The Pirate Post ha ricondiviso questo.

The media in this post is not displayed to visitors. To view it, please go to the original post.

The media in this post is not displayed to visitors. To view it, please go to the original post.

Operazione Olalampo: MuddyWater sfrutta Rust e Telegram per spiare il Medio Oriente
#CyberSecurity
insicurezzadigitale.com/operaz…


Operazione Olalampo: MuddyWater sfrutta Rust e Telegram per spiare il Medio Oriente


Dal gennaio 2026, il gruppo iraniano MuddyWater conduce una campagna di spionaggio sofisticata contro organizzazioni governative, energetiche e infrastrutturali del Medio Oriente e Nord Africa. L’Operazione Olalampo segna un salto qualitativo nelle capacità offensive del gruppo: malware scritto in Rust, sviluppo assistito da intelligenza artificiale e un canale di comando-e-controllo nascosto nei bot di Telegram.

Chi è MuddyWater e perché è pericoloso


MuddyWater — conosciuto anche come Seedworm, TA450, Mango Sandstorm ed Earth Vetala — è un gruppo APT ritenuto collegato al Ministero dell’Intelligence e Sicurezza iraniano (MOIS). Attivo da almeno il 2017, il gruppo ha nel tempo ampliato il proprio arsenale tecnico passando da strumenti commerciali come AnyDesk e SimpleHelp a malware completamente custom. L’Operazione Olalampo rappresenta la più recente e sofisticata evoluzione di questa traiettoria.

La catena d’attacco: da una macro Excel al controllo totale


L’infezione inizia con una campagna di spear-phishing mirata: le vittime ricevono email con allegati Microsoft Office (principalmente Excel) contenenti macro VBA malevole. Una volta attivata la macro, il codice decodifica ed esegue il payload iniziale in memoria, avviando una catena a più stadi progettata per massimizzare la furtività.

  • Stadio 1 — GhostFetch: downloader di prima fase con funzioni di profilazione del sistema, controlli anti-debug e anti-VM, ed esecuzione in memoria del payload successivo.
  • Stadio 2 — GhostBackDoor: backdoor completa con supporto per remote shell, operazioni sui file, esecuzione di comandi arbitrari e meccanismi di persistenza.
  • HTTP_VIP: downloader alternativo che effettua ricognizione del sistema, si autentica al C2 e può distribuire AnyDesk per l’accesso remoto diretto, oltre a monitorare gli appunti di sistema.
  • CHAR: backdoor scritta interamente in Rust, capace di esecuzione di comandi, accesso a PowerShell, operazioni di reverse proxy e deploy di proxy SOCKS5.


Il cuore dell’operazione: Telegram come infrastruttura C2


L’elemento più interessante di questa campagna è l’uso di un bot Telegram come canale di comando-e-controllo per la backdoor CHAR. Il bot — con display name “Olalampo” e username stager_51_bot — consente agli operatori di inviare comandi ai sistemi compromessi attraverso l’infrastruttura legittima di Telegram, rendendo il traffico indistinguibile da quello normale. Questo approccio offre tre vantaggi tattici significativi: il traffico viene cifrato end-to-end, si mimetizza nel traffico legittimo di messaggistica aziendale, e Telegram è molto difficile da bloccare completamente nei contesti aziendali.

Il monitoraggio del bot C2 ha permesso ai ricercatori di Group-IB di osservare direttamente le attività post-exploitation: comandi eseguiti, strumenti distribuiti e tecniche di raccolta dati utilizzate dagli operatori.

Sviluppo assistito da IA: una nuova frontiera per gli APT


Un dettaglio rivelatore nell’analisi del malware è la presenza di stringhe di debug contenenti emoji — un pattern tipico del codice generato o rifinito con l’assistenza di grandi modelli linguistici (LLM). Questo suggerisce che MuddyWater stia integrando strumenti di intelligenza artificiale nel proprio ciclo di sviluppo malware, potenzialmente accelerando la creazione di nuove varianti e riducendo gli errori. La scelta di Rust per CHAR va nella stessa direzione: Rust è un linguaggio relativamente giovane, ma molto popolare nei progetti LLM, cross-platform per definizione e che produce binari difficili da analizzare con i tradizionali strumenti di reverse engineering.

Infrastruttura e indicatori di compromissione


L’analisi DNS condotta da ricercatori indipendenti ha portato all’identificazione di quattro domini malevoli, tutti registrati tramite Namecheap con indirizzi di registrazione in Islanda — una tecnica di anonimizzazione comune tra gli attori state-sponsored. I domini risultano relativamente recenti, creati tra ottobre 2025 e febbraio 2026, confermando un’attiva preparazione dell’infrastruttura nelle settimane precedenti la campagna.

## Domini C2 identificati
jerusalemsolutions[.]com
miniquest[.]org
codefusiontech[.]org

## Indirizzi IP
162[.]0[.]230[.]185
209[.]74[.]87[.]100

## Telegram C2
Bot username: stager_51_bot
Bot display name: Olalampo

## Note infrastruttura
Registrar: Namecheap
Posizione registrazione: Islanda
Periodo creazione domini: 10/2025 – 02/2026
Comunicazioni victim-IoC osservate: 10 IP unici su 3 ASN (01/25–02/25/2026)

Settori e geografie colpite


I target primari dell’Operazione Olalampo includono agenzie governative, operatori di infrastrutture critiche, aziende del settore energetico, operatori di telecomunicazioni e professionisti di alto profilo nelle regioni MENA (Medio Oriente e Nord Africa). La scelta dei target è coerente con gli obiettivi di intelligence strategica del MOIS: raccolta di informazioni su politica estera, accordi energetici e comunicazioni riservate di governi nella sfera di influenza dell’Iran.

Consigli per i difensori


La natura dell’Operazione Olalampo richiede un approccio difensivo su più livelli. Limitare o monitorare il traffico verso i server Telegram (t.me, api.telegram.org) nei perimetri aziendali può bloccare il canale C2 principale, anche se ciò richiede un’analisi del rischio rispetto all’uso legittimo della piattaforma. A livello email, rafforzare i controlli sugli allegati Office con macro e abilitare Protected View/AMSI per documenti provenienti da fonti esterne è un primo scudo efficace. Sul fronte EDR, è fondamentale cercare attività anomale di PowerShell, processi figlio di applicazioni Office, e l’esecuzione di binari Rust non firmati. Infine, la presenza di processi AnyDesk o SimpleHelp avviati da percorsi inusuali dovrebbe costituire un alert ad alta priorità.


The Pirate Post ha ricondiviso questo.

The media in this post is not displayed to visitors. To view it, please go to the original post.

The media in this post is not displayed to visitors. To view it, please go to the original post.

GlassWorm: il worm che infetta tutti gli IDE tramite un’estensione OpenVSX contraffatta
#CyberSecurity
insicurezzadigitale.com/glassw…


GlassWorm: il worm che infetta tutti gli IDE tramite un’estensione OpenVSX contraffatta


Un’estensione contraffatta nel marketplace OpenVSX installa silenziosamente un dropper compilato in Zig che individua e infetta tutti gli IDE compatibili con VS Code presenti sulla macchina, per poi deployare un RAT con C2 su blockchain Solana e un’estensione Chrome per rubare sessioni e keystroke. La campagna GlassWorm è attiva da oltre un anno e ha appena compiuto il suo salto evolutivo più sofisticato.

Una campagna che cresce da un anno


GlassWorm non è una minaccia nuova: Aikido Security ne traccia l’evoluzione dal marzo 2025, quando fu individuata la prima variante nascosta in pacchetti npm attraverso caratteri Unicode invisibili per offuscare il payload. Da allora, la campagna ha iterato costantemente le proprie tecniche, arrivando oggi a una versione che colpisce non un singolo editor, ma l’intero ecosistema degli ambienti di sviluppo installati su una macchina — con una catena di infezione a più stadi difficile da individuare con le sole difese tradizionali.

