Sign in Subscribe

InfoSec News 30JAN2026

General

  • Google is expanding theft protection for mobile devices, including default enabling in presumably high-risk countries (initially Brazil). Updates include changes to "Failed Authentication Lock, a feature that automatically locks the device's screen after excessive failed authentication attempts", "critical tools that utilize Biometric Prompt, like third-party banking apps and Google Password Manager, now automatically benefit from the additional security of Identity Check.", "harder for a thief to guess your PIN, pattern, or password by increasing the lockout time after failed attempts.", "Remote Lock (android.com/lock) is a crucial tool that lets you lock your lost or stolen device from any web browser...adding a new optional security question/challenge to the process."
  • In further Google news - and one likely to make site-owners reeling under AI-company scrapers happy - Google Threat Intelligence Group (GTIG) have disrupted the IPIDEA residential proxy network.
IPIDEA has become notorious for its role in facilitating several botnets: its software development kits played a key role in adding devices to the botnets, and its proxy software was then used by bad actors to control them. This includes the BadBox2.0 botnet we took legal action against last year, and the Aisuru and Kimwolf botnets more recently.
RTUs standardize how distributed sites interface with control centers, enabling operators to manage large numbers of remote facilities from a single SCADA system....This combination of standardization and variation likely explains both what adversaries achieved and what they failed to accomplish....While many of these RTUs have control capabilities, tools like CRASHOVERRIDE or Industroyer2 cannot simply be deployed. .... The RTUs in distributed energy systems lack this standardization, and each requires unique commands tailored to its specific configuration
Previous attacks focused on centralized control systems managing large portions of the grid – distribution control centers in 2015, a transmission substation in 2016. The Poland attack instead targeted the distributed edge of the grid: the RTUs and communication systems managing dozens of smaller generation sites. This shift reflects the changing nature of electric grids, as countries like Poland add more distributed renewable generation
When compared with the 2015 attack in Ukraine, it shows similar technical tactics, techniques, and procedures, such as wiping Windows devices and damaging exposed serial terminal servers, but lacks the coordinated sequencing that maximized impact in that operation.
Dragos assesses with moderate confidence that opportunism was a key factor in the attack. Rather than executing a precisely planned operation with specific outcomes, ELECTRUM exploited whatever opportunities their access provided: wiping Windows-based devices, resetting configurations, or attempting to permanently damage (or brick) equipment. Each location required different manual actions rather than a single automated tool.
...While 1.2 GW represents only 5 percent of the total supply, the sudden simultaneous loss of this amount of generation would have had a noticeable impact on the system frequency. Such frequency deviations have caused cascading failures in other electrical systems, including the 2025 Iberian grid collapse
While production itself was not affected and bakeries continued operating at full capacity, the outage complicated order processing and deliveries. ... To keep supplies moving, the company shifted all office staff to a round-the-clock schedule and temporarily reverted to manual processing of orders and shipments.
DeMercurio and Wynn’s engagement at the Dallas County Courthouse on September 11, 2019, had been routine. A little after midnight, after finding a side door to the courthouse unlocked, the men closed it and let it lock. They then slipped a makeshift tool through a crack in the door and tripped the locking mechanism. After gaining entry, the pentesters tripped an alarm alerting authorities.
Within minutes, deputies arrived and confronted the two intruders. DeMercurio and Wynn produced an authorization letter—known as a “get out of jail free card” in pen-testing circles. After a deputy called one or more of the state court officials listed in the letter and got confirmation it was legit, the deputies said they were satisfied the men were authorized to be in the building. DeMercurio and Wynn spent the next 10 or 20 minutes telling what their attorney in a court document called “war stories” to deputies who had asked about the type of work they do.
When Sheriff Leonard arrived, the tone suddenly changed. He said the Dallas County Courthouse was under his jurisdiction and he hadn’t authorized any such intrusion. Leonard had the men arrested, and in the days and weeks to come, he made numerous remarks alleging the men violated the law. A couple months after the incident, he told me that surveillance video from that night showed “they were crouched down like turkeys peeking over the balcony” when deputies were responding.... Eventually, all charges were dismissed.

Geo-Politics

  • [LV] Latvia's National Security Service (SAB) warns of increasing attacks from Russia, in its annual report.
In 2025, Russia continued to deploy a wide range of instruments of influence against the West to undermine Western unity in supporting Ukraine or even to achieve a potential cessation of this support and prepare for a potential confrontation with NATO. Russia continued to conduct not only sabotage and information activities against Western countries, but also its readiness to carry out cyber attacks on industrial control system in Latvia and Western countries, which can lead to both short term inconveniences and threats to security of critical infrastructure. The aim of these activities is to spread uncertainty and mistrust among the population, undermine the quality of services, punish for supporting Ukraine, and discourage from showing support in future.
In 2025, there has been an increase in airspace violations and the number of unidentified drones being observed over NATO member states, including critical and military infrastructure. Russia has used the disruptions caused by drones to the airports in its information activities, highlighting the vulnerabilities of European countries, e.g., the inability to control airspace.
Moscow continued to influence both Latvian and international information domain, spreading narratives that are in line with Russian interests. These narratives aim to increase discord and differences in Latvian society and reduce trust in government institutions and our allies in the EU and NATO. Russia constantly tries to discredit Latvia internationally.
Information influence activities were also one of the main tools Russia used when trying to manipulate elections in Europe in 2025. Moscow used fake social media accounts to spread support for candidates preferred by Russia, while disseminating defamation for candidates who embraced the European course and advocated for continuous or even increased support for Ukraine. Information influence activities were also used to reduce public trust in the electoral process and democracy in general.
Sir Keir Starmer and his entire team are taking “burner” phones and laptops to China in an attempt to stop their hosts from spying on them.
...
New mobile phones, temporary Sim cards and throwaway laptops are being issued to the prime minister, attachés, special advisers, the No 10 policy team and digital media staffers before they departed on Tuesday night.
But a government source told Metro the decision to take a British Airways jet was simply down to the size of the delegation going along.

Privacy

Subscribe to Deuxieme RE Banque News

Sign up now to get access to the library of members-only issues.
Jamie Larson
Subscribe