Next week, on May 30th the NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE) opens the 10th International Conference on Cyber Conflict, CyCon 2018. The anniversary event focuses on the theme of maximising effects in the cyber domain.
↧
The 10th CyCon Starts Next Week
↧
The 10th CyCon Starts Next Week
↧
↧
The 10th CyCon Hosts 700 Cyber Experts in Tallinn
↧
CyCon 2019 Theme is Silent Battle in Cyber Space
↧
Romania to Join the NATO Cooperative Cyber Defence Centre of Excellence in Tallinn
The Prime Minister of Romania, Mrs. Viorica Dăncilă, announced today during her visit to Estonia that Romania looks forward to joining NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE) in 2019. NATO-accredited cyber defence hub in Tallinn welcomes the decision of Romania to become another NATO Ally to join the Centre.
↧
↧
Colonel Jaak Tarien to Become Director of the NATO Cooperative Cyber Defence Centre of Excellence
As of 1 September 2018 Colonel Jaak Tarien, former Commander of Estonian Air Force for the past six years, will assume the role of Director of the NATO Cooperative Cyber Defence Centre of Excellence based in Estonia.
Merle Maigre, current Director of CCDCOE, will take on a new challenge in September by joining CybExer Technologies, an Estonian cyber security company which is rapidly expanding its operations both in Estonia and abroad.
↧
Colonel Jaak Tarien assumes command of NATO CCDCOE
Colonel Jaak Tarien, until recently the long-term Commander of Estonian Air Force, assumed today from Merle Maigre the role of Director of the NATO Cooperative Cyber Defence Centre of Excellence based in Tallinn.
↧
CyCon 2019 Papers are Expected by 1 October
The Call for CyCon 2019 Papers is open until 1 October 2018. The theme for the eleventh International Conference on Cyber Conflict, hosted by the NATO Cooperative Cyber Defence Centre of Excellence, is ‘Silent Battle’. CyCon 2019 will take place in Tallinn, Estonia, from 28 to 31 May 2019.
The International Conference on Cyber Conflict, CyCon, is entering its second decade. Throughout the years, CyCon has established itself as a prominent multidisciplinary conference, introducing keynotes and panels focusing on the technical, legal, policy, strategy and military perspectives of cyber defence and security. This is undoubtedly thanks to the amount of high-quality original academic research presented at the conference. In 2018, the Academic Review Committee selected 22 articles that were presented at the conference and published in the proceedings.
↧
NATO CCDCOE brings improvement through practice
The NATO Cooperative Cyber Defence Centre of Excellence contributes this week to the setup and organisation of NATO’s largest cyber exercise Cyber Coalition 2018 taking place in Tartu, Estonia. This year, the experts of the Centre contributed to the operational and legal part of the exercise scenario, adding respective challenges to the participating cyber experts across the Alliance.
↧
↧
New Study by the CCDCOE: Cyber Security Organisation in Turkey
New Study by the CCDCOE: Cyber Security Organisation in Turkey
A recent report by NATO CCDCOE “National Cyber Security Organisation: Turkey” outlines the current cyber security landscape in Turkey. Being the most recent issue of the NATO CCD COE’s National Cybersecurity Governance series, the report provides a comprehensive overview of the digital ecosystem in Turkey and describes the responsibilities of different national agencies designated to ensure the security in the cyberspace.
↧
Missing 4-year-old son, father found dead following Amber Alert - WFLA
FAO Schwarz has a new Amazon storefront just in time … Holiday / 2 days ... Breaking News. SIGN UP NOW. Submit. What Do You Think? Report Poll
↧
Why do people seem to love no love deep web so much : r/deathgrips - Reddit
Out of all the albums in death grips discography no love deep web has always been kinda the outlier for me weirdly it just didn't click for me ...
↧
A suspected ISIS fighter was allowed to claim asylum and live in a hotel at your expense. He ...
Nigel Farage: A suspected ISIS fighter was allowed to claim asylum and live in a hotel at your expense. He crossed the Channel in a dinghy and now ...