Il vettore iniziale: un’estensione che finge di essere WakaTime


Il punto di ingresso è un’estensione pubblicata sul marketplace OpenVSX sotto il nome specstudio/code-wakatime-activity-tracker. L’estensione si spaccia per WakaTime, uno strumento molto diffuso tra gli sviluppatori che tiene traccia del tempo trascorso nel codice. Una volta installata, esegue immediatamente un codice di installazione minimale — dove un modulo punta a binari nativi Node.js compilati per la piattaforma target.

Il dropper Zig: fuori dalla sandbox JavaScript


Il vero cuore della tecnica è l’uso di binari nativi Node.js (file .node) compilati con Zig — un linguaggio di sistema relativamente giovane e poco presidiato dai motori antivirus. Questi addon vengono caricati direttamente nel runtime di Node con accesso completo al sistema operativo, bypassando completamente la sandbox JavaScript di VS Code. Il comportamento è fondamentalmente diverso da quello di un’estensione normale: non è codice JS interpretato con permessi limitati, ma una libreria nativa con diritti equivalenti al processo padre. I binari identificati sono specifici per piattaforma: su Windows viene deployato win.node (PE32+ DLL), mentre su macOS viene utilizzato mac.node (Universal Mach-O). Quest’ultimo conteneva simboli di debug rivelatori, con un percorso che ha permesso ai ricercatori di identificare il developer environment dell’autore.

Autopropagazione: infettare ogni IDE sulla macchina


Una volta eseguito, il dropper Zig non si limita a compromettere l’IDE corrente: scansiona il filesystem alla ricerca di tutti gli ambienti di sviluppo compatibili con le estensioni VS Code. Su Windows controlla le directory %LOCALAPPDATA%\Programs\ e %ProgramFiles%; su macOS la cartella /Applications/. Gli IDE target includono Microsoft VS Code e VS Code Insiders, ma anche i fork come Cursor (AI-first IDE in rapida adozione), Windsurf, VSCodium e Positron. Ogni editor trovato viene infettato con una seconda estensione malevola, installata silenziosamente tramite CLI usando il parametro –install-extension. Il secondo stadio si maschera da una estensione di auto-import con milioni di installazioni, scaricato da un repository GitHub sotto controllo degli attaccanti.

Il payload finale: Solana come C2, RAT e furto di sessioni Chrome


La seconda estensione malevola implementa le capacità di spionaggio vere e proprie. Il meccanismo di C2 è particolarmente innovativo: invece di puntare a un server fisso, il malware interroga la blockchain Solana per recuperare l’indirizzo del server di comando — una tecnica che rende il blocco dell’infrastruttura C2 praticamente impossibile senza bloccare l’intera blockchain. Tra le funzionalità documentate ci sono: geofencing contro sistemi con impostazioni locali russe (l’esecuzione viene saltata), esfiltrazione di segreti, token di sessione e chiavi API dal workspace dello sviluppatore, installazione di un RAT persistente con comunicazione cifrata, e deploy di un’estensione Chrome malevola per il furto di cookie di sessione e keystroke logging.

Indicatori di compromissione

## Estensioni malevole OpenVSX
specstudio/code-wakatime-activity-tracker  (1° stadio)
floktokbok.autoimport                       (2° stadio)

## Hash SHA-256 dei binari nativi Zig
win.node (Windows PE32+ DLL):
  2819ea44e22b9c47049e86894e544f3fd0de1d8afc7b545314bd3bc718bf2e02

mac.node (macOS Universal Mach-O):
  112d1b33dd9b0244525f51e59e6a79ac5ae452bf6e98c310e7b4fa7902e4db44

## Repository GitHub per distribuzione stage-2
ColossusQuailPray/oiegjqde

## Debug artifact (attributione autore)
/Users/davidioasd/Downloads/vsx_installer_zig

## IDE target confermati
VS Code, VS Code Insiders, Cursor, Windsurf, VSCodium, Positron

Perché questa campagna è un segnale d’allarme per i team di sicurezza


GlassWorm dimostra come il marketplace delle estensioni IDE sia diventato una superficie d’attacco matura e sfruttata attivamente. La compromissione di un singolo sviluppatore può propagarsi a tutta l’organizzazione attraverso repository git, ambienti CI/CD e pipeline di build condivisi — con un impatto potenziale molto superiore a quello di un malware che colpisce un endpoint generico. Il fatto che il dropper salti deliberatamente i sistemi russi suggerisce un attore state-sponsored o comunque con motivazioni geograficamente definite, probabilmente orientato verso organizzazioni di sviluppo software in occidente e in Asia.

Consigli per i difensori


I team di sicurezza dovrebbero esaminare l’elenco delle estensioni installate su tutti gli IDE degli sviluppatori, con particolare attenzione a estensioni non presenti nel Visual Studio Marketplace ufficiale ma solo su OpenVSX. L’introduzione di policy di allowlist per le estensioni VS Code, già supportata dalla funzionalità di Policy Management di VS Code, è oggi una misura consigliata in ambienti corporate. A livello di EDR, alert sulla creazione di file .node in directory di estensioni IDE e sull’esecuzione di processi IDE con parametri –install-extension da processi non interattivi sono indicatori ad alta fedeltà. L’analisi dei log di rete alla ricerca di chiamate RPC verso nodi Solana da processi Node.js può aiutare a rilevare la fase di C2 in modo precoce.


The Pirate Post ha ricondiviso questo.

In Ungarn wird morgen gewählt, Viktor Orbán kämpft mit allen Mitteln um den Machterhalt. Nun soll die Regierung Lizenzen für ein Programm erworben haben, das Menschen mit Daten aus der Online-Werbeindustrie überwachen kann, inklusive Handy-Ortungen.

Es wäre der erste bestätigte Kauf solcher Technik in Europa. In den USA nutzt unter anderem Trumps Abschiebemiliz ICE solche Dienste.

Überwachungsstaat und Überwachungskapitalismus wachsen zusammen. #ADINT #databrokerFiles

netzpolitik.org/2026/vor-schic…

The Pirate Post ha ricondiviso questo.

The media in this post is not displayed to visitors. To view it, please go to the original post.

Smart Slider 3 Pro Plugin Backdoored via Supply Chain Attack — 800,000+ Sites at Risk
#CyberSecurity
securebulletin.com/smart-slide…
The Pirate Post ha ricondiviso questo.

The media in this post is not displayed to visitors. To view it, please go to the original post.

Payload Ransomware Group Hits Egyptian Oil Giant WASCO in Double-Extortion Attack
#CyberSecurity
securebulletin.com/payload-ran…
The Pirate Post ha ricondiviso questo.

The media in this post is not displayed to visitors. To view it, please go to the original post.

Adobe Breach: Threat Actor Claims 13 Million Support Tickets Stolen via BPO Hack — HackerOne Data at Risk
#CyberSecurity
securebulletin.com/adobe-breac…
The Pirate Post ha ricondiviso questo.

The media in this post is not displayed to visitors. To view it, please go to the original post.

CVE-2026-39987: Critical Marimo Python Notebook RCE Exploited Within 10 Hours of Disclosure
#CyberSecurity
securebulletin.com/cve-2026-39…
The Pirate Post ha ricondiviso questo.

Es war mal wieder „Databroker-Woche“ bei uns und @roofjoke fragt sich so langsam: Soll das ewig so weitergehen?

Drei Anlässe hatten wir, um diese Woche über das Thema zu berichten.

Einer davon: Unsere Databroker-Recherche gibt's jetzt auch im Fernsehen.

Unser Wochenrückblick:
netzpolitik.org/2026/kw-15-die…

in reply to netzpolitik.org

The media in this post is not displayed to visitors. To view it, please go to the original post.

danke für eure so wertvolle Arbeit und Recherchen.
Diese - und auch die aktuellen TV-Dokus mit euch - sind sehr hilfreich, Freunde und Bekannte über die Probleme der Standortfreigabe aufzuklären.

PS: Hab euren Bericht von heute Früh eben noch in die Slides für den Vortrag um 10:00 bei den #glt26 @linuxtage eingebaut - pretalx.linuxtage.at/glt26/tal… Viele Grüße aus Graz 🙂

Whistleblower prosecution has nothing to do with national security


Dear Friend of Press Freedom,

This week saw President Donald Trump threatening journalists with bogus prosecutions and his administration bringing charges against another whistleblower. But the federal government is far from the only bad actor when it comes to press freedom these days. Read on for more.

