Category: Full Text Articles – Audio Posts

A leak suggests that Chinese cybersecurity firm TopSec offers censorship-as-a-service services, it provided bespoke monitoring services to a state-owned enterprise facing a corruption scandal.

SentinelLABS researchers analyzed a data leak that suggests that the Chinese cybersecurity firm TopSec offers censorship-as-a-service services. The origin of the data leak is unclear, the leak is large and inconsistently formatted, complicating the full analysis. TopSec was founded in 1995, it offers cybersecurity services such as Endpoint Detection and Response (EDR) and vulnerability scanning, along with “boutique” solutions to align with government initiatives and intelligence requirements.

TopSec is also a Tier 1 vulnerability supplier for China’s intelligence ministry and has provided cloud and IT security monitoring services nationwide since 2004.

The company provided monitoring services to a state-owned enterprise facing a corruption scandal.

The data leak includes infrastructure details and work logs from employees of a state-affiliated private sector security firm in China. The leak includes work logs, DevOps commands, API data, and network configs with hardcoded credentials, posing security risks to TopSec and its customers.

Some documents detail the use of web content monitoring services to enforce censorship for public and private sector customers.

“The data leak includes a document with 7,000+ lines of work logs and code used to orchestrate infrastructure for the firm’s DevOps practices and downstream customers and includes scripts that connect to several Chinese government hostnames, academic institutions and news sites.” reads the report published by SentinelLabs. “We identified work logs and system features that indicate TopSec is likely enabling content moderation for internet censorship purposes, a key strategy used by the Chinese Communist Party (CCP) to monitor and control public opinion on issues that the state deems contentious or antisocial.”

The leaked documents show that TopSec worked on projects for China’s Ministry of Public Security in Dandong, Songjiang, and Pudong, including a “Cloud Monitoring Service Project” in Shanghai.

The leaked TopSec data reveals infrastructure management code, network probes, and work logs referencing a specific censorship tool called Sparta. Sparta, migrated from Apollo-GraphQL, processes Chinese-language content via GraphQL APIs. Severe monitoring events are flagged and shared on WeChat for internal handling, raising privacy concerns due to China’s cybersecurity laws.

The tool allows operators to find hidden links in web content, identifying content related to political criticism, violence, or pornography. The operators can filter the content by searching for sensitive words. 

A leaked document from September 2023 shows tasks related to sensitive word detection and forwarding asset identifiers to Zhao Nannan, linked to political events in Shanghai. Zhao, previously at the Ministry of Public Security, later worked at Shanghai SASAC, where she received alerts about sensitive content on the same day a corruption investigation involving the head of the Shanghai SASAC, Bai Tinghui, was announced.

News of Shanghai official Bai Tinghui’s corruption investigation was covered by major outlets and confirmed by the government. The Shanghai SASAC, where Zhao Nannan worked, posted the news on WeChat without censorship, raising questions about the “validated events” reported to her. Interestingly, the Shanghai Municipal Commission for Discipline Inspection, involved in the investigation, is listed as a TopSec customer. This highlights the role of cybersecurity firms like TopSec in managing politically sensitive content in China.

“These leaks yield insight into the complex ecosystem of relationships between government entities and China’s private sector cybersecurity companies.” concludes the report.”The September 2023 situation in Shanghai provides insight into how local and national government interests are enforced through private sector partnerships. The CCP’s strategy of controlling information is multifaceted and requires significant investment in resources that enable the monitoring and alteration of content that citizens engage with. While there are still many unknown factors regarding how such censorship is applied, these findings yield insights into how collaboration occurs between the government and other entities in China.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, China)

It is salutary to remember that the man set to take over Germany has not had any role in government. Friedrich Merz, whose Christian Democrats won a comfortable if unconvincing victory in Sunday’s elections, will form a government at a time of tumult on multiple fronts.

He faces an economy reeling from a decade of under-investment and entering its third year of recession, an immigration crisis exacerbated by a series of lone terror attacks, and the ever-growing popularity of the far-right Alternative for Germany (AfD). Most of all it is facing the unprecedented collapse of relations with the U.S., on whom Germans have relied on for security since the end of World War Two.

[time-brightcove not-tgx=”true”]

Read More: Exclusive: Alice Weidel on Her Far-Right AfD Party’s Rise, Elon Musk’s Support, and the German Election

Merz would see himself as a classic Conservative of the old school, somewhere perhaps between Ronald Reagan and George H. W. Bush, a believer in traditional social values and the established security and political architecture of the postwar era that has bound Germans into the Transatlantic alliance.

When Donald Trump was re-elected U.S. President in November, Merz was confident he could do business with him—two fist-pumping men who wanted to slash bureaucracy, cut taxes, and wage war on “woke.” Yet the confrontational approach of Trump’s lieutenants at the recent Munich Security Conference—in which they lauded praise on the AfD—has changed that.

The 69-year-old Merz—a man who has interspersed politics with boardroom life as Chairman of the German arm of Blackrock, the investment house—is keen not to waste time. As he made clear during his victory speech, “the world isn’t waiting for us.” Germany, he added, could not spend months haggling over the finer points of a coalition agreement while Ukraine’s fate is decided by Trump and the man whom they feel has captured him, Russia’s Vladimir Putin.

Kaja Kallas, the E.U.’s chief diplomat, reiterated that point, expressing the hope that a new government is formed “as quickly as possible, as we really need to move on with decisions at the European level which requires German participation.”

With Emmanuel Macron in Washington today, and Keir Starmer following on Thursday, Europe is seeking to persuade Trump to step back from his seeming endorsement of Putin’s Ukraine position. Both the French and British leaders have been coordinating their positions, stressing the need for quiet diplomacy. But within hours of securing his election victory, Merz appeared to take a more confrontational approach toward the White House.

“My absolute priority will be to strengthen Europe as quickly as possible so that, step by step, we can really achieve independence from the USA,” Merz said Sunday, before even the final election tally came in.

Some wondered whether this might be another example of an impetuousness that is seen, even by his confidants, as a weak spot in Merz’s character. Yet he doubled down on his position the following morning: “Now more than ever, we must put Ukraine in a position of strength. For a just peace, the attacked country must be part of peace negotiations.”

For such talk to have substance, Merz will have to show that he is prepared to borrow more to ramp up Germany’s defense budget. A decade after NATO members agreed to devote a minimum of 2% of GDP for military spending, Germany only reached that target in 2024. In order to increase it to 2.5%, let alone a new 3% target, will cost tens of billions. For that, the incoming government will have to reform its so-called “debt brake” that places stringent limits on public debt.

It seems that Merz is prepared to do that, with the support of the center-left Social Democrats. The outgoing Chancellor Olaf Scholz’s SPD suffered a humiliating result, falling into third place to a historic low. They are now expected to play a junior role in a center-right administration. Yet some of Merz’s agenda will be hard for it to accede to, particularly elements of his economic reform package such as welfare cuts and tax breaks, and his plans to crack down hard on illegal migration.

In one respect, the row with Trump makes Merz’s task harder; it is a warning to mainstream on the politicians on both the left and right of what may follow if they fail to form a durable coalition. Encouraged by its best-ever result, with 20% of the vote, and boosted by the boisterous support of Elon Musk and others in the Trump Administration, the AfD is waiting in the wings. It is preparing a second front of attack the moment the new government faces its next crisis.

