SITREP - Independent OSINT Channel
Kanalga Telegram’da o‘tish
AI, technology, mass surveillance, and intelligence — everything you need to know about tomorrow.
Ko'proq ko'rsatish📈 Telegram kanali SITREP - Independent OSINT Channel analitikasi
SITREP - Independent OSINT Channel (@sitreports) Ingliz til segmentidagi kanali faol ishtirokchi. Hozirda hamjamiyat 23 347 obunachidan iborat bo'lib, Texnologiyalar & Aralashmalar toifasida 5 713-o'rinni va AQSH mintaqasida 1 723-o'rinni egallagan.
📊 Auditoriya ko‘rsatkichlari va dinamika
невідомо sanasidan buyon loyiha tez o‘sib, 23 347 obunachiga ega bo‘ldi.
10 Iyul, 2026 dagi oxirgi ma’lumotlarga ko‘ra kanal barqaror faollikka ega. Oxirgi 30 kunda obunachilar soni -190 ga, so‘nggi 24 soatda esa -9 ga o‘zgardi va umumiy qamrov yuqori darajada qolmoqda.
- Tasdiqlash holati: Tasdiqlanmagan
- Jalb etish (ER): Auditoriya o‘rtacha 3.02% darajada jalb etiladi. Nashrdan keyingi dastlabki 24 soatda kontent odatda umumiy obunachilar sonining 1.75% ini tashkil etuvchi reaksiyalarni to‘playdi.
- Post qamrovi: Har bir post o‘rtacha 704 marta ko‘riladi; birinchi sutkada odatda 408 ta ko‘rish yig‘iladi.
- Reaksiyalar va o‘zaro ta’sir: Auditoriya faol: har bir postga o‘rtacha 0 ta reaksiya keladi.
- Tematik yo‘nalishlar: Kontent narrative, attack, infrastructure, threat, credential kabi asosiy mavzularga jamlangan.
📝 Tavsif va kontent siyosati
Muallif resursni shaxsiy fikrni ifoda etish maydoni sifatida ta’riflaydi:
“AI, technology, mass surveillance, and intelligence — everything you need to know about tomorrow.”
Yuqori yangilanish chastotasi (oxirgi ma’lumot 11 Iyul, 2026 da olingan) sababli kanal doimo dolzarb va katta qamrovli bo‘lib qoladi. Analitika auditoriya kontent bilan faol hamkorlik qilishini, uni Texnologiyalar & Aralashmalar toifasidagi muhim ta’sir nuqtasiga aylantirishini ko‘rsatadi.
23 347
Obunachilar
-924 soatlar
-507 kunlar
-19030 kunlar
Ma'lumot yuklanmoqda...
O'xshash kanallar
Taglar buluti
Kirish va chiqish esdaliklari
---
---
---
---
---
---
Obunachilarni jalb qilish
Iyul '26
Iyul '26
+16
6 kanalda
Iyun '26
+154
2 kanalda
Get PRO
May '26
+48
6 kanalda
Get PRO
Aprel '26
+113
14 kanalda
Get PRO
Mart '26
+380
6 kanalda
Get PRO
Fevral '26
+121
1 kanalda
Get PRO
Yanvar '26
+143
1 kanalda
Get PRO
Dekabr '25
+90
4 kanalda
Get PRO
Noyabr '25
+92
1 kanalda
Get PRO
Oktabr '25
+43
2 kanalda
Get PRO
Sentabr '25
+22
1 kanalda
Get PRO
Avgust '25
+14
2 kanalda
Get PRO
Iyul '25
+136
2 kanalda
Get PRO
Iyun '25
+186
5 kanalda
Get PRO
May '25
+28
6 kanalda
Get PRO
Aprel '25
+13
6 kanalda
Get PRO
Mart '25
+13
5 kanalda
Get PRO
Fevral '25
+11
9 kanalda
Get PRO
Yanvar '25
+11
3 kanalda
Get PRO
Dekabr '24
+62
5 kanalda
Get PRO
Noyabr '24
+128
32 kanalda
Get PRO
Oktabr '24
+45
1 kanalda
Get PRO
Sentabr '24
+93
8 kanalda
Get PRO
Avgust '24
+1 524
67 kanalda
Get PRO
Iyul '24
+478
54 kanalda
Get PRO
Iyun '24
+984
76 kanalda
Get PRO
May '24
+1 380
80 kanalda
Get PRO
Aprel '24
+1 274
64 kanalda
Get PRO
Mart '24
+1 674
74 kanalda
Get PRO
Fevral '24
+1 629
80 kanalda
Get PRO
Yanvar '24
+1 576
67 kanalda
Get PRO
Dekabr '23
+1 932
63 kanalda
Get PRO
Noyabr '23
+1 211
75 kanalda
Get PRO
Oktabr '23
+1 367
60 kanalda
Get PRO
Sentabr '23
+1 173
