NEW CHAPTER IN CYBER WARFARE

Selling American Weapons Information In The Darkweb

Sigma NG (Next Generation) 155 mm Self Propelled Howitzer – Technical Brief, Operational Assessment, Cyber Security Incident and selling its information on the Dark web

1. System Specification

2. Capabilities

• High Survivability – Automated loading and remote turret operation keep the three person crew inside an armored cab, minimizing exposure to counter battery fire, drones and small arms.
• Rapid Fire & Dispersion – 8 rpm and MRSI enable massed effects and the ability to overwhelm enemy fire direction centres.
• Strategic Mobility – Wheeled 10 × 10 platform provides road speed advantages, ease of transport, and commonality with existing U.S. logistical fleets.
• Interoperability – Full compliance with NATO 155 mm ammunition simplifies supply chain integration for the U.S. Army and allied forces.
• Local Content Emphasis – By assembling the system in Charleston, South Carolina, Elbit aligns with U.S. procurement policies that favour domestic industrial participation, positioning the Sigma NG as a strong contender for the Self Propelled Howitzer Modernization (SPHM) program.
• Proven Design Heritage – The Roem variant’s operational testing within the Israel Defense Forces supplies doctrine, training data and maintainability experience that are attractive to U.S. evaluators seeking a “ready to field” solution.

3. Reported Disadvantages / Limitations

• Barrel Production Dependency – Although the majority of the system is U.S. made, the barrel requires a finish step in Israel. This cross border step is highlighted as the “main exception” to the all U.S. content narrative and could be viewed unfavourably under strict protectionist procurement criteria.
• Lack of Current U.S. Service – The United States presently fields the tracked M109A7 Paladin and HIMARS; no wheeled 155 mm self propelled howitzers are in active U.S. service, meaning the Sigma NG must prove its suitability to a force accustomed to different platform families.
• Competitive Landscape – The SPHM solicitation includes several established contenders (CAESAR Mk II, K9 Thunder, Archer, Rheinmetall HX3, BAE M109 52, etc.). While the Sigma NG brings automation and local content advantages, it must meet or exceed envelope requirements for armor, mobility, range (≈58 km) and precision (≈70 km) that are being benchmarked against these alternatives.
• Scaling Domestic Production – The articles note that the current “transitional arrangement” for barrel finishing will evolve toward fully U.S. manufacturing as the supply chain matures, indicating a near term need to expand domestic capability before large scale production can commence.

These points are drawn directly from the cited press reports; no speculative assessment has been added.

4. The Israel Elbit United States Deal

• Program Milestone – On 30 December 2025, Elbit America announced the completion of the first U.S.–assembled Sigma NG prototype at its Charleston plant. This marks a concrete step toward competing for the U.S. Army’s Self Propelled Howitzer Modernization program, with the first competition phase slated for February 2026.
• Strategic Intent – Elbit’s shift to full American production aims to secure a “multibillion dollar” contract that would replace aging M777 towed guns and some older Paladin units, thereby reinforcing Israeli U.S. security cooperation.
• Industrial Policy Alignment – The emphasis on local content reflects U.S. procurement preferences, especially under recent administration policies that prioritize domestic manufacturing and supply chain resilience amid geopolitical tension with China.
• Geopolitical Advantage – Industry sources cite Elbit’s experience delivering similar systems to Asia Pacific customers as an additional factor that could strengthen its bid against European and Korean competitors.

References: Israel Defense (June 2025), Army Recognition (Jan 2026), The Defense News (Jan 2026).

5. Recent Cyber Security Breach

• Threat Actor – The hacker collective known as C.I.F penetrated Elbit Systems’ networks in 2025.
• Compromise Details – Sensitive documentation concerning the Sigma NG program—including design files, production data and possibly procurement correspondence—was exfiltrated.
• Public Dissemination – The stolen documents have been uploaded to dark web forums and are presently being offered for sale. This public release may expose technical specifications, supply chain partners and vulnerability information to adversaries.
• Implications for Stakeholders – Potential buyers, U.S. defense acquisition officials and allied partners should treat any Sigma NG related data obtained from unofficial sources as unverified. The breach underscores the importance of heightened cyber defence measures for defense industry programs, especially those involved in high value, cross border procurement.

The information on the C.I.F breach is taken from the briefing supplied by the user; no additional speculation has been introduced.

C.I.F.: Cyber Isnaad Front / الجبهة الإسناد السيبرانية

Summary and Conclusion

The Israel U.S. agreement on the Sigma NG howitzer illustrates how a high tech, multibillion dollar defence programme can be undercut by lapses in cyber security and by a market that already rewards cheaper access to the same data.

