OODA Analysis and Briefs

Home > OODA Analysis and Briefs

Analysis

Senator of the Week

It would appear that a “Bear” has been lurking in Connecticut: A senior Republican lawmaker on Wednesday called for removing the nation’s center for publicly available intelligence from the CIA, arguing that it not adequately supported and haunted by past scandals. House Homeland Security Intelligence Subcommittee Chairman Rob Simmons, R-Conn., said the Open Source Center…
Indicators

Muslims blow up US military barracks Muslims attempt to blow up the World Trade Center Muslims bomb US Embassies Muslims blow a hole in a US Navy ship Muslims destroy the World Trade Center and blow a hole in the Pentagon Muslims worldwide riot over . . . cartoons Disaffected Muslims riot around France Muslims…
The Happy Face is Watching You

Wal-Mart’s ability to crunch numbers is a favorite of conspiracy theorists, and its data centers are the corporate counterpart to Area 51 at Groom Lake in the state of Nevada. According to one consumer activist, Katherine Albrecht, even the wildest conspiracy buff might be surprised at just how much Wal-Mart knows about its customers –…
Blissfully Unaware

It was a beautiful spring day at the Edina Art Fair. Some quite good and plenty of really bad “art” and the diet-blowing menu of brats, fried cheese curds, cherry lemonade, all ridiculously overpriced but oh-so delicious in the 84-degree sun. A perfect time to turn on my underused biological SIGINT capability and see what…
Euro View on Snooping

(Hat Tip to Bruce Schneier . . . naturally) I have been waiting for someone to tackle this topic from the European point of view: Had a European government, instead of the Bush administration, created the NSA’s call database, would that government be in violation of European privacy law? I think so, for the reasons…
Faster (patrol boats), Please

Via Geostrategy Direct (subscription): The Iran navy has procured hundreds of fast patrol boats as part of what is believed to be a swarm strategy to overcome the firepower of U.S. cruisers and destroyers. Gulf analysts said the Islamic Revolutionary Guard Corps has deployed and trained hundreds of FPBs in the northern Gulf to surround…
DHS Runs Out of Pork Loin (Update & Bump Up)

The Department of Homeland Security yesterday slashed anti-terrorism money for Washington and New York, part of an immediately controversial decision to reduce grant funds for major urban areas in the Northeast while providing more to mid-size cities from Jacksonville to Sacramento. The announcement that the two cities targeted on Sept. 11, 2001, would suffer 40…
Imagine That!

They have a plan, they have a pattern . . . Armed with details of billions of telephone calls, the National Security Agency used phone records linked to the Sept. 11, 2001 attacks to create a template of how phone activity among terrorists looks, say current and former intelligence officials who were briefed about the…
Jihad via PSP

Gamers quibble over trees while missing a forest: Was an elite congressional intelligence committee shown video footage from an off-the-shelf retail game and told by the Pentagon and a highly-paid defense contractor that it was a jihadist creation designed to recruit and indoctrinate terrorists? It’s looking more and more like that is the case. The…
Preparing to Fail

A long post derived from Inside the Pentagon (subscription): Retired Marine Corps Lt. Gen. Paul Van Riper, who led a “red team” of notional enemy forces at the outset of JFCOM’s Millennium Challenge 2002 war game, is calling on the command to spell out publicly how the experiment has influenced the Defense Department view of…
Nicely Done Mr. Barone

Acting on Assumptions with Iran & Iraq: To learn lessons from history, including recent history, it’s essential to get the history right. That’s why, in order to understand what to do about the mullahs’ regime in Iran, it’s worth revisiting the debate over the intelligence in Iraq. . . . and that’s just the first…
De Oppresso Liber

Work (I won’t call it duty) calls and finds me at the keyboard when I should be doing something that a lot of brothers are unable to do today: enjoying their families. In between flashes of corporate panic I find myself visiting the ‘sphere and taking note of those who are intentionally still blogging today,…
Get Ready for the RIF

A very interesting entry at Strategy Page, with the most significant points brought out in the second paragraph: DoD is overhauling its entire intelligence apparatus …The plans are pretty ambitious, and are partially implemented. The basic idea is to take advantage of abundant computer power, and affordable networking, to tie together as many troops, vehicles…
Piling on Wehner