The far-right in Germany is confident that its moment will come, again.

Signup to receive the Early Edition in your inbox here.

A curated weekday guide to major news and developments over the weekend. Here’s today’s news:

ISRAEL-HAMAS WAR 

Israel will delay the release of 620 Palestinian prisoners planned for last Saturday until the release of further hostages “has been assured,” and Hamas commits to releasing them without “humiliating ceremonies,” Israeli Prime Minister Benjamin Netanyahu’s office announced yesterday. Hamas, which released six Israeli hostages on Saturday, condemned the delay as representing a “clear violation” of the terms of the ceasefire agreement. Isabel Kershner, Aaron Boxerman, Adam Rasgon, and Fatima AbdulKarim report for the New York Times; Reuters reports.

White House envoy Steve Witkoff yesterday said he will travel to the Middle East on Wednesday to discuss the possibility of extending the first phase of Gaza’s ceasefire deal with Israel, Qatar, and Egypt. Barak Ravid reports for Axios.

RUSSIA-UKRAINE WAR — U.S. AND INTERNATIONAL RESPONSE 

The Trump administration on Friday has called on Ukraine to replace its draft U.N. resolution condemning Russia’s war with a U.S.-sponsored statement with no mentions of Russian responsibility, according to diplomats. Ukraine refused to withdraw the resolution, an official added. Siobhán O’Grady, Karen DeYoung, Michael Birnbaum, and Ellen Francis report for the Washington Post.

U.S. negotiators have raised the possibility of cutting off Ukraine’s access to the SpaceX-owned Starlink satellite internet system if Ukraine does not agree to a minerals deal, according to sources. On Saturday, the Polish deputy prime minister said that Poland has been paying for Ukraine’s Starlink subscription and “cannot imagine” a contract for a commercial service to which Warsaw is a party being terminated.  Andrea Shalal and Joey Roulette report for Reuters; Reuters reports.

The United States expects an agreement on U.S. access to Ukraine’s minerals to be signed this week, President Trump’s special envoy Steve Witkoff and Treasury Secretary Scott Bessent said yesterday. Kanishka Singh reports for Reuters.

RUSSIA-UKRAINE WAR 

Ukraine and the United States are still negotiating the deal to trade Ukraine’s minerals for American aid, Zelenskyy said yesterday, adding that he rejected the latest U.S. proposal requiring Ukraine to pay $500 billion using its natural resources revenues. Constant Méheut and Andrew E. Kramer report for the New York Times.

Zelenskyy yesterday said he is ready to give up his position in exchange for peace in Ukraine or NATO membership. Max Hunder, Anastasiia Malenko, and Yuliia Dysa report for Reuters.

Russia has launched its largest drone attack against Ukraine to date on the eve of the third anniversary of Moscow’s invasion, Zelenskyy said yesterday. Elena Giordano reports for POLITICO.

SYRIA 

Syria’s national dialogue conference will start on February 25th, two members of its preparatory committee said yesterday. Reuters reports.

Israel will not tolerate the presence of Hayat Tahrir al-Sham (HTS) forces in southern Syria and wants the territory to be demilitarized, Netanyahu said yesterday. Reuters reports. 

OTHER GLOBAL DEVELOPMENTS

Germany’s mainstream conservative party won the national election yesterday, with the far-right Alternative for Germany party doubling its previous result to become the nation’s second-largest party according to provisional results. Vanessa Gera reports for AP News.

Israel has expelled the residents of the occupied West Bank’s Jenin, Tulkarm, and Nur Shams refugee camps, Israel’s Defense Minister Israel Katz said yesterday. The “empty” camps would be occupied by the Israeli military for the coming year to “prevent the return of residents and resurgence of terrorism,” with tanks deployed into the West Bank for the first time in more than 20 years, Katz added. Tom Bennett reports for BBC News; Raneen Sawafta and James Mackenzie report for Reuters.

Tens of thousands of mourners yesterday participated in the long-delayed public funeral for Hezbollah’s leader Hassan Nasrallah, killed by an Israeli airstrike in September. Freddie Clayton reports for NBC News.  

Sudan’s Rapid Support Forces paramilitary signed a charter to form a parallel government with allied political and armed groups on Saturday, signatories said. Meanwhile, Sudan’s army yesterday said it had seized back control of the el-Gitaina town and broke RSF’s year-long siege on the city of el-Obeid. Khalid Abdelaziz reports for Reuters; Samy Magdy reports for AP News.

A Kenyan police officer was killed in Haiti yesterday during an operation to help combat gang violence in the country, officials said, in what appears to be the first death of a Kenyan officer forming part of the international contingent stationed in Haiti. Yan Zhuang reports for the New York Times.

TRUMP ADMINISTRATION ACTIONS 

The Office of Personnel Management on Saturday sent a mass email instructing federal government workers to summarize their accomplishments for the week by today. In an earlier post on X, Elon Musk said employees who do not answer would lose their jobs. The employees of several federal agencies were told by their agency leaders not to reply to the email pending further guidance. Kate Conger, Eileen Sullivan, and Christina Jewett report for the New York Times; Jonathan Landay, Joseph Ax and Sarah N. Lynch report for Reuters.

Trump on Friday announced he is replacing the Chairman of the Joint Chiefs of Staff Gen. Charles Brown with a retired three-star officer, Lt. Gen. Dan “Razin” Caine. Shortly afterwards, Defense Secretary Pete Hegseth said he would dismiss five other senior officers, including Adm. Lisa Franchetti, the first female chief of naval operations, and Gen. James Slife, a top Air Force officer as well as the three top military lawyers in the Army, U.S. Air Force, and Navy. Missy Ryan and Dan Lamothe report for the Washington Post.

FBI Director Kash Patel is expected to be named chief of the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF), a White House official said. Separately, Trump yesterday announced he was naming conservative podcaster Dan Bongino as Deputy FBI Director. Yamiche Alcindor, Ryan J. Reilly, and Nnamdi Egwuonwu report for NBC News; Jessica Piper reports for POLITICO.

The Social Security Administration was investigating Leland Dudek on suspicion of improperly sharing information with DOGE when Trump elevated Dudek last week to be acting Commissioner of the agency, sources say. Lisa Rein reports for the Washington Post; Ken Thomas reports for the Wall Street Journal.

The Trump administration on Friday removed the acting director of Immigration and Customs Enforcement, Caleb Vitello, from his post amid frustration over the pace of deportations, sources say. It is not yet clear who will replace Vitello. Michelle Hackman and Josh Dawsey report for the Wall Street Journal.

The Pentagon will fire 5,400 civilian probationary workers starting this week, a senior Defense Department personnel official said in a Friday statement. Eric Schmitt reports for the New York Times.

Kash Patel on Friday told FBI employees he wants to move 1,000 officers from the Washington D.C. area to field offices across the country and reassign 500 support staff members to the bureau’s Alabama campus, sources say. Adam Goldman and Devlin Barrett report for the New York Times.