On paper the Sigma NG is an attractive candidate for the Army’s Self Propelled Howitzer Modernization effort: a fully automated 155 mm gun, a protected three person crew, wheeled mobility that dovetails with existing U.S. logistics chains, and a proven Israeli design lineage. The deal, however, required the United States to shoulder a substantial purchase price while still relying on Israel for the final barrel finishing step—a foreign origin element that runs counter to the domestic content emphasis of U.S. procurement policy.

The breach by the hacker collective C.I.F. stripped away the very competitive edge the United States hoped to secure. Detailed design files, production data and procurement correspondence have been posted on dark web markets, where they can be acquired far below the price paid by American taxpayers. Consequently, any other nation or private buyer that can obtain this leaked information can reproduce or modify the system at a fraction of the cost, eroding the strategic and economic justification for the original contract.

In short, the Sigma NG deal demonstrates a paradox: a costly, high visibility partnership aimed at bolstering U.S. artillery capability has inadvertently created a cheap, widely accessible blueprint for the same capability. The episode underscores three urgent lessons for future acquisitions:

1. Cyber resilience must be a contract requirement, not an after thought. Robust, continuously audited security controls are essential before any sensitive design data leaves a vendor’s network.
2. Domestic content claims are hollow if critical components—or the knowledge to make them—are exposed externally. Fully indigenising the barrel production line and protecting its intellectual property should be non negotiable milestones.
3. Cost benefit analyses need to factor in the hidden price of data leakage. The true expense of a defence purchase includes the risk that the same capability can be obtained elsewhere for a fraction of the price once the technical secrets are public.

Cyberattacks by Iranian-affiliated groups on Israel's critical military infrastructure; Iran-Israel war in the cyber layer

 

The Iranian Cyber ​​Isnad Front has managed to infiltrate the Maya company, which is linked to Israeli forces, gaining access to confidential data on projects such as the Iron Beam laser system, the Hermes 900 drone, and the Spike anti-tank missile. The hacking group has also released footage from inside the company showing the stages of Israeli weapons production. In addition, the pro-Iranian hacking group Handala has revealed the identities of 6 Israeli defense/nuclear scientists, the brains behind Israel’s air (helicopters and F-35 aircraft), naval, and nuclear programs. Handala said they are senior engineers, architects of Israel’s air and naval power, and the secretive minds behind the Weizmann Institute’s most secret operations, including nuclear.

Dozens of celebrities take stage in London for ‘Together for Palestine’ fundraiser

 

“It’s important to speak out now, not when this is over, right now, while it’s happening, pressurize your government. Lend your support to those who are peacefully campaigning for Palestine. Call for a ceasefire, stop the killing,” Coogan said.

Dozens of musicians, actors, activists and speakers took to the stage at London’s biggest stadium on Wednesday to raise money for Palestinians at a fundraising concert for the war in Gaza.

The event, “Together for Palestine,” brought a star-studded lineup to Wembley Arena and included performances from Bastille, James Blake, Paloma Faith, Jamie xx, and PinkPantheress, as well as Palestinian artists such as Sama’ Abdulhadi, Saint Levant and Elyanna.

Actors such as Florence Pugh, Nicola Coughlan, and Benedict Cumberbatch, and other notable figures such as broadcaster Mehdi Hasan, footballer Eric Cantona, and Francesca Albanese, the UN special envoy for Palestine, also spoke at the event.

https://edition.cnn.com/2025/09/17/entertainment/celebrities-gaza-ceasefire-london-concert-latam-intl

https://x.com/PaulAnders1998/status/1968632249164714133

Alleged Iran-Linked Phishing Targets Israeli Actors

Hebrew media reported on Friday that dozens of Israeli actors were targeted in a phishing attack allegedly directed by Iran.

According to a statement cited from Israel’s Cybersecurity Authority, several Israeli actors received an email claiming to be from a famous director seeking to cast actors for a new film.

The email requested that the artists submit not only audition videos but also personal documents such as ID cards, passports, and home addresses.

Reports indicate that dozens of actors sent the requested documents and subsequently received threatening responses, with the attack attributed to Iran.

Israeli authorities have advised actors affected by the incident to replace their identity documents and notify government agencies.

Media: The Sophisticated Soft Weapons of the Modern Era

Cognitive Manipulation Mechanisms

Modern media represents a complex neuropsychological intervention system designed to systematically influence human cognitive processes through strategic communication technologies.

