Security

ICE wants to build a 24/7 social media surveillance team

Biz & IT, digital surveillance, federal surveillance, Government surveillance, immigration, immigration and customs enforcement, Policy, Security, syndication / Mike M. / October 4, 2025

Together, these teams would operate as intelligence arms of ICE’s Enforcement and Removal Operations division. They will receive tips and incoming cases, research individuals online, and package the results into dossiers that could be used by field offices to plan arrests.

The scope of information contractors are expected to collect is broad. Draft instructions specify open-source intelligence: public posts, photos, and messages on platforms from Facebook to Reddit to TikTok. Analysts may also be tasked with checking more obscure or foreign-based sites, such as Russia’s VKontakte.

They would also be armed with powerful commercial databases such as LexisNexis Accurint and Thomson Reuters CLEAR, which knit together property records, phone bills, utilities, vehicle registrations, and other personal details into searchable files.

The plan calls for strict turnaround times. Urgent cases, such as suspected national security threats or people on ICE’s Top Ten Most Wanted list, must be researched within 30 minutes. High-priority cases get one hour; lower-priority leads must be completed within the workday. ICE expects at least three-quarters of all cases to meet those deadlines, with top contractors hitting closer to 95 percent.

The plan goes beyond staffing. ICE also wants algorithms, asking contractors to spell out how they might weave artificial intelligence into the hunt—a solicitation that mirrors other recent proposals. The agency has also set aside more than a million dollars a year to arm analysts with the latest surveillance tools.

ICE did not immediately respond to a request for comment.

Earlier this year, The Intercept revealed that ICE had floated plans for a system that could automatically scan social media for “negative sentiment” toward the agency and flag users thought to show a “proclivity for violence.” Procurement records previously reviewed by 404 Media identified software used by the agency to build dossiers on flagged individuals, compiling personal details, family links, and even using facial recognition to connect images across the web. Observers warned it was unclear how such technology could distinguish genuine threats from political speech.

ICE wants to build a 24/7 social media surveillance team Read More »

A biological 0-day? Threat-screening tools may miss AI-designed proteins.

AI, biohazards, bioterrorism, protein design, risk assessment, Science, Security / Beth Washington / October 4, 2025

Ordering DNA for AI-designed toxins doesn’t always raise red flags.

Designing variations of the complex, three-dimensional structures of proteins has been made a lot easier by AI tools. Credit: Historical / Contributor

On Thursday, a team of researchers led by Microsoft announced that they had discovered, and possibly patched, what they’re terming a biological zero-day—an unrecognized security hole in a system that protects us from biological threats. The system at risk screens purchases of DNA sequences to determine when someone’s ordering DNA that encodes a toxin or dangerous virus. But, the researchers argue, it has become increasingly vulnerable to missing a new threat: AI-designed toxins.

How big of a threat is this? To understand, you have to know a bit more about both existing biosurveillance programs and the capabilities of AI-designed proteins.

Catching the bad ones

Biological threats come in a variety of forms. Some are pathogens, such as viruses and bacteria. Others are protein-based toxins, like the ricin that was sent to the White House in 2003. Still others are chemical toxins that are produced through enzymatic reactions, like the molecules associated with red tide. All of them get their start through the same fundamental biological process: DNA is transcribed into RNA, which is then used to make proteins.

For several decades now, starting the process has been as easy as ordering the needed DNA sequence online from any of a number of companies, which will synthesize a requested sequence and ship it out. Recognizing the potential threat here, governments and industry have worked together to add a screening step to every order: the DNA sequence is scanned for its ability to encode parts of proteins or viruses considered threats. Any positives are then flagged for human intervention to evaluate whether they or the people ordering them truly represent a danger.

Both the list of proteins and the sophistication of the scanning have been continually updated in response to research progress over the years. For example, initial screening was done based on similarity to target DNA sequences. But there are many DNA sequences that can encode the same protein, so the screening algorithms have been adjusted accordingly, recognizing all the DNA variants that pose an identical threat.

The new work can be thought of as an extension of that threat. Not only can multiple DNA sequences encode the same protein; multiple proteins can perform the same function. To form a toxin, for example, typically requires the protein to adopt the correct three-dimensional structure, which brings a handful of critical amino acids within the protein into close proximity. Outside of those critical amino acids, however, things can often be quite flexible. Some amino acids may not matter at all; other locations in the protein could work with any positively charged amino acid, or any hydrophobic one.

In the past, it could be extremely difficult (meaning time-consuming and expensive) to do the experiments that would tell you what sorts of changes a string of amino acids could tolerate while remaining functional. But the team behind the new analysis recognized that AI protein design tools have now gotten quite sophisticated and can predict when distantly related sequences can fold up into the same shape and catalyze the same reactions. The process is still error-prone, and you often have to test a dozen or more proposed proteins to get a working one, but it has produced some impressive successes.

So, the team developed a hypothesis to test: AI can take an existing toxin and design a protein with the same function that’s distantly related enough that the screening programs do not detect orders for the DNA that encodes it.

The zero-day treatment

The team started with a basic test: use AI tools to design variants of the toxin ricin, then test them against the software that is used to screen DNA orders. The results of the test suggested there was a risk of dangerous protein variants slipping past existing screening software, so the situation was treated like the equivalent of a zero-day vulnerability.

“Taking inspiration from established cybersecurity processes for addressing such situations, we contacted the relevant bodies regarding the potential vulnerability, including the International Gene Synthesis Consortium and trusted colleagues in the protein design community as well as leads in biosecurity at the US Office of Science and Technology Policy, US National Institute of Standards and Technologies, US Department of Homeland Security, and US Office of Pandemic Preparedness and Response,” the authors report. “Outside of those bodies, details were kept confidential until a more comprehensive study could be performed in pursuit of potential mitigations and for ‘patches’… to be developed and deployed.”

