Category: France

  • MIL-OSI China: WADA welcomes additional funding from Qatar for scientific research

    Source: People’s Republic of China – State Council News

    The World Anti-Doping Agency (WADA) has welcomed Qatar’s decision to provide additional funding to support the organization’s scientific research efforts.

    The Ministry of Sports and Youth in Qatar will contribute an extra 1.5 million U.S. dollars, in addition to the country’s annual payment of more than 200,000 dollars to WADA, the agency announced on Wednesday.

    “WADA is appreciative of the continued support of our partners within Qatar’s Ministry of Sports and Youth. The additional funding will make a significant impact on anti-doping research globally and within Qatar itself,” said WADA President Witold Banka.

    “This is another indication of the strong support WADA receives from governments around the world, which believe in and trust us to deliver on our clean sport mission and understand the importance of cutting-edge scientific research to being ahead of those who seek to cheat the system.”

    Earlier this month, Japan pledged an additional 196,000 dollars to support anti-doping capacity and capability development in Asia and Oceania. According to WADA, Japan has contributed roughly 2.5 million dollars in additional funding over the past two decades.

    In the past 10 years, WADA has also received additional contributions from countries including Australia, Azerbaijan, Brazil, Canada, China, Denmark, Egypt, France, India, Kuwait, Poland, Saudi Arabia, Switzerland and the United States.

    Banka stated earlier this year that WADA invests heavily in anti-doping research, allocating about 10 percent of its annual budget to scientific and social science initiatives. The agency has also called on its partners to support ongoing research efforts, including recent work focused on unintentional doping.

    WADA has set a budget of more than 50 million dollars for 2025.

    The United States, which failed to pay its 2024 annual fee of 3.62 million dollars–amounting to 14 percent of WADA’s budget–automatically loses its seat on the organization’s executive committee for the year.

    “It is so important for athletes that WADA is properly resourced and that it has certainty around the funds it receives,” said Yuhan Tan, Belgium’s former badminton player and WADA Athlete Council representative on the Foundation Board.

    “I call on all governments to fulfill their commitments and make their annual contributions to WADA in a predictable and timely fashion so the work upholding the World Anti-Doping Code and supporting athletes around the world can continue. Clearly, anti-doping is becoming more and more politicized, which must be avoided as it puts all athletes and the entire system at risk,” he commented when WADA released its budget plan earlier this year. 

    MIL OSI China News

  • MIL-OSI NGOs: UN Ocean Conference draft declaration fails to address the ocean crisis

    Source: Greenpeace Statement –

    Paris, France, 22 May 2025 – Greenpeace International is alarmed by the state of the UN Ocean Conference draft declaration which falls far short of expectations, with less than three weeks to the start in Nice, France. Rather than  establishing the ambition shown by states to protect the oceans,the current text – set to be published as the final text of the upcoming conference – lacks the necessary ambition to address the crisis facing the oceans.  

    The third, and supposedly final, draft declaration fails to include the key measures needed to ensure the ocean recovers from decades of abuse and can withstand the impacts of global climate change. 

    Megan Randles, UNOC Head of Delegation for Greenpeace International, said: “We’re shocked after all the fine words from the organisers of this conference to find a declaration text that lacks the ambition needed to protect the oceans. The UN Ocean Conference was supposed to be the moment when governments turned the tide and showcased genuine progress. Instead, we are handed a weak political declaration with glaring omissions and weak language. 

    “The current text makes clear governments once again aren’t serious about protecting the oceans, and are satisfied to say fine words but not deliver real change at sea. It also fails to recognise the rights and leadership of coastal communities and Indigenous Peoples, who are on the frontlines of ocean stewardship. Unless this Declaration is drastically improved, the UN Ocean Conference will become a meaningless talking shop.”

    The glaring omissions or regressions from earlier draft texts are:

    • Pitifully weak language on deep sea mining, with no reference to a moratorium on this dangerous industry, and the removal of any reference to applying the precautionary principle, which appeared in early drafts. [1] 
    • The lack of any urgency on the Global Ocean Treaty ratification, or reflection that the governmental self-set deadline to reach 60 ratifications by this Conference is set to be missed. [2] 
    • Failure to recognise that the Global Ocean Treaty is fundamental to deliver on the 30 by 30 target agreed under the Convention on Biological Diversity, as the Global Ocean Treaty is the only legal tool that can deliver this universally agreed and binding UN target on the high seas, which make ⅔ of the world’s ocean. [3]
    • The absence of a clear reference to the need to reduce plastic production. While there is a brief mention in the text on the development of an internationally binding instrument on plastic, it makes no mention of the need to reduce production.[4]
    • No mention of key issues such as addressing labour and human rights abuses in distant water fishing fleets or ensuring the protection of vulnerable marine ecosystems from the impact of destructive fishing practices – crucial issues that are fundamental to global marine conservation.
    • The removal of a “human rights-based” approach to protecting the oceans which undermines accountability in ocean governance. Otherwise, there is no guarantee that policies will protect the rights of those most dependent on — and essential to — ocean stewardship. This weakens the foundation for just, inclusive, and effective marine protection, and must be urgently addressed.[5]
    • No concrete commitments to additional financial resources.

    From aboard the Rainbow Warrior in the Tasman Sea, Georgia Whitaker, Senior Oceans Campaigner at Greenpeace Australia Pacific, said: “The Australian government has the opportunity to step up and showcase true global leadership on ocean protection at the UN Oceans Conference. The eyes of the world are now on the re-elected Albanese government that signed the Global Ocean Treaty in 2023, but has been dragging its feet, yet to bring its promise into law. We are calling on the Australian government to ratify the Global Ocean Treaty in the first 100 days of government, and propose ocean sanctuaries in the Lord Howe Rise and South Tasman Sea between Australia and Aotearoa-New Zealand, to help protect precious marine life being decimated by brutal industrial fishing.”

    A new analysis released this week by Greenpeace Australia Pacific has revealed the shocking extent of ocean destruction and shark bycatch in the Pacific Ocean in lieu of protection possible under the treaty. 

    “Australia’s approach to deep sea mining will be watched closely by the rest of the world. The Albanese government must join the 33 other countries, including some of our Pacific neighbours, and back a moratorium on deep sea mining to protect our precious blue backyard,” Whitaker added.

    The UN Ocean Conference follows the world’s first deep sea mining application for the international seabed, recently submitted by The Metals Company to the US government, as opposed to the UN regulator, amid high political controversy. This unilateral action undermines the UN, potentially is in violation of international law, and should be condemned by all States at the UN Ocean Conference.

    As of today, 21 countries have ratified the Global Ocean Treaty, and 33 countries support a moratorium on deep sea mining. 

    The United Nations Oceans Conference will be held in Nice, France from 9 – 13 June.

    — ENDS —

    Media contact:

    Magali Rubino, Greenpeace France:  +33 7 78 41 78 78 / [email protected] (CET)

    Kimberley Bernard, Greenpeace Australia Pacific: +61 407 581 404 / [email protected] (AEST) (WhatsApp best)

    Notes for editors: 

    The draft political declaration is available upon request.

    Greenpeace Australia Pacific spokespeople will be available from Nice, Australia and from the Rainbow Warrior in the Tasman Sea.

    [1]  The Zero Draft of the Political Declaration “emphasized the importance of a precautionary approach” in relation to seabed mining. The reference has been deleted from the final draft.

    [2]  The Treaty will only enter into force 120 days after 60 countries have ratified. The UN Secretary-General is required to convene the first meeting of the COP to the Agreement no later than one year after its entry into force. France had targeted for the Global Ocean Treaty to enter into force by the conference.

    [3] Paragraph 21 of the Zero Draft of the Political Declaration stated “We recognise the important role the Agreement will play in achieving 30×30.” That reference has been removed from the final draft.

    [4] The final version of the Political Declaration deletes critical mentions to the urgency of addressing plastics pollution or its human health impacts, which were present in earlier drafts. Astrid Puentes Riaño, Special Rapporteur on the human right to a clean, healthy and sustainable environment, stated on May 20th that “Human rights must be the core of ocean governance and of every ocean pledge”

    [5]  Paragraph 2 of the second version of the Draft Political Declaration stated that “We must act with urgency to face this challenge with bold, ambitious, human rights-based, just and transformative action.” The reference to human-right based actions has been removed.

    MIL OSI NGO

  • MIL-Evening Report: ER Report: A Roundup of Significant Articles on EveningReport.nz for May 22, 2025

    ER Report: Here is a summary of significant articles published on EveningReport.nz on May 22, 2025.