Whistleblower prosecution has nothing to do with national security


Courtney Williams, a former Army employee, has been charged under the Espionage Act for blowing the whistle to journalist Seth Harp on sexual harassment and discrimination she experienced and witnessed. Harp cited Williams as a source in his 2025 book, “The Fort Bragg Cartel,” and an article in Politico Magazine.

Freedom fo the Press Foundation (FPF) Chief of Advocacy Seth Stern said, “The notion that an administration that casually posts genocide threats during its illegal wars is worried about national security risks from whistleblowers who expose sexual harassment is absurd.”


DOJ wants to scrap the Presidential Records Act


FPF Daniel Ellsberg Chair on Government Secrecy Lauren Harper wrote for The Intercept about a bogus legal opinion that the PRA — the Watergate-era law establishing that presidents’ records are public property — is unconstitutional.

The Justice Department, Harper writes, “is effectively claiming that the presidency has private ownership over the American story.” You can use our action center to tell Congress to speak out against this attack on transparency.


No kings in DC, no compliance in LA


The Los Angeles Police Department obstructed, threatened, and arrested journalists covering the third round of “No Kings” protests — violating a federal injunction.

Watch FPF Deputy Director of Advocacy Adam Rose — who was on the ground in LA that day — explain what he witnessed. And if you’re a journalist who faced a press freedom violation, contact our U.S. Press Freedom Tracker, which is documenting the violence in LA.

And speaking of injunctions officers violated left and right, Rose has another video about an appellate ruling upholding a similar court order against the Department of Homeland Security for its press freedom violations. There’s plenty more to see on our YouTube channel.


The Republican about-face on Qatari media funding


A few years ago, then-Sen. Marco Rubio and his colleagues successfully urged the first Trump administration to force Al Jazeera to register under the Foreign Agents Registration Act.

But the second Trump administration, in which Rubio serves as secretary of state, is putting its weight behind Paramount Skydance’s acquisition of CNN parent Warner Bros. Discovery, even though the deal is financed, in part, by a Qatari sovereign wealth fund. Stern wrote about how the reversal shows that past fearmongering over foreign investment in media, including Al Jazeera and TikTok, had nothing to do with the supposed security risks and everything to do with controlling the narrative.


Judge tells Pentagon to stop censoring journalists again. Think they’ll listen this time?


Federal Judge Paul Friedman entered anorder yesterday compelling the Pentagon to comply with hisprior prohibition on enforcing its unconstitutional press policy.

Stern said in a statement that, although we appreciate Friedman granting The New York Times’ motion to compel, “at this point, any court order that responds to the administration’s blatant lawlessness with anything less than sanctions, contempt of court findings, and attorney disciplinary referrals is a disappointment.”


Sources aren’t safe when surveillance is for sale


Government agencies frequently evade the Fourth Amendment with the “data broker loophole” — using taxpayer dollars to buy sensitive, personal data about Americans and others from private data brokers.

FPF Senior Advocacy Adviser Caitlin Vogus explains that the use of data brokers for immigration enforcement has shown just how invasive this surveillance can be and how the government could use this purchased spy power to target journalists and their sources.


Trump’s threat to jail reporters deserves bipartisan condemnation


On Monday, Trump threatened to jail unnamed journalists if they do not reveal their sources for reporting about the mission to rescue airmen shot down in Iran. (Later in the week, he bizarrely threatened CNN with prosecution over completely accurate reporting).

Stern said in a statement, “Some of the most important news stories in American history have come from confidential sources, including stories that have brought down corrupt presidents. That’s why Trump is so obsessed with leaks.”


So-called ‘antifa’ prosecutions endanger the First Amendment and the press


We joined Defending Rights & Dissent and the National Lawyers Guild for a conversation about the Prairieland case in Texas, which the Trump administration is touting as its first successful domestic terrorism prosecution of “antifa.”

The defendants’ possession of anarchist zines was repeatedly touted as evidence of … something or other, even though the zines had nothing whatsoever to do with any alleged crimes any of them were accused of committing. That’s concerning to everyone who depends on the First Amendment, including the press.


What we're reading


Using AI safely as a journalist

FPF digital security team
Check out our digital security team’s three-part series to help journalists better understand risks of using artificial intelligence and set boundaries around which AI systems and tools make sense to use, adjust, or avoid.


Israel kills 3 journalists in Gaza and Lebanon in one day; CPJ calls for international action

Committee to Protect Journalists
This isn’t just a tragedy. It’s a pattern enabled by impunity — and by U.S. political and military backing.


The infrastructure nobody told you about

Backstory & Strategy
A new FBI budget request would give NSPM-7 real teeth. Journalists who report on matters arguably fitting within the nebulous scope of the presidential memorandum on domestic terrorism should take note.


Cherry Hill school district targets citizen with ludicrous lawsuit over public records

New Jersey Monitor
The district thinks a journalist filing 14 Freedom of Information Act requests in a year is a reason to sue to ban him from filing any more. Wait until they find out how many FOIAs FPF files.


freedom.press/issues/whistlebl…

Gazzetta del Cadavere reshared this.

The Pirate Post ha ricondiviso questo.

Studie: Vertrauen in Soziale Medien sehr gering, Debattenkultur im Netz erodiert netzpolitik.org/2026/studie-de…

reshared this

Pentagon ordered to stop censoring journalists … again


FOR IMMEDIATE RELEASE:

Washington, D.C., April 9, 2026 — Federal Judge Paul Friedman today entered an order compelling the Pentagon to comply with his prior prohibition against enforcing its unconstitutional press policy, which restricts journalists from asking questions to “unauthorized” personnel. The order was accompanied by a 20-page opinion explaining why the Pentagon’s revised policy was just a rehash of the one he struck down, and in some ways worse.

The following can be attributed to Freedom of the Press Foundation (FPF) Chief of Advocacy Seth Stern:

“We appreciate Judge Friedman seeing the Pentagon’s revised policy for the nonsense it is and granting The New York Times’ motion. The Constitution, of course, allows and encourages journalists to ask questions to anyone they want, authorized or unauthorized, and to publish the answers they get.

“But at this point, any court order that responds to the administration’s blatant lawlessness with anything less than sanctions, contempt of court findings, and attorney disciplinary referrals is a disappointment. It’s easy to write opinions listing the myriad ways the administration flouts the Constitution and court orders. The hard part is doing something about it. The administration will likely play more games to avoid complying with today’s order as well. Hopefully, Judge Friedman will rise to the moment.”

Please contact us if you would like further comment.


freedom.press/issues/pentagon-…

Gazzetta del Cadavere reshared this.

The Pirate Post ha ricondiviso questo.

The media in this post is not displayed to visitors. To view it, please go to the original post.

Lesetipp: Datenschutz auf EU-Ebene verstehen

Auf EU-Ebene werden weitreichende Entscheidungen zu Datenschutz und Informationssicherheit getroffen. Doch wie viel wissen wir eigentlich darüber, wer sich in Brüssel für unser Grundrecht auf Datenschutz einsetzt?

Im Interview mit netzpolitik berichten Thomas Zerdick und Robert Riemann, Mitarbeiter des Europäischen Datenschutzbeauftragten, vom Arbeitsalltag in Brüssel.

Zum Interview: netzpolitik.org/2026/grundrech…

#Datenschutz #DSVGO #Chatkontrolle

reshared this

The Pirate Post ha ricondiviso questo.

Prediction Markets sind in vielen Ländern illegal. Das Wetten auf zukünftige politische und gesellschaftliche Ereignisse wird aber immer populärer. Dabei sind die Wetten manipulationsanfällig und ethisch teilweise höchst fragwürdig.

netzpolitik.org/2026/hype-um-p…

reshared this

The Pirate Post ha ricondiviso questo.

Es wäre der erste bestätigte Kauf eines werbebasierten Überwachungstools durch eine europäische Regierung: Ungarn soll Lizenzen für ein Programm erworben haben, das Menschen mit Daten der Online-Werbeindustrie überwachen und verfolgen kann – auch anhand von Handy-Ortungen.

Genau das, wovor unsere Recherchen zu den #DatabrokerFiles warnen.