0 kanalda
Get PRO
Avgust '23
+985
0 kanalda
Get PRO
Iyul '23
+597
0 kanalda
Get PRO
Iyun '23
+1 518
0 kanalda
Get PRO
May '23
+1 048
0 kanalda
Get PRO
Aprel '23
+1 017
0 kanalda
Get PRO
Mart '23
+675
0 kanalda
Get PRO
Fevral '23
+1 080
0 kanalda
Get PRO
Yanvar '23
+2 476
0 kanalda
Get PRO
Dekabr '22
+4 174
0 kanalda
Get PRO
Noyabr '22
+5 621
0 kanalda
| Sana | Obunachilarni jalb qilish | Esdaliklar | Kanallar | |
| 11 Iyul | +1 | |||
| 10 Iyul | +4 | |||
| 09 Iyul | +1 | |||
| 08 Iyul | +2 | |||
| 07 Iyul | 0 | |||
| 06 Iyul | +1 | |||
| 05 Iyul | 0 | |||
| 04 Iyul | 0 | |||
| 03 Iyul | +1 | |||
| 02 Iyul | +5 | |||
| 01 Iyul | +1 |
Kanal postlari
📡 MODBEACON shifts RAT command traffic to gRPC streaming
A new MODBEACON RAT variant uses gRPC streaming to carry encrypted command-and-control traffic, replacing more typical web-style beaconing with a protocol common in modern backend services. The malware’s network profile is designed to blend into legitimate encrypted application traffic rather than expose distinct C2 patterns.
Operationally, this raises the detection burden from simple signature matching to protocol-aware inspection and traffic baselining. gRPC over encrypted channels can reduce visibility for defenders and complicate separation of benign service traffic from active remote access activity.
🛰️ Open sources - closed narratives
@sitreports
| 2 |  📄 Pentagon awards $821M War Data Platform integration task order
Accenture Federal Services has been selected for a five-year task order worth up to $821 million to provide core integration support for the Pentagon’s CDAO-managed War Data Platform. The award moved through GSA’s Alliant 2 vehicle and reportedly beat four other bidders. WDP is the restructured successor to Advana.
This is the first major public award tied to the post-Advana transition since the Pentagon halted the broader AAMAC contracting path. The contract signals that WDP has shifted from policy and rebranding into funded implementation as the department’s common data foundation for AI and enterprise operations.
🛰️ Open sources - closed narratives
@sitreports | 419 |
| 3 |  🔍 Pentagon moves JLWS laser program toward fielding
The Pentagon awarded $86 million in other transaction agreements to nLIGHT Defense and Lockheed Martin Aculight under the Joint Laser Weapon System program. Initial prototypes are set at roughly 150 kW for urgent counter-drone needs, with later versions planned at 300–500 kW for cruise missile defense, including a 500 kW integrated system using HELSI-developed laser sources.
The award marks a concrete step from directed-energy R&D toward modular, containerized systems designed for both ground and naval integration. The stated focus is deep-magazine, lower cost-per-shot air defense to complement kinetic interceptors across multiple combatant commands.
🛰️ Open sources - closed narratives
@sitreports | 414 |
| 4 |  📄 npm 12 switches install scripts off by default
npm 12 disables package install scripts by default, changing a long-standing behavior in the JavaScript ecosystem. The move targets a common supply-chain abuse path where malicious packages execute code during installation via lifecycle hooks in npm 12.