Not that he needs it but . . . Misleading Intel: Everyone (not just some US political cabal) thought Iraq had WMD. We’ve found arty shells with nerve-agent (sarin) in them; documents placing orders for precursor chemicals used to make this thing called Zyklon-B (famously used by another tyrant decades ago); and shady-looking mobile labs…
Nice Try (NSA critique) (Update)

One of the better attempts to critique the NSA’s efforts today in the NY Times: If the program is along the lines described by USA Today — with the security agency receiving complete lists of who called whom from each of the phone companies — the object is probably to collect data and draw a…

Briefs

UK Metal Engineering Firm Vesuvius Hit by Cyber-Attack

A UK-based molten metal flow engineering company has been hit with a cyberattack. The company, Vesuvius, issued a public alert on February 6 confirming the cyber incident and stating that it involved unauthorized system access. The company did not provide information about the nature and scope of the incident. Additionally, the identity of the attacker…
Finland’s Most-Wanted Hacker Nabbed in France

A 25-year-old Finnish man named Julius “Zeekill” Kivimaki has been arrested in France and charged with extorting a local online psychotherapy practice. According to authorities, Kivimaki released the therapy notes for more than 22,000 patients online. The attack against the psychotherapy practice is just one of the tens of thousands of cybercrimes that Kivimaki has…
Vulnerability Provided Access to Toyota Supplier Management Network

Car manufacturer Toyota as been alerted to a severe vulnerability in its web portal for the global supplier management network. According to Toyota, security researcher Eaton Zveare detected the vulnerability and was able to exploit it to gain access to sensitive information. The impacted web portal provides Toyota employees and suppliers with information about ongoing…
Patch Released for Actively Exploited GoAnywhere MFT Zero-Day

The developers behind the GoAnywhere managed file transfer (MFT) software have released a patch for a critical zero-day vulnerability. The flaw was identified recently and warnings of active exploitation emerged roughly a week ago. The company behind the software has not released any details about the attacks targeting the vulnerability. Security firm Fortra alerted GoAnywhere…
Major Florida Hospital Shuts Down Networks, Ransomware Attack Suspected

Tallahassee Memorial Healthcare, a major hospital located in northern Florida, has reported a security incident that resulted in network outages and the forced shutdown of its IT network. Additionally, the security incident forced the facility to divert some emergency medical services and cancel surgeries. The healthcare center stated that it was following protocols for system…
North Korea promises ‘expanded, intensified’ military drills

North Korea has announced that it will expand and intensify its military drills to make sure its armed forces are prepared for any war. The decision was made at a meeting of the central military commission on Monday. The meeting was run by the ruling Workers’ Party and Kim Jong Un chaired the meeting. North…
Heavy rain hampers earthquake rescue efforts

Rescuers are facing heavy rains and snow while they search for survivors of a fatal earthquake in south-east Turkey. The death toll from the quake has risen to at least 4,300 and 15,000 people have been injured in the earthquake that occurred in the early hours of Monday. The World Health Organization has warned that…
China says it ‘reserves the right’ to deal with ‘similar situations’ after US jets shoot down suspected spy balloon

After the United States’ decision to shoot down China’s high altitude balloon, China stated it has the right to deal with similar situations. China claimed that the United States’ decision was an overreaction and that the craft was an unmanned civilian airship. China called the decision a violation of international practice. US military jets shot…
Huge quake toppled buildings in Turkey and Syria as people slept

A powerful earthquake struck south-eastern Turkey killing over 1,700 people overnight and trapping many more. The earthquake was measured to be a 7.8 magnitude and struck at 4:17 A.M. local time. The earthquake’s epicenter was near the city of Gaziantep at a depth of 17.9km. A second earthquake occurred hours later at a 7.5 magnitude…
US Man Charged in $110m Crypto Trading Scheme

Avraham Eisenberg, a 27-year-old American man, has been charged with fraudulently obtaining $110 million of cryptocurrency from the crypto exchange Mango Markets. Avraham was reportedly living in Puerto Rico at the time of the scheme. He now faces up to 40 years in jail, according to the Department of Justice. The charges include one count…
UK Car Retailer Arnold Clark Hit by Ransomware

