Category Archives: Terror

China Warning to America, Prepare to Live off the Land

Posted on by

It is a major cyber attack discovered by Microsoft. It was discovered while we were all watching that ‘silly spy balloon’ as Biden called it. The attack is called Volt Typhoon, so be on notice America. The Biden White House has said nothing….

Microsoft has uncovered stealthy and targeted malicious activity focused on post-compromise credential access and network system discovery aimed at critical infrastructure organizations in the United States. The attack is carried out by Volt Typhoon, a state-sponsored actor based in China that typically focuses on espionage and information gathering. Microsoft assesses with moderate confidence that this Volt Typhoon campaign is pursuing development of capabilities that could disrupt critical communications infrastructure between the United States and Asia region during future crises.

Volt Typhoon has been active since mid-2021 and has targeted critical infrastructure organizations in Guam and elsewhere in the United States. In this campaign, the affected organizations span the communications, manufacturing, utility, transportation, construction, maritime, government, information technology, and education sectors. Observed behavior suggests that the threat actor intends to perform espionage and maintain access without being detected for as long as possible.

To achieve their objective, the threat actor puts strong emphasis on stealth in this campaign, relying almost exclusively on living-off-the-land techniques and hands-on-keyboard activity. They issue commands via the command line to (1) collect data, including credentials from local and network systems, (2) put the data into an archive file to stage it for exfiltration, and then (3) use the stolen valid credentials to maintain persistence.

***

Dark Reading in part published the following:

China-sponsored threat actors have managed to establish persistent access within telecom networks and other critical infrastructure targets in the US, with the observed purpose of espionage — and, potentially, the ability down the line to disrupt communications in the event of military conflict in the South China Sea and broader Pacific.

The first signs of compromise emerged in telecom networks in Guam, according to a New York Times report ahead of the findings being released. The National Security Agency discovered those intrusions around the same time that the Chinese spy balloon was making headlines for entering US airspace, according to the report. It then enlisted Microsoft to further investigate, eventually uncovering a widespread web of compromises across multiple sectors, with a particular focus on air, communications, maritime, and land transportation targets.

A Shadow Goal? Laying Groundwork for Disruption

The discovery of the activity is playing out against the backdrop of the US’ frosty relations with Beijing; the two superpowers have stalled in their diplomacy since the shooting down of the balloon, and has worsened amidst fears that Russia’s invasion of Ukraine could spur China to do the same in Taiwan.

In the event of a military crisis, a destructive cyberattack on US critical infrastructure could disrupt communications and hamper the country’s ability to come to Taiwan’s aid, the Times report pointed out. Or, according to John Hultquist, chief analyst at Mandiant Intelligence – Google Cloud, a disruptive attack could be used as a proxy for kinetic action.

“These operations are aggressive and potentially dangerous, but they don’t necessarily indicate attacks are looming,” he said in an emailed statement. “A far more reliable indicator for [a] destructive and disruptive cyberattack is a deteriorating geopolitical situation. A destructive and disruptive cyberattack is not just a wartime scenario either. This capability may be used by states looking for alternatives to armed conflict.”

Andersen Air Force Base in Yigo, Guam Anderson Air Foce Base/source

Dubbing such preparations “contingency intrusions,” he added that China is certainly not alone in conducting them — although notably, China-backed APTs are typically far more focused on cyber espionage than destruction.

“Over the last decade, Russia has targeted a variety of critical infrastructure sectors in operations that we do not believe were designed for immediate effect,” Hultquist noted. “Chinese cyber threat actors are unique among their peers in that they have not regularly resorted to destructive and disruptive cyberattacks. As a result, their capability is quite opaque.”

An Observed Focus on Stealth & Spying

To achieve initial access, Volt Typhoon compromises Internet-facing Fortinet FortiGuard devices, a popular target for cyberattackers of all stripes (Microsoft is still examining how they’re being breached in this case). Once inside the box, the APT uses the device’s privileges to extract credentials from Active Directory account and authenticate to other devices on the network. Read more here. 

The Iran Nuclear Facility Deep Deep Underground

Posted on by

It has long been declared by the mullahs of Iran that their nuclear development operation was only for peaceful purposes. Well then why hide it? Associated Press did some good reporting that many other news outlets picked up. This should change the newly formed relationships now in the Middle East and those European leaders need a sobering and honest rethink of Iran.

DUBAI, United Arab Emirates (AP) — Near a peak of the Zagros Mountains in central Iran, workers are building a nuclear facility so deep in the earth that it is likely beyond the range of a last-ditch U.S. weapon designed to destroy such sites, according to experts and satellite imagery analyzed by The Associated Press.