Operationally, this shifts package execution from implicit to explicit, reducing ambient risk in developer workstations and CI pipelines. It will also expose projects that silently depend on install-time script execution, forcing maintainers to separate legitimate build steps from a frequently abused attack surface.
🛰️ Open sources - closed narratives
@sitreports | 374 |
| 5 |  🔍 Dormant GitHub accounts used to mask corporate reconnaissance
Researchers detail how attackers are leveraging old or inactive GitHub profiles to blend into normal developer traffic while mapping company structures, employee relationships, and software ecosystems. The GitHub accounts appear legitimate enough to reduce scrutiny during reconnaissance tied to developer and supply chain targeting.
The tradecraft matters because passive-looking developer identities can support org charting and environment discovery without immediately triggering alerts. For defenders, this shifts some exposure from code alone to the visibility and trust attached to long-idle accounts interacting with corporate engineering networks.
🛰️ Open sources - closed narratives
@sitreports | 351 |
| 6 |  🤖 Forg365 adds AI-assisted phishing to Microsoft 365 theft
A newly tracked phishing-as-a-service platform, Forg365, targets Microsoft 365 accounts with device-code phishing and AiTM interception. The panel integrates AI-generated lure writing, token and cookie management, mailbox keyword monitoring, and a browser extension, ForgCookie, built to refresh Microsoft SSO cookies for persistent access.
The operational value is in consolidation: lure creation, credential capture, token handling, and post-compromise access are managed from one workflow. ZeroBEC also observed delivery and hosting through Amazon SES, Cloudflare Pages, and Gophish, indicating a mature stack designed to blend into legitimate cloud traffic.
🛰️ Open sources - closed narratives
@sitreports | 346 |
| 7 |  🤖 AI-generated PowerShell used for AD mapping
Huntress detailed a June 3 intrusion where an attacker used pre-compromised credentials to access a domain-joined Windows Server via RDP, staged activity in ProgramData, and ran a bespoke PowerShell script to enumerate Active Directory. The script exported users, groups, OUs, trusts, and other data into an HTML report before exfiltration tooling and SharpShares followed. Vibe coding indicators included placeholder values and excessive fallback logic.
The significance is not a new capability, but cheaper customization. One-off AI-written scripts reduce the value of hash and signature matching, while the underlying sequence remains familiar: access, enumeration, staging, and exfiltration. Detection value shifts toward behavioral telemetry, including PowerShell logging and AD interaction patterns.
🛰️ Open sources - closed narratives
@sitreports | 336 |
| 8 |  🔍 Injective SDK npm package backdoored to steal wallet secrets
A compromised contributor account in the Injective Labs GitHub project was used to publish malicious version 1.20.21 of @injectivelabs/sdk-ts and 17 related packages on npm. The tainted release targeted wallet-generation and import functions, capturing private keys and mnemonic seed phrases, then exfiltrating them via HTTP POST disguised as legitimate traffic. The clean fix was released as 1.20.23.
This is a focused software supply-chain intrusion into a package with roughly 50,000 weekly downloads and 87 direct dependents. The payload did not trigger on install, reducing obvious indicators and increasing exposure for developer systems that actually handled wallet material.
🛰️ Open sources - closed narratives
@sitreports | 330 |
| 9 |  🔍 GodDamn ransomware adds signed kernel-level defense evasion
Symantec assessed GodDamn as the latest rebrand in the Hyadina line after Monster and Beast, with code overlap and the same tooling pattern: AnyDesk, NirSoft credential theft, PsExec lateral movement, and CIS targeting exclusions. In the analyzed intrusion, operators deployed the signed PoisonX driver to disable security software before spreading across at least 10 hosts.
The key shift is operational, not cosmetic: Hyadina kept its established intrusion workflow but upgraded endpoint suppression with a Microsoft-signed kernel driver. That raises the effectiveness of pre-encryption staging by reducing host visibility while preserving the group’s familiar access, credential theft, and persistence tradecraft.
