SITREP - Independent OSINT Channel
Kanalga Telegram’da o‘tish
AI, technology, mass surveillance, and intelligence — everything you need to know about tomorrow.
Ko'proq ko'rsatish📈 Telegram kanali SITREP - Independent OSINT Channel analitikasi
SITREP - Independent OSINT Channel (@sitreports) Ingliz til segmentidagi kanali faol ishtirokchi. Hozirda hamjamiyat 23 341 obunachidan iborat bo'lib, Texnologiyalar & Aralashmalar toifasida 5 711-o'rinni va AQSH mintaqasida 1 723-o'rinni egallagan.
📊 Auditoriya ko‘rsatkichlari va dinamika
невідомо sanasidan buyon loyiha tez o‘sib, 23 341 obunachiga ega bo‘ldi.
11 Iyul, 2026 dagi oxirgi ma’lumotlarga ko‘ra kanal barqaror faollikka ega. Oxirgi 30 kunda obunachilar soni -188 ga, so‘nggi 24 soatda esa -3 ga o‘zgardi va umumiy qamrov yuqori darajada qolmoqda.
- Tasdiqlash holati: Tasdiqlanmagan
- Jalb etish (ER): Auditoriya o‘rtacha 2.84% darajada jalb etiladi. Nashrdan keyingi dastlabki 24 soatda kontent odatda umumiy obunachilar sonining 1.83% ini tashkil etuvchi reaksiyalarni to‘playdi.
- Post qamrovi: Har bir post o‘rtacha 662 marta ko‘riladi; birinchi sutkada odatda 427 ta ko‘rish yig‘iladi.
- Reaksiyalar va o‘zaro ta’sir: Auditoriya faol: har bir postga o‘rtacha 0 ta reaksiya keladi.
- Tematik yo‘nalishlar: Kontent narrative, attack, infrastructure, threat, credential kabi asosiy mavzularga jamlangan.
📝 Tavsif va kontent siyosati
Muallif resursni shaxsiy fikrni ifoda etish maydoni sifatida ta’riflaydi:
“AI, technology, mass surveillance, and intelligence — everything you need to know about tomorrow.”
Yuqori yangilanish chastotasi (oxirgi ma’lumot 12 Iyul, 2026 da olingan) sababli kanal doimo dolzarb va katta qamrovli bo‘lib qoladi. Analitika auditoriya kontent bilan faol hamkorlik qilishini, uni Texnologiyalar & Aralashmalar toifasidagi muhim ta’sir nuqtasiga aylantirishini ko‘rsatadi.
23 341
Obunachilar
-324 soatlar
-467 kunlar
-18830 kunlar
Ma'lumot yuklanmoqda...
O'xshash kanallar
Taglar buluti
Kirish va chiqish esdaliklari
---
---
---
---
---
---
Obunachilarni jalb qilish
Iyul '26
Iyul '26
+18
6 kanalda
Iyun '26
+154
2 kanalda
Get PRO
May '26
+48
6 kanalda
Get PRO
Aprel '26
+113
14 kanalda
Get PRO
Mart '26
+380
6 kanalda
Get PRO
Fevral '26
+121
1 kanalda
Get PRO
Yanvar '26
+143
1 kanalda
Get PRO
Dekabr '25
+90
4 kanalda
Get PRO
Noyabr '25
+92
1 kanalda
Get PRO
Oktabr '25
+43
2 kanalda
Get PRO
Sentabr '25
+22
1 kanalda
Get PRO
Avgust '25
+14
2 kanalda
Get PRO
Iyul '25
+136
2 kanalda
Get PRO
Iyun '25
+186
5 kanalda
Get PRO
May '25
+28
6 kanalda
Get PRO
Aprel '25
+13
6 kanalda
Get PRO
Mart '25
+13
5 kanalda
Get PRO
Fevral '25
+11
9 kanalda
Get PRO
Yanvar '25
+11
3 kanalda
Get PRO
Dekabr '24
+62
5 kanalda
Get PRO
Noyabr '24
+128
32 kanalda
Get PRO
Oktabr '24
+45
1 kanalda
Get PRO
Sentabr '24
+93
8 kanalda
Get PRO
Avgust '24
+1 524
67 kanalda
Get PRO
Iyul '24
+478
54 kanalda
Get PRO
Iyun '24
+984
76 kanalda
Get PRO
May '24
+1 380
80 kanalda
Get PRO
Aprel '24
+1 274