The photos and videos from Planet Labs PBC show Iran has been digging tunnels in the mountain near the Natanz nuclear site, which has come under repeated sabotage attacks amid Tehran’s standoff with the West over its atomic program.

With Iran now producing uranium close to weapons-grade levels after the collapse of its nuclear deal with world powers, the installation complicates the West’s efforts to halt Tehran from potentially developing an atomic bomb as diplomacy over its nuclear program remains stalled.

Completion of such a facility “would be a nightmare scenario that risks igniting a new escalatory spiral,” warned Kelsey Davenport, the director of nonproliferation policy at the Washington-based Arms Control Association. “Given how close Iran is to a bomb, it has very little room to ratchet up its program without tripping U.S. and Israeli red lines. So at this point, any further escalation increases the risk of conflict.”

The construction at the Natanz site comes five years after then-President Donald Trump unilaterally withdrew America from the nuclear accord. Trump argued the deal did not address Tehran’s ballistic missile program, nor its support of militias across the wider Middle East.

But what it did do was strictly limit Iran’s enrichment of uranium to 3.67% purity, powerful enough only to power civilian power stations, and keep its stockpile to just some 300 kilograms (660 pounds).

Since the demise of the nuclear accord, Iran has said it is enriching uranium up to 60%, though inspectors recently discovered the country had produced uranium particles that were 83.7% pure. That is just a short step from reaching the 90% threshold of weapons-grade uranium.

As of February, international inspectors estimated Iran’s stockpile was over 10 times what it was under the Obama-era deal, with enough enriched uranium to allow Tehran to make “several” nuclear bombs, according to the head of the International Atomic Energy Agency.

President Joe Biden and Israel’s prime minister have said they won’t allow Iran to build a nuclear weapon. “We believe diplomacy is the best way to achieve that goal, but the president has also been clear that we have not removed any option from the table,” the White House said in a statement to the AP.

DUBAI, United Arab Emirates (AP) — Near a peak of the Zagros Mountains in central Iran, workers are building a nuclear facility so deep in the earth that it is likely beyond the range of a last-ditch U.S. weapon designed to destroy such sites, according to experts and satellite imagery analyzed by The Associated Press.

The photos and videos from Planet Labs PBC show Iran has been digging tunnels in the mountain near the Natanz nuclear site, which has come under repeated sabotage attacks amid Tehran’s standoff with the West over its atomic program.

US bombs unlikely to reach underground Iran nuclear site: Report | Nuclear Energy News | Al Jazeera source

With Iran now producing uranium close to weapons-grade levels after the collapse of its nuclear deal with world powers, the installation complicates the West’s efforts to halt Tehran from potentially developing an atomic bomb as diplomacy over its nuclear program remains stalled.

Completion of such a facility “would be a nightmare scenario that risks igniting a new escalatory spiral,” warned Kelsey Davenport, the director of nonproliferation policy at the Washington-based Arms Control Association. “Given how close Iran is to a bomb, it has very little room to ratchet up its program without tripping U.S. and Israeli red lines. So at this point, any further escalation increases the risk of conflict.”

The construction at the Natanz site comes five years after then-President Donald Trump unilaterally withdrew America from the nuclear accord. Trump argued the deal did not address Tehran’s ballistic missile program, nor its support of militias across the wider Middle East.

But what it did do was strictly limit Iran’s enrichment of uranium to 3.67% purity, powerful enough only to power civilian power stations, and keep its stockpile to just some 300 kilograms (660 pounds).

Since the demise of the nuclear accord, Iran has said it is enriching uranium up to 60%, though inspectors recently discovered the country had produced uranium particles that were 83.7% pure. That is just a short step from reaching the 90% threshold of weapons-grade uranium.

As of February, international inspectors estimated Iran’s stockpile was over 10 times what it was under the Obama-era deal, with enough enriched uranium to allow Tehran to make “several” nuclear bombs, according to the head of the International Atomic Energy Agency.

President Joe Biden and Israel’s prime minister have said they won’t allow Iran to build a nuclear weapon. “We believe diplomacy is the best way to achieve that goal, but the president has also been clear that we have not removed any option from the table,” the White House said in a statement to the AP.

The Islamic Republic denies it is seeking nuclear weapons, though officials in Tehran now openly discuss their ability to pursue one.

Iran’s mission to the United Nations, in response to questions from the AP regarding the construction, said that “Iran’s peaceful nuclear activities are transparent and under the International Atomic Energy Agency safeguards.” However, Iran has been limiting access for international inspectors for years.

