Cascina Torchiera - Piazzale Cimitero Maggio 18, Milano (lunedì, 5 gennaio 19:00) Vi aspettiamo dalle 19, come ogni stramaledettissimo lunedì dell'anno con
il "Mercatork" di frutta, verdura e autoproduzioni
In questo spazio si pratica l’autogestione come espressione di responsabilità verso se stess* e tutto ciò che ci circonda. Come uno strumento di libertà e liberazione dai canoni del consumismo, come presa in carico del benessere collettivo e del pianeta
Quindi ricordati di lavare piatto e posate nell’area lavastoviglie
Riutilizza il bicchiere e quando hai finito di usarlo mettilo nei contenitori predisposti
Non buttare rifiuti per terra, utilizza i posacenere e bidoni della raccolta differenziata
Se hai dubbi CHIEDI: il tuo interessamento sarà apprezzato e ti sentirai parte di ciò che stai vivendo. Collabora alla buona riuscita dell’esperienza per tutt*, sii rispettos* e condividi la presa bene ❤
Lasciare pulito ciò che trovi pulito è Autogestione.
Lasciare pulito ciò che trovi sporco è Cura.
Lo spazio della Cascina è accessibile alle persone con difficoltà o disabilità motorie
Charla-debate: Impacto ecosocial de los Centros de Datos
CS La Cheli - Calle Iglesia 12 (sábado, 10 enero 18:00) ¿Cuánto cuesta la I.A.? 🤖La "nube" no flota: ocupa suelo y bebe agua. ¿Cómo podemos resistir contra Silicon Valley cuando lo digital amenaza el territorio y la vida? Acércate a esta charla-debate impartida por Aurora Gómez y Fanta del colectivo "Tu nube seca mi río" donde hablaremos del impacto ecosocial de los Centros de Datos y la famosa digitalización. 📈 España ha aumentado un 275% la potencia de centros de datos en los últimos 2 años y las grandes tecnológicas no buscan otra cosa que seguir creciendo. 💰💰💰Desde Rebelión o Extinción te invitamos a este evento para conocer mejor las amenazas del presente y poder organizarnos juntas hacia un futuro justo y deseable ❤️🔥⌛🗓️ Sábado 10 de enero a las 18h📍 CS La Cheli - C/Iglesia 12 - Marqués de Vadillo
Librería malaletra - Calle Sierra Alquife, 12 (lunes, 12 enero 19:00) ✨ya vienen ya vienen las actividades para el 2026 (!!!) empezamos el curso con las compiis de teknotejedoras (🌸) para leer juntas el libro de margarita padilla sobre inteligencia artificial,,,, dos fechas para leer y debatir en torno a preguntas como: ¿qué sería una inteligencia artificial radical? O mejor dicho, ¿cómo sería una relación radical con la inteligencia artificial? ¿es posible acaso volver a sentir la alegría hacker por la potencia de actuar, de subvertir, de crear? ¿cómo hacerlo?✨apúntate aquí: forms.gle/AuxnCVVTDKRxdCsH8
Ho già affrontato diversi lutti nella mia vita, e lo so che poi passa e ci si abitua all'assenza.. - ma porca miseria questa volta è davvero tanto difficile 💔
Intanto mi guardo Will Hunting, che so ancora a memoria, ..visto che né la brioche al pistacchio stamattina né Body Pump mi hanno aiutata a stare meglio.
The Shifting World of OSINT (with Craig Silverman)
Joseph speaks to Craig Silverman, one of the co-founders of Indicator. Indicator is a new, independent media company that Craig runs with Alexios Mantzarlis. For years Craig has covered the world of ad fraud and disinformation using all sorts of open source intelligence (OSINT) techniques. Definitely check out Indicator at Indicator.media. The site publishes its own investigations but also tips and tricks you can use yourself. playlist.megaphone.fm?e=TBIEA6… Listen to the weekly podcast on Apple Podcasts,Spotify, or YouTube. Become a paid subscriber for early access to these interview episodes and to power our journalism.If you become a paid subscriber, check your inbox for an email from our podcast host Transistor for a link to the subscribers-only version! You can also add that subscribers feed to your podcast app of choice and never miss an episode that way. The email should also contain the subscribers-only unlisted YouTube link for the extended video version too. It will also be in the show notes in your podcast player. youtube.com/embed/Lmj42F6HrPo?…
Tech News Podcast · Updated Weekly · Welcome to the podcast from 404 Media where Joseph, Sam, Emanuel, and Jason catch you up on the stories we published this week. 404 Media is a journalist-owned digital media company exploring the way …
Many of us have them, few of us really hack on them: well, here we’re talking about large home appliances. [Severin von Wnuck-Lipinski] and [Hajo Noerenberg] were both working on washing machines, found each other, and formed a glorious cooperation that ended in the unholy union of German super-brands Miele and B/S/H — a Miele washer remote controlled by Siemens’ web app.