    Indonesian military operations spark concerns over displaced indigenous Papuans
    By Caleb Fotheringham, RNZ Pacific journalist A West Papua independence leader says escalating violence is forcing indigenous Papuans to flee their ancestral lands. It comes as the Indonesian military claims 18 members of the West Papua National Liberation Army (TPNPB) were killed in an hour-long operation in Intan Jaya on May 14. In a statement,

    Compression tights and tops: do they actually benefit you during (or after) exercise?
    Source: The Conversation (Au and NZ) – By Ben Singh, Research Fellow, Allied Health & Human Performance, University of South Australia Olena Yakobchuk/Shutterstock You’ve seen them in every gym: tight black leggings, neon sleeves and even knee-length socks. Compression gear is everywhere, worn by weekend joggers, elite athletes and influencers striking poses mid-squat. But do

    Australia’s knowledge of Russia is dwindling. We need to start training our future experts now
    Source: The Conversation (Au and NZ) – By Jon Richardson, Visiting Fellow, Centre for European Studies, Australian National University Shutterstock Russia’s possible interest in basing long-range aircraft at an Indonesian airbase not far from Australian shores shook up a relatively staid election campaign last month. The news, which Jakarta immediately dismissed, caught many by surprise

    ‘Perfect bodies and perfect lives’: how selfie-editing tools are distorting how young people see themselves
    Source: The Conversation (Au and NZ) – By Julia Coffey, Associate Professor in Sociology, University of Newcastle Olena Yakobchuk/Shutterstock Like many of her peers, Abigail (21) takes a lot of selfies, tweaks them with purpose-made apps, and posts them on social media. But, she says, the selfie-editing apps do more than they were designed for:

    NZ Budget 2025: tax cuts and reduced revenues mean the government is banking on business growth
    Source: The Conversation (Au and NZ) – By Adrian Sawyer, Professor of Taxation, University of Canterbury Hagen Hopkins/Getty Images Not a lot is known about the government’s plans for taxes in the 2025 budget. Few tax policies have been announced so far, and what has been revealed involves targeted tax cuts for business interests. This

    Evidence shows AI systems are already too much like humans. Will that be a problem?
    Source: The Conversation (Au and NZ) – By Sandra Peter, Director of Sydney Executive Plus, University of Sydney Studiostoks / Shutterstock What if we could design a machine that could read your emotions and intentions, write thoughtful, empathetic, perfectly timed responses — and seemingly know exactly what you need to hear? A machine so seductive,

    Playing the crime card: do law and order campaigns win votes in Australia?
    Source: The Conversation (Au and NZ) – By Chloe Keel, Lecturer in Criminology and Criminal Justice, Griffith University Crime and public safety are usually the domain of state politics. But the Coalition tried to elevate them as key issues for voters in the recent federal election. Claiming crime had been “allowed to fester” under Labor,

    Labor now has the political clout to reset Australia’s refugee policy. Here’s where to start
    Source: The Conversation (Au and NZ) – By Mary Anne Kenny, Associate Professor, School of Law, Murdoch University Australia’s policy towards refugees and asylum seekers stands at a critical juncture. Global displacement is at record highs and many countries are retreating from their responsibilities. At this moment, Australia can lead by example. As Australia’s prime

    Please don’t tape your mouth at night, whatever TikTok says. A new study shows why this viral trend can be risky
    Source: The Conversation (Au and NZ) – By Moira Junge, Adjunct Clincal Associate Professor (Psychologist), Monash University K.IvanS/Shutterstock You might have heard of people using tape to literally keep their mouths shut while they sleep. Mouth taping has become a popular trend on social media, with many fans claiming it helps improve sleep and overall

    E-bikes for everyone: 3 NZ trials show people will make the switch – with the right support
    Source: The Conversation (Au and NZ) – By Caroline Shaw, Associate Professor in Public Health, University of Otago Getty Images Anyone who uses city roads will know e-bikes have become increasingly popular in Aotearoa New Zealand. But we also know rising e-bike sales have been predominantly driven by financially well-off households. The question now is,

    Drivers of SUVs and pick-ups should pay more to be on our roads. Here’s how to make the system fairer
    Source: The Conversation (Au and NZ) – By Milad Haghani, Associate Professor & Principal Fellow in Urban Risk & Resilience, The University of Melbourne In the year 2000, almost 70% of all new cars sold in Australia were small passenger vehicles – mainly sedans and hatchbacks. But over 25 years, their share has dropped dramatically

    Australia’s Wong condemns ‘abhorrent, outrageous’ Israeli comments over blocked aid
    Asia Pacific Report Australia’s Foreign Minister Penny Wong has released a statement saying “the Israeli government cannot allow the suffering to continue” after the UN’s aid chief said thousands of babies were at risk of dying if they did not receive food immediately. “Australia joins international partners in calling on Israel to allow a full

    The West v China: Fight for the Pacific – Episode 1: The Battlefield
    Al Jazeera How global power struggles are impacting in local communities, culture and sovereignty in Kanaky, New Caledonia, the Solomon Islands and Samoa. In episode one, The Battlefield, tensions between the United States and China over the Pacific escalate, affecting the lives of Pacific Islanders. Key figures like former Malaita Premier Daniel Suidani and tour

    Windows are the No. 1 human threat to birds – an ecologist shares some simple steps to reduce collisions
    Source: The Conversation (Au and NZ) – By Jason Hoeksema, Professor of Ecology, University of Mississippi Birds are drawn to the mirror effect of windows. That can turn deadly when they think they see trees. CCahill/iStock/Getty Images Plus When wood thrushes arrive in northern Mississippi on their spring migration and begin to serenade my neighborhood

    Politics with Michelle Grattan: Jim Chalmers on keeping Australia out of recession amid the ‘dark shadow’ of global instability
    Source: The Conversation (Au and NZ) – By Michelle Grattan, Professorial Fellow, University of Canberra This week, the Reserve Bank delivered welcome news for mortgage holders, with another 25 basis points rate cut. With this cut, some are hoping that the cost-of-living pain will start to finally ease. Economists, however, are still wary of celebrating

    40 years on – reflecting on Rainbow Warrior’s legacy, fight against nuclear colonialism
    Report by Dr David Robie – Café Pacific. – A forthcoming new edition of David Robie’s Eyes of Fire honours the ship’s final mission and the resilience of those affected by decades of radioactive fallout. PACIFIC MORNINGS: By Aui’a Vaimaila Leatinu’u The Greenpeace flagship Rainbow Warrior III ship returns to Aotearoa this July, 40 years

    Gordon Campbell: NZ’s silence over Gaza genocide, ethnic cleansing
    COMMENTARY: By Gordon Campbell Since last Thursday, intensified Israeli air strikes on Gaza have killed more than 500 Palestinians, and a prolonged Israeli aid blockade has led to widespread starvation among the territory’s two million residents. Belatedly, Israel is letting in a token amount of food aid that UN Under-Secretary Tom Fletcher has called a

    View from The Hill: Coalition split puts Victorian and NSW Nationals Senate seats at high risk
    Source: The Conversation (Au and NZ) – By Michelle Grattan, Professorial Fellow, University of Canberra The Victorian and NSW Nationals senators due to face the voters at the 2028 election will struggle to hold their seats if the former partners do not re-form the Coalition before then. Under usual Coalition arrangements, Bridget McKenzie, from Victoria,

    New Caledonia, French Polynesia at UN decolonisation seminar in Dili
    By Patrick Decloitre, RNZ Pacific correspondent French Pacific desk New Caledonia and French Polynesia have sent strong delegations this week to the United Nations Pacific regional seminar on the implementation of the Fourth International Decade for the Eradication of Colonialism in Timor-Leste. The seminar opened in Dili today and ends on Friday. As French Pacific

    NSW is copping rain and flooding while parts of Australia are in drought. What’s going on?
    Source: The Conversation (Au and NZ) – By Andrew King, Associate Professor in Climate Science, ARC Centre of Excellence for 21st Century Weather, The University of Melbourne Emergency crews were scrambling to rescue residents trapped by floodwaters on Wednesday as heavy rain pummelled the Mid North Coast of New South Wales. In some areas, more

    MIL OSI AnalysisEveningReport.nz

  • MIL-OSI China: Q&A: What to know about China’s visa-free policies

    Source: People’s Republic of China – State Council News

    BEIJING, May 21 — China’s visa-exemption policies have boosted inbound travel. Since the start of this year, “China Travel” has kept trending. On Wednesday, the Consular Department of the Ministry of Foreign Affairs of China released a list of frequently asked questions about these policies.

    Q: Who does the visa waiver apply to?

    A: Nationals of 43 countries including Brunei, France, Germany, Italy, Spain, Holland, Malaysia, Switzerland, Ireland, Hungary, Austria, Belgium, Luxembourg, New Zealand, Australia, Poland, Portugal, Greece, Cyprus, Slovenia, Slovakia, Norway, Finland, Denmark, Iceland, Andorra, Monaco, Liechtenstein, the Republic of Korea, Bulgaria, Romania, Croatia, Montenegro, North Macedonia, Malta, Estonia, Latvia, Japan, Brazil, Argentina, Chile, Peru and Uruguay (Brazil, Argentina, Chile, Peru and Uruguay take effect from June 1, 2025) holding valid ordinary passports can be exempted from visa requirement if entering China for the purpose of business, tourism, family or friend visits, exchange and transit. They can stay in China for no more than 30 days without a visa.