Iran says the new construction will replace an above-ground centrifuge manufacturing center at Natanz struck by an explosion and fire in July 2020. Tehran blamed the incident on Israel, long suspected of running sabotage campaigns against its program.

Tehran has not acknowledged any other plans for the facility, though it would have to declare the site to the IAEA if they planned to introduce uranium into it. The Vienna-based IAEA did not respond to questions about the new underground facility.

The new project is being constructed next to Natanz, about 225 kilometers (140 miles) south of Tehran. Natanz has been a point of international concern since its existence became known two decades ago.

Protected by anti-aircraft batteries, fencing and Iran’s paramilitary Revolutionary Guard, the facility sprawls across 2.7 square kilometers (1 square mile) in the country’s arid Central Plateau.

usaf gbu57 bomb 3D Model in Projectiles 3DExport Details and source here

Bunker buster developed in the United States, which would take several to deal with this hidden nuclear facility.

There is Never Going to be Adequate Consequences for Putin

Posted on by

The list is long…his war crimes in Syria…his approval for poisoning dissidents and the blasting of a passenger airliner out of the sky…those are just a few.

MH17 probe links Putin to missile that brought down plane


DW: Prosecutors in The Hague said Wednesday that Russian leader Vladimir Putin approved the transfer of missiles to Russian-backed rebel forces in eastern Ukraine who were later responsible for shooting down Malaysian Airlines flight MH17.

MH17 was struck down by a BUK missile over eastern Ukraine on July 17, 2014 as it flew from Amsterdam to Kuala Lumpur. All 298 people on board MH17 died.

The Missile Launcher that Shot Down MH17 - War on the Rocks source

Investigators in the Netherlands said there were “strong indications” based on intercepted phone calls that Putin had personally approved the weapons transfers to its proxy forces in the east of Ukraine.

Russia has long denied any involvement despite a mounting body of evidence to the contrary.

Despite the evidence, the probe is being halted as “all leads have been exhausted” and no further prosecutions could go forward.

The latest announcement comes weeks after a Dutch court convicted two Russians and a Ukrainian of mass murder for the loss of life aboard the flight.

What did investigators say?

In a statement, the Joint Investigation Team of six nations probing the incident said, “There are strong indications that the Russian president decided on supplying the Buk TELAR to the DPR (Donetsk People’s Republic) separatists.”

The Joint Investigation Team consists of investigators from the Netherlands, Australia, Belgium, Ukraine and Malaysia.

Investigators also said Russian officials were said to have delayed a decision on whether or not to send weapons to its proxy forces in the east of Ukraine while Putin was at a D-Day commemoration in France in June of 2014.

They played a recorded conversation of an aide who said, “There is only one who makes a decision,” later adding, “the person who is currently at a summit in France,” a reference to Putin.

As head of state, however, Putin enjoys immunity, investigators noted. They also hedged and suggested that “although we speak of strong indications, the high bar of complete and conclusive evidence is not reached.”

MH17 flight debris on fire in a field in Ukraine
Investigators said all investigatiive avenues in the deadly incident had been exhaustedImage: Dmitry Lovetsky/AP/dpa/picture alliance

Previously, investigators sought to name those responsible for firing the BUK missile that brought down MH17 and those whose responsibility extends to the chain of command. However, investigators conceded there were few avenues left to investigate the catastrophe.

In 2019, investigators released phone calls showing contact between Russian proxy forces occupying part of eastern Ukraine and a Kremlin aide at the time, Vladislav Surkov.

Dutch prosecutor Digna van Boetzelaer told a news conference, “The investigation has now reached its limit, all leads have now been exhausted, the investigation is therefore being suspended.”

The BUK missile that took out the Malaysian Airlines flight was brought from a Russian military base located in the city of Kursk.

Victims of MH17 came from 10 countries, with 196 Dutch, 43 Malaysians and 38 Australian residents on board at the time of the missile strike.

Australia vows to hold Russia accountable

Australia pledged to hold Russia accountable for shooting down Malaysia Airlines flight MH17, after a team of international investigators halted its probe into the disaster.

Australian Foreign Minister Penny Wong and Attorney-General Mark Dreyfus said Russia had repeatedly tried to thwart the investigation, making it “impossible” to collect proof.

However, they added that Australia would “hold Russia to account for its role in the downing of the civilian aircraft.”

ar/jcg (AFP, AP, dpa, Reuters)

 

Now Ukraine Militarily has to Battle both Russia and Iran

Posted on by

With credit in part to Bellingcat:

In the early hours of Monday, 10 October 2022, Russia pummelled Ukraine’s largest cities with missiles killing at least 20 people and wounding more than 100, according to Ukraine’s national emergency service. Russia has boasted about the surgical precision of its cruise missiles and claimed the attacks on 10 October targeted Ukraine’s military, security command centres and the national energy grid. However, open-source evidence shows that multiple missiles struck non-military targets, damaging residential buildings and hitting kindergartens and playgrounds.