The Trump administration has drawn up plans to start deporting unaccompanied migrant children and is ramping up plans to detain undocumented immigrants at military sites across the United States, according to sources and internal documents. Marisa Taylor, Ted Hesson, and Kristina Cooke report for Reuters; Zolan Kanno-Youngs, Hamed Aleaziz, and Eric Schmitt report for the New York Times.

OTHER U.S. DOMESTIC DEVELOPMENTS 

Former Proud Boys leader Enrique Tarrio was arrested outside the Capitol on Friday and charged with assaulting a female protester. Owen Hayes, Ryan J. Reilly, Frank Thorp V, and Dareh Gregorian report for NBC News.

The Washington D.C. police on Friday confirmed they are investigating Rep. Cory Mills (R-FL) in connection with a report of an assault on a woman last week. Aimee Ortiz reports for the New York Times.

The federal judge overseeing the corruption case against New York Mayor Eric Adams declined to immediately grant the DOJ request to drop the charges against Adams, appointing an outside lawyer to present a case against the move. Jeremy Roebuck and Shayna Jacobs report for the Washington Post.

The Supreme Court on Friday ruled a group of Jewish Holocaust survivors could not sue Hungary in the United States to recover the proceeds of property stolen by its state-owned railway. Adam Liptak reports for the New York Times.

U.S. FOREIGN AFFAIRS

The Trump administration yesterday notified at least 1,600 U.S. Agency for International Development (USAID) staffers they were fired and told most of its staffers worldwide that they were on administrative leave as of today. Ellen Knickmeyer reports for AP News.

Russian and U.S. teams are planning to hold a meeting this week to further discuss improving relations, a senior Russian diplomat said yesterday. Reuters reports.

Germany’s likely next Chancellor Friedrich Merz yesterday said Europe should achieve “independence” from the United States “as quickly as possible” due to Trump’s “indifference” to the region’s fate. Anne-Sylvaine Chassany, Laura Pitel, and Olaf Storbeck report for the Financial Times.

The U.S. military yesterday announced it transported about 15 new migrant detainees from Texas to Guantánamo Bay. Carol Rosenberg reports for the New York Times.

Deportees from the United States arrived in Costa Rica in a state of “visible distress,” not knowing where they were and desperately seeking to reach their relatives, according to a sharply critical report released on Friday by Costa Rica’s ombudsman. Annie Correal and David Bolaños report for the New York Times.

TRUMP ADMINISTRATION LITIGATION

The Supreme Court on Friday ruled that Trump cannot yet bring an appeal seeking to remove Hampton Dellinger, the head of the U.S. Office of Special Counsel, holding Trump’s application in abeyance until a temporary restraining order issued by a lower court expires in two days. Zach Schonfeld reports for the Hill. 

A federal judge on Friday ruled the Trump administration can for now proceed with a move to put thousands of USAID’s workers on administrative leave, saying that the plaintiffs have not shown irreparable harm that would justify the grant of an injunction. Zoë Richards reports for NBC News.

The Trump administration’s bid to cut funding from DEI programs violates the First Amendment by penalizing private organizations based on their viewpoints and chilling federal contractors’ speech, a federal judge ruled Friday. Kyle Cheney reports for POLITICO.

A federal judge on Friday extended an order blocking DOGE’s access to Treasury Department payment systems, citing the Treasury’s “rushed and ad hoc process” for granting access to the systems. Michael Stratford reports for POLITICO.

A federal judge on Friday agreed to extend an order blocking the National Institutes of Health from reducing funding to medical and scientific research institutions. Zach Montague reports for the New York Times.

The Associated Press on Friday filed a lawsuit accusing three Trump administration officials of interfering with its freedom of speech by blocking the service’s access to presidential events. David Bauder reports for AP News. 

New York City on Friday sued Trump and administration officials over the White House clawback of $80 million earmarked for immigrant services in the city. Joe Anuta reports for POLITICO.

Did you miss this? Stay up-to-date with our Litigation Tracker: Legal Challenges to Trump Administration Actions

The post Early Edition: February 24, 2025 appeared first on Just Security.

The nation’s military service academies have become a central battleground in the new Trump administration’s “war on woke.” At the confirmation hearing for Defense Secretary Pete Hegseth, Sen. Tommy Tuberville (R-Ala.) warned, “It now appears they are a breeding ground for leftist activists and champions of DEI and Critical [Race] Theory.”

Hegseth pledged to tackle the problem by getting rid of the civilian professors from “left-wing, woke universities” who “try to push that into service academies” and replace them with battle-hardened, uniformed officers. President Trump may be going even further: On Feb. 10, he dismissed the Board of Visitors for all four service academies to combat their infiltration by “Woke Leftist Ideologues.” Trump then pledged on his Truth Social platform to: “Make the Military Academies GREAT AGAIN.”

[time-brightcove not-tgx=”true”]

Each side in this debate accuses the other of dragging the country’s revered service academies into culture wars and political debate. But the truth is, our service academies have been a part of such battles since their very inception. For more than two centuries, the service academies have been both pawns and prizes in evolving cultural and political fights.

George Washington recommended establishing a military academy as early as 1783. Theoretically, it should’ve been an easy win. During the Revolutionary War, Washington’s Continental Army had depended on the good graces of foreign officers like the Prussian Baron von Steuben, who instilled order and discipline in the ragtag forces at Valley Forge, and Tadeusz Kościuszko a Polish engineer who designed the fortifications at West Point, among other places. It seemed obvious that if the U.S. wanted to maintain its new independence, it would need to educate its officers in the art and science of war.

But the establishment of a U.S. military academy became politically divisive, tied up for decades by competing visions for the nation.

Read More: Affirmative Action Still an Option at West Point, But Supreme Court Likely to Have Final Say

The initial debate pitted the Federalists, led by Alexander Hamilton, against the Republicans, led by Thomas Jefferson. The Federalists dreamed of a commercial colossus rivaling the empires of Europe, whereas the Republicans imagined a simple, agrarian republic of yeoman farmers defended by citizen militias, with no need for a federal military academy. When General Washington became President Washington, he tried to prevent the emergence of parties by bringing both factions into his administration, making both Jefferson and Hamilton cabinet secretaries. But this effectively gave both men a veto over major initiatives, and no proposal for a military academy made it out of cabinet debates.

Two days before his death in 1799, Washington was still writing wistfully about the need for an academy.

But Jefferson quickly shifted gears when he became president in 1801, suggesting that his objection was not to a military academy per se, but rather to putting such a powerful institution at the disposal of elitist Federalists like Hamilton. A year later, he signed into law the Military Peace Establishment Act of 1802, which finally created the U.S. Military Academy at West Point.

But despite Republicans dominating politics over the next three decades, the nature and purpose of the new academy remained unresolved. Republican purists wanted a simple, technical training school that kept the costs low and, more importantly, kept the officer corps from evolving into an aristocracy. Many other Republicans, however, were expansionists, who had a continent to conquer. Further, they were proponents of Enlightenment science and education, with no vehicle for advancing those aims other than the Academy.