Details of that original test are being made available today as part of a much larger analysis that extends the approach to a large range of toxic proteins. Starting with 72 toxins, the researchers used three open source AI packages to generate a total of about 75,000 potential protein variants.

And this is where things get a little complicated. Many of the AI-designed protein variants are going to end up being non-functional, either subtly or catastrophically failing to fold up into the correct configuration to create an active toxin. The only way to know which ones work is to make the proteins and test them biologically; most AI protein design efforts will make actual proteins from dozens to hundreds of the most promising-looking potential designs to find a handful that are active. But doing that for 75,000 designs is completely unrealistic.

Instead, the researchers used two software-based tools to evaluate each of the 75,000 designs. One of these focuses on the similarity between the overall predicted physical structure of the proteins, and another looks at the predicted differences between the positions of individual amino acids. Either way, they’re a rough approximation of just how similar the proteins formed by two strings of amino acids should be. But they’re definitely not a clear indicator of whether those two proteins would be equally functional.

In any case, DNA sequences encoding all 75,000 designs were fed into the software that screens DNA orders for potential threats. One thing that was very clear is that there were huge variations in the ability of the four screening programs to flag these variant designs as threatening. Two of them seemed to do a pretty good job, one was mixed, and another let most of them through. Three of the software packages were updated in response to this performance, which significantly improved their ability to pick out variants.

There was also a clear trend in all four screening packages: The closer the variant was to the original structurally, the more likely the package (both before and after the patches) was to be able to flag it as a threat. In all cases, there was also a cluster of variant designs that were unlikely to fold into a similar structure, and these generally weren’t flagged as threats.

What does this mean?

Again, it’s important to emphasize that this evaluation is based on predicted structures; “unlikely” to fold into a similar structure to the original toxin doesn’t mean these proteins will be inactive as toxins. Functional proteins are probably going to be very rare among this group, but there may be a handful in there. That handful is also probably rare enough that you would have to order up and test far too many designs to find one that works, making this an impractical threat vector.

At the same time, there are also a handful of proteins that are very similar to the toxin structurally and not flagged by the software. For the three patched versions of the software, the ones that slip through the screening represent about 1 to 3 percent of the total in the “very similar” category. That’s not great, but it’s probably good enough that any group that tries to order up a toxin by this method would attract attention because they’d have to order over 50 just to have a good chance of finding one that slipped through, which would raise all sorts of red flags.

One other notable result is that the designs that weren’t flagged were mostly variants of just a handful of toxin proteins. So this is less of a general problem with the screening software and might be more of a small set of focused problems. Of note, one of the proteins that produced a lot of unflagged variants isn’t toxic itself; instead, it’s a co-factor necessary for the actual toxin to do its thing. As such, some of the screening software packages didn’t even flag the original protein as dangerous, much less any of its variants. (For these reasons, the company that makes one of the better-performing software packages decided the threat here wasn’t significant enough to merit a security patch.)

So, on its own, this work doesn’t seem to have identified something that’s a major threat at the moment. But it’s probably useful, in that it’s a good thing to get the people who engineer the screening software to start thinking about emerging threats.

That’s because, as the people behind this work note, AI protein design is still in its early stages, and we’re likely to see considerable improvements. And there’s likely to be a limit to the sorts of things we can screen for. We’re already at the point where AI protein design tools can be used to create proteins that have entirely novel functions and do so without starting with variants of existing proteins. In other words, we can design proteins that are impossible to screen for based on similarity to known threats, because they don’t look at all like anything we know is dangerous.

Protein-based toxins would be very difficult to design, because they have to both cross the cell membrane and then do something dangerous once inside. While AI tools are probably unable to design something that sophisticated at the moment, I would be hesitant to rule out the prospects of them eventually reaching that sort of sophistication.

Science, 2025. DOI: 10.1126/science.adu8578 (About DOIs).

John is Ars Technica’s science editor. He has a Bachelor of Arts in Biochemistry from Columbia University, and a Ph.D. in Molecular and Cell Biology from the University of California, Berkeley. When physically separated from his keyboard, he tends to seek out a bicycle, or a scenic location for communing with his hiking boots.

A biological 0-day? Threat-screening tools may miss AI-designed proteins. Read More »

Google confirms Android dev verification will have free and paid tiers, no public list of devs

Apps, Google, play store, privacy, Security, Tech / DJ Henderson / October 4, 2025

A lack of trust

Google has an answer for the most problematic elements of its verification plan, but anywhere there’s a gap, it’s easy to see a conspiracy. Why? Well, let’s look at the situation in which Google finds itself.

The courts have ruled that Google acted illegally to maintain a monopoly in the Play Store—it worked against the interests of developers and users for years to make Google Play the only viable source of Android apps, and for what? The Play Store is an almost unusable mess of sponsored search results and suggested apps, most of which are little more than in-app purchase factories that deliver Google billions of dollars every year.

Google has every reason to protect the status quo (it may take the case all the way to the Supreme Court), and now it has suddenly decided the security risk of sideloaded apps must be addressed. The way it’s being addressed puts Google in the driver’s seat at a time when alternative app stores may finally have a chance to thrive. It’s all very convenient for Google.

Developers across the Internet are expressing wariness about giving Google their personal information. Google, however, has decided anonymity is too risky. We now know a little more about how Google will manage the information it collects on developers, though. While Play Store developer information is listed publicly, the video confirms there will be no public list of sideload developers. However, Google will have the information, and that means it could be demanded by law enforcement or governments.