The 10 October attacks marked Russia’s largest coordinated missile strikes since the beginning of the war. Yet the destruction didn’t end there. Missile strikes continued the next day with at least 28 launched on 11 October. The strikes left large numbers of civilians in Kyiv, Lviv, Vinnytsia, and Dnipro with no or sporadic access to electricity.

Cruise missile attacks on Ukraine’s energy infrastructure continued into a second week on 17 October 2022, when Ukraine reported shooting down three cruise missiles flying towards Kyiv. On the morning of 18 October, new missile attacks were reported in at least three cities leaving some of them with no electricity. As of 18 October 2022, international prosecutors were investigating the targeting of civilian buildings and critical civilian infrastructure as potential war crimes.

Remnants of a Kalibr missile found near impact craters on 10 October in Konotop, Ukraine, (Source: Ukraine’s Defence Ministry). The fuselage wreckage shows the Kalibr’s tell-tale black broken stripes (top right image) and the bottom shows partly the 3M-14 inscription that adorns the weapon and can be seen in greater detail here).

Visual evidence and photographs of remains of the missiles show that many that were launched on 10 and 11 October 2022 were winged cruise missiles, of the sea-launched Kalibr (3M-14), the land-launched R-500 (9M728) for the Iskander system, and air-launched Kh-101 types. These missiles are touted by Russia as high-precision weapons that only destroy relevant military targets. However, since the start of Russia’s invasion, long-range cruise missiles have repeatedly destroyed civilian infrastructure and caused hundreds of civilian deaths and injuries – for example when a cruise missile hit residential areas in Odesa and Mykolaiv earlier this summer. More here.

Now enter the manifest relationship between Russia and Iran.

In late November, U.S. media outlets quoted unnamed intelligence sources as saying that, in early November, Iran and Russia reached a definitive agreement under which Russia will produce Iran-designed armed drones in Russia proper. The agreement builds on recent deals under which Iran has delivered several hundred drones to Russia, which Moscow has used in Ukraine, primarily against civilian infrastructure targets such as power plants and water supply facilities. Iran has also reportedly agreed to transfer unknown numbers of its short-range ballistic missiles to Russia, for use against similar targets. Most of the Iranian drones that are part of the production deal are known as loitering munitions, which are capable of circling the skies until a suitable target is identified, providing greater reaction time and flexibility in target selection. These single-use systems, which use mobile launch platforms, are inexpensive, easy to operate, and have minimal maintenance costs. Low airspeeds allow the drones to travel long distances, sometimes flying below the radars of Ukrainian air defense systems, to reach their targets. This low and slow approach, however, has allowed Ukrainian forces to intercept many of the drones with short-range air defense weapons like heavy machine guns and the German-produced Gepard.

Moscow’s turn toward Iran for armed drones confirms that Russia has previously underinvested in its uncrewed aerial system (UAS). Despite this, Russia maintains a large and capable industrial base, and the production deal will grant Moscow greater control over the manufacturing process and possibly allow it to expedite and increase production of these simple but effective weapons. An alternative Iranian drone production facility in Tajikistan, inaugurated by Iran’s Defense Minister in May 2022, has unknown production capacity, and much of that factory’s output may be destined for other recipients, such as Iran’s regional allies and other armed drone customers, such as Sudan and Ethiopia.

The financial terms of the production deal have not been reported, and likely constitute a mix of cash, in-kind payments, and other promises of assistance from Moscow. Both countries are subject to sweeping U.S. and European sanctions, and the extent to which Russia is able to provide Iran with hard currency payments for the drone production agreement is unclear. As an alternative, Iranian leaders may seek additional Russian assistance to boost their nuclear program. Maintaining Russia as a partner may also help in circumventing sanctions that hinder Iran’s ability to acquire components and other goods for its advanced weapons programs. Several days after the reported production deal was reached, a key Russian hardliner, Secretary of the National Security Council Nikolai Patrushev, visited Tehran. According to Iranian and Russian media, Patrushev discussed Western sanctions and “interference” against both Russia and Iran with his counterparts in Tehran. The more than two months of protests in Iran, during which Iranian authorities have killed more than 400 demonstrators, have derailed any realistic prospect for Iran to achieve sanctions relief through an agreement with the United States to resume full compliance with the 2015 multilateral Iran nuclear deal. Iran also undoubtedly is looking to Russia to keep forces in Syria – despite Russia’s urgent need for personnel to deploy to Ukraine – in order to ensure Syrian President Bashar al-Assad maintains his grip on power.