About halfway through the talk, [Hajo] takes over, dissecting the internal D-Bus communication protocol. Here, you have to open up the box, but then you get easy access to everything about the internal state of the machine. And D-Bus seems to be used in a wide range of B/S/H/ home appliances, so this overview should give you footing for your own experimentation on coffee machines or dishwashers as well. Of course, he wires up an ESP32 to the bus, and connects everything, at the lowest level, to his home automation system, but he also went the extra mile and wrote up a software stack to support it.
It’s a great talk, with equal parts humor and heroic hacking. If you’re thinking about expanding out your own home automation setup, or are even just curious about what goes on inside those machines these days, you should absolutely give it a watch.
Editor Note: The “S” is Siemens, which is Hackaday’s parent company’s parent company. Needless to say, they had nothing to do with this work or our reporting on it.
NTP is one of the most interesting and important, but all too forgotten, protocols that makes the internet tick. Accurate clock synchronization is required for everything ranging from cryptography to business and science. NTP is closely tied around a handful of atomic clocks, some in orbit on GPS satellites, and some in laboratories. So the near-failure of one such atomic clock sparked a rather large, and nerdy, internet debate.
On December 17, 2025, the Colorado front range experience a massive wind storm. The National Center for Atmospheric Reassure in Boulder recorded gusts in excess of 100 mph (about 85 knots or 160 kph). This storm was a real doozy, but gusts this strong are not unheard of in Boulder either. That is no small reason the National Renewable Energy Laboratory (now the National Laboratory of the Rockies) has a wind turbine testing facility in the neighborhood.
High winds and dry weather make for a particularly bad time. Winds of this nature would not terribly interesting. However, the wind storm brought with it a particularly dangerous red flag warning outside of Boulder, a first for Colorado. Such high fire danger combined with damaged infrastructure prompted the local utility, Xcel Energy, to shut off power for hundreds of thousands of customers starting on December 17. Power was not regained until December 21 for many customers.
This outage came with all sorts of headaches to research institutions across Colorado. Not least of which was the National Institute of Science Technology’s (NIST) Boulder campus which houses a rather precise atomic clock. Due to predicted failure of NIST’s heat exchange, much of the normal monitoring equipment was unavailable to the scientists, further complicating the situation.
As was designed, once utility power failed, backup generators took over. But as the outage dragged on, indications came to the scientists in charge of the atomic clocks at NIST that one of the generators had failed. This prompted scientists to warn against relying on the Boulder NTP sources. The scientists running the clock feared complete failure of the hydrogen source clocks. Such failure would require a lengthy and complex re-start procedure once power was returned in the long term, and complete failure of a stratum one NTP source in the short term.
Further complicating the already bad situation was the fact that due to the dangers involved, the scientists could not reach the campus. So not only could they not confirm with certainty what issues the clocks may be experiencing, but they were unable to shut down the NTP servers. Fortunately, power was returned and the main source clock only drifted by a few microseconds. This is still far too much drift as would be preferred on a clock normally accurate in the range of nanoseconds, but perfectly usable for NTP which is only accurate to within a few milliseconds.
So this prompts the question, if such a key time source had failed, what would have happened? In short, not much. By nature of being so distributed, most servers have multiple NTP sources, often including GPS satellites. However, there would most certainly be any number of servers without multiple NTP sources configured. Websites hosted on such servers would be rendered inaccessible as HTTPS encryption handshakes require synchronized clocks. TOTP passkeys and FIDO hardware authenticators would likewise be unusable as both protocols rely on accurate time sources. So any two computers would be unable to properly execute protocols requiring synchronized time. Beyond the limited failures outlined above, its difficult to say what more the damage could be, but the effects are unlikely to be terribly dramatic.
In occasione della chiusura della Porta Santa a conclusione dell'anno giubilare, la Basilica Papale di Santa Maria Maggiore ha commissionato la realizzazione di una medaglia commemorativa, "riprendendo un'antica tradizione".
We elect our Pirate Council in February. Positions include Captain, First Officer, Quartermaster, PR/Media Director, Activism Director, Swarmwise Director, Web/Info Director, three Arbitrators and two representatives to the US Pirate Party.
Ballots will be sent out by February 13th and are due back by February 27th. We will use the same voting mechanism we used in our previous election. Voters will be emailed a randomly generated id that only the voter will know. Once the election is done, we will delete the ids. In this way, we can ensure that only supporters can vote, while also maintaining the secrecy of votes.