Hier fassen @roofjoke und ich die starke Recherche von @citizenlab und VSquare zusammen.

netzpolitik.org/2026/vor-schic…

Questa voce è stata modificata (2 mesi fa)
The Pirate Post ha ricondiviso questo.

Die US-Firma Penlink verkauft Überwachungstechnik, die auf Werbe-Tracking basiert. Nach Trumps Abschiebemiliz ICE hat offenbar auch die ungarische Regierung Lizenzen gekauft. Kurz vor der Wahl könnte sie damit gegen Opposition und Medienschaffende vorgehen.

netzpolitik.org/2026/vor-schic…

reshared this

The Pirate Post ha ricondiviso questo.

"Der Unterschied zwischen Vision und Theater auf dem höchsten Niveau liegt in der Arbeit dazwischen. Nicht in der glamourösen, nicht in der sichtbaren, sondern in der stillen, zeitaufwändigen, ein wenig demütigenden Arbeit, die das Geschehen auf der Bühne am Laufen hält."

Anselm Küsters in seinem überaus lesenswerten Kurz-Essay zu Kafka und KI bei @netzpolitik_feed - check it out: netzpolitik.org/2026/kafka-und…

The Pirate Post ha ricondiviso questo.

Es ist so krass, wie schnell manche Themen wieder aus dem Fokus der Öffentlichkeit verschwinden. Falls ihr euch noch für geschlechtsspezifische digitale Gewalt interessiert:

Meine Kolleg:innen @ckoever und @sebmeineck arbeiten seit Jahren dazu und erzählen mir in der aktuellen Folge des @netzpolitik_feed - Podcasts Off The Record, was für besseren Schutz zu tun ist (und was nicht):

netzpolitik.org/2026/306-off-t…

reshared this

The Pirate Post ha ricondiviso questo.

The media in this post is not displayed to visitors. To view it, please go to the original post.

The media in this post is not displayed to visitors. To view it, please go to the original post.

Il colloquio di lavoro come arma: Lazarus Group e la campagna Graphalgo contro gli sviluppatori crypto
#CyberSecurity
insicurezzadigitale.com/il-col…


Il colloquio di lavoro come arma: Lazarus Group e la campagna Graphalgo contro gli sviluppatori crypto


Si parla di:
Toggle


Da maggio 2025, un gruppo di minaccia attribuito con alta confidenza a Lazarus Group — il collettivo di hacker sponsorizzato dallo Stato nordcoreano — conduce un’operazione silenziosa e metodica contro sviluppatori JavaScript e Python specializzati in criptovalute e blockchain. La campagna, battezzata Graphalgo dai ricercatori di ReversingLabs, ha prodotto 192 pacchetti malevoli su npm e PyPI e ha preso di mira centinaia di professionisti attraverso uno strumento di social engineering particolarmente subdolo: un colloquio di lavoro tecnico.

L’esca: la finta azienda e il finto recruiter


Tutto inizia con un messaggio su LinkedIn, Facebook o un forum come Reddit. Un recruiter — cortese, professionale, apparentemente legittimo — si presenta come rappresentante di Veltrix Capital, società nel settore blockchain-fintech con un sito web dall’aspetto curato (veltrixcap.org, registrato il 4 aprile 2025). La posizione è appetibile: sviluppatore per una piattaforma di exchange crypto. Il processo di selezione è familiare: un task tecnico, un repository GitHub da clonare, del codice da eseguire.

Il repository appartiene all’organizzazione GitHub della finta azienda e appare legittimo in tutto e per tutto. La dipendenza richiesta si chiama graphnetworkx — un nome studiato per assomigliare alla ben nota libreria networkx. Oppure graphalgo, con varianti che seguono schemi di naming come graph-* o big-* su PyPI. In totale, i ricercatori hanno identificato 106 pacchetti malevoli su npm e 86 su PyPI — 192 in tutto.

La pazienza è un tratto distintivo dell’operazione: alcuni pacchetti sono rimasti benigni per settimane dopo la pubblicazione, accumulando fino a 10.000 download prima di essere attivati con il payload malevolo — una tattica che massimizza la probabilità di infettare sistemi reali prima che i controlli automatici possano rilevare la minaccia.

La catena d’attacco: tre stadi per un RAT


Il meccanismo di infezione è sofisticato quanto discreto e si articola in tre stadi.

Primo stadio: il pacchetto malevolo


Al momento dell’installazione o dell’import, il pacchetto scarica silenziosamente un secondo stadio da GitHub — non da fork anonimi, ma da repository apparentemente innocui come un banale blog_app con un file .env.example contenente payload cifrati. Nelle varianti più recenti, la raffinatezza aumenta ulteriormente: la chiave di decifrazione non è hard-coded nel pacchetto, ma viene costruita dinamicamente dagli argomenti passati al costruttore del grafo. Ad esempio, istanziare new Graph({weighted:true, directed:true}) genera la chiave "weighted-directed-graph". Il payload rimane cifrato e inerte finché il codice legittimo del candidato non lo attiva con i parametri corretti — una tecnica progettata specificamente per eludere l’analisi automatica da parte di sandbox e scanner.

Secondo stadio: il downloader adattivo


Il secondo stadio, ospitato su GitHub, funge da downloader che utilizza l’hash SHA256 del payload stesso, concatenato con l’hostname della macchina vittima, per derivare dinamicamente l’URL del server C2. Questo rende l’infrastruttura di comando e controllo unica per ogni vittima, complicando significativamente il monitoraggio e il blocco a livello di rete.

Terzo stadio: il RAT


Il Remote Access Trojan finale esiste in tre varianti — JavaScript, Python e Visual Basic Script — e comunica periodicamente con i server C2 (codepool[.]cloud, aurevian[.]cloud) per ricevere ed eseguire comandi arbitrari. Le comunicazioni sono protette da token di autenticazione, una caratteristica già osservata in precedenti campagne nordcoreane documentate, che impedisce a terze parti di interrogare l’infrastruttura C2 anche conoscendone l’indirizzo.

L’obiettivo reale: i wallet di criptovaluta


Un dettaglio rilevatore emerge dall’analisi del RAT: il malware verifica attivamente la presenza dell’estensione browser MetaMask. Non si tratta di un tentativo generico di accesso remoto: l’obiettivo primario è il furto di asset in criptovaluta, potenzialmente con accesso alle chiavi private dei wallet o alle seed phrase. Questo allinea Graphalgo con la lunga e documentata storia di Lazarus Group nel finanziamento delle operazioni di stato nordcoreane attraverso il furto di valuta digitale — una fonte di entrate stimata in miliardi di dollari negli ultimi anni.

I marcatori di attribuzione a Lazarus Group


L’attribuzione alla cellula nordcoreana non si basa su un singolo indizio, ma su una convergenza di evidenze tecniche e operative:

  • Fuso orario: i commit Git mostrano attività nel fuso GMT+9 — il fuso orario standard della Corea del Nord.
  • Tecnica d’approccio: le fake recruiter campaign sono una firma operativa consolidata del gruppo, documentata in campagne precedenti come “Contagious Interview” e “DEV-0139”.
  • Focus crypto: in linea con decine di operazioni precedenti finalizzate al furto di valuta digitale per finanziare il regime di Pyongyang.
  • C2 token-protected: tecnica osservata in precedenti campagne DPRK e mai diventata uno standard nel cybercrime comune.
  • Pazienza operativa e sviluppo attivo: la campagna è attiva da maggio 2025, con nuove varianti introdotte regolarmente; l’introduzione del naming big-* a novembre 2025 dimostra sviluppo continuativo.
  • RAT multi-linguaggio: la disponibilità di tre versioni del RAT (JS, Python, VBS) indica un’organizzazione con risorse, non un singolo attore.