    Q: Do foreign nationals eligible for a visa waiver need to make declarations to Chinese embassies and consulates in advance?

    A: Foreign nationals eligible for a visa waiver do not need to declare in advance to Chinese embassies and consulates before entering China without a visa.

    Q: Will the purpose of the intended stay in China be examined by Chinese border inspection authorities when entering China? How will it be done? Are other documents needed for entering China in addition to a passport?

    A: Foreign nationals traveling for purposes of business, tourism, family or friend visits, exchange and transit that meet the visa waiver requirements, can be allowed to enter China without a visa upon examination and approval in accordance with the law by border inspection authorities. Entry into China shall be denied by border inspection authorities in accordance with the law to foreign nationals who travel for purposes that do not meet the visa waiver requirements or who are not allowed to enter China in accordance with laws and regulations. It is recommended to take documents such as invitation letters, air tickets and reservations of accommodation as proof corresponding to the purposes of entry into China. Visa waiver does not apply to those who come to China for work, study, journalistic or similar purposes.

    Q: Is there any additional requirement for minors eligible for a visa waiver?

    A: Visa waiver requirements for minors are the same as for adults.

    Q: Are there any requirements regarding the type and validity of entry documents?

    A: For foreign nationals, an ordinary passport valid for at least the duration of the intended stay in China is needed. Holders of travel documents or temporary or emergency documents other than ordinary passports are not allowed to enter China without a visa.

    Q: How to calculate the duration of stay of 30 days?

    A: The duration of stay without a visa is calculated from the day after entry and lasts continuously for 30 calendar days.

    Q: Does the visa waiver apply to foreign nationals who travel from a third country?

    A: Eligible foreign nationals can depart for China from any country or region.

    Q: Does the visa waiver apply to foreign nationals who travel via modes of transport other than aviation?

    A: The visa waiver applies to all travelers coming to China through any sea, road and airport open to foreign nationals — except where laws, regulations or bilateral arrangements specify otherwise. For arrivals in China by way of private transport, certain procedures for entry and exit of means of transport shall be processed in accordance with relevant laws and regulations of China.

    Q: Does the visa waiver apply to tour groups?

    A: The visa waiver applies to eligible foreign nationals either in tour groups or as individuals.

    Q: If the length of intended stay exceeds 30 days, can the visa waiver be extended?

    A: Foreign nationals planning to stay in China for over 30 days shall apply for visas corresponding to their purposes of stay in advance at Chinese embassies or consulates. If they have to stay longer than 30 days for appropriate and sufficient reasons after entering China without a visa, they shall apply for stay permits to the exit and entry administrations of public security authorities of China.

    Q: Does the visa waiver allow multiple entries? Is there any requirement on the length of intervals between each entry, or any restriction on the number of entries without a visa or total days of stay?

    A: Foreign nationals eligible for the visa waiver can enter China without a visa multiple times. Currently, there is no restriction on the number of entries or total days of stay, but those who enjoy visa-free travel to China shall not engage in activities inconsistent with their purpose of entry.

    MIL OSI China News

  • MIL-OSI China: Top-seed Sun cruises into last 16 at TT worlds

    Source: People’s Republic of China – State Council News

    Top-seeded Chinese Sun Yingsha defeated France’s Charlotte Lutz in straight sets to reach the women’s singles last 16 at the World Table Tennis Championships on Wednesday.

    Sun Yingsha serves during the women’s singles round of 32 match between Sun Yingsha of China and Charlotte Lutz of France at ITTF World Table Tennis Championships Finals Doha 2025 in Doha, Qatar, May 21, 2025. (Xinhua/Xiao Yijiu)

    “Go go Shasha!” rooted for by a loud crowd, the 24-year-old superstar clinched an 11-4, 11-6, 11-6, 11-1 victory over the 20-year-old and world No. 92.

    “This was our first meeting, and I had studied her match videos,” said Sun after a 29-minute match. “She is young and promising.”

    Sun will next play against South Korea’s Shin Yu-bin, who advanced over Italy’s Gaia Monfardini in a score of 11-5, 8-11, 11-9, 14-12, 16-14.

    MIL OSI China News

  • MIL-OSI Security: Former Defense Contractor Pleads Guilty to Tax Crimes

    Source: Office of United States Attorneys

    Defendant Admits to Concealing 50% Ownership of $7B Defense Contracting Business to Evade Taxes

               WASHINGTON – Douglas Edelman, 73, a former defense contractor, pleaded guilty today to tax crimes related to a scheme to defraud the United States and evade taxes on income he earned from his contracts with the U.S. Department of Defense.

               The sentence was announced U.S. Attorney Jeanine Ferris Pirro, Acting Deputy Assistant Attorney General Karen E. Kelly of the Justice Department’s Tax Division, and Special Agent in Charge Kareem A. Carter with IRS-Criminal Investigation (IRS-CI) Washington, D.C. Field Office. 

               Edelman pleaded guilty to 10 felony counts: conspiracy to defraud the United States, seven counts of tax evasion, and two counts of making a false statement.  U.S. District Court Judge Colleen Kollar-Kotelly scheduled a hearing on issues related to sentencing on Nov. 17, 2026. Trial on the remaining counts of the indictment will be in 2026.

               According to court documents and statements made in court, Edelman founded and owned 50% of Mina Corp. and Red Star Enterprises (Mina/Red Star), a defense contracting business that received more than $7 billion from contracts with the U.S. Department of Defense to provide jet fuel in the United States’ post-9/11 military efforts in Afghanistan and the Middle East. 

               Working with others, Edelman engaged in a lengthy scheme to hide his Mina/Red Star profits to evade U.S. taxes, including by concealing his income in undisclosed foreign bank accounts, creating false documents and making false statements that one of his co-conspirators — a French citizen residing abroad and without U.S. tax obligations — founded and owned Mina/Red Star. 

               For example, when the company became profitable in 2005, Edelman began taking distributions which he deposited into Swiss bank accounts, primarily at Credit Suisse, in the name of other companies he owned. In 2008, Credit Suisse informed Edelman that he had to either close his accounts or disclose them to U.S. authorities. Rather than come into compliance with his tax and reporting obligations, Edelman closed his accounts and opened new ones at Bank Julius Baer in Singapore in the name of a nominee entity, the beneficiaries of which were purportedly Edelman’s daughters. He then directed the subject income he earned from Mina/Red Star to those bank accounts. 

               In 2010 the U.S. House of Representatives Committee on Oversight and Government Reform’s Subcommittee on National Security and Foreign Affairs began investigating allegations of corruption in connection with Mina/Red Star’s contracts with the Department of Defense. As part of this inquiry, the subcommittee became interested in the identity of Mina/Red Star’s owners. At this time, Edelman had not filed U.S. tax returns to report the millions of dollars he had earned from Mina/Red Star and had not paid U.S. taxes on his income. 

               Rather than disclose his ownership, Edelman caused his attorneys to tell Congress a false story that a French co-conspirator who had no U.S. tax or reporting obligations founded and co-owed Mina/Red Star with another individual. To corroborate the false story, Edelman and a co-conspirator caused false and backdated paperwork to be created. 

               To continue the scheme, Edelman conveyed the false story about Mina/Red Star’s ownership to other arms of the U.S. government, including to the Department of Defense during contract negotiations in 2010 and 2011, to the IRS in a 2016 application to the Offshore Voluntary Disclosure Program, and to the Justice Department in a 2018 presentation. 

               In conjunction with his 2016 application to the IRS’s Voluntary Disclosure Program, Edelman filed false tax returns for several prior years that only reported income from gifts or purported consulting payments, continuing to conceal the millions he had earned from his company. On the returns, he also concealed profits he had earned from a separate business to provide internet service to members of the armed forces at Kandahar Air Base in Afghanistan. 

               Instead of paying the taxes that he knew he owed, Edelman used the money to fund his lifestyle and additional investments. He invested in a music television franchise in Eastern Europe, a land venture in Tulum, Mexico, and a farm in Kenya, and purchased property around Europe, including a home in Ibiza, Spain, and a townhouse in London.

               Edelman faces a maximum penalty of five years in prison for each of the 10 counts to which he has pleaded. He also faces a period of supervised release, restitution, and monetary penalties. A federal district court judge will determine any sentence after considering the U.S. Sentencing Guidelines and other statutory factors.

               This case is being investigated by special agents from IRS-CI’s International Tax & Financial Crimes specialty group, a team based out of Washington, D.C., that is dedicated to uncovering international tax crimes, along with the Special Inspector General for Afghanistan Reconstruction. The Justice Department’s Office of International Affairs assisted in the investigation. His Majesty’s Revenue & Customs of the United Kingdom also provided assistance, as did the Joint Chiefs of Global Tax Enforcement (J5), which brings together the taxing authorities of Australia, Canada, the Netherlands, the United Kingdom, and the United States. The Guardia Civil of Spain assisted with the arrest. 