US Homeland Security News :Venezuela under US cyber attack! Blackout in Greater Caracas and other regions of Venezuela.

Given the available evidence, there is a strong possibility that the power outage was caused by internal problems, infrastructure or human sabotage, not a foreign cyberattack.

The release of this news is more of a psychological nationalism for the Venezuelan people and their weak government officials than a technical and cyber reality...

US Homeland Security News

Google recommends that 2.5 billion Gmail users change their passwords following an advanced phishing attack that started through a Salesforce vulnerability.

 

Google recommends that 2.5 billion Gmail users change their passwords following an advanced phishing attack that started through a Salesforce vulnerability.

The attack included fake phone calls with attackers posing as Google representatives, prompting users to enter their login details.

Google did not specify the extent of the affected users but emphasized the need for an immediate password change. It also recommends enabling two-factor authentication (2FA) and avoiding entering login details during unidentified phone calls.

The password change recommendation was also delivered via messages within Gmail to ensure users take immediate action.

Hackers breached the customer service system of TransUnion in the US through a third-party application, exposing sensitive personal information of about 4.4 million Americans including names, addresses, birth dates, and Social Security numbers, but without credit reports.

 

Hackers breached the customer service system of TransUnion in the US through a third-party application, exposing sensitive personal information of about 4.4 million Americans including names, addresses, birth dates, and Social Security numbers, but without credit reports.

The attack is attributed to the ShinyHunters and UNC6395 groups who exploited vulnerabilities in Salesforce.

TransUnion provides credit rating and financial information management services, so such a leak poses a serious risk of identity theft.

The company offers affected individuals two years of credit monitoring and identity protection services, while a class-action lawsuit against it is under review. Law enforcement authorities continue their investigation.

ESET researchers exposed PromptLock, the world’s first ransomware written using artificial intelligence.

 

ESET researchers exposed PromptLock, the world’s first ransomware written using artificial intelligence.

This is a PoC demonstrating the potential of using a local LLM (gpt-oss:20b via Ollama API) to create Lua scripts in real time, used for file scanning, data theft, and encryption.

The ransomware is written in Golang, runs on Windows and Linux, and uses the SPECK 128-bit encryption algorithm. Its uniqueness lies in the fact that each execution generates different and dynamic code, making it difficult for signature-based detection systems to stop it.

Although this is a demonstration and not a real attack, researchers warn that integrating AI into ransomware could make advanced capabilities accessible even to criminals with little technical knowledge, creating a new generation of more sophisticated ransomware.

ESET’s recommendations for dealing with this are maintaining proper backups, monitoring dynamic script creation, and preparing defenses against AI-based attacks.

#Ransomware #AI #PromptLock #ESET #CyberThreats #Malware

Tom Alexandrovich, a child molester who is the mastermind and founder of the Israeli Cyber Dome.

Tom Artyom Alexandrovich, 38, an Israeli national; executive director of the cyber department of the

Israeli National Cyber Authority, was arrested in Las Vegas, USA, along with eight other men. He was arrested on a felony charge of luring a child using a computer for sexual activity and was released on $10,000 bail and immediately returned to Israel.

Prior to this incident, Alexandrovich was known as a senior manager in Israel’s cybersecurity sector, specifically the Israeli National Cyber Authority. He had recently attended the Black Hat briefings, a cybersecurity conference in Las Vegas.

Under Nevada law, the charge of luring a child using a computer for sexual activity can carry a prison sentence of between one and ten years.

Others arrested with him include:

David Wonnacott-Yahnke, 40

Jose Alberto Perez-Torres, 35

Aniket Brajeshkumar Sadani, 23

James Ramon Reddick, 23

Ramon Manuel Parra Valenzuela, 29

Neal Harrison Creecy, 46

John Charles Duncan, 49

Tom Alexandrovich is a cybersecurity leader and executive specializing in national security cyber defense. He played a key role in designing and building Israel’s groundbreaking “Cyber Dome” program, a national initiative to protect civilian cyberspace. His expertise includes developing national cyber strategies, building high-performance teams, and protecting critical infrastructure and democratic institutions from advanced persistent threats (APTs).

With deep experience in cyber threat intelligence (CTI) and proactive cyber defense, Alexandrovich has shaped national cybersecurity policies not only in Israel but also on the international stage. He has advised senior government officials, managed multi-million dollar cybersecurity budgets, and contributed to the resilience of critical infrastructure and election security.