Timeline della campagna


  • 2 maggio 2025: primo pacchetto npm pubblicato (graphalgo@2.2.6)
  • 13 giugno 2025: prima variante PyPI
  • 17 novembre 2025: introdotta la variante di naming big-* su npm
  • 9 dicembre 2025: variante big-* appare su PyPI
  • 4 febbraio 2026: identificata variante VBS del RAT (SHA1: dbb4031e9bb8f8821a5758a6c308932b88599f18)
  • Aprile 2026: campagna ancora attiva con nuovi package pubblicati settimanalmente


Indicatori di compromissione (IoC)

Domini C2

codepool[.]cloud
aurevian[.]cloud

Organizzazione GitHub malevola

johns92/blog_app (secondo stadio)
raw.githubusercontent.com/johns92/blog_app/refs/heads/main/server/.env.example

File sospetti

graph-settings.min.js
graph-alg.min.js
graph_config.py
load_libraries.py
/Scripts/startup.js  (directory Chrome)

Hash (variante VBS del RAT)

SHA1: dbb4031e9bb8f8821a5758a6c308932b88599f18

Come proteggersi


  • Verificare sempre l’identità del recruiter e dell’azienda prima di clonare ed eseguire qualsiasi codice proveniente da task tecnici
  • Controllare la presenza nei propri progetti di dipendenze con nomi graph-* o big-* non riconducibili a librerie standard
  • Ispezionare i processi in esecuzione per connessioni verso codepool[.]cloud e aurevian[.]cloud
  • Verificare l’integrità delle estensioni browser, in particolare MetaMask
  • Se si ha un wallet crypto sull’host potenzialmente compromesso: considerarlo esposto e ruotare immediatamente le chiavi/generare un nuovo wallet
  • Segnalare offerte di lavoro sospette che richiedono l’esecuzione di codice a npm security (npm.community) e PyPI (security@pypi.org)

Fonti primarie: ReversingLabs – Inside Graphalgo | ReversingLabs – Fake Recruiter Campaign | GBHackers


The Pirate Post ha ricondiviso questo.

This weekend we are excited to be at the #CablesofResistance conference in Berlin, which brings together various forms of resistance against Big Tech. Read the conference’s manifesto: cableresist.de/#manifest and the program: programm.infraunited.org/cable…

We will be participating in the panel “Data Centers Everywhere, Data Justice Nowhere” alongside other activists from across Europe on Saturday, April 11. More info: programm.infraunited.org/cable…

The panels will be livestreamed on the conference website.

reshared this

The Pirate Post ha ricondiviso questo.

Ce weekend nous serons présentes à la conférence #CablesofResistance à Berlin, qui réunit diverses formes de résistance contre les BigTech. Lire le manifeste de la conférence : cableresist.de/#manifest et le programme : programm.infraunited.org/cable…

Nous participons au panel "Data centers partout, data justice nulle part" aux côtés d'autres activistes en Europe, samedi 11 avril. Plus d'infos ici : programm.infraunited.org/cable…

Les panels seront aussi diffusés en stream direct sur le site de la conférence.

The Pirate Post reshared this.

The Pirate Post ha ricondiviso questo.

The media in this post is not displayed to visitors. To view it, please go to the original post.

Windows Zero-Day “BlueHammer” Exploit Code Released — SYSTEM Privileges at Risk
#CyberSecurity
securebulletin.com/windows-zer…
The Pirate Post ha ricondiviso questo.

The media in this post is not displayed to visitors. To view it, please go to the original post.

Stryker Corporation Discloses Material Cybersecurity Incident Disrupting Global Manufacturing Operations
#CyberSecurity
securebulletin.com/stryker-cor…
The Pirate Post ha ricondiviso questo.

The media in this post is not displayed to visitors. To view it, please go to the original post.

LockBit 5.0 Ransomware-as-a-Service Platform Claims 207 Victims After Criminal Relaunch
#CyberSecurity
securebulletin.com/lockbit-5-0…
The Pirate Post ha ricondiviso questo.

The media in this post is not displayed to visitors. To view it, please go to the original post.

Critical Fortinet FortiClient EMS Zero-Day CVE-2026-35616 Actively Exploited — Patch Now
#CyberSecurity
securebulletin.com/critical-fo…
The Pirate Post ha ricondiviso questo.

The media in this post is not displayed to visitors. To view it, please go to the original post.

The media in this post is not displayed to visitors. To view it, please go to the original post.

TeamPCP: la gang che ha avvelenato la supply chain del software e violato la Commissione Europea
#CyberSecurity
insicurezzadigitale.com/teampc…


TeamPCP: la gang che ha avvelenato la supply chain del software e violato la Commissione Europea


Si parla di:
Toggle


Tra marzo e aprile 2026, un gruppo criminale noto come TeamPCP ha orchestrato uno degli attacchi alla supply chain del software più devastanti degli ultimi anni: in meno di dieci giorni ha compromesso strumenti di sicurezza usati da milioni di sviluppatori, rubato credenziali da oltre 500.000 sistemi e — grazie a una chiave AWS sottratta — ha violato le infrastrutture cloud della Commissione Europea, esfiltrando 340 GB di dati da 71 enti dell’Unione.

La catena del veleno: come funziona una supply chain attack


Attaccare uno strumento usato da migliaia di organizzazioni significa colpire migliaia di bersagli con una singola operazione. TeamPCP ha applicato questa filosofia in modo sistematico, con una raffinatezza tecnica che ha sorpreso persino i ricercatori più esperti. Il punto critico sfruttato è quello che in gergo si chiama trusted build pipeline: le pipeline CI/CD che automaticamente scaricano dipendenze, eseguono scanner di sicurezza e pubblicano package su registri pubblici come npm e PyPI. Una volta compromessa questa infrastruttura, il codice malevolo si propaga silenziosamente a tutti gli utilizzatori del pacchetto.

Il punto di partenza: Trivy e le credenziali rubate


Il 19 marzo 2026, TeamPCP ha sfruttato credenziali CI/CD parzialmente ruotate dopo un incidente minore avvenuto a fine febbraio nel repository GitHub di Aqua Security Trivy — uno degli scanner di vulnerabilità open-source più utilizzati al mondo. Con queste credenziali, il gruppo ha pubblicato una versione malevola (v0.69.4) del tool ed eseguito il force-push di 76 dei 77 tag della GitHub Action aquasecurity/trivy-action, sostituendo i tag legittimi con commit malevoli.

In parallelo, il gruppo ha deturpato l’organizzazione GitHub di Aqua Security, rinominando 44 repository con il prefisso “tpcp-docs-” — un messaggio esplicito: “TeamPCP Owns Aqua Security.”

L’effetto domino: npm, Checkmarx, LiteLLM, Telnyx


A partire dal 20 marzo, TeamPCP ha sfruttato le credenziali sottratte per propagarsi orizzontalmente su altri ecosistemi:

  • npm (20–22 marzo): Compromessi più di 45 pacchetti, inclusi scope @emilgroup e @opengov, con deployment di un worm auto-replicante focalizzato su payload Kubernetes.
  • Checkmarx (23 marzo): Le GitHub Actions KICS e AST sono state backdoorate; compromesse anche due estensioni OpenVSX.
  • LiteLLM (24 marzo): Due versioni del popolare AI gateway PyPI (1.82.7 e 1.82.8) pubblicate con payload malevoli. Particolarmente insidiosa la 1.82.8: il malware è stato iniettato in un file .pth denominato litellm_init.pth. L’interprete Python processa automaticamente i file .pth all’avvio, il che significa che il malware si eseguiva ad ogni avvio di qualsiasi processo Python, indipendentemente dal fatto che LiteLLM fosse mai importato.
  • Telnyx (27 marzo): Versioni 4.87.1 e 4.87.2 avvelenate con un payload particolarmente creativo: il malware veniva scaricato da un file WAV (ringtone.wav) — un secondo stadio XOR-cifrato nascosto steganograficamente nei frame audio del file.


L’anatomia del payload: sei fasi per compromettere tutto


Il payload di LiteLLM operava in sei fasi distinte:

  1. Raccolta credenziali: variabili d’ambiente, chiavi SSH, credenziali cloud (AWS, GCP, Azure), token Kubernetes, configurazioni Docker, cronologia shell, credenziali database, wallet file, segreti CI/CD.
  2. Cifratura: chiave di sessione AES-256 con wrapping RSA-4096.
  3. Esfiltrazione: dati inviati a models.litellm[.]cloud con header HTTP X-Filename: tpcp.tar.gz.
  4. Persistenza: creazione di ~/.config/sysmon/sysmon.py e unità systemd sysmon.service.
  5. Payload secondario: polling di https://checkmarx[.]zone/raw per eseguire codice controllato dagli attaccanti.
  6. Propagazione Kubernetes: se disponibili token di service account, creazione di pod privilegiati node-setup-* per espandersi nel cluster.