This factional dispute almost proved fatal in West Point’s early years. As the Chief of Engineers, Jonathan Williams was, by law, Superintendent of the Academy, and he envisioned “a great national establishment to… rival any in Europe.” But his duties mostly kept him away from West Point, and day-to-day leadership fell to Alden Partridge, who preferred to run things more like a drill sergeant. If the Army wasn’t sure how to run the Academy, neither was the government—in 1811, the Secretary of War ordered most of the cadets away for service elsewhere in the Army, effectively shutting it down for a year and a half.

It seemed Williams’ vision won out when, in 1817, President James Monroe appointed Sylvanus Thayer as Superintendent. Thayer inaugurated a set of reforms that established West Point as the nation’s premier scientific and engineering school and secured himself a legacy as the “Father of the Military Academy.” But Partridge was so committed to his rival vision for the Academy that the path for this progress had to be cleared by dragging him away from West Point under arrest.

Further, while Thayer’s firm hand eliminated one set of factional disputes, he envisioned the science and engineering program at West Point as serving strictly military ends. This vision created a new set of problems, because he took over the academy just as the Republican Party split into factions. The “National Republicans” led by John Quincy Adams wanted to grow the nation’s infrastructure. They needed civil engineers to build roads, canals, and railways to promote the national economy and support westward expansion. West Point was the only school that could provide them, but Thayer resisted any changes to the curriculum.

Finally, in 1824, a frustrated Congress passed the General Survey Act, which authorized the Army Corps of Engineers to support internal improvements. The law left Thayer with little choice but to green light the development of the nation’s first civil engineering program.

Read More: West Point Disbands Cadet Clubs Following Trump’s Anti-DEI Order

The General Survey Act also gave now-President Adams and his administration broad authority to dole out federal money in very targeted ways. West Point graduates led many of these internal improvement projects. Many took private pay, in addition to their military salaries, then cashed in on their taxpayer-funded education by leaving the Army for more lucrative civilian employment. This smelled of corruption, and it fueled the rise of Andrew Jackson’s Democratic Republican (eventually just Democratic) Party, as the National Republicans became the Whig Party.

The Academy became an easy target for Jackson, the self-taught, populist hero of the Battle of New Orleans. After he defeated Adams in 1828, Jackson actively antagonized Thayer by repeatedly reinstating cadets Thayer had expelled for disciplinary infractions, including for pro-Jackson political demonstrations. Partridge resurfaced to join congressional Democrats like Davy Crockett who called for abolishing West Point altogether.

Thayer resigned in frustration, but the Academy survived. Having made his political point, Jackson stopped meddling and instead deferred to Thayer’s successors in their disciplinary decisions.

In the Romantic era that followed, there were so many demands for additions to the Academy’s curriculum—history, literature, rhetoric—that the course of study was expanded to five years to accommodate them all, before the Civil War forced a return to the four-year program. This pattern continued through secession and Civil War, Reconstruction, the 20th century Civil Rights Movement, the other rights revolutions that made the academies more diverse, and through to the present day. A growing U.S. military also created the need for additional service academies to train officers for the Navy, Air Force, and Coast Guard.

Neither woke progressivism nor MAGA populism are terms that would be familiar to Hamilton, Jefferson, Partridge, Thayer, or Jackson. But the underlying debate would resonate with all of them.

Today, cadets and midshipmen at the academies study theories of civil-military relations that emphasize the apolitical nature of military service and a strict separation of military institutions from partisan concerns. Yet, this goal has never fully matched the reality of military education. Because the U.S. is a democracy, the military—including our military academies—have never been fully insulated from the political and cultural concerns of the day. And, in fact, they are obligated to respond to the needs of the nation, as determined by the citizens at the polls.

The principal concern, voiced by both sides in every era, is that the service academies continue to produce leaders who can defend the nation in times of war. The challenge for the current leaders of all of the academies will be—as it was for their predecessors—to stay focused on that mission amid the political noise.

Ryan Shaw is a professor of practice in history and strategy at Arizona State University. A retired Army officer, he previously taught U.S. history at West Point.

Made by History takes readers beyond the headlines with articles written and edited by professional historians. Learn more about Made by History at TIME here. Opinions expressed do not necessarily reflect the views of TIME editors.

When Palestinian Authority president Mahmoud Abbas issued a vaguely worded decree purportedly revoking the PA’s infamous “pay for slay” system, the European Commission called it a “significant political development” that “signals the Palestinian Authority’s commitment to implement far-reaching reforms.” Since then, Palestinian officials have assured the Arab world that the terror payments aren’t going anywhere.

The man overseeing the allegedly reformed system is Raed Abu al-Humus, the Free Beacon‘s Andrew Tobin reports from Jerusalem. He spent 10 years in prison alongside Nasser Abu Hamid, the late founder of Fatah’s Al-Aqsa Martyrs Brigades. Abu al-Humus has praised his jailmate as a “masked lion” and “inspiration” to the “Palestinian youth.” Now, he’s leading Abbas’s Commission of Detainees and Ex-Detainees Affairs.

Abu al-Humus replaces Qadura Fares, another convicted terrorist whom Abbas fired in a move that seemingly demonstrated his seriousness about reforming “pay for slay.”

“Just hours after his appointment,” Tobin reports, the commission “published a photograph of Abu al-Humus smiling alongside two arch-terrorists, Ahmed Barghouti and Mohammed Aradeh, whom Israel recently released to Cairo as part of a hostage-ceasefire deal with Hamas.” Both were serving life sentences.

“The photo is among a number of early signs that Abbas will once again disappoint international donors who expect him to end ‘pay for slay,'” Tobin writes. “Qatar’s Al-Sharq newspaper quoted unnamed senior Palestinian officials last Wednesday as saying the terrorism payments would continue ‘without any reduction.'”

Read more: Meet the Terrorist Overseeing Abbas’s ‘Reformed’ Payment System for Terrorist

Young, Gifted & Green is an “environmental justice” nonprofit that works with “Black and Latinx leaders” to end what it calls “environmental racism.” The Biden administration tapped its CEO, LaTricea Adams, to serve on the White House Environmental Justice Advisory Council, which Joe Biden created via executive order to address “racial inequity” in climate change.

Adams kept busy while serving on the council. In December, as Biden and his “antiracist” climate council eyed the exit doors, the EPA announced that it had selected Young, Gifted & Green to receive a $20 million taxpayer-funded grant under its Environmental and Climate Justice Community Change Program. Internal EPA documents reviewed by our Thomas Catenacci list Adams as the sole applicant for the grant. And while the council Adams served on advised the White House, it was formally considered a part of the EPA.

Adams served on that council from March 2021 through the end of the administration. “It remains unclear the extent to which Adams, in her role on the Environmental Justice Advisory Council, advised the EPA on its grantmaking activity or implementation of the Community Change program,” writes Catenacci. “But the revelation adds further weight to questions about the Biden administration’s process for doling out grants and whether the administration played favorites when it came to such programs.”

Federal officials “are generally expected to avoid even the appearance of impropriety when carrying out their duties.” Groups whose leaders served on Biden’s Environmental Justice Advisory Council, though, “were the recipients of EPA grants totaling hundreds of millions of dollars.”