Diversi Processi Stessa Regia: Direzione Nazionale Antiterrorismo e Antimafia
Sede della Direzione Nazionale Antiterrorismo e Antimafia - Via Giulia, 52, 00186 Roma RM (venerdì, 9 gennaio 11:30) DIVERSI PROCESSI STESSA REGIA: Direzione Nazionale Antiterrorismo e Antimafia
La DNAA guidata dal sionista Melillo, magistrato in quota PD, sta orientando i processi contro i "Colpevoli di Palestina" in tutto il paese, trasformando i tribunali italiani in succursali dei tribunali delle forze di Occupazione israeliane in Palestina. 28 anni in totale richiesti dal pubblico ministero contro Anan, Alì e Mansour per "non aver commesso reati" contro lo Stato italiano. A questi si sono aggiunte le persecuzioni contro Hannoun, Shahin, Salem, Tarek e tanti altri colpevoli di solidarietà con la Palestina contro i Genocidi sionisti o semplicemente per essere arabo-palestinesi
LIBERTA' PER ANAN YAEESH E TUTTI GLI ALTRI PERSEGUITATI! CONTRO I TRIBUNALI AL SERVIZIO DELL'OCCUPAZIONE DELLA PALESTINA! CONTRO LA SIONISTIZZAZIONE DELLO STATO ITALIANO!
In vista dell'appuntamento nazionale a L'Aquila per l'ultima udienza del processo contro Anan, Alì e Mansour PRESIDIO DI PROTESTA VENERDI' 9 GENNAIO - ORE 11:30 DAVANTI LA SEDE DELLA DNAA (Via Giulia 52, Roma)
Diversi Processi Stessa Regia: Direzione Nazionale Antiterrorismo e Antimafia
Inizia:Venerdì Gennaio 09, 2026 @ 11:30 AM GMT+01:00 (Europe/Rome)
DIVERSI PROCESSI STESSA REGIA: Direzione Nazionale Antiterrorismo e Antimafia
La DNAA guidata dal sionista Melillo, magistrato in quota PD, sta orientando i processi contro i "Colpevoli di Palestina" in tutto il paese, trasformando i tribunali italiani in succursali dei tribunali delle forze di Occupazione israeliane in Palestina. 28 anni in totale richiesti dal pubblico ministero contro Anan, Alì e Mansour per "non aver commesso reati" contro lo Stato italiano. A questi si sono aggiunte le persecuzioni contro Hannoun, Shahin, Salem, Tarek e tanti altri colpevoli di solidarietà con la Palestina contro i Genocidi sionisti o semplicemente per essere arabo-palestinesi
LIBERTA' PER ANAN YAEESH E TUTTI GLI ALTRI PERSEGUITATI! CONTRO I TRIBUNALI AL SERVIZIO DELL'OCCUPAZIONE DELLA PALESTINA! CONTRO LA SIONISTIZZAZIONE DELLO STATO ITALIANO!
In vista dell'appuntamento nazionale a L'Aquila per l'ultima udienza del processo contro Anan, Alì e Mansour PRESIDIO DI PROTESTA VENERDI' 9 GENNAIO - ORE 11:30 DAVANTI LA SEDE DELLA DNAA (Via Giulia 52, Roma)
Pochi giorni dopo l'accordo col Fisco che vedrà l'e-commerce statunitense pagare all'erario italiano 511 milioni di euro per chiudere il contenzioso tributario su presunte condotte illecite legate al versamento dell'Iva, Amazon ha deciso di lasciare a terra i suoi droni
Carcere di Marassi - Piazzale Marassi 2 (lunedì, 29 dicembre 18:00) 🇵🇸 Presidio - La solidarietà con la Palestina non si arresta 📅 Lunedì 29 dicembre 2025 🕔 Ore 18:00 📍 Genova - Carcere Marassi
CONCERTO DI CAPODANNO "ALLA SCOPERTA DI GIOVANI TALENTI"
Magnano - Chiesa di Santa Marta - Magnano, Chiesa di Santa Marta (mercoledì, 31 dicembre 20:00) Il Festival Musica Antica a Magnano e il Ensemble Musica Antica Magnano invitano e presentato due giovane violiniste e una giovane flautista.
Piatto, Bielmonte - Al Maneggio Ristobar - Località Bielmonte 17, 13844 Piatto BI (mercoledì, 31 dicembre 22:30) Cena AL MANEGGIO E POI…. Si brinda al bar panoramica con dj set!!!
A BIELMONTE IN PIAZZETTA LA NOTTE DI CAPODANNO SI FESTEGGIA!!!!!
Biella - Galileo - Via Galileo Galilei, 1, 13900 Biella BI (mercoledì, 31 dicembre 23:30) 🥂A PARTIRE DALLE 23:30 VIENI A FESTEGGIARE IL CAPODANNO CON LA GALILEO FAMILY🥂
“This is so fucking stressful,” Jason said. On a group call, all four of us—Jason, Sam, Emanuel, and me—were bidding on something that had long eluded us. 404media.com. Not the .co domain we launched with two years ago because that’s all we could afford. But a fully-fledged .com.