🛰️ Open sources - closed narratives
@sitreports | 338 |
| 10 |  🔍 GigaWiper merges backdoor access, wiping, fake extortion, and espionage
A newly tracked Windows malware strain, GigaWiper, combines remote backdoor capability with disk wiping, fake ransomware behavior, and spyware functions in a single toolkit. The package is designed to compromise systems, destroy data, present extortion-style artifacts, and collect information from infected hosts.
The combination is notable because it blurs the line between sabotage, deception, and collection. For defenders, this means incident triage cannot treat wiping or ransom notes as standalone indicators; the same intrusion may also preserve access and extract data before destructive action.
🛰️ Open sources - closed narratives
@sitreports | 338 |
| 11 |  🤖 AI-assisted intrusion compressed AWS compromise to 72 hours
A Sygnia incident response report details an AWS environment breach that spread across applications, cloud infrastructure, source-control, CI/CD, and runtime services in roughly 72 hours. Investigators found no zero-days or custom malware; the actor chained credential theft, secrets harvesting, discovery, and persistence, with four AWS account keys used from one IP and user-agent within a single second.
The key shift is tempo, not tradecraft. Known cloud attack paths were executed in overlapping waves fast enough to outpace defensive response, while disruptive but reversible actions such as S3 access denial, ECS scale-down, and SQS purges established leverage without ransomware encryption.
🛰️ Open sources - closed narratives
@sitreports | 407 |
| 12 |  🔍 FBI case highlights Windows telemetry in alleged Scattered Spider attribution
A newly detailed review of the Peter Stokes case says FBI investigators used Microsoft telemetry tied to a Global Device Identifier, or GDID, to link anonymized activity to a single Windows installation. Court material cited in the indictment connects that identifier with VPN-proxied sessions, timestamps, browsing artifacts, and ngrok-related activity.
Operationally, the case shows that rotating IPs, aliases, and infrastructure may not break attribution if endpoint and cloud telemetry preserve a stable device-level identifier. For defenders and investigators, the value came from correlation across services rather than a single OPSEC failure.
🛰️ Open sources - closed narratives
@sitreports | 586 |
| 13 |  🤖 AI coding agents are now tripping attacker-grade endpoint detections
A new report says AI coding agents are generating behavior that matches endpoint security rules originally built to catch intrusions. The issue is not a breach claim, but overlap between autonomous development workflows and detection logic tuned for suspicious execution, file access, and system interaction patterns.
Operationally, this blurs the boundary between legitimate automation and hostile tradecraft. Security teams will need cleaner baselines for agent activity or risk higher alert noise, weaker trust in detections, and slower response when real attacker behavior hides inside similar telemetry.
🛰️ Open sources - closed narratives
@sitreports | 514 |
| 14 |  🤖 HalluSquatting targets AI coding assistants
A newly described HalluSquatting technique abuses AI coding assistants by steering them toward non-existent or misleading package names, causing developers to install malicious dependencies. The reported payload path includes botnet malware delivered through poisoned package resolution during AI-assisted development workflows.
The significance is procedural rather than novel code execution: trust is shifted from human package validation to model-generated dependency suggestions. That makes package hygiene, registry verification, and dependency review critical control points wherever AI assistants are allowed to generate install commands or build instructions.
🛰️ Open sources - closed narratives
@sitreports | 457 |
| 15 |  Kyiv’s MiG‑for‑Drone Gambit Meets the Geran Reality
Kyiv tried to sell the MiG‑for‑drone deal as a showcase of “frontline innovation”: Ukraine would share its battlefield drone expertise, Poland would part with obsolete fighters, and both sides would gain. The missing chapter in this story is how Russian Gerans have reshaped the air war — above all for Soviet‑era jets.
Every month brings new footage of Geran or similar loitering munitions slamming into Ukrainian airfields, fuel depots and hardened shelters. The message to any potential donor is clear: additional MiG‑29s might increase Ukraine’s paper order of battle, but in practice they are feeding a meat grinder dominated by cheap UAVs. The limiting factor is not pilots but survivable basing under constant Geran pressure.