The current US administration has had harsh words for apps like ICEBlock, which it successfully pulled from the Apple App Store. Google’s new centralized control of app distribution would allow similar censorship on Android, and the real identities of those who developed such an app would also be sitting in a Google database, ready to be subpoenaed. A few years ago, developers might have trusted Google with this data, but now? The goodwill is gone.

Google confirms Android dev verification will have free and paid tiers, no public list of devs Read More »

Japan is running out of its favorite beer after ransomware attack

cyberattack, ransomware, Security, syndication / DJ Henderson / October 2, 2025

According to cyber security experts at the Tokyo-based group Nihon Cyber Defence (NCD), Japanese companies are increasingly seen as attractive targets for ransomware attackers because of their poor defenses and the fact that many companies simply paid the demanded sum through back channels.

In 2024 Japan’s National Police Agency said it had received 222 official reports of ransomware attacks—a 12 percent rise from the previous year, but experts at NCD said it represented just a small fraction of the real volume of attacks.

In a survey conducted by the agency, Japanese companies said that in 49 percent of ransomware cases, it took at least a month to recover the data lost in the attack. Asahi said in a statement that there was no confirmed leakage of customer data to external parties.

In a measure of growing public and private sector panic over cyber vulnerabilities, Japan passed a law in May that granted the government greater rights to proactively combat cyber criminals and state-sponsored hackers. The chair of the government’s policy research council at the time, Itsunori Onodera, warned that without an urgent upgrade of the nation’s cyber security, “the lives of Japanese people will be put at risk.”

Asahi, whose shares fell 2.6 percent on Thursday, not only produces Super Dry beer in Japan but also soft drinks, mints, and baby food, as well as producing own brand goods for Japanese retailers.

Asahi is still investigating whether it was a ransomware attack, according to a spokesperson.

As a result of the cyber attack, Asahi has postponed the planned launch of eight new Asahi products, including fruit soda, lemon-flavored ginger ale, and protein bars, indefinitely.

On Wednesday, Asahi trialled using paper-based systems to process orders and deliveries in a small-scale trial and it is in the process of figuring out whether to proceed with more manual-style deliveries.

Operations in other regions of the world, such as Europe, where it sells Peroni Nastro Azzurro, have not been affected by the cyber attack.

Japan is running out of its favorite beer after ransomware attack Read More »

That annoying SMS phish you just got may have come from a box like this

Biz & IT, hacking, modems, phishing, Security, smishing, SMS / Mike M. / October 2, 2025

Scammers have been abusing unsecured cellular routers used in industrial settings to blast SMS-based phishing messages in campaigns that have been ongoing since 2023, researchers said.

The routers, manufactured by China-based Milesight IoT Co., Ltd., are rugged Internet of Things devices that use cellular networks to connect traffic lights, electric power meters, and other sorts of remote industrial devices to central hubs. They come equipped with SIM cards that work with 3G/4G/5G cellular networks and can be controlled by text message, Python scripts, and web interfaces.

An unsophisticated, yet effective, delivery vector

Security company Sekoia on Tuesday said that an analysis of “suspicious network traces” detected in its honeypots led to the discovery of a cellular router being abused to send SMS messages with phishing URLs. As company researchers investigated further, they identified more than 18,000 such routers accessible on the Internet, with at least 572 of them allowing free access to programming interfaces to anyone who took the time to look for them. The vast majority of the routers were running firmware versions that were more than three years out of date and had known vulnerabilities.

The researchers sent requests to the unauthenticated APIs that returned the contents of the routers’ SMS inboxes and outboxes. The contents revealed a series of campaigns dating back to October 2023 for “smishing”—a common term for SMS-based phishing. The fraudulent text messages were directed at phone numbers located in an array of countries, primarily Sweden, Belgium, and Italy. The messages instructed recipients to log in to various accounts, often related to government services, to verify the person’s identity. Links in the messages sent recipients to fraudulent websites that collected their credentials.

“In the case under analysis, the smishing campaigns appear to have been conducted through the exploitation of vulnerable cellular routers—a relatively unsophisticated, yet effective, delivery vector,” Sekoia researchers Jeremy Scion and Marc N. wrote. “These devices are particularly appealing to threat actors, as they enable decentralized SMS distribution across multiple countries, complicating both detection and takedown efforts.”

That annoying SMS phish you just got may have come from a box like this Read More »

Rocket Report: Keeping up with Kuiper; New Glenn’s second flight slips

ariane 6, artemis II, astra, blue origin, Firefly Aerospace, moon, NASA, new glenn, rocket report, Security, Space, space launch system, spacex, starship, VIPER / Kelly Newman / September 26, 2025

Amazon plans to conduct two launches of Kuiper broadband satellites just days apart.

An unarmed Trident II D5 Life Extension (D5LE) missile launches from an Ohio-class ballistic missile submarine off the coast of Florida. Credit: US Navy

Welcome to Edition 8.12 of the Rocket Report! We often hear from satellite operators—from the military to venture-backed startups—about their appetite for more launch capacity. With so many rocket launches happening around the world, some might want to dismiss these statements as a corporate plea for more competition, and therefore lower prices. SpaceX is on pace to launch more than 150 times this year. China could end the year with more than 70 orbital launches. These are staggering numbers compared to global launch rates just a few years ago. But I’m convinced there’s room for more alternatives for reliable (and reusable) rockets. All of the world’s planned mega-constellations will need immense launch capacity just to get off the ground, and if successful, they’ll go into regular replacement and replenishment cycles. Throw in the still-undefined Golden Dome missile shield and many nations’ desire for a sovereign launch capability, and it’s easy to see the demand curve going up.