That September day I was on holiday in an Airbnb. Sam was in San Diego to report on the sentencing of a high profile sex trafficker. Emanuel was home. Jason was also at home and eating a bagel. Ordinarily we wouldn’t be able to buy a .com for two main reasons: they are typically quite expensive, and when we created our company the domain was already in use by someone else.
Fortunately for us, that company had seemingly moved on to other things, and the domain was up for auction. I got some emails from our domain registrar about the auction a few days before, and some 404 Media readers contacted us about it too. This was our chance.
But an auction is a very different experience to just buying the domain outright. We would be trying to beat other people or bots. We thought that might include those kindly trying to buy the domain on our behalf, or others trying to take it from underneath us. And we had no idea how high the price might go.
I was in charge of placing the bids themselves. Soon we found I wasn’t able to place bids of a certain size because, we later learned, the account didn’t have the necessary level of verification to do so. We were leading with a bid of $1,207.
A few minutes into our group call, Jason started recording it.
“I think we should just get 202 Media if this doesn’t work,” he said.
“Okay, under one minute until the five minute extension is over,” I added.
Emanuel led a ten second countdown.
“Your bid won,” I read from the screen. Everyone cheered. Here is what we said immediately afterwards: A transcript of some of the group call. Right now, our .com domain just redirects to the .co one. Maybe we’ll put an Easter Egg or something else fun on it soon, but we also had practical reasons for buying it. The first is that we’re proud to say 404 Media is a well known publication at this point, and we don’t want anyone else parking and abusing the .com domain that many people may end up at by mistake. The second is that, understandably, many people mistakenly email us at the @404media.com domain rather than the @404media.co domain, so now we’ll be able to catch those lost emails and save us all a lot of heartache.
But our ability to buy the domain signifies something important: that we are able to grow, bit by bit, sustainably. When we launched 404 Media in August 2023, we each put $1,000 in. That was to pay for the domain, the content management system (CMS) and website host we use called Ghost, some other add-ons that automatically send people emails, and that’s about it. Buying a .com was a pipedream then, just like running a website and podcast years later was.
Since then we’ve built a fulltext RSS feed for our subscribers (something that didn’t exist with Ghost before); run multiple in-person events; and most recently produced a physical zine. All while reporting and writing cutting edge journalism on technology and AI and how they are really impacting humans every day.
Thank you to all of our paying subscribers who make it possible for us to write impactful journalism every day. And let us buy a new domain.
We paid for the development of full text RSS feeds for Ghost-based publishers. Now we can offer them to our paid subscribers, and other Ghost sites can use the service too.
Analisi e correlazioni costruite anche grazie alla piattaforma Recorded Future (Insikt Group), che in questi casi è utile per mettere ordine nel caos tra segnali, rumor e priorità operative.
C’è una tradizione natalizia che nessuno ha chiesto ma che puntualmente arriva: panettone, parenti… e un bug pre-auth che fa uscire pezzi di memoria dal server come se fossero caramelle. Questa volta il regalo avvelenato si chiama MongoBleed, ovvero CVE-2025-14847, e colpisce MongoDB Server.
Non è la classica vulnerabilità “rompo tutto e ti cifro i dati”. È peggio in un modo più subdolo: ti porto via i segreti. E con i segreti ci apro tutto il resto.
Cosa succede
Il difetto nasce nella gestione dei messaggi compressi via zlib: con campi di lunghezza incoerenti, il server può finire a restituire heap memory non inizializzata a un client remoto non autenticato. Il risultato è un leak di dati “di passaggio” in memoria, molto in stile Heartbleed vibes, ma nel mondo MongoDB.
Qui il punto chiave è uno: prima dell’autenticazione. Se l’istanza è raggiungibile da Internet, l’attaccante non deve “indovinare” nulla. Deve solo parlare col servizio.
Parliamo di possibili leak di credenziali, token di sessione, API key, chiavi cloud, PII, config e frammenti di log. È materiale perfetto per fare pivot, escalation, e trasformare un leak “passivo” in compromissione “attiva” (e monetizzabile).
E no, non ti salva l’idea rassicurante “ma tanto Mongo è dietro al firewall”: spesso non lo è. O peggio, lo è “sulla carta”.
Patch
Le versioni fixate riportate pubblicamente includono 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, 4.4.30; NVD conferma la finestra di impatto e i rami coinvolti (inclusi quelli legacy dove la parola “migrazione” non è più un consiglio ma una condanna rimandata).
MongoDB ha rilasciato le patch il 19 dicembre 2025 e, come sempre, il tempo tra “fix disponibile” e “abuso in massa” si misura in sbadigli.
