😁😁😁

#Musk #Tesla #teslashares

Aside from GPUs, you don’t hear much about co-processors these days. [bitluni] perhaps missed those days, because he found a way to squeeze a 160 core RISC V supercluster onto a single m.2 board,and shared it all on GitHub.

OK, sure, each core isn’t impressive– he’s using CH32V003, so each core is only running at 48 MHz, but with 160 of them, surely it can do something? This is a supercomputer by mid-80s standards, after all. Well, like anyone else with massive parallelism, [bitluni] decided to try a raymarcher. It’s not going to replace RTX anytime soon, but it makes for a good demo.

Like his previous m.2 project, an LED matrix, the cluster is communicating over PCIe via a WCH CH382 serial interface. Unlike that project, blinkenlights weren’t possible: the tiny, hair-thin traces couldn’t carry enough power to run the cores and indicator LEDs at once. With the power issue sorted, the serial interface is the big bottleneck. It turns out this cluster can crunch numbers much faster than it can communicate. That might be a software issue, however, as the cluster isn’t using all of the CH382’s bandwidth at the moment. While that gets sorted there are low-bandwidth, compute-heavy tasks he can set for the cluster. [bitluni] won’t have trouble thinking of them; he has a certain amount of experience with RISCV microcontroller clusters.

We were tipped off to this video by [Steven Walters], who is truly a prince among men. If you are equally valorous, please consider dropping informational alms into ourever-present tip line.

youtube.com/embed/HRfbQJ6FdF0?…

hackaday.com/2025/07/07/160-co…

Introduction

Since early March 2025, our systems have recorded an increase in detections of similar files with names like договор-2025-5.vbe, приложение.vbe, and dogovor.vbe (translation: contract, attachment) among employees at various Russian organizations. The targeted attack begins with bait emails containing malicious links, sent under the pretext of signing a contract. The campaign began in July 2024 and is still ongoing at the time of publication. The main goal of the attack is to infect organizations with the previously unknown Batavia spyware, which then proceeds to steal internal documents. The malware consists of the following malicious components: a VBA script and two executable files, which we will describe in this article. Kaspersky solutions detect these components as HEUR:Trojan.VBS.Batavia.gen and HEUR:Trojan-Spy.Win32.Batavia.gen.

First stage of infection: VBS script

As an example, we examined one of the emails users received in February. According to our research, the theme of these emails has remained largely unchanged since the start of the campaign.

Example of an email with a malicious link

In this email, the employee is asked to download a contract file supposedly attached to the message. In reality, the attached file is actually a malicious link: https://oblast-ru[.]com/oblast_download/?file=hc1-[redacted].

Notably, the sender’s address belongs to the same domain – oblast-ru[.]com, which is owned by the attackers. We also observed that the file=hc1-[redacted] argument is unique for each email and is used in subsequent stages of the infection, which we’ll discuss in more detail below.

When the link is clicked, an archive is downloaded to the user’s device, containing just one file: the script Договор-2025-2.vbe, encrypted using Microsoft’s proprietary algorithm (MD5: 2963FB4980127ADB7E045A0F743EAD05).

Snippet of the malicious script after decryption

The script is a downloader that retrieves a specially crafted string of 12 comma-separated parameters from the hardcoded URL [strong]https://oblast-ru[.]com/oblast_download/?file=hc1-[redacted][/strong]&vput2. These parameters are arguments for various malicious functions. For example, the script identifies the OS version of the infected device and sends it to the attackers’ C2 server.

By accessing the address [strong]https://oblast-ru[.]com/oblast_download/?file=hc1-[redacted][/strong]&dd=d, the script downloads the file WebView.exe (MD5: 5CFA142D1B912F31C9F761DDEFB3C288) and saves it to the %TEMP% directory, then executes it. If the OS version cannot be retrieved or does not match the one obtained from the C2 server, the downloader uses the Navigate() method; otherwise, it uses Run().