               This case is being prosecuted by Assistant U.S. Attorney Joshua Gold for the District of Columbia and Assistant Chief Sarah Ranney and Trial Attorney Ezra Spiro of the Tax Division.

    24cr239

    MIL Security OSI

  • MIL-OSI Submissions: Tech – Europe’s Largest Inaugural Tech and Startup Event Opens in Berlin as the Continent Spurs Momentum for Open Innovation and AI Leadership

    Source: GITEX EUROPE x Ai Everything 2025

    EconomyEntrepreneurs / Start-UpTech / DigitalInnovation – Ministers and senior tech stakeholders from the European Union, Germany and the UAE inaugurate the momentous first edition of GITEX EUROPE x Ai Everything.

    Berlin, Germany – 21 May 2025: Berlin became the focal point of Europe’s tech momentum and global digital cooperation as GITEX EUROPE x Ai Everything 2025 opened its doors today at Messe Berlin, launching the region’s largest inaugural tech, startup and digital investment event to capacity crowds and the biggest, most international lineup of tech and businesses converging in Europe. The show arrives at an inflection point in Europe’s digital future, sparked by a continent-wide ‘Choose Europe’ movement to anchor the next wave of innovation, research, investment, talent and deep-tech breakthroughs on home ground; alongside a renewed impetus in Germany represented by the formation of a new government and the country’s first digital ministry taking stewardship on digital transformation, AI excellence and data policy.

    Born in the UAE with global editions now running in seven countries, GITEX is the world’s largest and best-rated tech and startup event, reflecting the UAE’s wider national commitment to global digital collaboration. With the show’s expansion into Europe, it echoes the UAE’s shared commitment to advance innovation and scientific frontiers, recently strengthened with Abu Dhabi’s MGX investment and Nvidia partnering to develop Europe’s largest AI data center campus (1) alongside the development of a new 5GW AI campus (2), the largest of its kind outside the US to be based in Abu Dhabi.

    Welcome addresses led the inauguration ceremony from European and global leaders, including Kai Wegner, Governing Mayor of Berlin; H.E. Alia Al Mazrouei, UAE Minister of State for Entrepreneurship; Clara Chappaz, the Minister of AI and Digital of France; Thomas Jarzombek, Parliamentary State Secretary at the Federal Minister for Digital and State Modernization, Germany; Jan Kavalírek, Deputy Minister of Industry and Trade, Czech Republic; Franziska Giffey, Mayor of Berlin & Senator for Economic Affairs, Energy and Public Enterprises; and Trixie LohMirmand, EVP of Dubai World Trade Centre, the global organiser of GITEX.

    With participation from over 100 countries, 1,400 tech companies, startups, and SMEs, more than 600 influential investors, and 500 industry leaders on-stage, the event sparked strategic dialogues on innovation, investment, policy shifts and business transformations, as well as catalysed collaborations at scale – across sectors and geographies. Taking place until 23 May at Messe Berlin, GITEX EUROPE x Ai Everything 2025 is organised in partnership with the Berlin Senate Department for Economics, Energy and Public Enterprises, Germany’s Federal Ministry for Economic Affairs and Climate Action, Berlin Partner for Business and Technology, and the European Innovation Council (EIC).

    Kai Wegner, Governing Mayor of Berlin: “The GITEX tech fair – which is taking place in Berlin for the very first time – brings founders from around the world, investors, and established companies together. As Germany’s startup capital, Berlin is the perfect place for GITEX. We want to create the best environment for founders in our city. Networking events and industry fairs like GITEX are part of that effort.”

    Her Excellency (H.E.) Alia Al Mazrouei, the UAE Minister of State for Entrepreneurship: “Moving beyond economic diplomacy, the UAE is now championing entrepreneurial diplomacy, guided by our diligent efforts in fostering global partnerships to empower entrepreneurs in the country. GITEX EUROPE’s vision of bringing together SMEs, investors, accelerators, incubators and industry leaders to ignite innovation, foster collaboration, and drive growth aligns with the UAE’s aspirations to strengthen partnerships with Europe in entrepreneurship and digital economy.”

    Clara Chappaz, the Minister of AI and Digital of France, commented on the development of AI: “When you were hear about Europe being a continent of regulation, this is the past. Today, Europe is all about innovation. More than ever, we have all the ingredients to succeed as Europeans building these amazing technologies when it comes to AI. The partnerships between France and Germany is extremely determined to accelerate Europe when it comes to innovation, and in particular when it comes to everything we can do on digital innovation.”

    Thomas Jarzombek, Parliamentary State Secretary at the Federal Minister for Digital and State Modernization reiterated: “It’s a great opportunity here to connect startups and also for investment opportunities right now here in Berlin. We have to move forward, faster than we did in the past. Easy for you to do business in Germany, easy for every citizen to do everything with an app and to digitalize things you have in our pocket right now.”

    Jan Kavalírek, Deputy Minister of Industry and Trade, Czech Republic: “One of our top priorities right now, is to create the best possible environment for AI researchers and to deploy artificial intelligence across all the industrial sector. This is the reason why we invest in AI heavily, both in software and in hardware infrastructure, and this is also the reason why we are glad to part of GITEX EUROPE.”

    Franziska Giffey, Mayor of Berlin and Senator for Economic Affairs, Energy and Public Enterprises: “We have more than 5,000 startup enterprises here in Berlin, and of course we want to do more. We want to be the number one innovation place in Europe. Whenever you think about coming to the place of freedom, the place of possibilities, come to Berlin.”

    Trixie LohMirmand, global organiser of GITEX: “As the world’s third largest economy, Germany’s market gravity and Europe’s openness create a powerful test-bed where capital, code and talent can cross-pollinate at speed, forging new collaborative forces across geographies and sectors. GITEX EUROPE proves that innovations can scale beyond borders, opening new markets and opportunities for Europe’s most ambitious companies.”

    Spanning high impact showcases and talks covering AI, cybersecurity, deep tech, green tech, quantum computing, SMEs, and startup, scaleup and investments, GITEX EUROPE x Ai Everything offers unmatched opportunities to access new markets, breakthrough technologies, industry transformations and business insights.

    Across the show floor, global tech enterprises including IBM, AWS, Bosch, Cisco, CrowdStrike, Dell, Fortinet, Lenovo, ManageEngine, NinjaOne, NVIDIA, and SAP, alongside over 750 startups from 60 countries, showcase how infrastructure, intelligence, and investment intersect to propel Europe’s digital future forward. From business leaders to AI architects, quantum researchers to CIOs, green tech innovators to global investors, the opening day’s gathering set the tone for decisive partnerships accelerating the continent’s AI and digital competitiveness.

    The opening day conference programme was headlined by Dr. Geoffrey Hinton, Nobel Physics Laureate and ‘Godfather of AI’ with a riveting keynote on ‘AI for Humanity’s Greatest Challenges’. In April 2025, the United Arab Emirates and European Union delivered a joint statement to begin dialogue toward a Comprehensive Economic Partnership Agreement (CEPA) (3) aimed at strengthening bilateral trade and investment ties across key sectors such as AI, advanced manufacturing, healthcare and more.

    GITEX EUROPE x Ai Everything leverages a powerful network of established relationships in tech, policy, investment and business spanning four regions and seven countries, with more new international editions in the wings. Currently the GITEX global network of events takes place in Abu Dhabi, Dubai, Germany, Morocco, Nigeria, Singapore, Thailand, and Vietnam.

    (1) https://fastcompanyme.com/news/nvidia-and-abu-dhabis-mgx-join-french-partners-to-build-europes-largest-ai-campus/
    (2) https://www.techrepublic.com/article/news-uae-us-ai-campus/
    (3) https://www.wam.ae/en/article/bj3wkyv-uae-president-president-european-commission-agree

    For more information, visit: www.gitex-europe.com.

    About GITEX EUROPE x Ai Everything 2025

    GITEX EUROPE x Ai Everything 2025, Europe’s most global, collaborative, and cross-industry tech event, taking place from May 21–23, 2025, at Messe Berlin, Germany. Convening over 1,400 exhibiting enterprises, SMEs and startups from 100-plus countries, alongside over 600 investors, and 500 expert speakers across AI, Deep Tech, Quantum, Cybersecurity, Connectivity, Smart Cities, Green Tech, and many more, GITEX EUROPE x Ai Everything is advancing the continent’s digital future in partnership with the world. This inaugural edition features the new SMEDEX, GITEX SCALEX, and GQX, and brings to Germany the world’s largest and best-rated startup and investor event – North Star Europe. GITEX EUROPE x Ai Everything is seamlessly connected with the GITEX network of tech and startup events in Germany, Morocco, Nigeria, Singapore, Thailand, UAE, and Vietnam. For more information, please visit: www.gitex-europe.com

    MIL OSI – Submitted News

  • MIL-OSI USA: NASA-French Satellite Spots Large-Scale River Waves for First Time

    Source: NASA

    In a first, researchers from NASA and Virginia Tech used satellite data to measure the height and speed of potentially hazardous flood waves traveling down U.S. rivers. The three waves they tracked were likely caused by extreme rainfall and by a loosened ice jam. While there is currently no database that compiles satellite data on river flood waves, the new study highlights the potential of space-based observations to aid hydrologists and engineers, especially those working in communities along river networks with limited flood control structures such as levees and flood gates.
    Unlike ocean waves, which are ordinarily driven by wind and tides, and roll to shore at a steady clip, river waves (also called flood or flow waves) are temporary surges stretching tens to hundreds of miles. Typically caused by rainfall or seasonal snowmelt, they are essential to shuttling nutrients and organisms down a river. But they can also pose hazards: Extreme river waves triggered by a prolonged downpour or dam break can produce floods.
    “Ocean waves are well known from surfing and sailing, but rivers are the arteries of the planet. We want to understand their dynamics,” said Cedric David, a hydrologist at NASA’s Jet Propulsion Laboratory in Southern California and a coauthor of a new study published May 14 in Geophysical Research Letters.