“In the wild”
Diverse analisi riportano sfruttamento attivo e un’accelerazione dopo la pubblicazione di dettagli/PoC. In parallelo, Censys fotografa l’elefante nella stanza: circa 87.000 istanze MongoDB esposte (con i soliti Paesi ai vertici).
E qui la nota di colore amara: nel 2025 discutiamo ancora di database lasciati su Internet come se fossero una landing page. Poi ci stupiamo se qualcuno passa a “raccogliere”.
Detection
Una delle parti più fastidiose di MongoBleed è proprio questa: non è detto che lasci tracce “facili” nei soliti flussi SIEM. Diversi ricercatori stanno spingendo artefatti e logiche di hunting (Velociraptor, query dedicate), perché intercettare i pattern del PoC richiede visibilità sul posto, non solo in periferia.
In pratica: se non hai logging decente sul nodo MongoDB, rischi di scoprire l’incidente dai sintomi, non dalla diagnosi.
Ubisoft / Rainbow Six Siege
Circola l’ipotesi che MongoBleed sia stato usato come vettore di accesso iniziale in un caso mediatico legato a Ubisoft / Rainbow Six Siege. VX-Underground riporta claim espliciti, mentre altre fonti trattano la vicenda come breach reale ma con vettore ancora non dimostrato pubblicamente. Morale: teniamolo sul radar, ma senza trasformare X in un tribunale.
Ed è esattamente qui che Recorded Future/Insikt, lato intelligence, torna comodo: separare fatti, probabilità e propaganda.
Cosa mi aspetto che succeda nelle prossime settimane
Succede sempre la stessa cosa: ondata di scanning, exploitation opportunistica, poi selezione dei bersagli “buoni” (quelli da cui puoi estrarre segreti utili per entrare altrove). MongoBleed è perfetta per questo modello: rubare chiavi è spesso più efficiente che bucare un perimetro a testate.
E in Italia? Non serve fare patriottismo dell’incidente: MongoDB è ovunque in stack moderni, spesso in mano a team piccoli, spesso “temporaneamente esposto” (cioè per sempre), spesso con l’idea che “tanto non interessa a nessuno”. Spoiler: interessa eccome. Soprattutto quando quello che esce dalla memoria sono token e credenziali riutilizzabili.
Cosa fare adesso
Patchare. Subito. Se non puoi patchare immediatamente, ridurre la superficie: niente esposizione diretta su Internet e, dove previsto come mitigazione temporanea, valutare la disabilitazione della compressione zlib finché non aggiorni (è una stampella, non una guarigione). Poi ragionare da incident responder, non da sysadmin ottimista: se l’istanza era esposta e sospetti attività, considera la rotazione dei segreti potenzialmente in memoria (credenziali, API key, token, chiavi cloud) e fai hunting mirato.
Perché la domanda non è “mi hanno bucato?”. La domanda, con MongoBleed, è più cinica: “quali segreti potrebbero essere già usciti?”
Approderà oggi in Consiglio dei ministri il nuovo decreto armi per il sostegno all’Ucraina, l’atto normativo che permetterà all’Italia di proseguire i trasferimenti di materiali militari e il supporto logistico a favore di Kyiv anche nel 2026. Il testo, frutto di settimane di confronto serrato tra i ministeri competenti e la
L’anno che volge al termine è stato caratterizzato da tanti momenti rilevanti, non solo per la vita della Chiesa e la comunità dei fedeli. In uno scenario globale caratterizzato da conflitti, disuguaglianze e timori per il futuro della nostra casa comune, l’anno giubilare ha permesso di custodire e coltivare la speranza. Abbiamo dato l’ultimo saluto a papa Francesco, dopo 12 anni di un pontificato intenso e coraggioso, e accolto con emozione papa Leone XIV che, in continuità con il suo predecessore, ha chiesto alla nostra rivista di continuare a «cogliere lo sguardo di Cristo sul mondo, coltivarlo, comunicarlo, testimoniarlo». Accogliendo l’invito del Pontefice, vogliamo ripercorrere le riflessioni che ci hanno accompagnato lungo tutto l’anno santo, rileggendo con voi i 12 articoli più letti pubblicati nel 2025.
“Il povero non è soltanto qualcuno a cui si aiuta, ma la presenza sacramentale del Signore”. Papa Leone XIV lo ha affermato nell’udienza a un gruppo di pellegrini della parrocchia Santo Tomás de Villanueva di Alcalá de Henares, in Spagna, ricevuti qu…
“Il Paese non ha soltanto bisogno di fognature, di case, di strade, di acquedotti, di marciapiedi. Il Paese ha bisogno anche di una maniera di sentire, di vivere, una maniera di guardarsi, una maniera di affratellarsi”.
