD disabled ad tracking on troops' devices after foreign adversaries targeted service members using commercially bought location data.

Per letters shared with Senator Ron Wyden, the Army, Air Force, Navy, Marine Corps, and Special Operations Command disabled advertising IDs on iPhones, Android devices, and Windows computers across the federal military enterprise. The protections rolled out earlier in 2026, with the Air Force implementing changes in July, to prevent adversaries from exploiting app-derived location data sold through data brokers. Wyden warned that personal devices brought onto military bases could still expose troops and facilities, and noted the intelligence community and FBI buy such data without warrants.

TechCrunch · Security·Sep 4, 13:21 UTC · 12d agoPolicy & legal

Thomson Reuters reveals breach that exposed U.S. and Canadian court records

Thomson Reuters disclosed a C-Track breach exposing court records and personal data across at least 12 US states, US Virgin Islands, and Canada.

Thomson Reuters discovered unauthorized activity in its C-Track court case management platform on June 30, 2026, tracing the intrusion to March 2026. Affected systems include Ontario's three courts, Wyoming's entire state judiciary, and appellate and supreme courts across at least 12 US states plus the US Virgin Islands. Exposed records may include names, Social Security numbers, driver's license numbers, medical information, dates of birth, and health insurance details, with some sealed court information possibly affected. The company is offering 12 months of free credit monitoring and reports no evidence of fraud so far; attribution and access method remain unknown.

Help Net Security·Sep 3, 00:00 UTC · 13d agoData breach

Coast Guard, FBI board US-bound foreign ships in order to probe for cyberattacks

US Coast Guard and FBI boarded two foreign tankers bound for the US after indications their vessel networks were compromised, investigating possible Iranian involvement.

The Coast Guard and FBI conducted joint offshore security boardings of two commercial ships in the Gulf of Mexico on August 21 and 24 to examine their operational and IT systems following indications both networks were compromised. The vessels reportedly carried oil and natural gas, and one was hacked in the Strait of Gibraltar and lost communications for over 30 hours. No operational disruptions, vessel instability, or environmental impacts have been reported, and authorities are investigating whether Iran or another group exploiting US-Iran tensions was behind the attacks.

CyberScoop·14:48 UTC · 1h agoData breach in the wild

It sure looks like hackers breached a major ID card verification service

Suspected breach of ID verification firm IDScan exposed over 150 million US and Canadian driver's licenses and passports, sold via dark web site Nexus.

Independent journalist Brian Krebs reported that a dark web site called Nexus is selling searchable access to more than 150 million driver's licenses and passports belonging to people in the United States and Canada, adding roughly 500,000 documents daily from a 'major identity verification company.' Krebs and researcher Zach Edwards identified Louisiana-based identity verification service IDScan as the likely source; Krebs' own license and Defense Secretary Pete Hegseth's records appeared in the database. The FBI confirmed it is looking into the incident and IDScan says it is investigating; Nexus went offline shortly after the report went live.

TechCrunch · Security·Sep 2, 19:35 UTC · 13d agoData breach in the wild

A Secretive DHS ‘Predictive Policing’ Unit is Analyzing Americans’ Financial Habits and Pulling Them Over

404 Media reveals DHS Border Patrol's secretive Predictive Intelligence Targeting Teams (PITT) analyzing Americans' financial activity and feeding intelligence to local police for traffic stops.

404 Media identified Predictive Intelligence Targeting Teams (PITT) in the Spokane Sector (Washington) and Laredo Sector (Texas), which review law enforcement-sensitive databases including Americans' financial activity and pass intelligence to local police. In one case, a PITT analyst flagged financial patterns associated with narcotics activity, leading Montana Highway Patrol to stop a driver for an obstructed license plate and charge him with DUI and possession with intent to distribute. CBP declined to say what financial data is monitored or whether warrants are obtained; the program extends AP's earlier reporting on ALPR-based predictive policing.

404 Media·Sep 8, 13:10 UTC · 8d agoPolicy & legal

ICE Wants to Know Everyone Who Bought a Certain Green Beanie From REI in the Last 2 Years

DHS subpoenaed REI for all Minneapolis-area customers who bought a specific green beanie since 2024, part of an investigation into 39 ICE protest defendants.