Second stage of infection: WebView.exe

WebView.exe is an executable file written in Delphi, with a size of 3,235,328 bytes. When launched, the malware downloads content from the link [strong]https://oblast-ru[.]com/oblast_download/?file=[/strong]1[strong]hc1-[redacted]&view[/strong] and saves it to the directory C:\Users[username]\AppData\Local\Temp\WebView, after which it displays the downloaded content in its window. At the time of analysis, the link was no longer active, but we assume it originally hosted the fake contract mentioned in the malicious email.

At the same time as displaying the window, the malware begins collecting information from the infected computer and sends it to an address with a different domain, but the same infection ID: [strong]https://ru-exchange[.]com/mexchange/?file=[/strong]1[strong]hc1-[redacted][/strong]. The only difference from the ID used in the VBS script is the addition of the digit 1 at the beginning of the argument, which may indicate the next stage of infection.

The spyware collects several types of files, including various system logs and office documents found on the computer and removable media. Additionally, the malicious module periodically takes screenshots, which are also sent to the C2 server. To avoid sending the same files repeatedly, the malware creates a file named h12 in the %TEMP% directory and writes a 4-byte FNV-1a_32 hash of the first 40,000 bytes of each uploaded file. If the hash of any subsequent file matches a value in h12, that file is not sent again.

In addition, WebView.exe downloads the next-stage executable from [strong]https://oblast-ru[.]com/oblast_download/?file=[/strong]1[strong]hc1-[redacted][/strong]&de and saves it to %PROGRAMDATA%\jre_22.3\javav.exe. To execute this file, the malware creates a shortcut in the system startup folder: %APPDATA%\Microsoft\Windows\Start Menu\Programs\StartUp\Jre22.3.lnk. This shortcut is triggered upon the first device reboot after infection, initiating the next stage of malicious activity.

Third stage of infection: javav.exe

The executable file javav.exe (MD5: 03B728A6F6AAB25A65F189857580E0BD) is written in C++, unlike WebView.exe. The malicious capabilities of the two files are largely similar; however, javav.exe includes several new functions.

For example, javav.exe collects files using the same masks as WebView.exe, but the list of targeted file extensions is expanded to include these formats:

• Image and vector graphic: *.jpeg, *.jpg, *.cdr
• Spreadsheets: *.csv
• Emails: *.eml
• Presentations: *.ppt, *.pptx, *.odp
• Archives: *.rar, *.zip
• Other text documents: *.rtf, *.txt

Like its predecessor, the third-stage module compares the hash sums of the obtained files to the contents of the h12 file. The newly collected data is sent to [strong]https://ru-exchange[.]com/mexchange/?file=[/strong]2[strong]hc1-[redacted][/strong].
Note that at this stage, the digit 2 has been added to the infection ID.

Additionally, two new commands appear in the malware’s code: set to change the C2 server and exa/exb to download and execute additional files.

In a separate thread, the malware regularly sends requests to [strong]https://ru-exchange[.]com/mexchange/?[/strong]set[strong]&file=[/strong]2[strong]hc1-[redacted]&data=[xxxx][/strong], where [xxxx] is a randomly generated 4-character string. In response, javav.exe receives a new C2 address, encrypted with a 232-byte XOR key, which is saved to a file named settrn.txt.

In another thread, the malware periodically connects to [strong]https://ru-exchange[.]com/mexchange/?[/strong]exa[strong]&file=[/strong]2[strong]hc1-[redacted]&data=[xxxx][/strong] (where [xxxx] is also a string of four random characters). The server responds with a binary executable file, encrypted using a one-byte XOR key 7A and encoded using Base64. After decoding and decryption, the file is saved as %TEMP%\windowsmsg.exe. In addition to this, javav.exe sends requests to [strong]https://ru-exchange[.]com/mexchange/?[/strong]exb[strong]&file=[/strong]2[strong]hc1-[redacted]&data=[xxxx][/strong], asking for a command-line argument to pass to windowsmsg.exe.

To launch windowsmsg.exe, the malware uses a UAC bypass technique (T1548.002) involving the built-in Windows utility computerdefaults.exe, along with modification of two registry keys using the reg.exe utility.
add HKCU\Software\Classes\ms-settings\Shell\Open\command /v DelegateExecute /t REG_SZ /d "" /f

add HKCU\Software\Classes\ms-settings\Shell\Open\command /f /ve /t REG_SZ /d "%temp%\windowsmsg.exe <arg>"
At the time of analysis, downloading windowsmsg.exe from the C2 server was no longer possible. However, we assume that this file serves as the payload for the next stage – most likely containing additional malicious functionality.