Arnold Clark, a UK-based car retailer, has confirmed that it suffered from a cyberattack that resulted in the exposure of customer data. The Play ransomware group has taken credit for the attack via a message on its Tor-based leak website. Play claims to have obtained gigabytes of sensitive information from the company. Arnold Clark has…
Spain, Morocco seek reset of testy relationship at Rabat summit

Spain and Morocco have agreed to set aside their differences to repair their relationship according to Spanish Prime Minister Pedro Sanchez. The relationship between the two countries have often been marked by disputes over migration and territory. The two countries signed almost 20 agreements to boost trade and investment, including credit lines of up to…
US tracking suspected Chinese surveillance balloon

The US is tracking a suspected surveillance balloon that has flown over sensitive sites over the past few days. The balloon has been called a high-altitude surveillance balloon and defense officials say the balloon belonged to China. Military leaders have decided against shooting the balloon down due to concerns over falling debris. The object flew…
Israel and Sudan finalize text of peace agreement, says Israeli foreign minister

Israel and Sudan have finalized a peace agreement to be signed later on in 2023 according to the ISraeli Foreign Minister Eli Cohen’s announcement on Thursday. Cohen traveled back from Sudan’s capital Khartoum and said that the trip was made with the support of the United States and that the peace agreement would be signed…
City of London on High Alert After Ransomware Attack

Ion Cleared Derivatives, a key supplier of trading software to the City of London, has released a statement confirming that it was hit by a suspected ransomware attack. The attack affected some of its services and therefore disrupted activity in the derivatives market. According to the supplier, the incident has been contained to a specific…
Ransomware Attack Forces Closure of Nantucket Schools

On Tuesday, schools on the island of Nantucket, Massachusetts, were forced to shut down as a result of a ransomware attack. The closure impacted four establishments serving roughly 1700 students. Nantucket district superintendent Elizabeth Hallett announced the decision via email, stating that the district’s technology department was working to restore computers and internet service. The…
N Korea says US drills pushing situation to ‘extreme red-line’

North Korea has criticized both South Korea and the United States over their joint military exercises. North Korea has stated the drills have pushed the situation on the peninsula to a red line and have threatened the region into a more critical war zone. The statement was issued on Thursday and also threatened the “toughest”…
Russia planning 24 February offensive, Ukrainian defense minister says

Russia is preparing a major new offensive according to Ukraine’s defense minister. The defense minister has warned that the offensive could come as soon as February 24. Oleski Reznikov said Moscow has amassed thousands of troops and could possible try an attack to mark the anniversary of the initial invasion. During the current fighting, three…
‘Silent strike’ marks two years of military rule in Myanmar

Pro-democracy protestors are holding a silent strike in Myanmar to mark the two year anniversary of the military coup that removed Aung San Suu Kyi from power. The activists urged people to stay at home and asked businesses to close. The military administration of the country has extended a state of emergency for six months.…
30k Internet-Exposed QNAP NAS Devices Affected by Recent Vulnerability

Censys, an attack surface management firm, has identified roughly 30,000 internet-exposed QNAP network attacked storage appliances that have been affected by a critical vulnerability. The vulnerability is a critical-severity code injection vulnerability that is described as an SQL injection bug. It allows remote attackers to inject malicious code into vulnerable devices such as the 30,000…
GitHub Confirms Signing Certificates Stolen in Cyber-Attack, Revokes Them

On Monday, GitHub confirmed that threat actors stole digital certificates used for applications such as Desktop and Atom in a cyberattack that occurred in December 2022. GitHub stated that it investigated the incident and determined that there was no risk to GitHub’s services and that it detected no unauthorized changes to the projects. To mitigate…
BEC Group Uses Open Source Tactics in Hundreds of Attacks

Security researchers have identified a highly successful new business email compromise (BEC) group. The group has been named Firebrick Ostrich and has conducted at least 347 campaigns since April 2021. Firebrick Ostrich uses relatively unsophisticated techniques to target organizations, such as open source research to identify existing contracts and vendors, as well as total vendor…
Microsoft’s Verified Publisher Status Abused in Email Theft Campaign

On Tuesday, Microsoft and cybersecurity firm Proofpoint warned that a threat actor had recently abused Microsoft’s verified publisher status to launch a campaign involving malicious OAuth applications. The warning stated that organizations using cloud services should be aware of the campaign, especially those in Ireland and the UK. Microsoft has already taken measures to stop…
Hackers Use TrickGate Software to Deploy Emotet, REvil, Other Malware

