Defense

A 2.9 GB Telegram exfiltration archive places 845 credential-theft packages and the operators themselves in Ho Chi Minh City. The cluster operates a corporate front, eggcop.com, with eight identified staff mailboxes and one strongly attributed individual operator.

When the White House press shop tells a former Secretary of State to shut his stupid mouth, the public sees the language and misses the substance. The substance is that Pompeo's argument on Iran was correct on the merits.

Ohio volunteers are recovering Revolutionary War soldiers who died without official documentation. These men built America with their lives. The irony of calling them undocumented while Congress debates who belongs here is not lost on anyone paying attention.

The distinction between military cyber operations under Title 10 authority and intelligence operations under Title 50 authority has become a pressure point inside U.S. Cyber Command. The organizational confusion costs operational efficiency and creates legal exposure.

A sophisticated threat actor I designate INDIGO RUST has been conducting sustained reconnaissance against telecommunications infrastructure operators for approximately eighteen weeks. I am withholding the affected vendor and the affected build. The patch is not out yet.

The Vietnamese-aligned cluster I track as EGGCOP has pivoted. The LinkedIn approach is now joined by a second vector working through industry conference registration channels. The defensive read has shifted.

Office of the Director of National Intelligence officials confirmed to Congress that Section 702 surveillance warrants have exceeded legal scope in specific cases. Intelligence Committee staffers expressed concern about overly broad application.

Cisco's Secure Workload has a vulnerability advisory queued for publication this week. I am withholding the technical particulars. Operators of the platform should already have patch deployment and API authentication telemetry posture calibrated.

Three former NSD attorneys say the division's litigation posture has changed in the last six months in ways the public docket does not yet reflect. The implications for foreign agent registration enforcement are substantial.

Second Amendment advocacy groups raised 47 million dollars last fiscal year while veteran suicide rates climbed to 6,200 annually. The disconnect is stunning and demands honest debate.

The authority you operate under determines the oversight you answer to. The current habit of laundering Title 10 activity through Title 50 framings, and the reverse, breaks the system the Congress built.

VA's quarterly performance data show the disability claims backlog has grown for two consecutive quarters. The agency's press shop has not described the trend on the record.

An advanced actor I track as OBSIDIAN HALCYON has been operating against identity-provider infrastructure for at least seven weeks. I am withholding the affected platform vendor and the affected build. The patch is not out yet.

Industrial control system reconnaissance activity has resurfaced across U.S. water and energy distribution operators in the trailing ten days. The tradecraft signatures are consistent with Iranian-affiliated programs that have been on standby through Q1.

The debate over a separate cyber force has focused on whether to create a new uniformed service. The harder question, which the service-branch debate obscures, is what authority architecture the cyber mission actually requires.

The Iranian Revolutionary Guard Corps cyber component is standing up an operational wave that two intelligence officials describe in detail. The public reporting is days away. The defensive posture across critical infrastructure verticals is the question.

Senior intelligence officers are quietly raising alarm about the volume of cleared material now circulating outside SCIFs. The pattern shows up in three places at once, and it is not a coincidence.

An attacker cluster has been operating against a major cloud-hosted learning management platform for two weeks. The initial public acknowledgment will be a containment narrative. The recompromise risk is materially higher than that narrative will suggest.

The Department of Defense's acquisition system produces capable platforms slowly. The slow production was tolerable when the strategic environment moved slowly. The strategic environment has stopped moving slowly.

Pete Hegseth's assessment that Iran's chaotic retaliation drove its own partners toward Washington is accurate, not spin. Tehran handed the United States a strategic windfall through operational failure and regional miscalculation.

Mexican cartels are adjusting strategy in response to Trump's FTO designations and military pressure. For the first time in a generation, cartel commanders fear American retaliation. That's progress, but only if Washington holds the line.

France is proposing a broader European nuclear deterrent as American commitment to NATO faces political uncertainty. This is the strategic reckoning Europe chose to defer for thirty years, and the bill is now due.

The ammunition shortage plaguing Ukrainian forces isn't just about production capacity. Supply chain bottlenecks and allied logistics failures are creating a critical gap between demand and delivery. Combat units are rationing shells they need yesterday.