Victims

The victims of the Batavia spyware campaign were Russian industrial enterprises. According to our telemetry data, more than 100 users across several dozen organizations received the bait emails.

Number of infections via VBS scripts, August 2024 – June 2025 (download)

Conclusion

Batavia is a new spyware that emerged in July 2024, targeting organizations in Russia. It spreads through malicious emails: by clicking a link disguised as an official document, unsuspecting users download a script that initiates a three-stage infection process on their device. As a result of the attack, Batavia exfiltrates the victim’s documents, as well as information such as a list of installed programs, drivers, and operating system components.

To avoid falling victim to such attacks, organizations must take a comprehensive approach to infrastructure protection, employing a suite of security tools that include threat hunting, incident detection, and response capabilities. Kaspersky Next XDR Expert is a solution for organizations of all sizes that enables flexible, effective workplace security. It’s also worth noting that the initial infection vector in this campaign is bait emails. This highlights the importance of regular employee training and raising awareness of corporate cybersecurity practices. We recommend specialized courses available on the Kaspersky Automated Security Awareness Platform, which help reduce employees’ susceptibility to email-based cyberattacks.

Indicators of compromise

Hashes of malicious files
Договор-2025-2.vbe
2963FB4980127ADB7E045A0F743EAD05
webview.exe
5CFA142D1B912F31C9F761DDEFB3C288
javav.exe
03B728A6F6AAB25A65F189857580E0BD

C2 addresses
oblast-ru[.]com
ru-exchange[.]com

securelist.com/batavia-spyware…

The 2025 Pirate National Conference is officially behind us! If you missed the conference, be sure to check out Parts 1 and 2 on our YouTube channel.

A special thanks to Birgitta Jónsdóttir and Sean Tobin for taking the time out of their days to deliver speeches and presentations.

With the conclusion of the conference and the tabulation of the results, we are pleased to present our new board:

Captain – Jolly Mitch Davilo
Vice Captain – Ty Clifford
Treasurer – Darren McKeeman
Scribe – Blase Henry
Lookout – Wanda Ward
Beancounter – Eli McGee
Swarmcare – Dustin Etts
Webadmin – Morgan Landry
Director of PR – Ryan Codine

and our inaugural YPUSA Captain – Rowan Tipping!

Thank you to everyone who participated in this year’s conference and contributed to the new look Pirate Party. We look forward to the upcoming year and the future of the USPP.

Congratulations to all the new board members!

CAPTAIN’S NOTE: I’m honored to be trusted with the keys to the ship. Thank you everyone for the vote of confidence. May the next year and coming years of the United States Pirate Party be fruitful.

Victory is Arrrs.

uspirates.org/a-new-board-elec…

La cooperazione internazionale è fondamentale per contrastare i traffici illeciti marittimi. Si tratta di fenomeni criminali spesso transnazionali che coinvolgono reti organizzate che sfruttano la complessità e la vastità degli spazi marittimi per eludere le autorità di uno o più Stati.

Solo attraverso un coordinamento efficace tra Paesi è possibile superare le difficoltà operative legate alla giurisdizione (come nel caso dell'inseguimento di navi sospette che attraversano acque territoriali diverse), e garantire una risposta tempestiva e coordinata alle minacce.

Inoltre, la cooperazione consente lo scambio di informazioni, la condivisione di intelligence e l’adozione di strategie comuni, elementi indispensabili per prevenire e reprimere efficacemente il traffico illecito, la pirateria e altre forme di criminalità organizzata marittima.

Il contrasto

La strategia per il contrasto ai traffici illeciti marittimi è portata avanti da diverse organizzazioni e istituzioni internazionali, nonché da coalizioni di Stati.

L’Unione Europea, che ha lanciato operazioni militari come la missione “Atalanta” per la lotta alla pirateria al largo delle coste somale, integrando attività di protezione, prevenzione e repressione.