TrickGate, a malicious live software service, has been deployed by threat actors in recent attacks to bypass endpoint detection. The malware is not new, and has been deployed against detection measures and response protection software for six years. Check Point Research recently released a report detailing TrickGate and its usage by groups such as Emotet,…
Killnet Attackers DDoS US and Dutch Hospitals

According to recent reports, Russian hactivists targeted several hospitals across the US and the Netherlands with DDoS attacks. The campaign targeted facilities including the University of Michigan Hospital and Stanford Health Care Center. The recent attacks may be in response to President Biden’s recent decision to send dozens of Abrams tanks in a move aimed…
JD Sports Confirms Breach Affected 10 Million Customers

JD Sports has advised its customers to change their passwords after the discovery of a cyberattack that may have resulted in the exposure of data belonging to 10 million customers. JD Sports notified its users of the breach via email, stating that the attack impacts customers who placed orders between November 2018 and October 2020.…
Burkina Faso says 28 soldiers, civilians killed in rebel attacks

At least 28 people have been killed in two separate attacks by armed groups in Burkina Faso. The victims include soldiers and civilians. A combat unit in Falagountou, in the north of the country, came under attack and 10 soldiers and a civilian were killed. The bodies of 15 assailants were found after the attack…
More confirmed dead in marathon search of rubble in Pakistan mosque blast

The death toll of the attack in the Pakistan province of Peshawar has risen to at least 87 people. The attack occurred in a mosque with a suicide bombing that targeted policemen. The mosque is located within a high-security police headquarters area. An investigation into how the bomber was able to get into the mosque…
Pope Francis travels to Congo with a pious wish for peace

Pope Francis is visiting the war-torn nation of the Democratic Republic of Congo to boost the sense of community. The Catholic Church plays a large role in education and healthcare systems in the country. Pope Francis will be holding Mass on Wednesday in the town of Kinshasa, the capital of the Democratic Republic of Congo. …
Iran summons Ukraine’s envoy over drone attack comments

The Iranian foreign ministry has summoned the charge d’affaires for Ukraine after comments were made by a presidential adviser who linked drone attacks in central Iran to the war in Ukraine. The envoy was called to provide explanations for the comments. The statement draws ties between Ukrainian president Volodymyr Zelensky and explosions that targeted drone…
At least 32 killed after attack in Peshawar

At least 150 people have been injured and 32 have been killed in a bombing at a mosque in the Pakistani city of Peshawar. The explosion destroyed part of the building and officials say that there are people trapped under the debris. Most of the people who died were members of the police force, it…
Federal Reserve Board issues policy statement to promote a level playing field for all banks: Includes guidances on ‘crypto-assets’

The Federal Reserve Board has issued a policy statement to promote a level playing field for all banks under its supervision, regardless of deposit insurance status. The statement clarifies that both uninsured and insured banks will be subject to the same limitations on activities, including those related to crypto-assets. The statement also reiterates that banks…
Rockets, air attacks in Gaza follow deadly Israeli raid in Jenin

A deadly raid in the occupied West Bank has created anger in Gaza. Rockets were fired into Israel and hundreds of Palestinians are holding vigils and rallies to condemn the attack. Nine Palestinians were killed in the raid on Thursday in Jenin. After the attack, Gaza’s armed groups declared a state of high alert. After…
New Zealand city declares emergency after torrential rain

New Zealand’s city Auckland has declared a state of emergency after large amounts of rain caused widespread flooding and evacuations. The downpour moved houses, stalled traffic and cut power to homes. Fire crews fielded over 1,000 calls for help as people evacuated. The New Zealand Defence Force is also assisting with evacuations. All flights into…
US forces kill Islamic State Somalia leader in cave complex

US forces have killed Bilal al-Sudani, an Islamic State leader, and ten of his operatives in northern Somalia. The forces raided a remote mountainous cave complex hoping to catch him. Al-Sudani was allegedly funding ISIS activities globally and had been growing the presence of the group in Africa. The nature of the operation has not…
DragonSpark Hackers Evade Detection With SparkRAT and Golang