    Measuring Speed and Size
    To search for river waves for her doctoral research, lead author Hana Thurman of Virginia Tech turned to a spacecraft launched in 2022. The SWOT (Surface Water and Ocean Topography) satellite is a collaboration between NASA and the French space agency CNES (Centre National d’Études Spatiales). It is surveying the height of nearly all of Earth’s surface waters, both fresh and salty, using its sensitive Ka-band Radar Interferometer (KaRIn). The instrument maps the elevation and width of water bodies by bouncing microwaves off the surface and timing how long the signal takes to return.
    “In addition to monitoring total storage of waters in lakes and rivers, we zoom in on dynamics and impacts of water movement and change,” said Nadya Vinogradova Shiffer, SWOT program scientist at NASA Headquarters in Washington.
    Thurman knew that SWOT has helped scientists track rising sea levels near the coast, spot tsunami slosh, and map the seafloor, but could she identify river height anomalies in the data indicating a wave on the move?
    She found that the mission had caught three clear examples of river waves, including one that arose abruptly on the Yellowstone River in Montana in April 2023. As the satellite passed overhead, it observed a 9.1-foot-tall (2.8-meter-tall) crest flowing toward the Missouri River in North Dakota. It was divided into a dramatic 6.8-mile-long (11-kilometer-long) peak followed by a more drawn‐out tail. These details are exciting to see from orbit and illustrate the KaRIn instrument’s uniquely high spatial resolution, Thurman said.
    Sleuthing through optical Sentinel-2 imagery of the area, she determined that the wave likely resulted from an ice jam breaking apart upstream and releasing pent-up water.
    The other two river waves that Thurman and the team found were triggered by rainfall runoff. One, spotted by SWOT starting on Jan. 25, 2024, on the Colorado River south of Austin, Texas, was associated with the largest flood of the year on that section of river. Measuring over 30 feet (9 meters) tall and 166 miles (267 kilometers) long, it traveled around 3.5 feet (1.07 meters) per second for over 250 miles (400 kilometers) before discharging into Matagorda Bay.
    The other wave originated on the Ocmulgee River near Macon, Georgia, in March 2024. Measuring over 20 feet (6 meters) tall and extending more than 100 miles (165 kilometers), it traveled about a foot (0.33 meters) per second for more than 124 miles (200 kilometers).
    “We’re learning more about the shape and speed of flow waves, and how they change along long stretches of river,” Thurman said. “That could help us answer questions like, how fast could a flood get here and is infrastructure at risk?”
    Complementary Observations
    Engineers and water managers measuring river waves have long relied on stream gauges, which record water height and estimate discharge at fixed points along a river. In the United States, stream gauge networks are maintained by agencies including the U.S. Geological Survey. They are sparser in other parts of the world.
    “Satellite data is complementary because it can help fill in the gaps,” said study supervisor George Allen, a hydrologist and remote sensing expert at Virginia Tech.
    If stream gauges are like toll booths clocking cars as they pass, SWOT is like a traffic helicopter taking snapshots of the highway.
    The wave speeds that SWOT helped determine were similar to those calculated using gauge data alone, Allen said, showing how the satellite could help monitor waves in river basins without gauges. Knowing where and why river waves develop can help scientists tracking changing flood patterns around the world.
    Orbiting Earth multiple times each day, SWOT is expected to observe some 55% of large-scale floods at some stage in their life cycle. “If we see something in the data, we can say something,” David said of SWOT’s potential to flag dangerous floods in the making. “For a long time, we’ve stood on the banks of our rivers, but we’ve never seen them like we are now.”
    More About SWOT
    The SWOT satellite was jointly developed by NASA and CNES, with contributions from the Canadian Space Agency (CSA) and the UK Space Agency. NASA’s Jet Propulsion Laboratory, managed for the agency by Caltech in Pasadena, California, leads the U.S. component of the project. For the flight system payload, NASA provided the Ka-band radar interferometer (KaRIn) instrument, a GPS science receiver, a laser retroreflector, a two-beam microwave radiometer, and NASA instrument operations. The Doppler Orbitography and Radioposition Integrated by Satellite system, the dual frequency Poseidon altimeter (developed by Thales Alenia Space), the KaRIn radio-frequency subsystem (together with Thales Alenia Space and with support from the UK Space Agency), the satellite platform, and ground operations were provided by CNES. The KaRIn high-power transmitter assembly was provided by CSA.
    News Media Contacts
    Jane J. Lee / Andrew WangJet Propulsion Laboratory, Pasadena, Calif.818-354-0307 / 626-379-6874Written by Sally Younger2025-074

    MIL OSI USA News

  • MIL-OSI USA: Russian GRU Targeting Western Logistics Entities and Technology Companies

    News In Brief – Source: US Computer Emergency Readiness Team

    Executive Summary

    This joint cybersecurity advisory (CSA) highlights a Russian state-sponsored cyber campaign targeting Western logistics entities and technology companies. This includes those involved in the coordination, transport, and delivery of foreign assistance to Ukraine. Since 2022, Western logistics entities and IT companies have faced an elevated risk of targeting by the Russian General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (85th GTsSS), military unit 26165—tracked in the cybersecurity community under several names (see “Cybersecurity Industry Tracking”). The actors’ cyber espionage-oriented campaign, targeting technology companies and logistics entities, uses a mix of previously disclosed tactics, techniques, and procedures (TTPs). The authoring agencies expect similar targeting and TTP use to continue.

    Executives and network defenders at logistics entities and technology companies should recognize the elevated threat of unit 26165 targeting, increase monitoring and threat hunting for known TTPs and indicators of compromise (IOCs), and posture network defenses with a presumption of targeting.

    This cyber espionage-oriented campaign targeting logistics entities and technology companies uses a mix of previously disclosed TTPs and is likely connected to these actors’ wide scale targeting of IP cameras in Ukraine and bordering NATO nations.

    The following authors and co-sealers are releasing this CSA:

    • United States National Security Agency (NSA)
    • United States Federal Bureau of Investigation (FBI)
    • United Kingdom National Cyber Security Centre (NCSC-UK)
    • Germany Federal Intelligence Service (BND) Bundesnachrichtendienst
    • Germany Federal Office for Information Security (BSI) Bundesamt für Sicherheit in der Informationstechnik
    • Germany Federal Office for the Protection of the Constitution (BfV) Bundesamt für Verfassungsschutz
    • Czech Republic Military Intelligence (VZ)  Vojenské zpravodajství
    • Czech Republic National Cyber and Information Security Agency (NÚKIB) Národní úřad pro kybernetickou a informační bezpečnost
    • Czech Republic Security Information Service (BIS) Bezpečnostní informační služba
    • Poland Internal Security Agency (ABW) Agencja Bezpieczeństwa Wewnętrznego
    • Poland Military Counterintelligence Service (SKW) Służba Kontrwywiadu Wojskowego
    • United States Cybersecurity and Infrastructure Security Agency (CISA)
    • United States Department of Defense Cyber Crime Center (DC3)
    • United States Cyber Command (USCYBERCOM)
    • Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC)
    • Canadian Centre for Cyber Security (CCCS)
    • Danish Defence Intelligence Service (DDIS) Forsvarets Efterretningstjeneste
    • Estonian Foreign Intelligence Service (EFIS) Välisluureamet
    • Estonian National Cyber Security Centre (NCSC-EE) Küberturvalisuse keskus
    • French Cybersecurity Agency (ANSSI) Agence nationale de la sécurité des systèmes d’information
    • Netherlands Defence Intelligence and Security Service (MIVD) Militaire Inlichtingen- en Veiligheidsdienst
       

    Download the PDF version of this report:

    Russian GRU Targeting Western Logistics Entities and Technology Companies (PDF, 1,081KB)

    For a downloadable list of IOCs, visit:

    Introduction

    For over two years, the Russian GRU 85th GTsSS, military unit 26165—commonly known in the cybersecurity community as APT28, Fancy Bear, Forest Blizzard, BlueDelta, and a variety of other identifiers—has conducted this campaign using a mix of known tactics, techniques, and procedures (TTPs), including reconstituted password spraying capabilities, spearphishing, and modification of Microsoft Exchange mailbox permissions.
    In late February 2022, multiple Russian state-sponsored cyber actors increased the variety of cyber operations for purposes of espionage, destruction, and influence—with unit 26165 predominately involved in espionage. [1] As Russian military forces failed to meet their military objectives and Western countries provided aid to support Ukraine’s territorial defense, unit 26165 expanded its targeting of logistics entities and technology companies involved in the delivery of aid. These actors have also targeted Internet-connected cameras at Ukrainian border crossings to monitor and track aid shipments.
    Note: This advisory uses the MITRE ATT&CK® for Enterprise framework, version 17. See Appendix A: MITRE ATT&CK tactics and techniques for a table of the threat actors’ activity mapped to MITRE ATT&CK tactics and techniques. This advisory uses the MITRE D3FEND® framework, version 1.0.