Vale la pena sottolineare un dettaglio agghiacciante sul deploy Kubernetes: sui sistemi ritenuti non iraniani, veniva creato un DaemonSet host-provisioner-std; sui sistemi con caratteristiche riconducibili all’Iran, veniva invece lanciato un container denominato kamikaze che cancellava il filesystem dell’host e forzava il reboot del nodo — un payload distruttivo deliberatamente riservato a un target geopolitico specifico.

Il colpo più clamoroso: la Commissione Europea


Il 19 marzo, il payload Trivy aveva silenziosamente sottratto le chiavi API AWS della piattaforma Europa di hosting web dell’Unione Europea — chiavi che, come si è scoperto, funzionavano come master key sull’intera infrastruttura cloud della Commissione. Passano cinque giorni prima che l’accesso venga rilevato.

La timeline della crisi istituzionale:

  • 19 marzo: accesso iniziale, chiavi AWS sottratte tramite Trivy
  • 24 marzo: rilevamento dell’accesso anomalo (5 giorni di dwell time)
  • 25 marzo: CERT-EU viene notificato
  • 28 marzo: le credenziali compaiono sul dark web, pubblicate da ShinyHunters
  • 2 aprile: la Commissione Europea divulga ufficialmente l’incidente

Il bilancio: 340 GB esfiltrando (91,7 GB compressi) da 71 enti clienti della piattaforma EU — 42 dipartimenti interni della Commissione più 29 altri enti UE. Inclusi circa 52.000 file email (2,22 GB di comunicazioni in uscita). Almeno 30 entità dell’Unione potenzialmente impattate, rendendo questo uno dei breach più significativi nella storia delle istituzioni europee.

La comparsa dei dati su ShinyHunters apre ulteriori interrogativi: il gruppo criminale opera indipendentemente da TeamPCP, suggerendo che le credenziali siano state cedute o vendute, complicando ulteriormente il quadro di attribuzione.

Indicatori di compromissione (IoC)

Rete

models.litellm[.]cloud
checkmarx[.]zone
83.142.209[.]203 / 83.142.209[.]11
46.151.182[.]203
championships-peoples-point-cassette.trycloudflare.com
investigation-launches-hearings-copying.trycloudflare.com
aquasecurtiy[.]org  (typosquat)

Filesystem

litellm_init.pth
~/.config/sysmon/sysmon.py
~/.config/systemd/user/sysmon.service
/tmp/pglog
/tmp/.pg_state

Kubernetes

Pod names: node-setup-*
DaemonSets: host-provisioner-std, host-provisioner-iran
Container names: kamikaze, provisioner

Cosa fare se si è stati esposti


  • Aggiornare immediatamente i package colpiti alle versioni sicure (verificare i changelog ufficiali dei maintainer)
  • Ruotare tutte le credenziali presenti sull’host: AWS, GCP, SSH, database, token CI/CD
  • Verificare la presenza del file litellm_init.pth e del servizio sysmon.service
  • Analizzare i log di rete per traffico verso i domini e IP indicati negli IoC
  • Se si opera Kubernetes, ispezionare pod e DaemonSet per anomalie
  • Se si trovano tracce di compromissione, considerare l’host come completamente compromesso e procedere a re-imaging

Fonti primarie: Datadog Security Labs | Palo Alto Unit42 | SANS ISC


Republicans are suddenly OK with Qatari investment in U.S. news?


In August 2020, then-Sen. Marco Rubio and several of his colleagues urged the first Trump administration to force Al Jazeera to register under the Foreign Agents Registration Act. A month later, Trump’s Department of Justice granted their request.

The largely Republican coalition argued that Qatar created unspecified security risks by funding a media outlet that operated inside the United States and influenced Americans. Similar arguments led Congress to pass, and the Supreme Court to uphold, the Protecting Americans from Foreign Adversary Controlled Applications Act to force the sale of TikTok.

What a difference a few years and a $400 million jet make.

The Trump administration is now putting its weight behind Paramount Skydance’s plans to acquire Warner Bros. Discovery with help from sovereign wealth funds from Gulf States — including Qatar — which reportedly committed this week to investing up to $24 billion.

Trump, now-Secretary of State Rubio, and the other Republicans once alarmed by the supposed threat of Qatari-funded media are silent on potential significant Qatari backing of CNN and HBO (which Warner owns). The proposed investment has been public knowledge since last year.

The hypocrisy underscores why the government shouldn’t decide who owns or finances media, no matter who is in the White House, particularly absent a specific, imminent national security threat. Such authority will invariably be politicized to steer ownership away from any given administration’s critics and toward its allies, with foreign influence as a mere pretext.

As Justice Hugo Black famously said in the Pentagon Papers case, “the word ‘security’ is a broad, vague generality whose contours should not be invoked to abrogate the fundamental law embodied in the First Amendment.”

The administration doesn’t care if Ellison, the Qataris, or anyone else meddles with CNN, as long as they do so in ways the president likes.

The self-serving Republican about-face on foreign investment proves Black right. Paramount Skydance is led by Trump ally David Ellison, who has a proven track record of MAGA-fying news outlets and who has reportedly promised Trump the “sweeping changes” he wants at CNN. Put simply, Trump is confident that the new CNN will serve his interests better than the old one, precisely because he expects ownership to influence coverage.

Ellison has offered assurances that his foreign investors won’t meddle in news decisions, but there’s no indication that the administration intends to do anything to confirm that’s true. And Ellison has little credibility. He has also said he won’t meddle, which is almost certainly nonsense given his track record.

The bottom line is the administration doesn’t care if Ellison, the Qataris, or anyone else meddles, as long as they do so in ways the president likes.

Similarly, it was never about whether foreign powers’ alleged influence through Al Jazeera (or TikTok) harmed America’s interests. It was about whether those outlets furthered the agendas of those in power, for example, by supporting wars they bankrolled. Foreign ownership just offered the government a hook to punish and harass them when they didn’t.

Fearmongering about threats from Al Jazeera arose largely from the outlet’s critical coverage of Israel and, later, that nation’s U.S.-funded war in Gaza. Israel has taken it further, baselessly labeling Al Jazeera reporters terrorists as an excuse to target and kill them.

But as Trump recently said, “When somebody’s nice to me, I love that person. Even if they’re bad people, I couldn’t care less.” Now that a Qatari sovereign wealth fund seeks to invest in media that he believes will be nice to him, Trump could “care less” about supposed security risks. The U.S. government welcomes Qatari media money.

Same goes for TikTok. The worries about Chinese propaganda were really about anti-war sentiments catching on with young people. The panic about surveillance was a red herring.

If China were looking to surveil Americans’ social media activity, it could have bought the data TikTok allegedly enabled it to monitor straight from the data brokers that the same lawmakers refuse to rein in with comprehensive privacy legislation.

The marketplace of ideas isn’t limited to domestic ones.

Tellingly, when Trump became president and stalled the TikTok sale that was supposedly so urgently needed, none of them seemed to mind.

That’s not to say Al Jazeera and TikTok are above criticism — they’re certainly not. Maybe Qatar and China do influence their content. We can’t prove otherwise, any more than we can prove the British government doesn’t meddle with the BBC. But Americans who don’t like Qatar’s influence, if any, can go elsewhere. The marketplace of ideas isn’t limited to domestic ones.

And any Qatari influence likely pales in comparison to the influence Trump’s administration seeks to exert over private media outlets in the U.S., let alone government-funded ones. Has Qatar ever threatened to jail Al Jazeera journalists for not outing their sources, or to criminally investigate them for accurate reporting, let alone both in the same week?

Trump would probably be insulted by the implication that foreign governments can propagandize his constituents — he and his domestic allies like the Ellisons are doing just fine at that on their own, thank you very much.