↧
↧
Inside Al-Qaeda and the Taliban: Beyond Bin Laden and 9/11 - Google Books
President Obama may have delivered on his campaign promise to kill Osama bin Laden, but as an Al-Qaeda strategist bin Laden has been dead for ...
↧
AI boom propels Chinese semiconductor exports to record $44.95 billion - Cybernews
03 Chips now make up nearly one-tenth of China's exports and exceed auto and mobile phone exports. ... hacking, and digital privacy. With 12 years of ...
↧
How to watch and stream Iron Winter - 2025 on Roku
Down the Deep, Dark Web. Dark Web Exposed. The Descendant of Wing Chun. The Dark Web: The Candyman. The Dark Web: The Queen of Sextortion. The Last ...
↧
State Security arrested a Syrian over affiliation with Daesh
On October 20, the State Security General Directorate arrested three Syrian nationals over affiliation to Daesh terrorist organization. The ...
↧
↧
oilandgas #energymarketing #youngprofessional #midnightmarketing #energyindustry #marketing
Transcript. Hey guys, I'm Isis with Midnight Marketing and welcome back to the series of things I've learned as an early professional and the energy ...
↧
American Nuclear Power Barge Startup Buys its First Uranium Fuel - The Maritime Executive
That part of the regulatory process will involve both the Department of Energy and the U.S. Coast Guard, within their respective areas of expertise.
↧
Meta GitHub Repositories Compromised, Exposing Software Code and Employee Personal Data
Meta is offering affected individuals credit monitoring and dark web monitoring services and is notifying regulators. ... What is Deep Web The deep web, ...
↧
New book investigates unsolved 1984 murder in Lebanon - CNN
Will ISIS attacks spread to U.S.? 1:49. Now playing. • Source: CNN. A picture taken from the Israeli border with the Gaza Strip shows smoke billowing ...
↧
↧
Amy Poehler's DIG Adds Michael Schur Alumni, Miranda Cosgrove Joins Abbott Elementary
... dark web of power, luxury and the crosshairs of a seductive killer who knows her secrets." Duplass will play William Holbrook, "a brilliant UC ...
↧
Three Years After October 7, Israelis Parallel Americans' Post-9/11 Mood Swings
By 2004, America had crushed al-Qaeda– although Osama bin Laden would roam free until 2011. American forces had ousted the Taliban in Afghanistan and ...
↧
EIIL, EI, Daesh, Organisation de l'Etat Islamique - quelle terminologie pour le groupe ...
L'Elysée utilise désormais un acronyme, Daesh, en lieu et place d'Etat Islamique, comme se désignent ces jihadistes.
↧
LEDGER EXPANDS ITS PRECAUTIONARY SALES-HALT REQUEST TO SEVEN ASIAN ...
Dark Web Intelligence · @DailyDarkWeb. UPDATE: LEDGER EXPANDS ITS PRECAUTIONARY SALES-HALT REQUEST TO SEVEN ASIAN MARKETS Follow-up to our ...
↧
↧
DOJ to defer prosecution against ex-CIA analyst in South Korea spy case - YouTube
Read more: https://www.usatoday.com/story/news/nation/2026/10/14/sue-mi-terry-south-korea ... A rare look inside a suspected cell of covert North Korean ...
↧
Explainer: STFC multidisciplinary facilities prioritisation update October 2026 - UKRI
This will enable ISIS to continue to play a leading role in enabling scientific discovery, supporting industry and developing future technologies.
↧
AI-armed hackers tear through corporate Japan's neglected defences
... cybersecurity firm Macnica's Security Research Centre, noting ... China's militaryTrending in China. Focus. Greater Bay Area. We use cookies ...
↧
B.C. Conservative campaign director under fire for social posts will stay on, Doerkson says
“Her Twitter feed reads like the worst corners of the dark web,” Eby said. It launched a lengthy back and forth between Eby and Doerkson about ...
↧
↧
Taiwanese, Korean firms eye Japan grid storage market with China locked out - Nikkei Asia
Starting next April, the Japanese government will require equipment connected to the power grid to obtain JC-STAR cybersecurity certification. For ...