    Description of Targets

    The GRU unit 26165 cyber campaign against Western logistics providers and technology companies has targeted dozens of entities, including government organizations and private/commercial entities across virtually all transportation modes: air, sea, and rail. These actors have targeted entities associated with the following verticals within NATO member states, Ukraine, and at international organizations: 

    •  Defense Industry
    • Transportation and Transportation Hubs (ports, airports, etc.)
    • Maritime
    • Air Traffic Management
    • IT Services

    In the course of the targeting lifecycle, unit 26165 actors identified and conducted follow-on targeting of additional entities in the transportation sector that had business ties to the primary target, exploiting trust relationships to attempt to gain additional access [T1199].

    The actors also conducted reconnaissance on at least one entity involved in the production of industrial control system (ICS) components for railway management, though a successful compromise was not confirmed [TA0043].

    The countries with targeted entities include the following, as illustrated in Figure 1:

    • Bulgaria
    • Czech Republic
    • France
    • Germany
    • Greece
    • Italy
    • Moldova
    • Netherlands
    • Poland
    • Romania
    • Slovakia
    • Ukraine
    • United States
       
    Figure 1: Countries with Targeted Entities

    Initial Access TTPs

    To gain initial access to targeted entities, unit 26165 actors used several techniques to gain initial access to targeted entities, including (but not limited to):

    The actors abused vulnerabilities associated with a range of brands and models of small office/home office (SOHO) devices to facilitate covert cyber operations, as well as proxy malicious activity via devices with geolocation in proximity to the target [T1665]. [2]

    Credential Guessing/Brute Force

    Unit 26165 actors’ credential guessing [T1110.001] operations in this campaign exhibit some similar characteristics to those disclosed in the previous CSA “Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments.” [3] Based on victim network investigations, the current iteration of this TTP employs a similar blend of anonymization infrastructure, including the use of Tor and commercial VPNs [T1090.003]. The actors frequently rotated the IP addresses used to further hamper detection. All observed connections were made via encrypted TLS [T1573]. 

    Spearphishing

    GRU unit 26165 actors’ spearphishing emails included links [T1566.002] leading to fake login pages impersonating a variety of government entities and Western cloud email providers’ webpages. These webpages were typically hosted on free third-party services or compromised SOHO devices and often used legitimate documents associated with thematically similar entities as lures. The subjects of spearphishing emails were diverse and ranged from professional topics to adult themes. Phishing emails were frequently sent via compromised accounts or free webmail accounts [T1586.002, T1586.003]. The emails were typically written in the target’s native language and sent to a single targeted recipient. 

    Some campaigns employed multi-stage redirectors [T1104] verifying IP-geolocation [T1627.001] and browser fingerprints [T1627] to protect credential harvesting infrastructure or provide multifactor authentication (MFA) [T1111] and CAPTCHA relaying capabilities [T1056]. Connecting endpoints failing the location checks were redirected to a benign URL [T1627], such as msn.com. Redirector services used include:

    • Webhook[.]site
    • FrgeIO
    • InfinityFree
    • Dynu
    • Mocky
    • Pipedream
    • Mockbin[.]org

    The actors also used spearphishing to deliver malware (including HEADLACE and MASEPIE) executables [T1204.002] delivered via third-party services and redirectors [T1566.002], scripts in a mix of languages [T1059] (including BAT [T1059.003] and VBScript [T1059.005]) and links to hosted shortcuts [T1204.001].

    CVE Usage

    Throughout this campaign, GRU unit 26165 weaponized an Outlook NTLM vulnerability (CVE-2023-23397) to collect NTLM hashes and credentials via specially crafted Outlook calendar appointment invitations [T1187]. [4],[5] These actors also used a series of Roundcube CVEs (CVE-2020-12641, CVE-2020-35730, and CVE-2021-44026) to execute arbitrary shell commands [T1059], gain access to victim email accounts, and retrieve sensitive data from email servers [T1114].

    Since at least fall 2023, the actors leveraged a WinRAR vulnerability (CVE-2023-38831) allowing for the execution of arbitrary code embedded in an archive as a means of initial access [T1659]. The actors sent emails with malicious attachments [T1566.001] or embedded hyperlinks [T1566.002] that downloaded a malicious archive prepared using this CVE. 

    Post-Compromise TTPs

    After an initial compromise using one of the above techniques, unit 26165 actors conducted contact information reconnaissance to identify additional targets in key positions [T1589.002]. The actors also conducted reconnaissance of the cybersecurity department [T1591], individuals responsible for coordinating transport [T1591.004], and other companies cooperating with the victim entity [T1591.002].

    The actors used native commands and open source tools, such as Impacket and PsExec, to move laterally within the environment [TA0008]. Multiple Impacket scripts were used as .exe files, in addition to the python versions, depending on the victim environment. The actors also moved laterally within the network using Remote Desktop Protocol (RDP) [T1021.001] to access additional hosts and attempt to dump Active Directory NTDS.dit domain databases [T1003.003] using native Active Directory Domain Services commands, such as in Figure 2: Example Active Directory Domain Services command:

    C:Windowssystem32ntdsutil.exe "activate instance ntds" ifm "create full C:temp[a-z]{3}" quit quit

    Figure 2: Example Active Directory Domain Services command

    Additionally, GRU unit 26165 actors used the tools Certipy and ADExplorer.exe to exfiltrate information from the Active Directory. The actors installed python [T1059.006] on infected machines to enable the execution of Certipy. Accessed files were archived in .zip files prior to exfiltration [T1560]. The actors attempted to exfiltrate archived data via a previously dropped OpenSSH binary [T1048].

    Incident response investigations revealed that the actors would take steps to locate and exfiltrate lists of Office 365 users and set up sustained email collection. The actors used manipulation of mailbox permissions [T1098.002] to establish sustained email collection at compromised logistics entities, as detailed in a Polish Cybercommand blog. [6]

    After initial authentication, unit 26165 actors would change accounts’ folder permissions and enroll compromised accounts in MFA mechanisms to increase the trust-level of compromised accounts and enable sustained access [T1556.006]. The actors leveraged python scripts to retrieve plaintext passwords via Group Policy Preferences [T1552.006] using Get-GPPPassword.py and a modified ldap-dump.py to enumerate the Windows environment [T1087.002] and conduct a brute force password spray [T1110.003] via Lightweight Directory Access Protocol (LDAP). The actors would additionally delete event logs through the wevtutil utility [T1070.001].

    After gaining initial access to the network, the actors pursued further access to accounts with access to sensitive information on shipments, such as train schedules and shipping manifests. These accounts contained information on aid shipments to Ukraine, including: 

    • sender,
    • recipient,
    • train/plane/ship numbers,
    • point of departure,
    • destination,
    • container registration numbers,
    • travel route, and
    • cargo contents. 

    In at least one instance, the actors attempted to use voice phishing [T1566.004] to gain access to privileged accounts by impersonating IT staff.

    Malware

    Unit 26165’s use of malware in this campaign ranged from gaining initial access to establishing persistence and exfiltrating data. In some cases, the attack chain resulted in multiple pieces of malware being deployed in succession. The actors used dynamic link library (DLL) search order hijacking [T1574.001] to facilitate malware execution. There were a number of known malware variants tied to this campaign against logistics sector victims, including:

    • HEADLACE [7]
    • MASEPIE [8]

    While other malware variants, such as OCEANMAP and STEELHOOK, [8] were not directly observed targeting logistics or IT entities, their deployment against victims in other sectors in Ukraine and other Western countries suggest that they could be deployed against logistics and IT entities should the need arise. 

    Persistence

    In addition to the abovementioned mailbox permissions abuse, unit 26165 actors also used scheduled tasks [T1053.005], run keys [T1547.001], and placed malicious shortcuts [T1547.009] in the startup folder to establish persistence. 