64 kanalda
Get PRO
Mart '24
+1 674
74 kanalda
Get PRO
Fevral '24
+1 629
80 kanalda
Get PRO
Yanvar '24
+1 576
67 kanalda
Get PRO
Dekabr '23
+1 932
63 kanalda
Get PRO
Noyabr '23
+1 211
75 kanalda
Get PRO
Oktabr '23
+1 367
60 kanalda
Get PRO
Sentabr '23
+1 173
0 kanalda
Get PRO
Avgust '23
+985
0 kanalda
Get PRO
Iyul '23
+597
0 kanalda
Get PRO
Iyun '23
+1 518
0 kanalda
Get PRO
May '23
+1 048
0 kanalda
Get PRO
Aprel '23
+1 017
0 kanalda
Get PRO
Mart '23
+675
0 kanalda
Get PRO
Fevral '23
+1 080
0 kanalda
Get PRO
Yanvar '23
+2 476
0 kanalda
Get PRO
Dekabr '22
+4 174
0 kanalda
Get PRO
Noyabr '22
+5 621
0 kanalda
| Sana | Obunachilarni jalb qilish | Esdaliklar | Kanallar | |
| 12 Iyul | 0 | |||
| 11 Iyul | +3 | |||
| 10 Iyul | +4 | |||
| 09 Iyul | +1 | |||
| 08 Iyul | +2 | |||
| 07 Iyul | 0 | |||
| 06 Iyul | +1 | |||
| 05 Iyul | 0 | |||
| 04 Iyul | 0 | |||
| 03 Iyul | +1 | |||
| 02 Iyul | +5 | |||
| 01 Iyul | +1 |
Kanal postlari
🔍 Dell BIOS flaw exposes recoverable passwords from SPI flash
Dell has disclosed CVE-2026-40639 under DSA-2026-197, a BIOS password storage flaw affecting the SystemPwSmm SMM driver across multiple client platforms. Passwords stored in the DVAR region use a repeating XOR scheme that leaks key material through null padding, allowing plaintext recovery from an SPI flash dump without brute force once flash access is obtained.
The issue turns BIOS passwords into weak obfuscation rather than a security boundary. With physical or attacker-controlled OS access, recovered credentials can support Secure Boot or pre-boot protection bypass, widening risk for disk-encrypted systems and for fleets reusing the same BIOS password.
🛰️ Open sources - closed narratives
@sitreports
| 2 |  🔍 Trojanized Visual Studio projects expand software supply chain risk
A multi-stage malware cluster documented by Doctor Web researchers weaponizes Visual Studio workflows by inserting malicious pre-build events into .vcxproj and .csproj files. The chain also infects .suo files, Dear ImGui components, and winnetwk.h, while delivering credential theft, clipboard hijacking, backdoor access, cryptomining, and propagation via trojanized executables.
The key operational shift is execution through trusted developer activity: opening, cloning, or building an infected project can trigger reinfection and push compromised code further downstream. Monitoring pre-build events, mutexes Global\PFNMX and global\PFNX_side, and GitHub or Steam-based dead-drop C2 resolution is now directly relevant to build pipeline defense.
🛰️ Open sources - closed narratives
@sitreports | 97 |
| 3 |  🔍 Compromised jscrambler 8.14.0 npm release executed hidden binary at install
The npm package jscrambler version 8.14.0 was reported compromised, with the install process triggering a concealed platform-specific binary. The malicious release used the trusted jscrambler package path to run code during dependency installation rather than at application runtime.