In any event, Trump, presumably, won’t be president forever. Assuming the Paramount transaction goes through, what’s to stop a Democratic administration that dislikes the new CNN from accusing foreign investors of dictating its content and demanding it register under FARA, or labeling Qatar a foreign adversary and weaponizing the law used to ban TikTok against CNN’s websites and apps?

Never mind whether the coverage they dislike is really dictated by Qatar, as opposed to the Ellisons or whatever hacks they hire to run their news outlet. Foreigners are far easier to scapegoat. Yes, there’s the First Amendment, but the Supreme Court was all too willing to throw it aside when it came to foreign-funded media in the TikTok case. Just mumble something about national security and data privacy, and you’re in the clear, apparently.

For now, any Republicans who are legitimately concerned about risks to national security (as opposed to their own reputational security) from foreign ownership of U.S. media could prove it by opposing Qatari investment in CNN, just like they did with Al Jazeera and TikTok. They’d be wrong, but at least they’d be consistent.


freedom.press/issues/republica…

Sources aren’t safe when surveillance is for sale


Constitutional limits are increasingly being replaced with commercial transactions, putting Americans’ privacy and the free press at risk. But our representatives on Capitol Hill will soon have a chance to plug that gap.

The Fourth Amendment was designed to protect us from government searches and seizures without a warrant. But government agencies can evade this requirement with the “data broker loophole” — using taxpayer dollars to buy sensitive, personal data about Americans and others from private data brokers.

Although we’ve known about this problem for a while, recent reporting about the use of data brokers for immigration enforcement has shown just how invasive state surveillance fueled by data broker purchases can be. That reporting also has important lessons for how the government could use this purchased spy power to target journalists and their sources.

Investigative outlets like 404 Media have been at the forefront of exposing how government agencies are using data brokers to power the Trump administration’s deportation campaign. The commercial data the government is exploiting can be drawn from everyday apps like those for weather, gaming, or news.

404 Media used public records to report on Customs and Border Patrol’s purchase of online advertising data that it can use to follow people’s “precise movements over time” by tracking their phones.

It also reported on Immigration and Customs Enforcement’s use of tools based on commercial location data to monitor phones in entire neighborhoods. This kind of location tracking can identify who is using a particular device by tracking where they live or work, and can then be used to follow their movements.

According to 404 Media, ICE has also turned to Palantir, a notorious data mining and surveillance company, to find neighborhoods to raid and to create dossiers on potential targets for deportation. At least one of Palantir’s tools is powered by a Thomson Reuters product called Clear, which sells “names, addresses, car registration information, Social Security numbers, and details on someone’s ethnicity.”

Together, this and other reporting make it obvious that the Department of Homeland Security is ramping up surveillance capabilities based on the data broker loophole. And this tactic isn’t limited to immigration enforcement. In the past, the government has used data it purchased to track users of a Muslim prayer app and protesters in the racial justice movement, for instance.

With the Trump administration determined to prosecute journalists and their sources, it’s reasonable to be concerned that the data broker loophole could be used in leak investigations, too. The Department of Justice has pledged to target leakers, and the FBI has already raided one reporter’s house in connection with a national security leak investigation.

In March, FBI Director Kash Patel, who once promised to “come after” the media, testified before Congress that his agency was once again purchasing Americans’ data and location histories as part of federal investigations.

Data purchased by the government for leaks investigations could reveal reporters’ contacts with sources, with potentially devastating consequences for reporter-source confidentiality and press freedom. For instance, the government could buy location data for the devices of journalists and suspected leakers to determine if they visited the same locations at the same time. It could purchase internet records to determine if a suspected source visited a news outlet’s website or searched for a particular journalist.

The Fourth Amendment was designed to prevent exactly this kind of warrantless surveillance. But as the Center for Democracy and Technology’s Jake Laperruque noted recently, the government currently operates under a “spy first and ask forgiveness later mentality.”

Now, Congress has a rare opportunity to fix this. A new bill, the Government Surveillance Reform Act, would reauthorize and reform the government’s foreign intelligence surveillance powers under Section 702 of FISA. Crucially, it would prohibit law enforcement and intelligence agencies from buying sensitive information that otherwise would require a warrant.

Whether it’s being used for out-of-control immigration sweeps or to spy on journalists and their sources, the data broker loophole has become an insidious bypass to the Bill of Rights. The government shouldn’t be able to buy its way out of the Constitution. It’s time for Congress to close the data broker loophole.


freedom.press/issues/sources-a…


CBP Tapped Into the Online Advertising Ecosystem To Track Peoples’ Movements


📄
This article was primarily reported using public records requests. We are making it available to all readers as a public service. FOIA reporting can be expensive, please consider subscribing to 404 Media to support this work. Or send us a one time donation via our tip jar here.

Customs and Border Protection (CBP) bought data from the online advertising ecosystem to track peoples’ precise movements over time, in a process that often involves siphoning data from ordinary apps like video games, dating services, and fitness trackers, according to an internal Department of Homeland Security (DHS) document obtained by 404 Media.

The document shows in stark terms the power, and potential risk, of online advertising data and how it can be leveraged by government agencies for surveillance purposes. The news comes after Immigration and Customs Enforcement (ICE) purchased similar tools that can monitor the movements of phones in entire neighbourhoods. ICE also recently said in public procurement documents it was interested in sourcing more “Ad Tech” data for its investigations. Following 404 Media’s revelation of that ICE purchase, on Tuesday a group of around 70 lawmakers urged the DHS oversight body to conduct a new investigation into ICE’s location data buying.

💡
Do you work at CBP, ICE, or a location data company? I would love to hear from you. Using a non-work device, you can message me securely on Signal at joseph.404 or send me an email at joseph@404media.co.

This sort of information is a “goldmine for tracking where every person is and what they read, watch, and listen to,” Johnny Ryan, director of the Irish Council for Civil Liberties (ICCL) Enforce, which has closely followed the sale of advertising data, told 404 Media in an email.

This post is for subscribers only


Become a member to get access to all content
Subscribe now


Charges against whistleblower Courtney Williams have nothing to do with national security


FOR IMMEDIATE RELEASE:

Washington, D.C., April 9, 2026 — Courtney Williams, a former Army employee, has been charged under the Espionage Act for blowing the whistle to journalist Seth Harp on sexual harassment and discrimination she experienced and witnessed during her military tenure. Harp cited Williams as a source in his 2025 book, “The Fort Bragg Cartel,” and an article in Politico Magazine.

The government’s complaint is vague about what classified information Williams disclosed and what, if any, risk it contends the information posed to national security, as well as on the tactics used to obtain information about Williams, Harp, and their communications.

The following can be attributed to Freedom of the Press Foundation (FPF) Chief of Advocacy Seth Stern.

“Ask anybody who has read ‘The Fort Bragg Cartel’ which they think is the real threat to national security: Seth Harp’s sources, or the rampant corruption and criminality they enabled him to document. The administration knows the answer to that question, and that’s why it wants to punish whistleblowers and chill investigative reporting by bringing cases like this one.

“The charges also underscore why the Pentagon’s unconstitutional efforts to limit journalists’ access to everything except ‘authorized’ information are so outrageous. Does anyone think Pete Hegseth or his authorized PR flacks would have voluntarily disclosed these abuses to their briefing room of stenographers? Of course not. This is very clearly a retaliatory, anti-transparency prosecution and nothing more. The notion that an administration that casually posts genocide threats during its illegal wars is worried about national security risks from whistleblowers who expose sexual harassment is absurd.”

Please contact us if you would like further comment.


freedom.press/issues/fpf-state…

Speaking Up In The Age of AI -Strenghtening The Whistleblower Protection In The EU


For democracy to function, voices must be heard. For justice to prevail, those voices must also be protected. When both happen, transparency and trust grow together and help build healthy societies.

At its core, the idea is simple. People, no matter their position or power, should be able to report wrongdoing without fear. This could be corruption, misuse of authority, or risks to public safety.

Such individuals are known as whistleblowers.

A whistleblower is typically an employee, contractor, or insider who exposes misconduct, illegal activity, fraud, or risks to public health within an organization or government body. Yet in reality, power structures often silence those who speak up.