UNIX version 4 is quite special on account of being the first UNIX to be written in C instead of PDP-11 ASM, but it was also considered to have been lost to the ravages of time. Joyfully, we can report that the more than fifty year old magnetic tape that was recently discovered in a University of Utah storeroom did in fact contain the UNIX v4 source code. As reported by Tom’s Hardware, [Al Kossow] of Bitsavers did the recovery by passing the raw flux data from the tape read head through the ReadTape program to reconstruct the stored data.
Since the tape was so old there was no telling how much of the data would still be intact, but fortunately it turned out that the tape was not only largely empty, but the data that was on it was in good nick. You can find the recovered files here, along with a README, with Archive.org hosting the multi-GB raw tape data. The recovered data includes the tape file in SimH format and the filesystem
Suffice it to say that you will not run UNIX v4 on anything other than a PDP-11 system or emulated equivalent, but if you want to run its modern successors in the form of BSD Unix, you can always give FreeBSD a shot.
Arizona – the Arizona Pirate Party will start the year off by hosting their first in-person meeting in the Tucson area, expected to be held at a public library. Discussions will include expectations for the upcoming year, the Henry campaign, among other topics. The Arizona Pirate Party has also been actively working to help Nevada and Colorado to get a Pirate Party officially formed in their states.
Illinois – the Illinois Pirate Party released their meeting dates for 2026 for both the Illinois Pirate Party and the Chicagoland Pirate Party. The first Illinois Pirate Party will be held January 4th over Jitsi. In-person meetings for both Chicagoland and Illinois will take place in earnest come August. Otherwise, meetings are expected to be held over Jitsi unless stated otherwise.
West Virginia – Those seeking a warm place to sleep have a location available in Keyser, WV. The link and address can be found in the link to the meeting posted below.
Committee News – A renewed focus shall be put onto our committees within the US Pirate Party. Regular meetings are scheduled to be held weekly for Platform, Outreach, IT and Press Committee. A new chair, USPP PR Director Cy Kindsfather, will take over for the Outreach Committee. You can join our Discord server to find more information on committees and to get involved in the discussions.
Volunteers – We are actively seeking volunteers! This is nothing new, but if you are from the states of Idaho, Michigan, Montana, North Carolina, Ohio or West Virginia, especially, you are incredibly close to having an official party in your state. It would only take a couple volunteers to make it official, and all it might take is you (yes, YOU ).
Quote of the Week – “That’s what’s called leadership… those of us who are willing to actually look around and see ‘this isn’t getting done so I guess I’m gonna try to do something’. That’s leadership.” – Drew Bingaman
Check out our last meeting here! Victory is Arrrs.
In mid-2025, we identified a malicious driver file on computer systems in Asia. The driver file is signed with an old, stolen, or leaked digital certificate and registers as a mini-filter driver on infected machines. Its end-goal is to inject a backdoor Trojan into the system processes and provide protection for malicious files, user-mode processes, and registry keys.
Our analysis indicates that the final payload injected by the driver is a new sample of the ToneShell backdoor, which connects to the attacker’s servers and provides a reverse shell, along with other capabilities. The ToneShell backdoor is a tool known to be used exclusively by the HoneyMyte (aka Mustang Panda or Bronze President) APT actor and is often used in cyberespionage campaigns targeting government organizations, particularly in Southeast and East Asia.
The command-and-control servers for the ToneShell backdoor used in this campaign were registered in September 2024 via NameCheap services, and we suspect the attacks themselves to have begun in February 2025. We’ve observed through our telemetry that the new ToneShell backdoor is frequently employed in cyberespionage campaigns against government organizations in Southeast and East Asia, with Myanmar and Thailand being the most heavily targeted.
Notably, nearly all affected victims had previously been infected with other HoneyMyte tools, including the ToneDisk USB worm, PlugX, and older variants of ToneShell. Although the initial access vector remains unclear, it’s suspected that the threat actor leveraged previously compromised machines to deploy the malicious driver.
Compromised digital certificate
The driver file is signed with a digital certificate from Guangzhou Kingteller Technology Co., Ltd., with a serial number of 08 01 CC 11 EB 4D 1D 33 1E 3D 54 0C 55 A4 9F 7F. The certificate was valid from August 2012 until 2015.
We found multiple other malicious files signed with the same certificate which didn’t show any connections to the attacks described in this article. Therefore, we believe that other threat actors have been using it to sign their malicious tools as well. The following image shows the details of the certificate.
Technical details of the malicious driver
The filename used for the driver on the victim’s machine is ProjectConfiguration.sys. The registry key created for the driver’s service uses the same name, ProjectConfiguration.