Yet, the production deal with Moscow also carries substantial risks for Tehran. On the one hand, Iranian leaders might see the deal as reducing their exposure to new sanctions because the drones would be produced in Russia, not Iran. On Friday, the Biden administration announced sanctions on three entities within the Russian military responsible for training and transfers related to Iranian drones. Russian and Iranian leaders assess that the United States and NATO have many more options to interdict Iranian deliveries of armed drones to Russia than they have options to interrupt production of the weapons inside the Russian Federation itself. However, U.S., European, and regional leaders view the drone production pact as a deepening of Iran’s involvement in the Ukraine conflict, and a demonstration of Iran’s emergence as a significant strategic threat capable of influencing a war in Europe. Iran’s active and direct support for the Russian war effort increases tensions between the United States and Iran. Iranian involvement in the Ukraine war may strengthen Binyamin Netanyahu’s arguments for increased joint retaliation against Iran between the U.S. and Israel. U.S. forces have struck Iranian targets and their proxies in Iraq and Syria in response to attacks against U.S. personnel. Direct action against Iran as a reaction to its support of Russia, however, is an escalatory step the U.S. is unlikely to take. Source is Soufan Intel.

Is Turkey About to Copy the Russian Invasion Plan?

Posted on by

Primer: Today as this is posted, the United States has an estimate 900 troops in Syria sharing bases with the Syrian Defense Force located in the Hassekeh and Raqqa provinces.

Erdogan does not seem to care, one NATO member country to another….

Turkey wants full control of key regions in Syria….sounds much like much like the selected oblasts in Ukraine that Russia works to control. Could it be that Iran is out of money and tired of Syria and has moved on to embellish their relationship with Moscow?

In Syria, Erdoğan is off to make war… "in the name of peace" - KEDISTAN source

FNC:

Turkey’s impending invasion of northern Syria likely results from “political reasons” rather than a national security need, and it remains unclear how officials will declare “mission success,” experts told Fox News Digital.

“This is a politically motivated military incursion rather than a sort of, you know, tactically sound or, you know, strategically oriented ambition,” Sinan Ciddi, an expert on Turkish domestic politics and foreign policy for the Foundation for Defense of Democracies, said. “The timing of this operation will have been much closer to the upcoming Turkish presidential election, so they can reap maximum political benefit out of it.”

Turkish President Recep Tayyip Erdogan last week ordered a series of airstrikes against Kurdish militias in northern Syria and vowed to order a land invasion of the territory as tensions surrounding border disputes peaked.

The Pentagon urged Turkey to stand down on its plan to invade Syria as U.S. officials warned that the operation could endanger U.S. troops in the country.

A spokesperson for the Turkish Embassy in Washington, D.C., told Fox News Digital that officials have “time and again pointed out threats against our national security, posed by the PKK/YPG terrorist network in Syria and Iraq.”

“We have always called for unequivocal and genuine solidarity in the face of terrorism in all its forms and manifestations,” the spokesperson said. “Notwithstanding, the terrorist organization continued its attacks, recently targeting innocent civilians in the heart of Istanbul.”

The spokesman pointed to Turkey’s commitment to help fight DAESH – the Arabic name for ISIS – and is “the only NATO ally that has put boots on the ground and fought DAESH chest-to-chest since the outset,” even though U.S. officials have warned that the invasion could lead to the release of detained ISIS members.

Sinam Sherkany Mohamad, the representative of the Syrian Democratic Council mission in the U.S., said that democratic forces – located in northern and eastern Syria – remain prepared for the invasion but “hope it will not happen.”

“We don’t want war, we don’t want to create another conflict zone in the region,” Mohamad said. “We already, as Syria, suffered a lot [in] 12 years from the Syrian crisis, so we don’t want to create another conflict zone or a war in the region that is not in the interest of anyone, neither the United States nor Syrian nor Turkey.”

“We hope that the international community and the main powers, like Russia and the United States, could stop us from [facing] any ground invasion in the coming [days and weeks],” she added.

Mohamad praised the U.S. efforts to pressure Turkey to prevent the invasion from happening, echoing concerns for U.S. troop safety, and she urged U.S. officials to consider sanctions against Turkey should Erdogan authorize the invasion.

“There are many mechanisms that the U.S. administration can do to prevent Turkey from this ground invasion,” she said, stressing that any invasion would result in a “humanitarian catastrophe” with millions of displaced people.