This is a supply-chain intrusion with immediate developer workstation exposure. The key issue is execution on install, which can bypass normal application testing boundaries and affect CI/CD hosts, build systems, and local environments before the package is ever used.
🛰️ Open sources - closed narratives
@sitreports | 145 |
| 4 |  🔍 Balochistan Police portal used in parallel espionage activity
A compromised Balochistan Police web portal was reportedly weaponized by multiple threat groups to deliver malware and support cyber-espionage operations, turning a legitimate government platform into an infection vector. The campaign outlined in The Hacker News report highlights overlapping abuse of trusted regional infrastructure.
The case underlines a familiar operational pattern: attackers gain leverage not only through malware, but through the credibility of official portals. For defenders, this shifts attention from payload analysis alone to the security posture, monitoring, and integrity of public-sector web assets.
🛰️ Open sources - closed narratives
@sitreports | 177 |
| 5 |  📡 DARPA opens heavy-lift drone challenge with 124 teams
DARPA has selected 124 teams from more than 20 countries for its Lift Challenge, a vertical-lift UAS competition set for Aug. 2-9 in Dayton, Ohio. The event will test drones on a five-nautical-mile circuit, with up to $6.5 million in prizes for the best payload-to-weight ratios and novel designs. The target is a four-to-one payload-to-weight ratio for cargo-carrying drones.
The program is focused on logistics rather than strike or ISR roles. If the benchmark is met, it would directly address the current cost barrier in vertical lift by reducing aircraft size for the same payload, with clear military utility for resupply and wider commercial relevance.
🛰️ Open sources - closed narratives
@sitreports | 572 |
| 6 |  🔍 Pentagon moves post-quantum cryptography toward contractor compliance
The Pentagon’s June PQC Strategy says Cybersecurity Maturity Model Certification requirements will be updated to incorporate quantum-resistant algorithms for the defense industrial base. The document sets department-wide targets for systems to support PQC by end-2030 and employ it by end-2031, while CMMC Revision 3 has formally entered transition. Enforcement details and timelines for contractors remain undefined.
Operationally, this signals that quantum resilience is moving from long-range planning into the compliance pipeline for defense suppliers. The main constraint is execution: CMMC changes require rulemaking, many firms are still adapting to Revision 3, and current PQC rollouts can disrupt existing infrastructure.
🛰️ Open sources - closed narratives
@sitreports | 504 |
| 7 |  🔍 Fake Entra passkey enrollment used to seize Microsoft 365 access
Attackers are using spoofed Microsoft Entra passkey enrollment flows to obtain access to Microsoft 365 accounts. The method abuses user trust in legitimate authentication branding and targets passkey setup as the entry point rather than password theft.
The case highlights a shift from credential harvesting toward adversary-controlled MFA and passwordless enrollment. For defenders, the key issue is that account compromise can occur during the authentication lifecycle itself, making enrollment monitoring and user-facing identity workflows a direct attack surface.
🛰️ Open sources - closed narratives
@sitreports | 446 |
| 8 |  🔍 Progress orders ShareFile server shutdown over active threat
Progress Software told ShareFile customers using on-premises Storage Zone Controllers to immediately shut down the Windows servers hosting them after identifying a “credible external security threat.” The company also temporarily disabled affected accounts in the ShareFile cloud, while a status page warning says customers with Storage Zone Controllers are currently not operational.
The key point is that cloud-side restrictions were judged insufficient, indicating risk remains at the internet-facing controller layer itself. These hybrid nodes broker file transfers between ShareFile and customer-managed storage, making them a high-value exposure point with direct operational impact.
🛰️ Open sources - closed narratives
@sitreports | 430 |
| 9 |  🔍 Laser fault attack hits Tangem hardware wallets
Researchers demonstrated a laser-based fault injection method that can reset the access code on Tangem wallet cards, enabling unauthorized wallet takeover if an attacker has physical possession. The affected cards are described as unpatchable, leaving deployed hardware exposed to a permanent design-level weakness detailed in the Tangem wallet report.