↧
New Zealand to Help Fiji Overhaul Intelligence Agencies - USNews.com
... China-linked cyber intrusions highlight concerns about vulnerabilities in the Pacific island nation. Cabinet approved a six-month partnership ...
↧
North Korea says it tested submarine-launched cruise missiles, KCNA says | Reuters
North Korea said it had tested two types of ... cyber intrusions highlight concerns about vulnerabilities in the Pacific island nation.
↧
Three B.C. party leaders face off in only televised debate of election - Castanet.net
... , with NDP Leader David Eby swiftly focusing on messages coming from the B.C. Conservative camp that "read like the worst corners of the dark web."
↧
↧
How Non-State Alliances Are Reshaping The Global Order - Analysis - Eurasia Review
... Al-Shabaab, Islamic State in Somalia ... Al Qaeda's persistence despite decades of US pressure demonstrates the resilience of these groups.
↧
Massive sinkhole nearly swallows van on residential street in Los Feliz after water main break - ABC7
Amber Alert issued for 9-month-old girl last seen with woman in Westlake. In 2 hours. The cause of the water main break was unknown. Report a ...
↧
Isis-Abrahel - sonido original - TikTok
Canción sonido original creada por Isis-Abrahel. Mira los vídeos más recientes de sonido original en TikTok.
↧
Dark Web Intelligence on X: " UPDATE: CISA ADDS EXPLOITED AHSAY CBS AUTH ...
Dark Web Intelligence · @DailyDarkWeb. UPDATE: CISA ADDS EXPLOITED AHSAY CBS AUTH BYPASS + COMMAND INJECTION CHAIN TO KEV (CVE-2026-105133, CVE ...
↧
↧
Missing 4-year-old son and father found dead following Amber Alert - NewsNation
4-year-old Andres 'Harry' Furley, and his father have been found deceased after an Amber Alert was issued for their disappearance Tuesday evening.
↧
Massive Cyber Attack Threatens Release of Data from 38 Maritime Companies
Massive Cyber Attack Threatens Release of Data from 38 Maritime Companies. cyberattack A total of 38 companies appear caught up in the current attack ...
↧
First Alert Weather: Temps drop and sun returns on Thursday - CBS New York
CBS News New York's Scott Padgett is calling for showers on Friday and then a big temperature drop on Saturday under sunny and dry conditions.
↧
Cyberattacks surge as stolen Japanese data appears on dark web - YouTube
Our investigation finds images of Japanese driver's licenses listed for sale on the dark web, as the government urges businesses to strengthen ...
↧
↧
Women's Soccer vs Cal Poly on 10/14/2026 - Box Score - CSUN Athletics
FOR CPM: , #99 Porubski, Shannon, #2 Nunes, Kate, #6 Franklin, Farra, #8 Cole, Lilly, #10 Salazar-Ortega, Isis, #13 Collier, Lauren, #16 Urzua ...
↧
North Korea and China Open Their Biggest Border Bridge - The New York Times
North Korea has largely accomplished the latter through illicit means such as smuggling, sending workers overseas, cyber operations and cryptocurrency ...
↧
New bill would expand outbound inspections targeting cartel trafficking in US - High Point Enterprise
Drug Cartel· Smuggling · Illegal Drug Trade · Bill (law) · Inspection · Mexico · United States · First Presidency Of Donald Trump · United States ...
↧
New four-lane bridge between China and North Korea opens after a decade of delay
Hacker Hunter · Rethink · Sci-Tech. Featured. Euronews Tech Talks. Euronews ... North Korean side, South Korea's Yonhap news agency reported. North ...
↧
↧
U.S. Shuts Down Over 40 Laptop Farms, Charges 14 in North Korean IT Worker Fraud
Zhang Li Ping, age unknown, unknown location; Yu Yang, 40, age unknown ... In tandem, the U.S. Federal Bureau of Investigation (FBI) has issued an alert ...