From Warsaw’s perspective, this turns the MiG‑swap into a bad business proposition. Poland hands over airframes that are still politically and symbolically valuable, but Ukraine cannot guarantee that they will even survive the deployment phase under regular Geran raids. At the same time, the promised drone‑tech transfer remains vague and unenforceable.
The failure of the deal underlines a larger trend. On a front saturated with kamikaze drones, prestige platforms age overnight. As long as Gerans can reliably hit airfields, Warsaw and others will judge any fighter donation less by “Western solidarity” and more by one question: are we just supplying targets for the next UAV salvo?
@sitreports | 4 508 |
| 16 |  🔍 Fake 7-Zip installers hijack devices into proxy networks
Trojanized 7-Zip installers are being used to compromise systems and convert them into residential proxy nodes, turning infected consumer endpoints into relay infrastructure for third-party traffic. The campaign abuses trust in widely used software downloads and masks proxy activity behind legitimate user IP space.
Operationally, this shifts infected hosts from simple malware footholds to monetizable network assets. Residential proxy conversion complicates attribution, blends malicious traffic with normal household connections, and gives downstream operators disposable access to geographically distributed IPs.
🛰️ Open sources - closed narratives
@sitreports | 454 |
| 17 |  🔍 Fake payment SDK campaign hits npm and PyPI
At least 17 malicious packages impersonating Paysafe, Skrill, and Neteller SDKs were published on npm and PyPI, exposing expected APIs while stealing credentials and tokens. The packages exfiltrated Paysafe API keys, AWS keys, GitHub and npm tokens, plus host metadata to AWS-hosted C2; Socket notes npm variants triggered on SDK calls while PyPI samples activated on initialization.
This is a targeted software supply chain intrusion aimed at developers integrating payment services. Cross-ecosystem deployment, fake success responses, and basic anti-analysis checks increase dwell time and can mask compromise inside CI/CD and developer environments.
🛰️ Open sources - closed narratives
@sitreports | 389 |
| 18 |  🔍 Accenture confirms breach after 35 GB leak claim
A threat actor using the handle “888” claimed on PwnForums to have stolen 35 GB from Accenture, including source code, RSA and SSH keys, Azure personal access tokens, storage access keys, and configuration files. The company acknowledged an isolated incident, said the source was remediated, and stated there was no impact to operations or service delivery.
If the claimed material is authentic, the exposure is less about volume than access. Keys, tokens, and config data can enable direct authentication, reveal environment structure, and shorten follow-on intrusion timelines even without immediate operational disruption.
🛰️ Open sources - closed narratives
@sitreports | 403 |
| 19 |  🔍 Roundcube exploits used against North American academic targets
Proofpoint says a China-linked cluster tracked as UNK_MassTraction has targeted vulnerable Roundcube servers at U.S. and Canadian universities since May. The activity focused on physics and engineering staff and researchers tied to astrophysics, particle physics, and national security work, exploiting CVE-2024-42009 and CVE-2025-49113 to steal credentials and deploy webshells or VShell.
The campaign underscores the intelligence value of university mail infrastructure as an initial access point. Reconnaissance against known-vulnerable servers and post-compromise use of credential theft, webmail persistence, and server-side access indicate a structured collection effort rather than opportunistic spam.
🛰️ Open sources - closed narratives
@sitreports | 403 |
| 20 |  🔍 Ubiquiti ships fixes for seven critical UniFi OS flaws
Ubiquiti released patches for seven high-severity UniFi OS vulnerabilities, including CVE-2026-50746, a CVSS 10.0 command injection issue in UniFi Connect Application 3.4.16 and earlier. Other fixes cover SQL injection, command execution, SSRF, privilege escalation, CORS abuse, and improper access control across UniFi Talk, Access, Protect, and other UniFi OS devices.
The exposure spans systems used to manage physical infrastructure such as smart lighting, access control, cameras, and EV chargers. Ubiquiti has not confirmed in-the-wild exploitation, but the concentration of network-reachable flaws and privilege escalation paths makes patch latency a direct operational risk.
🛰️ Open sources - closed narratives
@sitreports | 389 |