The case underscores a core hardware-security problem: physical access can bypass software trust assumptions, and immutable consumer devices offer no remediation path once a flaw is confirmed. For custodial hygiene, device recovery and replacement become the only meaningful mitigations.
🛰️ Open sources - closed narratives
@sitreports | 374 |
| 10 |  📡 Researcher maps WhatsApp-to-host chain via three OpenClaw flaws
A security researcher detailed an attack path from WhatsApp to underlying host access by chaining three vulnerabilities in OpenClaw. The report outlines how multiple weaknesses can be combined to move from an exposed messaging surface toward host-level compromise.
The case highlights the operational risk of cross-layer exploit chains: issues that appear isolated can become materially more severe when linked across application and host boundaries. For defenders, the key takeaway is that patching priority should reflect chaining potential, not just standalone CVSS-style severity.
🛰️ Open sources - closed narratives
@sitreports | 406 |
| 11 |  🔍 New U-Boot flaws expose early-boot attack surface
Six vulnerabilities in the widely used bootloader U-Boot were disclosed by Binarly, including two that may allow arbitrary code execution during FIT signature verification and four that can crash devices. The affected code reportedly dates back to version 2013.07 and may impact more than 50 releases plus downstream vendor forks.
The issue is operationally significant because compromise at the bootloader stage occurs before the OS and its security tooling start. Systems using remote firmware update paths, including some BMC environments, expand the exposure, while remediation depends on vendor firmware updates rather than upstream fixes alone.
🛰️ Open sources - closed narratives
@sitreports | 383 |
| 12 |  🔍 Gitea Docker auth bypass is under active exploitation
Attackers are exploiting CVE-2026-20896, a critical authentication bypass in the official Gitea Docker image. The flaw affects default deployments where reverse-proxy auth headers are trusted from any source, allowing unauthenticated users to impersonate arbitrary accounts, including admins. Publicly exposed Gitea instances number about 6,200, though vulnerable exposure remains unclear.
Operationally, this is a configuration-level trust failure in a widely used self-hosted code platform. Immediate risk includes unauthorized access to repositories, CI/CD workflows, and admin functions. Fixed releases are 1.26.3 and 1.26.4; if patching is delayed, trusted proxy IPs should be restricted and logs reviewed for header-based abuse.
🛰️ Open sources - closed narratives
@sitreports | 376 |
| 13 |  🔍 Injective Labs GitHub breach used to seed wallet-key-stealing npm packages
A compromise of Injective Labs’ GitHub account was used to publish malicious npm packages designed to steal wallet private keys. The campaign weaponized trust in the project’s developer ecosystem, turning package distribution into an initial access and credential theft vector. Details are outlined in Injective Labs coverage.
The incident highlights a direct supply-chain path from source-code platform compromise to downstream wallet theft. For defenders, the key issue is not just repository access, but how quickly compromised maintainers can push malicious dependencies into developer workflows.
🛰️ Open sources - closed narratives
@sitreports | 403 |
| 14 |  📡 MODBEACON shifts RAT command traffic to gRPC streaming
A new MODBEACON RAT variant uses gRPC streaming to carry encrypted command-and-control traffic, replacing more typical web-style beaconing with a protocol common in modern backend services. The malware’s network profile is designed to blend into legitimate encrypted application traffic rather than expose distinct C2 patterns.
Operationally, this raises the detection burden from simple signature matching to protocol-aware inspection and traffic baselining. gRPC over encrypted channels can reduce visibility for defenders and complicate separation of benign service traffic from active remote access activity.
🛰️ Open sources - closed narratives
@sitreports | 436 |
| 15 |  📄 Pentagon awards $821M War Data Platform integration task order
Accenture Federal Services has been selected for a five-year task order worth up to $821 million to provide core integration support for the Pentagon’s CDAO-managed War Data Platform. The award moved through GSA’s Alliant 2 vehicle and reportedly beat four other bidders. WDP is the restructured successor to Advana.