↧
Massive Cyber Attack Threatens Release of Data from 38 Maritime Companies
In addition to agencies supporting shipping operations, it also reaches into related businesses, including Chinese crane manufacturer ZPMC. Not a lot ...
↧
Nearly one million Iraqis remain displaced as obstacles persist: UN - The New Region
Ali Abbas, spokesperson for Iraq's migration and displaced ministry, told The New Region that the displaced families fled after ISIS ... US-led ...
↧
Nearly one million Iraqis remain displaced as obstacles persist: UN - The New Region
ERBIL, Kurdistan Region of Iraq – Nearly one million people remain displaced across Iraq nearly a decade after the Islamic State (ISIS) was ...
↧
↧
Russia and China are using AI to stage relentless cyberattacks against the UK
AI is helping to boost the cyberattack abilities of both Russia and China. GREG BAKER/AFP. Russia and China are staging “relentless” cyberattacks ...
↧
Russia and China are using AI to stage relentless cyberattacks against the UK
Paul Chichester, director of operations at the National Cyber Security Centre (NCSC) – the government department tasked with securing the nation's IT ...
↧
Beyond firewalls: Singapore's cyber playbook for Korean banks - The Korea Herald
Singapore's response to major telecom cyberattack highlights value of constant monitoring and rapid intervention as Korean banks confront security ...
↧
Hirudo Android Trojan Replaces Banking Apps to Steal Credentials
Android trojan Hirudo replaces genuine banking apps with modified versions to steal credentials and bypass security checks, enabling financial fraud.
ThreatFabric researchers detailed a new Android banking trojan called Hirudo that takes a genuinely different approach to defeating banking security. Instead of throwing a fake login screen over the real app, it uninstalls the real app and puts a modified copy in its place.
“What sets it apart is the lengths its operators go to once a bank is in their sights: rather than overlaying a fake screen on top of the genuine banking app, Hirudo attempts to replace the banking app itself with a modified copy that quietly disables the bank’s own security checks from the inside.” reads the analysis published by ThreatFabric.
Eight Indonesian banking apps from seven banks already have specially designed replacements ready. The malware’s credential-stealing code also targets users in Indonesia, China, India, Mexico, Morocco, and Thailand.
Hirudo is delivered as a second app hidden inside a convincing dropper. The dropper looks like a legitimate shopping app, short drama platform, or adult video service. It loads real content through a WebView to make the app look genuine. If it detects a banking app on the device and finds that Hirudo is not yet installed, it displays a fake in-app update prompt.
One dropper analysed by researchers goes a step further. During installation, it creates a deliberately broken VPN connection that cuts off the device’s internet access while Hirudo is installed. This does not fully bypass Google Play Protect, but ThreatFabric believes the technique is designed to weaken online reputation checks and code analysis while the malicious APK is being installed. Hirudo is then installed as a separate app from the dropper. Before it can carry out its malicious activities, it must obtain its own Accessibility and notification permissions.
When the payload detects a target banking app, it checks the app’s signing certificate against a stored reference, then shows a fake update prompt and immediately opens Android’s uninstaller without waiting for the user to tap confirm. It downloads the patched replacement in parallel.
“Hirudo keeps a registry of 42 financial apps, but only eight Indonesian apps, across seven banks, have dedicated replacement downloads. For these, the RAT detects the installed banking app through Accessibility, checks its signing certificate against a stored reference, then shows a fake “update” prompt.” reads the analysis. “It opens Android’s uninstaller for the genuine app without waiting for the user to tap, and downloads the bank-specific replacement in parallel.”
The replacement keeps the original package name and version number, but it’s signed with a public test key rather than the bank’s real certificate. Android won’t install it as an update over a properly signed app, which is why the original has to go first. That requirement is a real constraint: the victim can interrupt it. But if they don’t, what follows is clever enough to matter.
The bank’s original code remains almost unchanged. Only one line is added to the app’s Application class. This line loads a built-in hooking engine when the app starts. The engine uses two open-source frameworks: YAHFA to modify Java methods and Dobby to modify native functions. It activates only when it finds a trigger file created by the RAT on the device. Without this file, the modified banking app appears harmless.