Read more: Biden Environmental Justice Adviser Received Millions in Taxpayer Funds After Personally Applying For EPA Grant

It’s been nearly 10 years since Joy Reid’s homophobic and anti-Semitic blog posts resurfaced, and Reid still hasn’t found the “hackers” who allegedly “planted” the bigoted screeds on her site. But she’s about to have a lot more time to look.

Reid got the ax at MSNBC, our Andrew Stiles reports, with the final episode of her show The ReidOut set to air sometime this week. Replacing her is a trio of MSNBC weekend anchors: former Kamala Harris adviser Symone Sanders, so-called Republican Michael Steele, and Alicia Menendez, the daughter of Democrat and convicted felon Bob Menendez. MSNBC is reportedly interested in hiring Politico reporter and self-described “walking Beyoncé encyclopedia” Eugene Daniels to fill their weekend slot.

Reid was known for delivering insightful analysis that connected with working-class Americans, like her insistence that Kamala Harris waged a “flawlessly run” campaign because she earned an endorsement from Queen Latifah, who “never endorses anyone.” In 2020, she expressed shock when a Latino congressman suggested “Latinx” was not a “preferred term” for actual Latinos.

“These insightful remarks persuaded MSNBC to give Reid an annual salary believed to be in the range of $3 million,” writes Stiles. “Network executives clearly valued her cerebral reporting and ‘in-depth interviews with politicians and other newsmakers,’ according to the New York Times. In November, for instance, Reid interviewed a Yale psychologist who argued Democrats were ‘entitled’ to shun their Trump-supporting family members because it ‘may be essential for your mental health.'”

“Reid’s sway at MSNBC was such that the network didn’t even bother to figure out what really happened to Reid’s old blog after internet sleuths uncovered a series of bigoted posts in 2017. Reid accused ‘hackers’ of having ‘accessed and manipulated’ her blog to post hateful content—targeting gays, Jews, and Muslims—that was ‘fabricated.’ She urged the FBI to investigate. The results of the alleged investigation were never released, but Reid was promoted to a full-time host in 2020.”

Away from the Beacon:

• Benjamin Netanyahu halted the release of Palestinian prisoners over Hamas’s “humiliating” hostage handovers, including the recent display in which the terror group brought detained hostages to a ceremony where other captives were freed. Netanyahu said he won’t change course until Israeli hostages are released “without the humiliating ceremonies,” something Hamas showed it is capable of on Saturday, when it quietly released Arab-Israeli Hisham al-Sayed away from the propaganda display. The White House supports the move.
• Kamala Harris received an NAACP award over the weekend and managed to deliver a speech without saying anything at all. “Some see the flames on our horizons, the rising waters in our cities, the shadows gathering over our democracy, and ask, ‘What do we do now?'” she said. “But we know exactly what to do.” We do?
• Barnard College expelled two students who stormed an Israeli history class and targeted Jewish students with anti-Semitic flyers. Who knew administrators had the power to do that?
• Fifty-seven percent of voters say Trump is doing a better job than Biden as president, a number driven by the “hugely popular” policies of closing the border, cutting waste, and “resetting merit as the prime hiring and contracting principle,” according to a Stagwell poll that drops today.

The post A Convicted Terrorist Oversees Abbas’s ‘Reformed’ Pay for Slay System. Plus, How a Biden ‘Environmental Justice’ Adviser Raked in Taxpayer Dollars. appeared first on .

This article is part of The D.C. Brief, TIME’s politics newsletter. Sign up here to get stories like this sent to your inbox.

Chris Christie’s flight from Detroit landed in Newark, N.J., on Thursday and was one of the unlucky arrivals without a dedicated gate assignment. Tired and cranky, the former New Jersey Governor lumbered onto a bus ferrying passengers back to the terminal, where the woman seated beside him started unpacking the unpredictable state of politics, particularly President Donald Trump’s chaotic first few weeks back in power.

[time-brightcove not-tgx=”true”]

“She said, ‘You know, he’s really shaking things up, and maybe some of that will turn out OK,’” Christie recalled two days later at the Principles First Summit, a confab of traditionalist Republicans trying to chart their way through the next four years of Trumpism. “At that moment, when I’m at the end of my travel day, my Sicilian instinct is to grab her by the shoulders and go, ‘Are you kidding me?’”

But Christie, who ran against Trump for the 2016 GOP presidential nomination, ran afoul of his mercurial nature, and subsequently found himself exiled, listened politely before offering a self-aware question to her: “What about everything you’ve seen about him for the last 10 years leads you to believe that it might turn out OK?”

In Christie’s telling, the woman in question said it was important for anyone in the presidency to succeed. Christie, uncharacteristically, was prepared to let the chat end there, but not his parable for an audience of hard-core NeverTrumpers, disaffected Republicans, and more than a few self-identified Democrats looking for answers in this charged period.

“There’s going to come a moment where that woman, I believe in my heart, is going to say, ‘Yeah, no, this is not OK anymore,’” Christie said. “But we all get there at a different pace.”

And then the former prosecutor summed up the ethos for that sold-out thinkfest held a few blocks from the White House back in Trump’s control.

“To the extent that we try to force that pace because we can’t stand it anymore, we run the risk of lengthening it, not shortening it,” he said. “And a lot of damage could be done.”

Welcome to the latest iteration of the Conservative Resistance. They are angry, they are motivated, and they are altogether at a loss at what to do with those feelings. This year’s Principles First summit, it’s fifth, offered its usual blend of anti-Trump fervor and pragmatic posturing about how to reclaim a Republican Party and conservative movement with which they once comfortably identified. On the same day that Trump regaled the more boisterous crowd just across the river at CPAC with his tales of political retribution, several hundred activists and insiders gathered in downtown D.C. to make sense of their current impotence.

In the room, much of the rhetoric came off as scorching and inspired, as if a solution to the ongoing dismantling of much of the federal government were just over the horizon. Beyond the basement ballroom, though, it sure seemed lukewarm. It was a wait-it-out strategy that, frankly, is not entirely dissimilar to the approach Democrats are taking on their side of the observation deck. The path forward in no way matched the appetite for immediate action. It felt, at times, like being promised a decadent five-course meal and realizing later you had been served a rice cake.

Dark humor and worries about democracy’s nadir frequently intersected in the basement of the J.W. Marriott. When former Attorney General Alberto Gonzales mused that maybe “Congress will say enough is enough,” the ballroom giggled with skepticism. Former Arkansas Gov. Asa Hutchinson similarly drew laughs when he suggested Congress will assert its check over the presidency: “I’m optimistic that they will at the right time. And it may be very, very soon.”

Yet former Rep. Joe Walsh, a Tea Party founder from Illinois, said no one should count on the group he once counted himself a member to do their jobs: “Forget about Republicans in Congress. They’re done.”

Billionaire entrepreneur Mark Cuban was similarly dismissive of those who thought wailing about Trump tearing down democracy would get the public on their side. “How’d that work in the campaign?” he needled.

The gathering seemed simultaneously poisoned by pessimism and laden with pleas to give Trump time to reveal himself as a true threat to All Things American. The job of harnessing that outrage, the argument went, will get easier once Trump inevitably hands his critics a full dossier of second-term over-reach. As one introducer ticked through Trump’s foreign policy changes so far, he seemed out of breath by the end of the partial list. “That was in one month,” he said. “There are 47 months left.”