SentinelLabs recently attributed a new string of attacks targeting East Asian organizations to a threat actor referred to as DragonSpark. SentinelLabs stated that the campaign leverages a rare open-source SparkRAT and malware tools to evade detection through source code interpretation techniques. The techniques are based on the Go programming language. Security researchers said that this…
Russia scorns Germany for sending Leopard battle tanks to Ukraine

Moscow has spoken out against Germany’s move to provide battle tanks to Ukraine. Russia accused Germany of abandoning its historical responsibility to Russia after its war crimes committed in World War II. The Russian embassy in Germany stated on Wednesday that the decision to send 14 german-made Leopard 1 tanks to Kyiv would worsen the…
Microsoft to Block Excel XLL Add-Ins to Stop Malware Delivery

Microsoft has confirmed that it plans to change its software to automatically block all XLL add-in files that have been downloaded from the internet. The reasoning behind the update is to prevent phishing attacks and malware downloads that rely on these types of lures. Microsoft stated that the plans will be implemented by March of…
Zendesk Hacked After Employees Fall for Phishing Attack

Zendesk, a customer service solutions provider, has suffered from a data breach that occurred due to a SMS phishing attack launched against its employees. At least one employee fell for the phishing attack, enabling the attackers to steal the employee’s credentials. Last week, cryptocurrency trading and portfolio management company Coinigy revealed that Zendesk had informed…
Most Federal Agencies Ignored GAO’s Cybersecurity Recommendations

The US Government Accountability Office (GAO) released a report last Thursday highlighting federal agencies’ failure to implement cybersecurity recommendations. The GAO found that 60% of the cybersecurity recommendations made by the office since 2010 have not been implemented. The GAO stated that the failure to follow the recommendations results in limited abilities to protect private…
FBI Confirms North Korean Hackers Behind $100 Million Horizon Bridge Heist

The FBI has announced that it confirmed a link between North Korean hackers and the $100 million Horizon Bridge Heist that occurred in June 2022. Horizon bridge is a platform designed to enable cryptocurrency holders to transfer assets between networks such as the Ethereum Network, Binance Chain, Bitcoin, and Harmony’s network. The attack occurred when…
A Major App Flaw Exposed the Data of Millions of Indian Students

An app operated by India’s Education ministry contained a security lapse that resulted in the exposure of personally identifying information belonging to millions of students and teachers. The information was exposed for over a year, the ministry confirmed. The app in question is the Digital Infrastructure for Knowledge Sharing app, also known as Diksha. The…
Finland calls for ‘time-out’ in heated Nato talks with Turkey

A time out has been called in the talks with Finland, Sweden and Turkey about joining Nato. A series of protests in Sweden over the recent days have angered Turkish President Recep Tayyip Erdogan. Turkey is already a member of Nato and can block applications to join. In one of the protests, a Quran was…
Germany won’t block export of its Leopard 2 tanks, foreign minister says

Germany’s foreign minister Anna Baerbock has stated that Germany will not stand in the way of Poland if they were to send Leopard 2 tanks to Ukraine. Ukraine has asked the West for German-made tanks to help theme defeat Russia. Germany has not yet provided the vehicles and its export laws prevent other countries from…
Burkina Faso’s military government demands French troops leave the country within one month

According to the government press agency, the military government of Burkina Faso is demanding the departure of French troops from the country. The government cited the terms of the 2018 agreement that state that France has exactly one month to remove all of tis troops from the country. France still has 400 special forces based…
If ChatGPT Can Pass a Wharton MBA Class What Does This Tell You About the State of Higher Education (The Paper Belt)?

Christian Terwiesch, A professor at the University of Pennsylvania’s Wharton school, one of the most prestigious US business schools, decided to test out how well GPT technologies like ChatGPT could do on one of his key course tests. To his surprise, ChatGPT did better than many of his students! He published a paper based on…
Lebanon MPs sit in as 11th vote for president fails

Two politicians have spent the night inside Lebanon’s parliament building to protest MP’s failure to elect a new president for the 11th time. The two, Najat Saliba and Melhem Khalaf refused to leave the chamber until after the latest round of voting. The outgoing president’s term ended on October 31 and a replacement should have…
CircleCI Confirms Data Breach Was Caused By Infostealer on Employee Laptop