As always, we welcome reader submissions. If you don’t want to miss an issue, please subscribe using the box below (the form will not appear on AMP-enabled versions of the site). Each report will include information on small-, medium-, and heavy-lift rockets, as well as a quick look ahead at the next three launches on the calendar.

Sharp words from Astra’s Chris Kemp. Chris Kemp, the chief executive officer of Astra, apparently didn’t get the memo about playing nice with his competitors in the launch business. Kemp made some spicy remarks at the Berkeley Space Symposium 2025 earlier this month, billed as the largest undergraduate aerospace event at the university (see video of the talk). During the speech, Kemp periodically deviated from building up Astra to hurling insults at several of his competitors in the launch industry, Ars reports. To be fair to Kemp, some of his criticisms are not without a kernel of truth. But they are uncharacteristically rough all the same, especially given Astra’s uneven-at-best launch record and financial solvency to date.

Wait, what?! … Kemp is generally laudatory in his comments about SpaceX, but his most crass statement took aim at the quality of life of SpaceX employees at Starbase, Texas. He said life at Astra is “more fun than SpaceX because we’re not on the border of Mexico where they’ll chop your head off if you accidentally take a left turn.” For the record, no SpaceX employees have been beheaded. “And you don’t have to live in a trailer. And we don’t make you work six and a half days a week, 12 hours a day.” Kemp also accused Firefly Aerospace of sending Astra “garbage” rocket engines as part of the companies’ partnership on propulsion for Astra’s next-generation rocket.

The easiest way to keep up with Eric Berger’s and Stephen Clark’s reporting on all things space is to sign up for our newsletter. We’ll collect their stories and deliver them straight to your inbox.

Sign Me Up!

A step forward for Europe’s reusable rocket program. No one could accuse the European Space Agency and its various contractors of moving swiftly when it comes to the development of reusable rockets. However, it appears that Europe is finally making some credible progress, Ars reports. Last week, the France-based ArianeGroup aerospace company announced that it completed the integration of the Themis vehicle, a prototype rocket that will test various landing technologies, on a launch pad in Sweden. Low-altitude hop tests, a precursor for developing a rocket’s first stage that can vertically land after an orbital launch, could start late this year or early next.

Hopping into the future … “This milestone marks the beginning of the ‘combined tests,’ during which the interface between Themis and the launch pad’s mechanical, electrical, and fluid systems will be thoroughly trialed, with the aim of completing a test under cryogenic conditions,” ArianeGroup said. This particular rocket will likely undergo only short hops, initially about 100 meters. A follow-up vehicle, Themis T1E, is intended to fly medium-altitude tests at a later date. Some of the learnings from these prototypes will feed into a smaller, reusable rocket intended to lift 500 kilograms to low-Earth orbit. This is under development by MaiaSpace, a subsidiary of ArianeGroup. Eventually, the European Space Agency would like to use technology developed as part of Themis to develop a new line of reusable rockets that will succeed the Ariane 6 rocket.

Navy conducts Trident missile drills. The US Navy carried out four scheduled missile tests of a nuclear-capable weapons system off the coast of Florida within the last week, Defense News reports. The service’s Strategic Systems Programs conducted flights of unarmed Trident II D5 Life Extension missiles from a submerged Ohio-class ballistic missile submarine from September 17 to September 21 as part of an ongoing scheduled event meant to test the reliability of the system. “The missile tests were not conducted in response to any ongoing world events,” a Navy release said.

Secret with high visibility … The Navy periodically performs these Trident missile tests off the coasts of Florida and California, taking advantage of support infrastructure and range support from the two busiest US spaceports. The military doesn’t announce the exact timing of the tests, but warnings issued for pilots to stay out of the area give a general idea of when they might occur. One of the launch events Sunday was visible from Puerto Rico, illuminating the night sky in photos published on social media. The missiles fell in the Atlantic Ocean as intended, the Navy said. The Trident II D5 missiles were developed in the 1980s and are expected to remain in service on the Navy’s ballistic missile submarines into the 2040s. The Trident system is one leg of the US military’s nuclear triad, alongside land-based Minuteman ballistic missiles and nuclear-capable strategic bombers. (submitted by EllPeaTea)

Firefly plans for Alpha’s return to flight. Firefly Aerospace expects to resume Alpha launches in the “coming weeks,” with two flights planned before the end of the year, Space News reports. These will be the first flights of Firefly’s one-ton-class Alpha rocket since a failure in April destroyed a Lockheed Martin tech demo satellite after liftoff from California. In a quarterly earnings call, Firefly shared a photo showing its next two Alpha rockets awaiting shipment from the company’s Texas factory.

Righting the ship … These next two launches really need to go well for Firefly. The Alpha rocket has, at best, a mixed record with only two fully successful flights in six attempts. Two other missions put their payloads into off-target orbits, and two Alpha launches failed to reach orbit at all. Firefly went public on the NASDAQ stock exchange last month, raising nearly $900 million in the initial public offering to help fund the company’s future programs, namely the medium-lift Eclipse rocket developed in partnership with Northrop Grumman. There’s a lot to like about Firefly. The company achieved the first fully successful landing of a commercial spacecraft on the Moon in March. NASA has selected Firefly for three more commercial landings on the Moon, and Firefly reported this week it has an agreement with an unnamed commercial customer for an additional dedicated mission. But the Alpha program hasn’t had the same level of success. We’ll see if Firefly can get the rocket on track soon. (submitted by EllPeaTea)

Avio wins contract to launch “extra-European” mission. Italian rocket builder Avio has signed a launch services agreement with US-based launch aggregator SpaceLaunch for a Vega C launch carrying an Earth observation satellite for an “extra-European institutional customer” in 2027, European Spaceflight reports. Avio announced that it had secured the launch contract on September 18. According to the company, the contract was awarded through an open international competition, with Vega C chosen for its “versatility and cost-effectiveness.” While Avio did not reveal the identity of the “extra-European” customer, it said that it would do so later this year.