But talk of waiting things out was constantly in tension with what many saw as an urgent moment in history that demanded action.

“This is the collapse of an American ideal, American ideology, the American view of the world,” said Tom Nichols, a retired academic who now writes for The Atlantic. 

To his right on stage, one of the most recognized democracy advocates, chess grandmaster and Russian dissident Garry Kasparov, offered a polite correction. “We are not watching the collapse of the American ideal. We are watching the betrayal of the American ideal,” Kasparov said. “We are living in the middle of the coup.”

As the day’s sessions neared its end, Sarah Longwell, a political strategist and publisher of The Bulwark, deadpanned, “This has been a long day and is terrifying,” before calling the President “a fabulist, a liar, and a bad person.” No one really objected to the verdict, but it was not apparent what to do with it. 

(Before the Summit closed out on Sunday, organizers announced they had received “a credible bomb threat” from someone claiming to be Enrique Tarrio, the former leader of the Proud Boys, forcing a temporary evacuation. Tarrio reportedly denied any involvement.)

While adopting a resigned wait-it-out slouch, a running thread at the summit came down to a simple but actionable question: At what point has the United States entered into a constitutional crisis? Trump has been musing that he was not subject to court rulings, might serve a third term, and could start annexing the Panama Canal, Canada, and Greenland. 

Gonzales, who served as President George W. Bush’s top lawyer and ran his Justice Department, but endorsed Vice President Kamala Harris last year, said he is waiting to see if Trump ignores an inevitable setback from the courts. “Until that happens, we don’t have a constitutional crisis,” Gonzales said. Added Hutchinson, a former U.S. attorney: “We’re not there yet.” And Christie, another former U.S. attorney, said he, too, is concerned about the looming crisis, but warned that the language is being too casually bandied about.

“I think we use this ‘constitutional crisis’ thing much too liberally,” Christie said. “What we’re doing is cheating, because when we really do have the constitutional crisis, half the country is going to go…” He then uttered a verbal shrug that could possibly be transcribed as “meh.”

In the room, folks nodded along with a dour expectation that they too were going to be using that rhetoric at some point. It may just be as premature as it is inevitable. Patience is far from sexy, but it may be the best strategy to allow for Trump to trip over traps of his own making. Yet those most committed to restoring traditional conservative footing in the GOP are anxious to do more than stand by at this specific moment. 

“The resistance will rise,” said Bill Kristol, a self-described hawk who served as chief of staff to Vice President Dan Quayle. “But will it rise quickly enough?” In the crowd, there were visible shaking of heads.

Make sense of what matters in Washington. Sign up for the D.C. Brief newsletter.

In the final weeks of the Biden administration, the Environmental Protection Agency awarded a lucrative environmental justice grant to a left-wing nonprofit whose CEO—LaTricea Adams—personally applied for the taxpayer funding while simultaneously serving as a member of a top White House advisory council.

The Biden EPA announced in December that it selected Young, Gifted & Green to receive a $20 million grant under its so-called Environmental and Climate Justice Community Change Program—the largest grant allowed under the program. The EPA dished out 105 grants—including the grant to Adams’s Tennessee-based group—totaling $1.6 billion as part of the program after receiving 2,801 applications from groups nationwide, according to internal agency documents reviewed by the Washington Free Beacon.

The EPA documents also show that Adams was listed as the individual applicant for the grant, which she applied for on behalf of Young, Gifted & Green in late September. Adams personally submitted the application while serving as a member of former president Joe Biden’s Environmental Justice Advisory Council, which was housed at the EPA. She served on the council from March 2021 through the end of the Biden administration.

It remains unclear the extent to which Adams, in her role on the Environmental Justice Advisory Council, advised the EPA on its grantmaking activity or implementation of the Community Change Program. Young, Gifted & Green did not respond to requests for comment.

But the revelation adds further weight to questions about the Biden administration’s process for doling out grants and whether the administration played favorites when it came to such programs. Federal officials are generally expected to avoid even the appearance of impropriety when carrying out their duties.

The Free Beacon previously reported that groups whose leaders served on Biden’s Environmental Justice Advisory Council were the recipients of EPA grants totaling hundreds of millions of dollars during the previous administration. The Young, Gifted & Green grant, though, represents the only known instance in which a council member personally applied for the funding their group ultimately received from the EPA.

The Trump administration has taken aim at both environmental justice programs as part of its energy agenda. It has also initiated audits of climate spending executed under the Biden administration as part of its efforts to cut government waste and abuse.

“The deep ties between the Biden-Harris administration, their donors, advisers, and grant recipients are a staggering wake-up call,” EPA administrator Lee Zeldin told the Free Beacon in a statement. “There will be zero tolerance for waste or abuse at EPA under the Trump administration.”

“Being a good steward of American hard-earned tax dollars to protect human health and the environment is my top priority, not following the corrupt example of those who funneled funds through kickbacks and pass throughs to far-left activists,” Zeldin said.

The EPA’s billion-dollar Environmental and Climate Justice Community Change Program was created by the Democrats’ Inflation Reduction Act, which Biden signed into law in August 2022. The purpose of the initiative is to fund local efforts to fight climate change in ways that “benefit disadvantaged communities.”

Young, Gifted & Green said it would use its $20 million grant to finance energy efficiency upgrades in 150 low-income homes in Memphis, Tenn., and support small businesses that seek to install solar panels or replace gas appliances with electric alternatives. The group added that it would construct new greenspaces.

The size of the EPA grant dwarfs the amount of money Young, Gifted & Green had previously handled. Since it registered as a 501(c)(3) nonprofit in 2020, the group has reported a total revenue of $2.7 million, about 14 percent the size of its EPA grant, according to tax filings reviewed by the Free Beacon.

“These shocking revelations solidify the Biden administration’s legacy as the most corrupt in modern history,” Tom Jones, the executive director of right-leaning watchdog group the American Accountability Foundation, told the Free Beacon.

“While everyday Americans suffered under Bidenflation, rampant cronyism flourished—a disgrace that demands full investigation and accountability and proves once again the necessity for all these grants to be impounded by the Office of Management and Budget immediately,” Jones continued. “The American people deserve nothing less.”

Daren Bakst, the director of the Competitive Enterprise Institute’s Center for Energy and Environment, argued that Zeldin should consider investigating the full extent of the Biden administration’s environmental justice initiatives. He said the case involving Young, Gifted & Green could expose deeper issues with how the Biden administration approached such programs.

“The entire Environmental and Climate Justice Program should be in his sights,” Bakst told the Free Beacon. “As part of this, the EPA should ensure that grant recipients were eligible for the money.”

“It is quite possible that White House Environmental Justice Advisory Council members can be leaders of organizations receiving the grants,” he said. “But this would be yet again another example of the problems with the Inflation Reduction Act and how the Biden EPA implemented the programs.”

The post Biden Environmental Justice Adviser Received Millions in Taxpayer Funds After Personally Applying For EPA Grant appeared first on .