Raphaël Halet’s experience shows how difficult this can be. After exposing secret tax arrangements that benefited multinational corporations, he was convicted of a crime. He spent nearly a decade in legal battles before being cleared by the European Court of Human Rights in 2023.

Even more stark is the case of Daphne Caruana Galizia, who relied on whistleblowers to uncover systemic corruption in Malta. Her pursuit of the truth ultimately cost her life.

These cases reveal a hard truth. Without real protection, speaking up can come at a very high personal cost.

In response to this chilling effect, the EU Whistleblower Protection Directive was introduced. Its goal is to ensure that people who report wrongdoing are protected through secure reporting channels and safeguards against retaliation. Protecting whistleblowers is not only an ethical responsibility. It is essential for building systems that people can trust.

From Traditional Risks to the Age of AI


As the European Union moves deeper into the world of artificial intelligence, the role of whistleblowers becomes even more important.

The Directive was originally designed to address areas such as financial fraud, public safety, and environmental harm. But today, technology shapes decisions across hiring, healthcare, finance, and governance. Risks are no longer always visible or easy to detect.

This is where the EU AI Act comes in. It sets out rules for how AI systems should be designed, deployed, and monitored, especially in high-risk areas.

The relationship between the Directive and the AI Act is both practical and necessary. AI systems are often complex and difficult to understand from the outside. Regulators cannot always see how decisions are made. Insiders, however, can.

Developers, engineers, and contractors are often the first to notice problems such as biased algorithms, unsafe design, or misuse of AI tools. The Directive ensures that these individuals are protected when they speak up. The AI Act ensures that what they report is legally recognized and actionable.

By including AI-related problems and supporting safe ways to report them, the EU is doing more than just updating a law. The EU is reflecting on the fact that accountability today relies on protecting people who raise concerns from within organizations.

Together, these two frameworks create a strong foundation.

At this point, it is important to note that, from a policy perspective, integrating the Whistleblower Protection Directive and the EU AI Act offers hope for stronger compliance with rules and more transparent systems. But effective and uniform implementation requires deeper introspection.

According to the report adopted by the European Commission on 3 July, 2024, there remains a gap between what the law promises and what people experience in practice.

1. Retaliation Protection and Fundamental Rights


The Directive promises strong protection. Whistleblowers should not be dismissed, demoted, or harassed for speaking up. Employers must prove that any negative action is unrelated to the disclosure.

In reality, this protection is uneven.

Across EU Member States, enforcement varies. Some systems work well, while others are harder to access. This inconsistency weakens trust.

Retaliation is not always obvious. It can take the form of stalled careers, damaged reputations, or workplace isolation. These effects are difficult to prove but deeply felt.

Enforcement also remains a challenge. Authorities may lack resources or technical expertise, especially in complex AI cases. When retaliation is unlikely to be punished, protection risks becoming symbolic.

The Directive protects whistleblowers from being held responsible for acting in the public interest. But with AI, there are grey areas. Some risks might not break the law but can still cause harm. This makes people unsure if they are protected when they raise ethical issues.

At a deeper level, whistleblowing is tied to fundamental rights such as freedom of expression and access to information. When someone is silenced, the public loses access to important truths.

The AI Act recognizes this role, but in practice, retaliation is still often treated as a workplace issue rather than a broader democratic concern.

2. Scope in the Digital and Technology Sector


Extending protection to AI is a necessary step, but it also highlights new challenges.

From August 2026, violations of the AI Act will clearly fall within the Directive’s scope. This extends protection to employees, contractors, and self-employed individuals working with AI systems. Secure and anonymous reporting tools have also been introduced.

However, gaps remain.

AI risks can spread quickly. A flawed system can affect thousands of people at once. Bias can be repeated automatically without being noticed.

Many risks appear before any law is broken. For example, an AI system may rely on biased data or flawed testing. These issues may not be illegal, but they can still cause harm.

This creates uncertainty. Those who identify early risks are often unsure whether they are protected if they report them.

There are also limits on who is covered. Researchers, auditors, and civil society groups play an important role in identifying risks, but they are not always fully protected.

This creates a clear gap. Those best placed to detect problems are not always adequately protected when they speak up.

3. Transparency, Awareness, and Accessibility


Legal protection only works if people know about it and trust it.

The Directive requires organizations to establish mechanisms for reporting problems, but these systems are not always clear or easy to use. Some employees worry their identity will be revealed. Others do not know what happens after they report something. This uncertainty makes people less likely to speak up.

The AI Act introduces new tools that improve confidentiality and access. However, full protection for AI-related disclosures will only clearly apply from August 2026, leaving a period of uncertainty.

Non-traditional workers face additional challenges. Contractors, freelancers, and self-employed individuals are included in the law, but often lack formal reporting structures. Many depend on short-term contracts, which makes speaking up riskier.

Delays in implementing the Directive across Member States have also affected trust. Uneven adoption has led to confusion and reduced awareness.

When laws are not applied consistently, people are less likely to rely on them.

Conclusion: From Legal Framework to Real Protection


The European Union has created a strong legal framework by aligning the EU Whistleblower Protection Directive with the EU AI Act.

The challenge now is making it work in practice.

This requires consistent enforcement, stronger institutional support, and greater awareness. Protection should also cover new risks, not just clear legal violations. For example, AI systems might unintentionally discriminate in hiring, reinforce bias in healthcare, or make decisions that cannot be explained. These problems may not break the law, but they can still cause harm.

Reporting systems must be easy to access and trustworthy. Most importantly, retaliation must be treated as a serious issue that affects not just individuals’ but public trust.

In a world shaped by complex technologies, accountability often depends on individuals willing to speak up.

Protecting them is not just good policy. It is essential for the future.


europeanpirates.eu/speaking-up…

The Pirate Post ha ricondiviso questo.

In Folge unserer Recherchen zu den #DatabrokerFiles hat die Hamburger Datenschutzbehörde gravierende Verstöße bei einer bekannten Dating-App gefunden. Demnach habe die App genaue Handy-Standortdaten an Werbefirmen geschickt, selbst wenn Nutzer*innen nicht eingewilligt haben. 📌👀

- mit @roofjoke für @netzpolitik_feed

netzpolitik.org/2026/nach-unse…

reshared this

The Pirate Post ha ricondiviso questo.

Eine populäre deutsche Dating-App hat genaue Handy-Standortdaten an Werbefirmen geschickt, selbst wenn Nutzer*innen nicht eingewilligt haben. Genau solche Daten fanden netzpolitik.org und BR im Angebot von Databrokern – eine große Gefahr für Nutzer*innen.

netzpolitik.org/2026/nach-unse…

The Pirate Post ha ricondiviso questo.

The media in this post is not displayed to visitors. To view it, please go to the original post.

C'est ce soir à Marseille !


Jeudi 9 avril aura lieu à Marseille une discussion publique autour des révélations de Disclose sur l'utilisation de la reconnaissance faciale lors de contrôles d'identités. Ce sera à partir de 18h30 à la Fraternité-Belle de Mai (7 boulevard Burel, 13003 Marseille).
Inscription sur helloasso.com/associations/dis…

Les intervenant·es s’interrogeront sur cette pratique. Quels sont nos droits ? Que peut faire la police en matière de reconnaissance faciale, de photo ? Comment se défendre ?


Questa voce è stata modificata (2 mesi fa)

The Pirate Post reshared this.

in reply to La Quadrature du Net

Est-ce fait avec du matériel de la firme Palantir? Dirigée par des escrocs d'extrême-droite, le propriétaire P. Thiel a déclaré que "la démocratie et l'économie ne sont plus compatibles". Le Premier Ministre britannique leur a fourgué le Service de Santé, et on vient de s'apercevoir que la firme avait obtenu les adresses email d'1,5 millions de gens qui travaillent dans la santé...
The Pirate Post ha ricondiviso questo.

KI sei verfänglich für faschistische Ideologien und gehe mit autoritären Machtzentren einher. Große Plattformen wie ImmobilienScout24 und Doctolib machen Profit mit Grundbedürfnissen der Menschen. Zwei Aktivist*innen schlagen im Interview konkrete Schritte hin zu einer demokratischen digitalen Teilhabe vor.

netzpolitik.org/2026/widerstan…