Once activated, the engine runs inside the banking app and controls how it responds to security checks. If the app asks for its signing certificate, the engine returns the genuine one. If it checks which accessibility services are enabled, the engine returns an empty list. It also removes the flag that blocks screenshots, allowing the attacker to view and record the banking screen remotely.
Play Integrity checks are sent over plain HTTP to a server controlled by the operator, which returns an acceptable result. Researchers highlight two important points. First, the keybox used for attestation has been leaked publicly, and at least two of its certificates are already on Google’s revocation list. Second, a valid Play Integrity response does not prove that the app has not been tampered with. In this case, the response was relayed through the operator’s server rather than generated through a genuine integrity check.
The lures don’t spread through side-loaded APKs from shady forums. They’re served from Amazon CloudFront, tied to campaign tracking through OpenInstall attribution, and linked to Meta Pixel IDs connecting specific branding to specific campaign groups. Some download routes were still live through late September and into October 2026. The operator APK-processing panel, which rebuilds dropper and payload APKs into finished lures and patched banking apps, was reachable without authentication, with cloud storage buckets and credentials left exposed, a significant operational security failure that helped ThreatFabric map the operation.
Records from August 2026 included thousands of credential entries split across campaign groups, device records, lock-screen history, and financial profiles with monthly income and risk score fields. Operators annotated records they considered “phished,” which signals a workflow built to convert stolen data into actual fraud rather than just collect it.
ThreatFabric’s conclusion on the defensive side is worth reading directly: “once an app can be replaced, its locally produced signals — signature, accessibility list, integrity verdict — must be treated as attacker-influenced and verified server-side.” A valid Play Integrity verdict from a relayed request is not a green light. A clean accessibility list from a patched app is not evidence there’s no controlling service running. The signals the app produces locally are no longer trustworthy, and any bank relying on them as blockers rather than inputs to server-side risk scoring is running on assumptions this trojan was designed to exploit.
“Hirudo marks a deliberate escalation in how Android bankers approach hardened applications. By moving its tampering inside the target app, the operation shifts the contest from the device to the application’s own integrity checks, and from a bespoke patch to a reusable engine that can be retargeted at other apps and regions.” concludes the report. “The defensive conclusion is consistent across every capability we examined: signals produced locally by an app that may have been replaced cannot be trusted on their own.”
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Android malware)
↧
↧
China's top prosecutor arrests former Chengdu mayor suspected of bribery - Reuters
China's top prosecuting agency, the Supreme People's Procuratorate, has sought the arrest of the former mayor of Chengdu, Wang Fengchao, ...
↧
North Korea and China Open Their Biggest Border Bridge - The New York Times
The bridge connects the Chinese city of Dandong to Sinuiju, a North Korean city on the Yalu River that forms much of the border between the two ...
↧
New Zealand to help Fiji overhaul intelligence agencies | Reuters
... as US warnings of suspected China-linked cyber intrusions highlight concerns about vulnerabilities in the Pacific island nation.
↧
14 charged in Ohio over $3M IT worker conspiracy to fund North Korea
The FBI has issued an alert warning businesses about the hiring of fraudulent remote IT workers. ... Zhang Li Ping, age unknown, unknown location; Yu ...
↧
↧
Pinpoint Weather Alert Day issued for Thursday night - Denver - KDVR
Download our app — Radar, breaking news, live video · Live Traffic ... FAO Schwarz has a new Amazon storefront just in time … Holiday / 3 days ...
↧
US military weighs use of 'mother of all bombs' in future strikes on Iran: report - NY Post
John Nicholson, then-commander of US forces in Afghanistan, authorized the deadly strike as Trump praised the bombing of ISIS strongholds as a “very, ...
↧
El Paso fentanyl dealer who claimed cartel ties convicted in DEA case
A convicted El Paso fentanyl dealer faces five to 40 years in prison after a jury found him guilty on drug-trafficking charges at trial in U.S. ...
↧