Northwestern University’s mandatory anti-discrimination training relies on unverified data from the Council on American-Islamic Relations (CAIR) that inflate Islamophobic attacks, giving the false impression that those attacks vastly outpace anti-Semitic hate crimes. The training also questions anti-Zionism’s ties to Jew-hatred and explicitly addresses “anti-Muslim, anti-Arab, and anti-Palestinian biases,” but it doesn’t do the same for anti-Israeli or anti-Zionist sentiment.

All Northwestern students, faculty, and staff across all departments, must watch the nearly 20-minute video training, obtained by the Washington Free Beacon, and is part of a 3-hour online course created by the university.

“Reports from Northwestern University faculty and staff suggest that its so-called anti-discrimination training does the opposite of what it claims,” Coalition Against Antisemitism at Northwestern president Michael Teplitsky told the Free Beacon. “Instead of fostering genuine inclusion, it selectively elevates certain perspectives while excluding Israeli students from the conversation—despite these students facing some of the most severe harassment and intimidation on U.S. college campuses.”

“This omission is not an oversight; it reflects Northwestern’s ongoing pattern of sidelining Jewish concerns in response to activist pressure,” he added.

The training relies on separate datasets to show anti-Semitic and anti-Muslim hate crimes. For anti-Semitic attacks, it cites official FBI data. But for Muslim attacks, the training showed unverified figures from CAIR—without citing the source.

As a result, the training falsely suggests there were five times more incidents against Muslims than Jews.

Citing FBI data, the video notes that anti-Semitic hate crimes rose 63 percent from 2022 to 2023, though it didn’t include the bureau’s raw figures—an increase from 1,122 to 1,832.

Had Northwestern consistently used that dataset, it would have shown that anti-Muslim and anti-Arab hate crimes had a much smaller rise and far fewer incidents. According to the FBI data, anti-Muslim hate crimes increased from 158 to 236 and anti-Arab hate crimes increased from 92 to 123.

Instead, Northwestern’s training pointed to CAIR data, which simply aggregate self-reported complaints.

“By one account, there was a 56 percent increase from 2022, with 8,061 complaints reported nationwide in 2023,” a voiceover says, referencing a CAIR report almost verbatim. “It has been noted that this is even higher than what occurred during the travel ban imposed by a presidential executive order in 2017.”

CAIR has a long history of anti-Semitism, which has been underscored since Hamas’s Oct. 7, 2023, attack on Israel. Two days after the assault, CAIR accused Israel of provoking the attack through “apartheid policies.” Weeks later, CAIR executive director Nihad Awad said he was “happy to see” Hamas kill Jews. In 1993, Awad participated in a secret meeting that was wiretapped by the FBI. During that gathering, participants reportedly discussed ways to support Hamas.

Northwestern spokesman Jon Yates ignored the Free Beacon‘s question about why the university used different datasets and relied on CAIR’s figures. Instead, he defended the training in a statement.

“Our required training for faculty and staff, which was released in December, comprehensively covers antisemitism, anti-Zionism and anti-Jewish hate, diving deep into the history, common tropes and pervasiveness of such hate today,” Yates said. “Our required training for students, released this week, was developed by the Jewish United Fund and covers the same topics, and is a permanent and annual training.”

Northwestern’s training was revamped as recently as last December to include “components on overcoming antisemitic, anti-Muslim, anti-Arab and anti-Palestinian biases,” according to a December 17 email obtained by the Free Beacon. Still, it appears unbalanced.

In the “overcoming anti-Muslim, anti-Arab and anti-Palestinian biases” section, the training provides specific examples of discrimination, including “verbal or online harassment,” “physical attacks and profiling,” and “everyday interactions such as inappropriate comments or actions.” The section addressing anti-Semitism, however, offers no comparable examples of discrimination specifically targeting Jews.

And while the training does discuss anti-Zionism, it receives less attention than anti-Arab and anti-Palestinian biases—and with qualifications. Anti-Israel sentiment is barely mentioned at all.

The video opens with a voiceover stating that “current affairs have brought anti-Semitism and anti-Muslim, anti-Arab, and anti-Palestinian biases to the fore”—but the introduction makes no mention of anti-Zionism or anti-Israeli discrimination. It then divides into two sections: “Overcoming Anti-Semitism” and “Overcoming Anti-Muslim, Anti-Arab, and Anti-Palestinian Biases.”

When the video begins to discuss protections for pro-Zionists toward the end of the anti-Semitism section, it casts doubt on the movement’s ties to Jew-hatred.

“There’s heated debate about the distinction between anti-Zionism, opposition to the existence of the state of Israel as a Jewish state, and anti-Semitism,” the voiceover says. “Some scholars and members of Jewish communities hold that opposition to Zionism is not anti-Semitic. Others say that anti-Zionism can and often does take anti-Semitic forms. Accordingly, at Northwestern, students, staff and faculty cannot be excluded from activities or spaces because they are Jewish or pro-Zionist.”

Harvard University, meanwhile, settled a lawsuit with Jewish students last month by agreeing to issue guidance that includes Zionists as a protected class under its non-discrimination policy, stating that targeting them could lead to disciplinary action. It also adopted the International Holocaust Remembrance Alliance definition of anti-Semitism. That definition, which Northwestern has not adopted, states that “denying the Jewish people their right to self-determination, e.g., by claiming that the existence of a State of Israel is a racist endeavor,” is a form of anti-Semitism.

Earlier this month, the Department of Education opened a probe into “widespread antisemitic harassment” at Northwestern and four other universities following Hamas’s attack. During anti-Israel protests at Northwestern last year, demonstrators defaced the Star of David and chanted that Jews should “go back to Germany,” among other anti-Semitic incidents.

Northwestern’s training video also goes out of its way to highlight modern-day “Palestinian territories” when describing Jews’ origins.

“Jews emerged 3,500 years ago in what is today Israel and Palestinian territories as the first practitioners of monotheism, or belief in one god,” the voiceover says.

“Northwestern is already under federal investigation for potential Title VI violations due to its failure to protect Jewish, Zionist, and Israeli students,” Teplitsky said. “If it continues to downplay antisemitism and distort history to fit activist agendas, it risks not only its credibility but also serious consequences at the federal level.”

Northwestern is also providing free legal defense to a group of anti-Israel radicals who orchestrated a blockade at Chicago’s O’Hare International Airport, highlighting a perceived inconsistency in addressing discriminatory practices on campus.

The post Northwestern University Mandatory Anti-Discrimination Training Pushes Unverified CAIR Data appeared first on .

CYFIRMA researchers discovered that the SpyLend Android malware was downloaded 100,000 times from the official app store Google Play.

CYFIRMA researchers discovered an Android malware, named SpyLend, which was distributed through Google Play as Finance Simplified. The malware targets Indian users with unauthorized loan apps, enabling predatory lending, blackmail, and extortion.

The Finance Simplified app is still available on Google Play at the time of this report’s publication, with downloads doubling to 100,000 in a week. Experts have noted numerous negative reviews, with users reporting blackmail, harassment, and photo manipulation.

The app poses as a financial tool, it lures users with easy loan promises but demands excessive permissions to access contacts, call logs, SMS, photos, and location.

“While marketed as a finance calculator, the app detects the user’s location (India) and displays fake loan applications via WebView instead of providing EMI calculator functionality.” reads the report published by CYFIRMA. “These loan apps are specifically designed to target Indian users.”