The malicious driver contains two user-mode shellcodes, which are embedded into the .data section of the driver’s binary file. The shellcodes are executed as separate user-mode threads. The rootkit functionality protects both the driver’s own module and the user-mode processes into which the backdoor code is injected, preventing access by any process on the system.
API resolution
To obfuscate the actual behavior of the driver module, the attackers used dynamic resolution of the required API addresses from hash values.
The malicious driver first retrieves the base address of the ntoskrnl.exe and fltmgr.sys by calling ZwQuerySystemInformation with the SystemInformationClass set to SYSTEM_MODULE_INFORMATION. It then iterates through this system information and searches for the desired DLLs by name, noting the ImageBaseAddress of each.
Once the base addresses of the libraries are obtained, the driver uses a simple hashing algorithm to dynamically resolve the required API addresses from ntoskrnl.exe and fltmgr.sys.
The hashing algorithm is shown below. The two variants of the seed value provided in the comment are used in the shellcodes and the final payload of the attack.
Protection of the driver file
The malicious driver registers itself with the Filter Manager using FltRegisterFilter and sets up a pre-operation callback. This callback inspects I/O requests for IRP_MJ_SET_INFORMATION and triggers a malicious handler when certain FileInformationClass values are detected. The handler then checks whether the targeted file object is associated with the driver; if it is, it forces the operation to fail by setting IOStatus to STATUS_ACCESS_DENIED. The relevant FileInformationClass values include:
FileRenameInformation
FileDispositionInformation
FileRenameInformationBypassAccessCheck
FileDispositionInformationEx
FileRenameInformationEx
FileRenameInformationExBypassAccessCheck
These classes correspond to file-delete and file-rename operations. By monitoring them, the driver prevents itself from being removed or renamed – actions that security tools might attempt when trying to quarantine it.
Protection of registry keys
The driver also builds a global list of registry paths and parameter names that it intends to protect. This list contains the following entries:
ProjectConfiguration
ProjectConfiguration\Instances
ProjectConfiguration Instance
To guard these keys, the malware sets up a RegistryCallback routine, registering it through CmRegisterCallbackEx. To do so, it must assign itself an altitude value. Microsoft governs altitude assignments for mini-filters, grouping them into Load Order categories with predefined altitude ranges. A filter driver with a low numerical altitude is loaded into the I/O stack below filters with higher altitudes. The malware uses a hardcoded starting point of 330024 and creates altitude strings in the format 330024.%l, where %l ranges from 0 to 10,000.
The malware then begins attempting to register the callback using the first generated altitude. If the registration fails with STATUS_FLT_INSTANCE_ALTITUDE_COLLISION, meaning the altitude is already taken, it increments the value and retries. It repeats this process until it successfully finds an unused altitude.
The callback monitors four specific registry operations. Whenever one of these operations targets a key from its protected list, it responds with 0xC0000022 (STATUS_ACCESS_DENIED), blocking the action. The monitored operations are:
RegNtPreCreateKey
RegNtPreOpenKey
RegNtPreCreateKeyEx
RegNtPreOpenKeyEx
Microsoft designates the 320000–329999 altitude range for the FSFilter Anti-Virus Load Order Group. The malware’s chosen altitude exceeds this range. Since filters with lower altitudes sit deeper in the I/O stack, the malicious driver intercepts file operations before legitimate low-altitude filters like antivirus components, allowing it to circumvent security checks.
Finally, the malware tampers with the altitude assigned to WdFilter, a key Microsoft Defender driver. It locates the registry entry containing the driver’s altitude and changes it to 0, effectively preventing WdFilter from being loaded into the I/O stack.
Protection of user-mode processes
The malware sets up a list intended to hold protected process IDs (PIDs). It begins with 32 empty slots, which are filled as needed during execution. A status flag is also initialized and set to 1 to indicate that the list starts out empty.
Next, the malware uses ObRegisterCallbacks to register two callbacks that intercept process-related operations. These callbacks apply to both OB_OPERATION_HANDLE_CREATE and OB_OPERATION_HANDLE_DUPLICATE, and both use a malicious pre-operation routine.
This routine checks whether the process involved in the operation has a PID that appears in the protected list. If so, it sets the DesiredAccess field in the OperationInformation structure to 0, effectively denying any access to the process.
The malware also registers a callback routine by calling PsSetCreateProcessNotifyRoutine. These callbacks are triggered during every process creation and deletion on the system. This malware’s callback routine checks whether the parent process ID (PPID) of a process being deleted exists in the protected list; if it does, the malware removes that PPID from the list. This eventually removes the rootkit protection from a process with an injected backdoor, once the backdoor has fulfilled its responsibilities.
Payload injection
The driver delivers two user-mode payloads.
The first payload spawns an svchost process and injects a small delay-inducing shellcode. The PID of this new svchost instance is written to a file for later use.