Le Nazioni Unite, con strumenti giuridici come la Convenzione delle Nazioni Unite sul diritto del mare (#UNCLOS) che impone agli Stati l’obbligo di cooperare nella repressione della pirateria e di altri traffici illeciti marittimi.

Organizzazioni come l’ #IMO (Organizzazione Marittima Internazionale), che promuovono norme e fondi per la sicurezza marittima e la gestione dei danni ambientali legati a incidenti marittimi.

Coalizioni multilaterali e accordi bilaterali o trilaterali tra Stati costieri, come quelli in corso tra Francia, Italia e Spagna, per migliorare la cooperazione operativa e giuridica nella lotta ai traffici illeciti via mare.

La lotta ai traffici illeciti marittimi richiede una strategia multilivello e multilaterale, basata su un forte coordinamento internazionale che coinvolge istituzioni sovranazionali, Stati e forze di polizia marittime, per garantire sicurezza, legalità e tutela degli interessi economici e umanitari nel contesto globale

Rotte marittime per il traffico di droga

Il Rapporto Mondiale sulla Droga 2024 dell'Ufficio delle Nazioni Unite contro la Droga e il Crimine (#UNODC) rivela una preoccupante tendenza all'aumento delle rotte marittime per il traffico illecito di droga. Nello specifico, i sequestri di cocaina nei porti europei sono aumentati del 18% durante la pandemia di COVID-19, evidenziando la crescente dipendenza da sofisticati “narco-sottomarini” segreti, in grado di trasportare ingenti quantità di droga su lunghe distanze. Pochi giorni orsono la Marina colombiana ha sequestrato al largo del Mar dei Caraibi il primo drone subacqueo utilizzato dai narcotrafficanti: un semisommergibile autonomo senza equipaggio con tecnologia Starlink, probabilmente testato dal cartello Gulf Clan.

L’imbarcazione, lunga circa 10 metri, è stata trovata priva di carico, ma secondo le autorità colombiane rappresenta un prototipo sperimentale in fase di test. Il potente cartello Gulf Clan è già noto per l’impiego di tecnologia avanzata nelle sue rotte clandestine.

Questa tendenza si inserisce in un panorama più ampio di crimini marittimi che minacciano la sicurezza globale, tra cui pirateria, contrabbando di armi, tratta di esseri umani, traffico di migranti, pesca illegale e criminalità ambientale marittima. Questi crimini sono spesso perpetrati dalle stesse reti criminali transnazionali, evidenziando la necessità di un approccio globale per affrontare queste minacce.

In risposta a ciò, il Programma Globale sulla Criminalità Marittima (#GMCP) dell'UNODC fornisce un supporto fondamentale agli Stati membri attraverso iniziative di rafforzamento delle capacità. Le attività del programma prevedono la formazione specializzata per le squadre di interdizione, l'implementazione di tecnologie per la consapevolezza del dominio marittimo e la promozione della cooperazione transfrontaliera nelle indagini penali. Partendo da queste basi, il GMCP mira a istituire quadri sostenibili e basati sullo stato di diritto per l'individuazione, l'intercettazione, il perseguimento e il giudizio dei reati marittimi.

Nel 2024, il GMCP ha compiuto progressi significativi in ​​questo ambito, formando oltre 8.500 agenti in 109 paesi. Questo risultato sottolinea l'impegno del programma nell'aiutare gli Stati membri a rispondere efficacemente alle crescenti minacce marittime transnazionali.

Per saperne di più [en]:

https://youtu.be/c0IjddUfi9c

@Notizie dall'Italia e dal mondo

"Quando si tratta di mandare in bancarotta il nostro Paese con sprechi e corruzione, viviamo in un sistema monopartitico, non in una democrazia. Oggi, l'America Party è nato per restituirvi la libertà".

Tutto ciò è meraviglioso.

E comunque aveva ragione Yoda, "sempre due ci sono: un maestro e un apprendista".

rainews.it/articoli/2025/07/us…

Elon Musk annuncia la nascita del partito "America"

Ieri, nel giorno delle celebrazioni dell'Indipendenza Usa, aveva lanciato un sondaggio su X

^{Redazione di Rainews (RaiNews)}