Plenty of peculiarities … There are several questions to unpack here, and Andrew Parsonson of European Spaceflight goes through them all. Presumably, extra-European means the customer is based outside of Europe. Avio’s statement suggests we’ll find out the answer to that question soon. Details about the US-based launch broker SpaceLaunch are harder to find. SpaceLaunch appears to have been founded in January 2025 by two former Firefly Aerospace employees with a combined 40 years of experience in the industry. On its website, the company claims to provide end-to-end satellite launch integration, mission management, and launch procurement services with a “portfolio of launch vehicle capacity around the globe.” SpaceLaunch boasts it has supported the launch of more than 150 satellites on 12 different launch vehicles. However, according to public records, it does not appear that the company itself has supported a single launch. Instead, the claim seems to credit SpaceLaunch with launches that were actually carried out during the two founders’ previous tenures at Spaceflight, Firefly Aerospace, Northrop Grumman, and the US Air Force. (submitted by EllPeaTea)

Falcon 9 launches three missions for NASA and NOAA. Scientists loaded three missions worth nearly $1.6 billion on a SpaceX Falcon 9 rocket for launch Wednesday, toward an orbit nearly a million miles from Earth, to measure the supersonic stream of charged particles emanating from the Sun, Ars reports. One of the missions, from the National Oceanic and Atmospheric Administration (NOAA), will beam back real-time observations of the solar wind to provide advance warning of geomagnetic storms that could affect power grids, radio communications, GPS navigation, air travel, and satellite operations. The other two missions come from NASA, with research objectives that include studying the boundary between the Solar System and interstellar space and observing the rarely seen outermost layer of our own planet’s atmosphere.

Immense value …All three spacecraft will operate in orbit around the L1 Lagrange point, a gravitational balance point located more than 900,000 miles (1.5 million kilometers) from Earth. Bundling these three missions onto the same rocket saved at least tens of millions of dollars in launch costs. Normally, they would have needed three different rockets. Rideshare missions to low-Earth orbit are becoming more common, but spacecraft departing for more distant destinations like the L1 Lagrange point are rare. Getting all three missions on the same launch required extensive planning, a stroke of luck, and fortuitous timing. “This is the ultimate cosmic carpool,” said Joe Westlake, director of NASA’s heliophysics division. “These three missions heading out to the Sun-Earth L1 point riding along together provide immense value for the American taxpayer.”

US officials concerned about China mastering reusable launch. SpaceX’s dominance in reusable rocketry is one of the most important advantages the United States has over China as competition between the two nations extends into space, US Space Force officials said Monday. But several Chinese companies are getting close to fielding their own reusable rockets, Ars reports. “It’s concerning how fast they’re going,” said Brig. Gen. Brian Sidari, the Space Force’s deputy chief of space operations for intelligence. “I’m concerned about when the Chinese figure out how to do reusable lift that allows them to put more capability on orbit at a quicker cadence than currently exists.”

By the numbers … China has used 14 different types of rockets on its 56 orbital-class missions this year, and none have flown more than 11 times. Eight US rocket types have cumulatively flown 145 times, with 122 of those using SpaceX’s workhorse Falcon 9. Without a reusable rocket, China must maintain more rocket companies to sustain a launch rate of just one-third to one-half that of the United States. This contrasts with the situation just four years ago, when China outpaced the United States in orbital rocket launches. The growth in US launches has been a direct result of SpaceX’s improvements to launch at a higher rate, an achievement primarily driven by the recovery and reuse of Falcon 9 boosters and payload fairings.

Atlas V launches more Kuiper satellites. Roughly an hour past sunrise Thursday, an Atlas V rocket from United Launch Alliance took flight from Cape Canaveral Space Force Station, Florida. Onboard the rocket, flying in its most powerful configuration, were the next 27 Project Kuiper broadband satellites from Amazon, Spaceflight Now reports. This is the third batch of production satellites launched by ULA and the fifth overall for the growing low-Earth orbit constellation. The Atlas V rocket released the 27 Kuiper satellites about 280 miles (450 kilometers) above Earth. The satellites will use onboard propulsion to boost themselves to their assigned orbit at 392 miles (630 kilometers).

Another Kuiper launch on tap … With this deployment, Amazon now has 129 satellites in orbit. This is a small fraction of the network’s planned total of 3,232 satellites, but Amazon has enjoyed a steep ramp-up in the Kuiper launch cadence as the company’s satellite assembly line in Kirkland, Washington, continues churning out spacecraft. Another 24 Kuiper satellites are slated to launch September 30 on a SpaceX Falcon 9 rocket, and Amazon has delivered enough satellites to Florida for an additional launch later this fall. (submitted by EllPeaTea)

German military will fly with Ariane 6. Airbus Defense and Space has awarded Arianespace a contract to launch a pair of SATCOMBw-3 communications satellites for the German Armed Forces, European Spaceflight reports. Airbus is the prime contractor for the nearly $2.5 billion (2.1 billion euro) SATCOMBw-3 program, which will take over from the two-satellite SATCOMBw-2 constellation currently providing secure communications for the German military. Arianespace announced Wednesday that it had been awarded the contract to launch the satellites aboard two Ariane 6 rockets. “By signing this new strategic contract for the German Armed Forces, Arianespace accomplishes its core mission of guaranteeing autonomous access to space for European sovereign satellites,” said Arianespace CEO David Cavaillolès.