The second payload is the final component – the ToneShell backdoor – and is later injected into that same svchost process.
Injection workflow:
The malicious driver searches for a high-privilege target process by iterating through PIDs and checking whether each process exists and runs under SeLocalSystemSid. Once it finds one, it customizes the first payload using random event names, file names, and padding bytes, then creates a named event and injects the payload by attaching its current thread to the process, allocating memory, and launching a new thread.
After injection, it waits for the payload to signal the event, reads the PID of the newly created svchost process from the generated file, and adds it to its protected process list. It then similarly customizes the second payload (ToneShell) using random event name and random padding bytes, then creates a named event and injects the payload by attaching to the process, allocating memory, and launching a new thread.
Once the ToneShell backdoor finishes execution, it signals the event. The malware then removes the svchost PID from the protected list, waits 10 seconds, and attempts to terminate the process.
ToneShell backdoor
The final stage of the attack deploys ToneShell, a backdoor previously linked to operations by the HoneyMyte APT group and discussed in earlier reporting (see Malpedia and MITRE). Notably, this is the first time we’ve seen ToneShell delivered through a kernel-mode loader, giving it protection from user-mode monitoring and benefiting from the rootkit capabilities of the driver that hides its activity from security tools.
Earlier ToneShell variants generated a 16-byte GUID using CoCreateGuid and stored it as a host identifier. In contrast, this version checks for a file named C:\ProgramData\MicrosoftOneDrive.tlb, validating a 4-byte marker inside it. If the file is absent or the marker is invalid, the backdoor derives a new pseudo-random 4-byte identifier using system-specific values (computer name, tick count, and PRNG), then creates the file and writes the marker. This becomes the unique ID for the infected host.
The samples we have analyzed contact two command-and-control servers:
avocadomechanism[.]com
potherbreference[.]com
ToneShell communicates with its C2 over raw TCP on port 443 while disguising traffic using fake TLS headers. This version imitates the first bytes of a TLS 1.3 record (0x17 0x03 0x04) instead of the TLS 1.2 pattern used previously. After this three-byte marker, each packet contains a size field and an encrypted payload.
Packet layout:
Header (3 bytes): Fake TLS marker
Size (2 bytes): Payload length
Payload: Encrypted with a rolling XOR key
The backdoor supports a set of remote operations, including file upload/download, remote shell functionality, and session control. The command set includes:
Command ID
Description
0x1
Create temporary file for incoming data
0x2 / 0x3
Download file
0x4
Cancel download
0x7
Establish remote shell via pipe
0x8
Receive operator command
0x9
Terminate shell
0xA / 0xB
Upload file
0xC
Cancel upload
0xD
Close connection
Conclusion
We assess with high confidence that the activity described in this report is linked to the HoneyMyte threat actor. This conclusion is supported by the use of the ToneShell backdoor as the final-stage payload, as well as the presence of additional tools long associated with HoneyMyte – such as PlugX, and the ToneDisk USB worm – on the impacted systems.
HoneyMyte’s 2025 operations show a noticeable evolution toward using kernel-mode injectors to deploy ToneShell, improving both stealth and resilience. In this campaign, we observed a new ToneShell variant delivered through a kernel-mode driver that carries and injects the backdoor directly from its embedded payload. To further conceal its activity, the driver first deploys a small user-mode component that handles the final injection step. It also uses multiple obfuscation techniques, callback routines, and notification mechanisms to hide its API usage and track process and registry activity, ultimately strengthening the backdoor’s defenses.
Because the shellcode executes entirely in memory, memory forensics becomes essential for uncovering and analyzing this intrusion. Detecting the injected shellcode is a key indicator of ToneShell’s presence on compromised hosts.
Recommendations
To protect themselves against this threat, organizations should:
Implement robust network security measures, such as firewalls and intrusion detection systems.
@Informatica (Italy e non Italy 😁) Disponibile in rete l’exploit per la vulnerabilità MongoBleed identificata in MongoDB: lo sfruttamento attivo potrebbe consentire l’accesso non controllato a zone di memoria riservate. La falla di sicurezza è già stata risolta dal vendor,
@Notizie dall'Italia e dal mondo Mente i negoziati non procedono una nuova indagine per corruzione coinvolge vari deputati ucraini, mentre l'ex capo delle forze armate ucraine sarebbe pronto a tornare in patria L'articolo UCRAINA. Deputati indagati per corruzione e nuovo stallo del negoziato proviene da
leggendo un articolo l'importante è capire il meccanismo o i meccanismi citati, e fissarseli nel cervello. per conoscenza. non cercare di acquisire solo la conclusione, che non può che essere aleatoria e non certa.
A transcript of some of the group call.
Scimmia di Mare
in reply to aimee80 • • •aimee80 likes this.