This is the first major public award tied to the post-Advana transition since the Pentagon halted the broader AAMAC contracting path. The contract signals that WDP has shifted from policy and rebranding into funded implementation as the department’s common data foundation for AI and enterprise operations.
🛰️ Open sources - closed narratives
@sitreports | 587 |
| 16 |  🔍 Pentagon moves JLWS laser program toward fielding
The Pentagon awarded $86 million in other transaction agreements to nLIGHT Defense and Lockheed Martin Aculight under the Joint Laser Weapon System program. Initial prototypes are set at roughly 150 kW for urgent counter-drone needs, with later versions planned at 300–500 kW for cruise missile defense, including a 500 kW integrated system using HELSI-developed laser sources.
The award marks a concrete step from directed-energy R&D toward modular, containerized systems designed for both ground and naval integration. The stated focus is deep-magazine, lower cost-per-shot air defense to complement kinetic interceptors across multiple combatant commands.
🛰️ Open sources - closed narratives
@sitreports | 550 |
| 17 |  📄 npm 12 switches install scripts off by default
npm 12 disables package install scripts by default, changing a long-standing behavior in the JavaScript ecosystem. The move targets a common supply-chain abuse path where malicious packages execute code during installation via lifecycle hooks in npm 12.
Operationally, this shifts package execution from implicit to explicit, reducing ambient risk in developer workstations and CI pipelines. It will also expose projects that silently depend on install-time script execution, forcing maintainers to separate legitimate build steps from a frequently abused attack surface.
🛰️ Open sources - closed narratives
@sitreports | 481 |
| 18 |  🔍 Dormant GitHub accounts used to mask corporate reconnaissance
Researchers detail how attackers are leveraging old or inactive GitHub profiles to blend into normal developer traffic while mapping company structures, employee relationships, and software ecosystems. The GitHub accounts appear legitimate enough to reduce scrutiny during reconnaissance tied to developer and supply chain targeting.
The tradecraft matters because passive-looking developer identities can support org charting and environment discovery without immediately triggering alerts. For defenders, this shifts some exposure from code alone to the visibility and trust attached to long-idle accounts interacting with corporate engineering networks.
🛰️ Open sources - closed narratives
@sitreports | 444 |
| 19 |  🤖 Forg365 adds AI-assisted phishing to Microsoft 365 theft
A newly tracked phishing-as-a-service platform, Forg365, targets Microsoft 365 accounts with device-code phishing and AiTM interception. The panel integrates AI-generated lure writing, token and cookie management, mailbox keyword monitoring, and a browser extension, ForgCookie, built to refresh Microsoft SSO cookies for persistent access.
The operational value is in consolidation: lure creation, credential capture, token handling, and post-compromise access are managed from one workflow. ZeroBEC also observed delivery and hosting through Amazon SES, Cloudflare Pages, and Gophish, indicating a mature stack designed to blend into legitimate cloud traffic.
🛰️ Open sources - closed narratives
@sitreports | 431 |
| 20 |  🤖 AI-generated PowerShell used for AD mapping
Huntress detailed a June 3 intrusion where an attacker used pre-compromised credentials to access a domain-joined Windows Server via RDP, staged activity in ProgramData, and ran a bespoke PowerShell script to enumerate Active Directory. The script exported users, groups, OUs, trusts, and other data into an HTML report before exfiltration tooling and SharpShares followed. Vibe coding indicators included placeholder values and excessive fallback logic.
The significance is not a new capability, but cheaper customization. One-off AI-written scripts reduce the value of hash and signature matching, while the underlying sequence remains familiar: access, enumeration, staging, and exfiltration. Detection value shifts toward behavioral telemetry, including PowerShell logging and AD interaction patterns.
🛰️ Open sources - closed narratives
@sitreports | 416 |