Running home to Europe … The chief goal of the Ariane 6 program is to provide Europe with independent access to space, something many European governments see as a strategic requirement. Several European military, national security, and scientific satellites have launched on SpaceX Falcon 9 rockets in the last few years as officials waited for the debut of the Ariane 6 rocket. With three successful Ariane 6 flights now in the books, European customers seem to now have the confidence to commit to flying their satellites on Ariane 6. (submitted by EllPeaTea)

Artemis II launch targeted for February. NASA is pressing ahead with preparations for the first launch of humans beyond low-Earth orbit in more than five decades, and officials said Tuesday that the Artemis II mission could take flight early next year, Ars reports. Although work remains to be done, the space agency is now pushing toward a launch window that opens on February 5, 2026, officials said during a news conference on Tuesday at Johnson Space Center. The Artemis II mission represents a major step forward for NASA and seeks to send four astronauts—Reid Wiseman, Victor Glover, Christina Koch, and Jeremy Hansen—around the Moon and back. The 10-day mission will be the first time astronauts have left low-Earth orbit since the Apollo 17 mission in December 1972.

Orion named Integrity … The first astronauts set to fly to the Moon in more than 50 years will do so in Integrity, Ars reports. NASA’s Artemis II crew revealed Integrity as the name of their Orion spacecraft during a news conference on Wednesday at the Johnson Space Center in Houston. “We thought, as a crew, we need to name this spacecraft. We need to have a name for the Orion spacecraft that we’re going to ride this magical mission on,” said Wiseman, commander of the Artemis II mission.

FAA reveals new Starship trajectories. Sometime soon, perhaps next year, SpaceX will attempt to fly one of its enormous Starship rockets from low-Earth orbit back to its launch pad in South Texas. A successful return and catch at the launch tower would demonstrate a key capability underpinning Elon Musk’s hopes for a fully reusable rocket. In order for this to happen, SpaceX must overcome the tyranny of geography. A new document released by the Federal Aviation Administration shows the narrow corridors Starship will fly to space and back when SpaceX tries to recover them, Ars reports.

Flying over people … It was always evident that flying a Starship from low-Earth orbit back to Starbase would require the rocket to fly over Mexico and portions of South Texas. The rocket launches to the east over the Gulf of Mexico, so it must approach Starbase from the west when it comes in for a landing. The new maps show SpaceX will launch Starships to the southeast over the Gulf and the Caribbean Sea, and directly over Jamaica, or to the northeast over the Gulf and the Florida peninsula. On reentry, the ship will fly over Baja California and Mexico’s interior near the cities of Hermosillo and Chihuahua, each with a population of roughly a million people. The trajectory would bring Starship well north of the Monterrey metro area and its 5.3 million residents, then over the Rio Grande Valley near the Texas cities of McAllen and Brownsville.

New Glenn’s second flight at least a month away. The second launch of Blue Origin’s New Glenn rocket, carrying a NASA smallsat mission to Mars, is now expected in late October or early November, Space News reports. Tim Dunn, NASA’s senior launch director at Kennedy Space Center, provided an updated schedule for the second flight of New Glenn in comments after a NASA-sponsored launch on a Falcon 9 rocket Wednesday. Previously, the official schedule from NASA showed the launch date as no earlier than September 29.

No surprise … It was already apparent that this launch wouldn’t happen September 29. Blue Origin has test-fired the second stage for the upcoming flight of the New Glenn rocket but hasn’t rolled the first stage to the launch pad for its static fire. Seeing the rocket emerge from Blue’s factory in Florida will be an indication that the launch date is finally near. Blue Origin will launch NASA’s ESCAPADE mission, a pair of small satellites to study how the solar wind interacts with the Martian upper atmosphere.

Blue Origin will launch a NASA rover to the Moon. NASA has awarded Blue Origin a task order worth up to $190 million to deliver its Volatiles Investigating Polar Exploration Rover (VIPER) to the Moon’s surface, Aviation Week & Space Technology reports. Blue Origin, one of 13 currently active Commercial Lunar Payload Services (CLPS) providers, submitted the only bid to carry VIPER to the Moon after NASA requested offers from industry last month. NASA canceled the VIPER mission last year, citing cost overruns with the rover and delays in its planned ride to the Moon aboard a lander provided by Astrobotic. But engineers had already completed assembly of the rover, and scientists protested NASA’s decision to terminate the mission.

Some caveats … Blue Origin will deliver VIPER to a location near the Moon’s south pole in late 2027 using a robotic Blue Moon MK1 lander, a massive craft larger than the Apollo lunar landing module. The company’s first Blue Moon MK1 lander is scheduled to fly to the Moon next year. NASA’s contract for the VIPER delivery calls for Blue Origin to design accommodations for the rover on the Blue Moon lander. The agency said it will decide whether to proceed with the actual launch on a New Glenn rocket and delivery of VIPER to the Moon based partially on the outcome of the first Blue Moon test flight next year.

Next three launches

Sept. 26: Long March 4C | Unknown Payload | Jiuquan Satellite Launch Center, China | 19: 20 UTC

Sept. 27: Long March 6A | Unknown Payload | Taiyuan Satellite Launch Center, China | 12: 39 UTC

Sept. 28: Falcon 9 | Starlink 11-20 | Vandenberg Space Force Base, California | 23: 32 UTC

Stephen Clark is a space reporter at Ars Technica, covering private space companies and the world’s space agencies. Stephen writes about the nexus of technology, science, policy, and business on and off the planet.