    Exfiltration

    GRU unit 26165 actors used a variety of methods for data exfiltration that varied based on the victim environment, including both malware and living off the land binaries. PowerShell commands [T1059.001] were often used to prepare data for exfiltration; for example, the actors prepared zip archives [T1560.001] for upload to their own infrastructure. 

    The actors also used server data exchange protocols and Application Programming Interfaces (APIs) such as Exchange Web Services (EWS) and Internet Message Access Protocol (IMAP) [T1114.002] to exfiltrate data from email servers. In multiple instances, the actors used periodic EWS queries [T1119] to collect new emails sent and received since the last data exfiltration [T1029]. The actors typically used infrastructure in close geographic proximity to the victim. Long gaps between exfiltration, the use of trusted and legitimate protocols, and the use of local infrastructure allowed for long-term collection of sensitive data to go undetected. 

    Connections to Targeting of IP Cameras

    In addition to targeting logistics entities, unit 26165 actors likely used access to private cameras at key locations, such as near border crossings, military installations, and rail stations, to track the movement of materials into Ukraine. The actors also used legitimate municipal services, such as traffic cams. 

    The actors targeted Real Time Streaming Protocol (RTSP) servers hosting IP cameras primarily located in Ukraine as early as March 2022 in a large-scale campaign, which included attempts to enumerate devices [T1592] and gain access to the cameras’ feeds [T1125]. Actor-controlled servers sent RTSP DESCRIBE requests destined for RTSP servers, primarily hosting IP cameras [T1090.002]. The DESCRIBE requests were crafted to obtain access to IP cameras located on logically distinct networks from that of the routers that received the request. The requests included Base64-encoded credentials for the RTSP server, which included publicly documented default credentials and likely generic attempts to brute force access to the devices [T1110]. An example of an RTSP request is shown in Figure 3.

    DESCRIBE rtsp://[IP ADDRESS] RTSP/1.0

    CSeq: 1

    Authorization: Basic

    User-Agent: WebClient

    Accept: application/sdp

    DESCRIBE rtsp://[IP ADDRESS] RTSP/1.0

    CSeq: 2

    Authorization: Digest username="admin", realm="[a-f0-9]{12}", algorithm="MD5", nonce="[a-f0-9]{32}", uri="", response="[a-f0-9]{32}"

    User-Agent: WebClient

    Accept: application/sdp

    Figure 3: Example RTSP request

    Successful RTSP 200 OK responses contained a snapshot of the IP camera’s image and IP camera metadata such as video codec, resolution, and other properties depending on the IP camera’s configuration. 

    From a sample available to the authoring agencies of over 10,000 cameras targeted via this effort, the geographic distribution of victims showed a strong focus on cameras in Ukraine and border countries, as shown in Table 1:

    Table 1: Geographic distribution of targeted IP cameras
    Country Percentage of Total Attempts
    Ukraine 81.0%
    Romania 9.9%
    Poland 4.0%
    Hungary 2.8%
    Slovakia 1.7%
    Others 0.6%

    Mitigation Actions

    General Security Mitigations

    Architecture and Configuration

    • Employ appropriate network segmentation [D3-NI] and restrictions to limit access and utilize additional attributes (such as device information, environment, and access path) when making access decisions [D3-AMED].
      • Consider Zero Trust principles when designing systems. Base product choices on how those products can solve specific risks identified as part of the end-to-end design. [9]
    • Ensure that host firewalls and network security appliances (e.g., firewalls) are configured to only allow legitimately needed data flows between devices and servers to prevent lateral movement [D3-ITF]. Alert on attempts to connect laterally between host devices or other unusual data flows.
    • Use automated tools to audit access logs for security concerns and identify anomalous access requests [D3-RAPA].
    • For organizations using on-premises authentication and email services, block and alert on NTLM/SMB requests to external infrastructure [D3-OTF].
    • Utilize endpoint, detection, and response (EDR) and other cybersecurity solutions on all systems, prioritizing high value systems with large amounts of sensitive data such as mail servers and domain controllers [D3-PM] first.
      • Perform threat and attack modeling to understand how sensitive systems may be compromised within an organization’s specific architecture and security controls. Use this to develop a monitoring strategy to detect compromise attempts and select appropriate products to enact this strategy.
    • Collect and monitor Windows logs for certain events, especially for events that indicate that a log was cleared unexpectedly [D3-SFA].
    • Enable optional security features in Windows to harden endpoints and mitigate initial access techniques [D3-AH]:
      • Enable attack surface reduction rules to prevent executable content from email [D3-ABPI].
      • Enable attack surface reduction rules to prevent execution of files from globally writeable directories, such as Downloads or %APPDATA% [D3-EAL].
      • Unless users are involved in the development of scripts, limit the local execution of scripts (such as batch scripts, VBScript, JScript/JavaScript, and PowerShell [10]) to known scripts [D3-EI], and audit execution attempts.
      • Disable Windows Host Scripting functionality and configure PowerShell to run in Constrained mode [D3-ACH].
    • Where feasible, implement allowlisting for applications and scripts to limit execution to only those needed for authorized activities, blocking all others by default [D3-EAL].
    • Consider using open source SIGMA rules as a baseline for detecting and alerting on suspicious file execution or command parameters [D3-PSA].
    • Use services that provide enhanced browsing services and safe link checking [D3-URA]. Significant reductions in successful spearphishing attempts were noted when email providers began offering link checking and automatic file detonation to block malicious content.
    • Where possible, block logins from public VPNs, including exit nodes in the same country as target systems, or, if they need to be allowed, alert on them for further investigation. Most organizations should not need to allow incoming traffic, especially logins to systems, from VPN services [D3-NAM].
    • Educate users to only use approved corporate systems for relevant government and military business and avoid the use of personal accounts on cloud email providers to conduct official business. Network administrators should also audit both email and web request logs to detect such activity.

    Many organizations may not need to allow outgoing traffic to hosting and API mocking services, which are frequently used by GRU unit 26165. Organizations should consider alerting on or blocking the following services, with exceptions allowlisted for legitimate activity [D3-DNSDL].

    • *.000[.]pe
    • *.1cooldns[.]com
    • *.42web[.]io
    • *.4cloud[.]click
    • *.accesscan[.]org
    • *.bumbleshrimp[.]com
    • *.camdvr[.]org
    • *.casacam[.]net
    • *.ddnsfree[.]com
    • *.ddnsgeek[.]com
    • *.ddnsguru[.]com
    • *.dynuddns[.]com
    • *.dynuddns[.]net
    • *.free[.]nf
    • *.freeddns[.]org
    • *.frge[.]io
    • *.glize[.]com
    • *.great-site[.]net
    • *.infinityfreeapp[.]com
    • *.kesug[.]com
    • *.loseyourip[.]com
    • *.lovestoblog[.]com
    • *.mockbin[.]io
    • *.mockbin[.]org
    • *.mocky[.]io
    • *.mybiolink[.]io
    • *.mysynology[.]net
    • *.mywire[.]org
    • *.ngrok[.]io
    • *.ooguy[.]com
    • *.pipedream[.]net
    • *.rf[.]gd
    • *.urlbae[.]com
    • *.webhook[.]site
    • *.webhookapp[.]com
    • *.webredirect[.]org
    • *.wuaze[.]com

    Heuristic detections for web requests to new subdomains, including of the above providers, may uncover malicious phishing activity [D3-DNRA]. Logging the requests for each sub-domain requested by users on a network, such as in DNS or firewall logs, may enable system administrators to identify new targeting and victims.

    Identity and Access Management

    Organizations should take measures to ensure strong access controls and mitigate against common credential theft techniques: 

    • Use MFA with strong factors, such as passkeys or PKI smartcards, and require regular re-authentication [D3-MFA]. [11], [12] Strong authentication factors are not guessable using dictionary techniques, so they resist brute force attempts.
    • Implement other mitigations for privileged accounts: including limiting the number of admin accounts, considering using hardware MFA tokens, and regularly reviewing all privileged user accounts [D3-JFAPA].
    • Separate privileged accounts by role and alert on misuse of privileged accounts [D3-UAP]. For example, email administrator accounts should be different from domain administrator accounts.
    • Reduce reliance on passwords; instead, consider using services like single sign-on [D3-TBA].
      • For organizations using on-premises authentication and email services, plan to disable NTLM entirely and migrate to more robust authentication processes such as PKI certificate authentication.
    • Do not store passwords in Group Policy Preferences (GPP). Remove all passwords previously included in GPP and change all passwords on the corresponding accounts [D3-CH]. [13]
    • Use account throttling or account lockout [D3-ANET]:
      • Throttling is preferred to lockout. Throttling progressively increases time delay between successive login attempts.
      • Account lockout can leave legitimate users unable to access their accounts and requires access to an account recovery process.
      • Account lockout can provide a malicious actor with an easy way to launch a Denial of Service (DoS).
      • If using lockout, then allowing 5 to 10 attempts before lockout is recommended.
    • Use a service to check for compromised passwords before using them [D3-SPP]. For example, “Have I Been Pwned” can be used to check whether a password has been previously compromised without disclosing the potential password.
    • Change all default credentials [D3-CRO] and disable protocols that use weak authentication (e.g., clear-text passwords or outdated and vulnerable authentication or encryption protocols) or do not support multi-factor authentication [D3-ACH] [D3-ET]. Always configure access controls carefully to ensure that only well-maintained and well-authenticated accounts have access. [13]