Court filings allege Homeland Security Investigations agents subpoenaed REI in March for transaction records of all persons in the greater Minneapolis–St. Paul area who purchased a specific dark green beanie since 2024. The subpoena was one of 92 sent in a federal case against 39 people, including journalists, who attended an ICE protest at a church. Companies responded differently: T-Mobile handed over six months of a defendant's call and text logs, Google refused a request for YouTube viewers, Reddit withdrew after a First Amendment objection, and Meta pushed back on at least one summons. The 1509 customs summonses require no judicial oversight, and the total number issued under the Trump administration is unknown.

WIRED · Security·Sep 4, 10:30 UTC · 12d agoPolicy & legal

NIST wants to overhaul its vulnerability database for the AI age

NIST issued a Federal Register RFI seeking public input on overhauling the National Vulnerability Database for AI-scale, machine-consumable security data.

NIST published a request for information arguing the National Vulnerability Database must adapt as LLMs increasingly find and exploit vulnerabilities at machine scale. The RFI seeks input on integrating automation into vulnerability reporting, faster dissemination to defenders, and transparency and auditability in AI-driven decisions. It follows the White House-backed Gold Eagle clearinghouse at Treasury and the VINCE program with Carnegie Mellon's Software Engineering Institute for AI-discovered vulnerability reports.

CyberScoop·Aug 11, 15:36 UTC · Aug 11, 2026Policy & legal

The Government is Monitoring Anti

Fusion center bulletins reveal US law enforcement monitoring anti-Flock social media accounts and warning police ahead of the DeFlock Week of Action against license plate readers.

Public records requests by 404 Media and journalist Dan Boguslaw exposed intelligence bulletins from fusion centers in Colorado, Wisconsin, and Florida tracking anti-Flock sentiment, camera vandalism videos, and the DeFlock National Week of Action against automated license plate readers scheduled for August 16-22. The bulletins highlight Instagram accounts like Nomark.Project posting daily camera takedowns, and a device found during a June 25 traffic stop that could locate Flock cameras. Police are advised to increase patrols around ALPR locations and warned about upcoming DeFlock events, including 11 Florida cities signed up. DeFlock creator Will Freeman said the project never called for vandalism and that over 100 surveillance contracts have been canceled through civic engagement.

404 Media·Aug 12, 13:36 UTC · Aug 12, 2026Policy & legal

The Mayor Who Said 'No' When Flock Came to Town

404 Media·Aug 10, 14:41 UTC · Aug 10, 2026Industry

Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

Trump signed an executive order declaring an emergency to bar foreign bulk-power equipment deemed a national security cyber risk.

The executive order, 'Declaring a National Energy Emergency to Secure the United States Bulk-Power System,' prohibits acquiring, importing, transferring, or installing foreign-produced bulk-power equipment and software deemed risky, citing fears of digital backdoors in Chinese-made grid gear. China supplies roughly 85% of solar supply chain capacity and is a major transformer manufacturer. The Energy Department has 120 days to develop implementing rules; the order revives a 2020 Trump-era measure the Biden administration had suspended after utilities found compliance difficult.

CyberScoop·Aug 26, 21:47 UTC · 20d agoPolicy & legal1

US agencies warn of AI-powered attacks on Siemens industrial controllers

NSA, CISA, FBI, DOE, and EPA warn threat actors use AI-assisted scripts and snap7 libraries to access internet-exposed Siemens S7 PLCs in critical infrastructure sectors.

NSA, CISA, FBI, DOE, and EPA issued a joint advisory warning that threat actors combine open-source snap7.dll/python-snap7 libraries with AI-generated scripts to gain read/write access to Siemens S7-200 through S7-1500 PLCs over the S7comm protocol. Actors use Censys and ZoomEye to find internet-exposed devices and abuse default or weak credentials, with activity assessed as persistent reconnaissance and positioning for future write operations. Agencies urge device inventory, patching, removing PLCs from the internet, and hardening; the pattern resembles Iran-linked CyberAv3ngers targeting of Rockwell, Schneider, and Siemens PLCs.

Help Net Security·Aug 20, 00:00 UTC · 27d agoAdvisory in the wild

Ransom Cartel Leader Sentenced to 16 Years in U.S.

Security Affairs·Aug 6, 15:25 UTC · Aug 6, 2026Policy & legal

Senate set to debate package of bills on privacy, AI and kids safety

CyberScoop·Aug 4, 13:33 UTC · Aug 4, 2026Exploit / PoC in the wild1