Rocket Report: Keeping up with Kuiper; New Glenn’s second flight slips Read More »

As many as 2 million Cisco devices affected by actively exploited 0-day

Biz & IT, Cisco, exploit, Security, zero-day, zero-day vulnerability / Beth Washington / September 25, 2025

As many as 2 million Cisco devices are susceptible to an actively exploited zero-day that can remotely crash or execute code on vulnerable systems.

Cisco said Wednesday that the vulnerability, tracked as CVE-2025-20352, was present in all supported versions of Cisco IOS and Cisco IOS XE, the operating system that powers a wide variety of the company’s networking devices. The vulnerability can be exploited by low-privileged users to create a denial-of-service attack or by higher-privileged users to execute code that runs with unfettered root privileges. It carries a severity rating of 7.7 out of a possible 10.

Exposing SNMP to the Internet? Yep

“The Cisco Product Security Incident Response Team (PSIRT) became aware of successful exploitation of this vulnerability in the wild after local Administrator credentials were compromised,” Wednesday’s advisory stated. “Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability.”

The vulnerability is the result of a stack overflow bug in the IOS component that handles SNMP (simple network management protocol), which routers and other devices use to collect and handle information about devices inside a network. The vulnerability is exploited by sending crafted SNMP packets.

To execute malicious code, the remote attacker must have possession of read-only community string, an SNMP-specific form of authentication for accessing managed devices. Frequently, such strings ship with devices. Even when modified by an administrator, read-only community strings are often widely known inside an organization. The attacker would also require privileges on the vulnerable systems. With that, the attacker can obtain RCE (remote code execution) capabilities that run as root.

As many as 2 million Cisco devices affected by actively exploited 0-day Read More »

Supermicro server motherboards can be infected with unremovable malware

baseboard management controllers, Biz & IT, bms, exploits, Security, supermicro / Shannon Garcia / September 24, 2025

Servers running on motherboards sold by Supermicro contain high-severity vulnerabilities that can allow hackers to remotely install malicious firmware that runs even before the operating system, making infections impossible to detect or remove without unusual protections in place.

One of the two vulnerabilities is the result of an incomplete patch Supermicro released in January, said Alex Matrosov, founder and CEO of Binarly, the security firm that discovered it. He said that the insufficient fix was meant to patch CVE-2024-10237, a high-severity vulnerability that enabled attackers to reflash firmware that runs while a machine is booting. Binarly discovered a second critical vulnerability that allows the same sort of attack.

“Unprecedented persistence”

Such vulnerabilities can be exploited to install firmware similar to ILObleed, an implant discovered in 2021 that infected HP Enterprise servers with wiper firmware that permanently destroyed data stored on hard drives. Even after administrators reinstalled the operating system, swapped out hard drives, or took other common disinfection steps, ILObleed would remain intact and reactivate the disk-wiping attack. The exploit the attackers used in that campaign had been patched by HP four years earlier but wasn’t installed in the compromised devices.

“Both issues provide unprecedented persistence power across significant Supermicro device fleets including [in] AI data centers,” Matrasov wrote to Ars in an online interview, referring to the two latest vulnerabilities Binarly discovered. “After they patched [the earlier vulnerability], we looked at the rest of the attack surface and found even worse security problems.”

The two new vulnerabilities—tracked as CVE-2025-7937 and CVE-2025-6198—reside inside silicon soldered onto Supermicro motherboards that run servers inside data centers. Baseboard management controllers (BMCs) allow administrators to remotely perform tasks such as installing updates, monitoring hardware temperatures, and setting fan speeds accordingly. BMCs also enable some of the most sensitive operations, such as reflashing the firmware for the UEFI (Unified Extensible Firmware Interface) that’s responsible for loading the server OS when booting. BMCs provide these capabilities and more, even when the servers they’re connected to are turned off.

Supermicro server motherboards can be infected with unremovable malware Read More »

US uncovers 100,000 SIM cards that could have “shut down” NYC cell network

NYC, Secret Service, Security, sim cards, spying, UN / Shannon Garcia / September 23, 2025

The US Secret Service announced this morning that it has located and seized a cache of telecom devices large enough to “shut down the cellular network in New York City.” And it believes a nation-state is responsible.

According to the agency, “more than 300 co-located SIM servers and 100,000 SIM cards” were discovered at multiple locations within the New York City area. Photos of the seized gear show what appear to be “SIM boxes” bristling with antennas and stuffed with SIM cards, then stacked on six-shelf racks. (SIM boxes are often used for fraud.) One photo even shows neatly stacked towers of punched-out SIM card packaging, suggesting that whoever put the system together invested some quality time in just getting the whole thing set up.

The gear was identified as part of a Secret Service investigation into “anonymous telephonic threats” made against several high-ranking US government officials, but the setup seems designed for something larger than just making a few threats. The Secret Service believes that the system could have been capable of activities like “disabling cell phone towers, enabling denial of services attacks and facilitating anonymous, encrypted communication between potential threat actors and criminal enterprises.”

So many empty SIM card packages… Secret Service

Analysis of data from so many devices will take time, but preliminary investigation already suggests that “nation-state threat actors” were involved; that is, this is probably some country’s spy hardware. With the UN General Assembly taking place this week in New York, it is possible that the system was designed to spy on or disrupt delegates, but the gear was found in various places up to 35 miles from the UN. BBC reporting suggests that the equipment was “seized from SIM farms at abandoned apartment buildings across more than five sites,” and the ultimate goal remains unclear.

While the gear has been taken offline, no arrests have yet been made, and the investigation continues.