As the founder of Israel’s Cyber Dome program and the national approach to proactive cyber defense, Alexandrovich has significantly strengthened the country’s cyber resilience. His contributions include co-founding the Israeli National Aviation Cyber Security Program and receiving the Israel Defense Forces Award for Outstanding Achievement.

This incident exemplifies the multi-layered complexities that arise from the intersection of technology, ethics, and politics. The arrest of a senior cybersecurity official not only has a personal dimension, but also raises fundamental questions about the regulatory structure and professional ethics in this field. Given the sensitive place of cybersecurity in international relations, such incidents can have profound implications for strategic cooperation.

From an analytical perspective, this incident highlights the importance of multi-dimensional approaches; Because it cannot be reduced to a single individual error. The ethical, security, and political issues are intertwined, and any strategic analysis must consider these dimensions simultaneously.

Many analysts consider him to be one of the most powerful cyberwarfare officials in the entire Israeli government, a man who operates at the nerve center of the national intelligence and defense apparatus. As head of the data and artificial intelligence division at Israel’s National Cybersecurity Authority, his job is nothing less than protecting Israel’s critical infrastructure from digital attacks—everything from the power grid to airports to the country’s most sensitive information networks.

Officially, the swift response from the Israeli Prime Minister’s Office was an attempt to contain the diplomatic crisis. The clear statement that no arrests had taken place was implicitly intended to calm public opinion and prevent media hype. This approach in crisis diplomacy is a smart move to avoid damaging political relations.

Israel was able to prevent the crisis from escalating by insisting that the issue had no political dimensions; However, the global media coverage highlights the importance of public opinion management. This incident demonstrated that failure to control the media narrative in a timely manner can have serious costs for an institution’s credibility. Therefore, designing a proactive communication strategy is a key imperative in cyber management.

AI-Driven Trends in Endpoint Security: What the 2025 Gartner® Magic Quadrant™ Reveals

 

Cyber threats and attacks like ransomware continue to increase in volume and complexity with the endpoint typically being the most sought after and valued target. With the rapid expansion and adoption of AI, it is more critical than ever to ensure the endpoint is adequately secured by a platform capable of not just keeping pace, but staying ahead of an ever-evolving threat landscape.

SentinelOne's steadfast commitment to delivering AI-powered cybersecurity enables global customers and partners to achieve resiliency and reduce risk with real-time, autonomous protection across the entire enterprise — all from a single agent and console with a robust, rigorously tested platform that keeps the customer in control.

Cybersecurity today isn't just about detection—it's about operational continuity under pressure. For example, endpoint solutions must account for encrypted traffic inspection, policy enforcement during identity compromise, and fast containment across distributed environments. These capabilities are especially critical in industries like healthcare or finance, where seconds can mean regulatory penalties or breached patient records.

Gartner recently named SentinelOne a Leader in the 2025 Gartner® Magic Quadrant for Endpoint Protection Platforms for the fifth consecutive year. This recognition builds on the Singularity Platform's momentum in innovation as the first solution with an AI analyst and the first unified platform delivering EDR, CNAPP, Hyperautomation, and SIEM to be FedRAMP High (the highest level of U.S. federal cloud security authorization) Authorized.

SentinelOne provides protection for organizations of all sizes—from small businesses to global governments and enterprises—meeting their unique needs in the face of an increasingly complex cyber landscape. The Singularity Platform secures organizations across any device, any OS, and any cloud, providing industry-leading signal-to-noise so SOC teams can focus on responding as quickly as possible. With advanced XDR, AI SIEM, and CNAPP capabilities, a lightweight agent, and responsible architecture, SentinelOne offers a solution designed for both security and operational resiliency.

Organizations using Singularity Endpoint and Purple AI detect threats 63% faster, reduce MTTR by 55%, and lower the likelihood of a security incident by 60%. Customers have reported a 338% ROI over three years, maximizing the value of their security investments while strengthening their endpoint security.

For example, a healthcare provider using SentinelOne reported cutting incident response time by over 50% during a phishing-induced ransomware outbreak, thanks to automated rollback and unified visibility across cloud workloads and endpoints.

Many teams searching for EDR or XDR platforms are trying to answer: "Will this reduce alert fatigue?" or "Can it integrate with my SIEM or SOAR stack without more overhead?" This is where automation must go beyond buzzwords—reducing manual triage, stitching disconnected signals, and working with existing tools instead of replacing them.

https://thehackernews.com/2025/07/ai-driven-trends-in-endpoint-security.html