The app redirects users to external links for APK downloads, bypassing Google Play security. Once installed, it accesses photos, videos, and contacts, capturing clipboard data to steal sensitive information.

The researchers discovered that the malicious app uses a custom C2 server on Amazon EC2, with an admin panel in English and Chinese, suggesting Chinese-speaking attackers. The malware exploits APIs to access files, contacts, call logs, SMS, and installed apps. Operators behind the threat used stolen data for blackmail and extortion, they were spotted editing victims’ photos into fake nudes to coerce payments.

“The analysis of SpyLend reveals a highly deceptive and dangerous threat targeting Android users. Initially presented as a harmless Finance management application, it downloads a fraud loan app from an external download URL, which once installed, gains extensive permissions to access sensitive data, including files, contacts, call logs, SMS, clipboard content, and even the camera.” concludes the report. “This allows the attackers to extort users by the creation of deepfake photos from the manipulation of files in their photo gallery. The app’s ability to harvest and exploit personal information highlights its severe impact on user privacy and security, demonstrating how malicious actors abuse seemingly legitimate apps to carry out financial fraud and psychological manipulation.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, SpyLend Android malware)

Leaked Black Basta chat logs reveal internal conflicts, exposing member details and hacking tools as the gang reportedly falls apart.

An unknown actor, named ExploitWhispers, leaked Matrix chat logs of the Black Basta ransomware gang revealing internal conflicts, and exposing member details and hacking tools as the gang reportedly collapses.

ExploitWhispers first uploaded the chat messages on MEGA, then also uploaded them to Telegram.

The leaked archive includes Black Basta’s internal chat messages from September 18, 2023, to September 28, 2024.

PRODAFT researchers reported that Black Basta has been largely inactive in 2025 due to internal conflicts, ransom scams, and ineffective ransomware. Key members left for other groups, and a major chat log leak on February 11 exposed their operations, allegedly due to attacks on Russian banks.

As part of our continuous monitoring, we’ve observed that BLACKBASTA (Vengeful Mantis) has been mostly inactive since the start of the year due to internal conflicts. Some of its operators scammed victims by collecting ransom payments without providing functional decryptors.…

— PRODAFT (@PRODAFT) February 20, 2025

“BlackBasta’s internal chats just got exposed, proving once again that cybercriminals are their own worst enemies. Keep burning our intelligence sources, we don’t mind.” wrote PRODAFT on X.

“As part of our continuous monitoring, we’ve observed that BLACKBASTA (Vengeful Mantis) has been mostly inactive since the start of the year due to internal conflicts. Some of its operators scammed victims by collecting ransom payments without providing functional decryptors.” added the experts.

Their ransomware is also considered less effective compared to other major groups. Earlier this year, key members left BLACKBASTA to join Cactus (Nurturing Mantis) ransomware or other cybercriminal groups. The internal conflict was driven by “Tramp” (LARVA-18), a known threat actor who operates a spamming network responsible for distributing QBOT. As a key figure within BLACKBASTA, his actions played a major role in the group’s instability.

On February 11, 2025, a major leak exposed BLACKBASTA’s internal Matrix chat logs. The leaker claimed they released the data because the group was targeting Russian banks. This leak closely resembles the previous Conti leaks.”

The leaked Black Basta chat logs reveal insights into the gang’s operations, tactics, and tools. Researchers found they prioritized VPN exploits and maintained a shared victim spreadsheet. One member was identified as a 17-year-old. Messages indicate a blunt, high-pressure work environment.

Researchers from VX-underground analyzed the leaked Black Basta chat logs and reported they reveal insights into their operations, including skepticism towards LockBit, recruitment concerns about Dispossessor ransomware group, and interest in VPN exploits. One member is a 17-year-old. They use social engineering, maintaining a spreadsheet of targets and prioritizing industries like electrical and financial firms. Their workflow includes tricking victims into executing malicious files that connect to a C2 server, enabling ransomware deployment or remote access. A private loader was offered to them for $84,000/month.

Regarding the BlackBasta leaks: we haven’t reviewed them in totality yet. It’s quite a bit of messages in JSON format. It also has some Russian slang which makes it difficult to translate accurately. Thankfully there are some native Russian speakers who have made some interesting…

— vx-underground (@vxunderground) February 21, 2025

The leaked messages from Black Basta convey a direct and harsh tone, with members mocking failures and emphasizing deadlines. Their workflow relies on social engineering to deliver malicious HTA files that connect to their server for payload deployment. Victims typically have 10-12 days to pay the ransom before their stolen data is published.

The researcher Suyesh Prabhugaonkar identified 367 unique Zoom links, domains, and IPs used by Black Basta. The gang exploited weak credentials, unpatched vulnerabilities, and social engineering for initial access. They rotated infrastructure to avoid detection and tested payloads. Key player GG (Trump), likely leader Oleg Nefedov, was involved in delegating tasks, tracking performance, and applying pressure on deadlines, according to Prodaft.

In May 2024, the FBI, CISA, HHS, and MS-ISAC issued a joint Cybersecurity Advisory (CSA) regarding the Black Basta ransomware activity as part of the StopRansomware initiative.

Black Basta has targeted at least 12 critical infrastructure sectors, including Healthcare and Public Health. The alert provides Tactics, Techniques, and Procedures (TTPs) and Indicators of Compromise (IOCs) obtained from law enforcement investigations and reports from third-party security firms.

Black Basta ransomware-as-a-service (RaaS) has been active since April 2022, it impacted several businesses and critical infrastructure entities across North America, Europe, and Australia. As of May 2024, Black Basta has impacted over 500 organizations worldwide.

“Black Basta is a ransomware-as-a-service (RaaS) variant, first identified in April 2022. Black Basta affiliates have targeted over 500 private industry and critical infrastructure entities, including healthcare organizations, in North America, Europe, and Australia.” reads the CSA.

In December 2023, Elliptic and Corvus Insurance published a joint research that revealed the group accumulated at least $107 million in Bitcoin ransom payments since early 2022. According to the experts, the ransomware gang has infected over 329 victims, including ABB, Capita, Dish Network, and Rheinmetall. 

The researchers analyzed blockchain transactions, they discovered a clear link between Black Basta and the Conti Group.

In 2022, the Conti gang discontinued its operations, coinciding with the emergence of the Black Basta group in the threat landscape.

The group mainly laundered the illicit funds through the Russian crypto exchange Garantex.

“Black Basta is a Russia-linked ransomware that emerged in early 2022. It has been used to attack more than 329 organizations globally and has grown to become the fourth-most active strain of ransomware by number of victims in 2022-2023.” reads the Elliptic’s report. “Our analysis suggests that Black Basta has received at least $107 million in ransom payments since early 2022, across more than 90 victims. The largest received ransom payment was $9 million, and at least 18 of the ransoms exceeded $1 million. The average ransom payment was $1.2 million.”

Most of the victims are in the manufacturing, engineering and construction, and retail sectors. 61,9% of the victims are in the US, 15.8% in Germany, and 5.9% in Canada.

Some of the victims’ ransom payments were sent by both Conti and Black Basta groups to the gang behind the Qakbot malware.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, ransomware)