US uncovers 100,000 SIM cards that could have “shut down” NYC cell network Read More »

Microsoft’s Entra ID vulnerabilities could have been catastrophic

cloud vulnerability, microsoft, Security, security vulnerability, syndication / Beth Washington / September 20, 2025

“Microsoft built security controls around identity like conditional access and logs, but this internal impression token mechanism bypasses them all,” says Michael Bargury, the CTO at security firm Zenity. “This is the most impactful vulnerability you can find in an identity provider, effectively allowing full compromise of any tenant of any customer.”

If the vulnerability had been discovered by, or fallen into the hands of, malicious hackers, the fallout could have been devastating.

“We don’t need to guess what the impact may have been; we saw two years ago what happened when Storm-0558 compromised a signing key that allowed them to log in as any user on any tenant,” Bargury says.

While the specific technical details are different, Microsoft revealed in July 2023 that the Chinese cyber espionage group known as Storm-0558 had stolen a cryptographic key that allowed them to generate authentication tokens and access cloud-based Outlook email systems, including those belonging to US government departments.

Conducted over the course of several months, a Microsoft postmortem on the Storm-0558 attack revealed several errors that led to the Chinese group slipping past cloud defenses. The security incident was one of a string of Microsoft issues around that time. These motivated the company to launch its “Secure Future Initiative,” which expanded protections for cloud security systems and set more aggressive goals for responding to vulnerability disclosures and issuing patches.

Mollema says that Microsoft was extremely responsive about his findings and seemed to grasp their urgency. But he emphasizes that his findings could have allowed malicious hackers to go even farther than they did in the 2023 incident.

“With the vulnerability, you could just add yourself as the highest privileged admin in the tenant, so then you have full access,” Mollema says. Any Microsoft service “that you use EntraID to sign into, whether that be Azure, whether that be SharePoint, whether that be Exchange—that could have been compromised with this.”

This story originally appeared on wired.com.

Microsoft’s Entra ID vulnerabilities could have been catastrophic Read More »

Two of the Kremlin’s most active hack groups are collaborating, ESET says

advanced persistent threat, APT, Biz & IT, gamaredon, russia, Security, turla / Kelly Newman / September 20, 2025

But ESET said its most likely hypothesis is that Turla and Gamaredon were working together. “Given that both groups are part of the Russian FSB (though in two different Centers), Gamaredon provided access to Turla operators so that they could issue commands on a specific machine to restart Kazuar, and deploy Kazuar v2 on some others,” the company said.

Friday’s post noted that Gamaredon has been seen collaborating with other hack groups previously, specifically in 2020 with a group ESET tracks under the name InvisiMole.

In February, ESET said, company researchers spotted four distinct Gamaredon-Turla co-compromises in Ukraine. On all of the machines, Gamaredon deployed a wide range of tools, including those tracked under the names PteroLNK, PteroStew, PteroOdd, PteroEffigy, and PteroGraphin. Turla, for its part, installed version 3 of its proprietary malware Kazuar.

ESET software installed on one of the compromised devices observed Turla issuing commands through the Gamaredon implants.

“PteroGraphin was used to restart Kazuar, possibly after Kazuar crashed or was not launched automatically,” ESET said. “Thus, PteroGraphin was probably used as a recovery method by Turla. This is the first time that we have been able to link these two groups together via technical indicators (see First chain: First chain: Restart of Kazuar v3).”

Then, in April and again in June, ESET said it detected Kazuar v2 installers being deployed by Gamaredon malware. In all the cases, ESET software was installed after the compromises, so it wasn’t possible to recover the payloads. Nonetheless, the firm said it believes an active collaboration between the groups is the most likely explanation.

“All those elements, and the fact that Gamaredon is compromising hundreds if not thousands of machines, suggest that Turla is interested only in specific machines, probably ones containing highly sensitive intelligence,” ESET speculated.

Two of the Kremlin’s most active hack groups are collaborating, ESET says Read More »

Two UK teens charged in connection to Scattered Spider ransomware attacks

Biz & IT, criminal courts, Cyberattacks, ransomware, Security / 9u50fv / September 19, 2025

Federal prosecutors charged a UK teenager with conspiracy to commit computer fraud and other crimes in connection with the network intrusions of 47 US companies that generated more than $115 million in ransomware payments over a three-year span.

A criminal complaint unsealed on Thursday (PDF) said that Thalha Jubair, 19, of London, was part of Scattered Spider, the name of an English-language-speaking group that has breached the networks of scores of companies worldwide. After obtaining data, the group demanded that the victims pay hefty ransoms or see their confidential data published or sold.

Bitcoin paid by victims recovered

The unsealing of the document, filed in US District Court of the District of New Jersey, came the same day Jubair and another alleged Scattered Spider member—Owen Flowers, 18, from Walsall, West Midlands—were charged by UK prosecutors in connection with last year’s cyberattack on Transport for London. The agency, which oversees London’s public transit system, faced a monthslong recovery effort as a result of the breach.

Both men were arrested at their homes on Thursday and appeared later in the day at Westminster Magistrates Court, where they were remanded to appear in Crown Court on October 16, Britain’s National Crime Agency said. Flowers was previously arrested in connection with the Transport for London attack in September 2024 and later released. NCA prosecutors said that besides the attack on the transit agency, Flowers and other conspirators were responsible for a cyberattack on SSM Health Care and attempting to breach Sutter Health, both of which are located in the US. Jubair was also charged with offenses related to his refusal to turn over PIN codes and passwords for devices seized from him.

Two UK teens charged in connection to Scattered Spider ransomware attacks Read More »