CircleCI has confirmed that a data breach that impacted the integration and delivery platform was the result of an infostealer deployed to an employee’s laptop. The breach occurred on January 4, 2023 and the company identified the incident after detecting the presence of an unauthorized third party. The information stealer was used to steal a…
Fire at Armenian military barracks kills at least 15 people

A fire that broke out at a military unit in Azat village in Arminia’s province of Gegharkunik has killed at least 15 men and injured three. The fire in the eastern province broke out in the barracks of an engineer and sniper company of a military unit. The three men who were injured are in…
New Zealand PM quits citing burnout

Jacinda Ardern is quitting as the New Zealand prime minister before this year’s election. Ms Ardern stated the six challenging years on the job had taken a toll. The announcement comes as polling indicates that her party, the Labour Party faces a difficult path to re-election in October. Labor members of Parliament will vote to…
Russia’s Ukraine War Drives 62% Slump in Stolen Cards

Recorded Future has released a report that describes how the Russian invasion of Ukraine in early 2022 led to a 62% decrease in stolen payment card records. The records were later published to the dark web on cybercrime underground forums. The report details all payment fraud trends and information from 2022. Recorded future stated that…
Website of Canadian Liquor Distributor LCBO Infected With Web Skimmer

Liquor Control Board of Ontario (LCBO), a Canadian liquor distributor, has announced that it fell victim to a web skimmer that was injected into its online store. The skimmer was used by malicious actors to steal personal information belonging to customers of the site. LCBO is a major distributor of alcoholic beverages in Ontario, boasting…
Pakistan PM seeks India talks on ‘burning issues such as Kashmir’

The Pakistan Prime Minister Shehbaz Sharif has called for talks with India to discuss burning issues and has asked the United Arab Emirates to play a role in dissolving the tensions between the two countries. Last week, Sharif visited the UAE and termed it a brotherly country. He has stated that Pakistan will talk to…
Russia’s Wagner Group commander requests Norway asylum

A previous commander in the Russian paramilitary Wagner Group has claimed asylum in Norway after deserting from the group. Andrey Medvedev crossed the border into Norway last Friday and was detained by border guards. He is currently being held in Oslo where he faces charges of illegal entry into Norway. His lawyer says that Medvedev…
Euro Police Bust Multimillion-Dollar Crypto Fraud Gang

European law enforcement agencies collaborated to take down a multimillion dollar cryptocurrency fraud group, making multiple arrests last week. The operation was coordinated by Europol and targeted individuals associated with a large scale cryptocurrency investment fraud scheme. Those arrested include 14 individuals in Serbia and one in Germany, as well as 261 additional individuals questioned…
Illegal Crypto Transaction Volumes Hit All-Time High

According to recent reporting by blockchain analysis company Chainalysis, over $20 billion worth of illegal transactions were conducted using cryptocurrency last year. The record numbers are expected to get even higher as more illicit activity is uncovered by security research teams. Chainalysis works with law enforcement agencies and the government to trace cryptocurrency transactions. In…
German defense minister resigns after blunders

Germany’s Defense Minister Christine Lambrecht has resigned after a series of mistakes and PR disasters. Her resignation comes during a time of increasing pressure on Berlin to allow the delivery of German-built battle tanks to Ukraine. Lambrecht was mocked after her announcement that Germany would support Ukraine by sending them 5,000 military helmets. She was…
Russian Turla Cyberspies Leveraged Other Hackers’ USB-Delivered Malware

Russian state-sponsored threat actor Turla has been identified leveraging Andromeda malware to attack Ukrainian organizations. The malware was likely deployed by other hackers through an infected USB drive. Mandiant detailed the attack in a recent report, stating that the attack was conducted in September 2022. Turla has been active since at least 2006 and is…
Millions of Insurance Customers Compromised Via Supplier

Aflac and Zurich have confirmed that millions of customers located in Japan were impacted after a third-party contractor used by both of the insurance multi-nationals was breached. Customer details were allegedly put up for sale after the incident. Although the breached supplier has not been named, Japanese media outlets claim that the company is based…
UK Schools Hit by Mass Leak of Confidential Data

Following a cyberattack that occurred in 2022, confidential data from 14 different UK schools has been leaked online by the hackers allegedly behind the breach. The information exposed includes children’s SEN information, passport scans, staff pay scales, and staff contract details. The information was reportedly leaked after the schools impacted by the attack refused to…