    IP Camera Mitigations

    The following mitigation techniques for IP cameras can be used to defend against this type of malicious activity:

    • Ensure IP cameras are currently supported. Replace devices that are out of support.
    • Apply security patches and firmware updates to all IP cameras [D3-SU].
    • Disable remote access to the IP camera, if unnecessary [D3-ITF].
    • Ensure cameras are protected by a security appliance, if possible, such as by using a firewall to prevent communication with the camera from IP addresses not on an allowlist [D3-NAM].
    • If remote access to IP camera feeds is required, ensure authentication is enabled [D3-AA] and use a VPN to connect remotely [D3-ET]. Use MFA for management accounts if supported [D3-MFA].
    • Disable Universal Plug and Play (UPnP), Peer-to-Peer (P2P), and Anonymous Visit features on IP cameras and routers [D3-NI].
    • Turn off other ports/services not in use (e.g., FTP, web interface, etc.) [D3-ACH].
    • If supported, enable authenticated RTSP access only [D3-AA].
    • Review all authentication activity for remote access to make sure it is valid and expected [D3-UBA]. Investigate any unexpected or unusual activity.
    • Audit IP camera user accounts to ensure they are an accurate reflection of your organization and that they are being used as expected [D3-UAP].
    • Configure, tune, and monitor logging—if available—on the IP camera.

    Indicators of Compromise (IOCs)

    Note: Specific IoCs may no longer be actor controlled, may themselves be compromised infrastructure or email accounts, or may be shared infrastructure such as public VPN or Tor exit nodes. Care should be taken when basing triaging logs or developing detection rules on these indicators. GRU unit 26165 almost certainly uses extensive further infrastructure and TTPs not specifically listed in this report.

    Utilities and scripts

    Legitimate utilities

    Unauthorized or unusual use of the following legitimate utilities can be an indication of a potential compromise:

    • ntdsutil – A legitimate Windows executable used by threat actors to export contents of Active Directory
    • wevtutil – A legitimate Windows executable used by threat actors to delete event logs
    • vssadmin – A legitimate Windows executable possibly used by threat actors to make a copy of the server’s C: drive
    • ADexplorer – A legitimate window executable to view, edit, and backup Active Directory Certificate Services
    • OpenSSH – The Windows version of a legitimate open source SSH client
    • schtasks – A legitimate Windows executable used to create persistence using scheduled tasks
    • whoami – A legitimate Windows executable used to retrieve the name of the current user
    • tasklist – A legitimate Windows executable used to retrieve the list of running processes
    • hostname – A legitimate Windows executable used to retrieve the device name
    • arp – A legitimate Windows executable used to retrieve the ARP table for mapping the network environment
    • systeminfo – A legitimate Windows executable used to retrieve a comprehensive summary of device and operating system information
    • net – A legitimate Windows executable used to retrieve detailed user information
    • wmic – A legitimate Windows executable used to interact with Windows Management Instrumentation (WMI), such as to retrieve letters assigned to logical partitions on storage drives
    • cacls – A legitimate Windows executable used to modify permissions on files
    • icacls – A legitimate Windows executable used to modify permissions to files and handle integrity levels and ownership
    • ssh – A legitimate Windows executable used to establish network shell connections
    • reg – A legitimate Windows executable used to add to or modify the system registry 

    Note: Additional heuristics are needed for effective hunting for these and other living off the land (LOTL) binaries to avoid being overwhelmed by false positives if these legitimate management tools are used regularly. See the joint guide, Identifying and Mitigating Living Off the Land Techniques, for guidance on developing a multifaceted cybersecurity strategy that enables behavior analytics, anomaly detection, and proactive hunting, which are part of a comprehensive approach to mitigating cyber threats that employ LOTL techniques.

    Malicious scripts

    • Certipy – An open source python tool for enumerating and abusing Active Directory Certificate Services
    • Get-GPPPassword.py – An open source python script for finding insecure passwords stored in Group Policy Preferences
    • ldap-dump.py – A script for enumerating user accounts and other information in Active Directory
    • Hikvision backdoor string: “YWRtaW46MTEK”

    Suspicious command lines

    While the following utilities are legitimate, and using them with the command lines shown may also be legitimate, these command lines are often used during malicious activities and could be an indication of a compromise:

    • edge.exe “-headless-new -disable-gpu”
    • ntdsutil.exe “activate instance ntds” ifm “create full C:temp[a-z]{3}” quit quit
    • ssh -Nf
    • schtasks /create /xml

    Outlook CVE Exploitation IOCs

    • md-shoeb@alfathdoor[.]com[.]sa
    • jayam@wizzsolutions[.]com
    • accounts@regencyservice[.]in
    • m.salim@tsc-me[.]com
    • vikram.anand@4ginfosource[.]com
    • mdelafuente@ukwwfze[.]com
    • sarah@cosmicgold469[.]co[.]za
    • franch1.lanka@bplanka[.]com
    • commerical@vanadrink[.]com
    • maint@goldenloaduae[.]com
    • karina@bhpcapital[.]com
    • tv@coastalareabank[.]com
    • ashoke.kumar@hbclife[.]in
    • 213[.]32[.]252[.]221
    • 124[.]168[.]91[.]178
    • 194[.]126[.]178[.]8
    • 159[.]196[.]128[.]120

    Commonly Used Webmail Providers

    • portugalmail[.]pt
    • mail-online[.]dk
    • email[.]cz
    • seznam[.]cz

    Malicious Archive Filenames Involving CVE-2023-38831

    • calc.war.zip
    • news_week_6.zip
    • Roadmap.zip
    • SEDE-PV-2023-10-09-1_EN.zip
    • war.zip
    • Zeyilname.zip

    Brute Forcing IP Addresses

    Disclaimer: These IP addresses date June 2024 through August 2024. The authoring agencies recommend organizations investigate or vet these IP addresses prior to taking action, such as blocking.

    June 2024 July 2024 August 2024
    192[.]162[.]174[.]94 207[.]244[.]71[.]84 31[.]135[.]199[.]145 79[.]184[.]25[.]198 91[.]149[.]253[.]204  
    103[.]97[.]203[.]29 162[.]210[.]194[.]2 31[.]42[.]4[.]138 79[.]185[.]5[.]142 91[.]149[.]254[.]75  
    209[.]14[.]71[.]127   46[.]112[.]70[.]252 83[.]10[.]46[.]174 91[.]149[.]255[.]122  
    109[.]95[.]151[.]207   46[.]248[.]185[.]236 83[.]168[.]66[.]145 91[.]149[.]255[.]19  
        64[.]176[.]67[.]117 83[.]168[.]78[.]27 91[.]149[.]255[.]195  
        64[.]176[.]69[.]196 83[.]168[.]78[.]31   91[.]221[.]88[.]76  
        64[.]176[.]70[.]18 83[.]168[.]78[.]55   93[.]105[.]185[.]139  
        64[.]176[.]70[.]238 83[.]23[.]130[.]49   95[.]215[.]76[.]209  
        64[.]176[.]71[.]201 83[.]29[.]138[.]115   138[.]199[.]59[.]43  
        70[.]34[.]242[.]220 89[.]64[.]70[.]69   147[.]135[.]209[.]245  
        70[.]34[.]243[.]226 90[.]156[.]4[.]204   178[.]235[.]191[.]182  
        70[.]34[.]244[.]100 91[.]149[.]202[.]215   178[.]37[.]97[.]243  
        70[.]34[.]245[.]215 91[.]149[.]203[.]73   185[.]234[.]235[.]69  
        70[.]34[.]252[.]168 91[.]149[.]219[.]158 192[.]162[.]174[.]67  
        70[.]34[.]252[.]186 91[.]149[.]219[.]23   194[.]187[.]180[.]20  
        70[.]34[.]252[.]222 91[.]149[.]223[.]130   212[.]127[.]78[.]170  
        70[.]34[.]253[.]13 91[.]149[.]253[.]118 213[.]134[.]184[.]167
        70[.]34[.]253[.]247   91[.]149[.]253[.]198    
        70[.]34[.]254[.]245 91[.]149[.]253[.]20    

    Detections

    Customized NTLM listener

    rule APT28_NTLM_LISTENER {

           meta:

                  description = "Detects NTLM listeners including APT28's custom one"

           strings:

                  $command_1 = "start-process powershell.exe -WindowStyle hidden"

                  $command_2 = "New-Object System.Net.HttpListener"

                  $command_3 = "Prefixes.Add('http://localhost:8080/')"

                  $command_4 = "-match 'Authorization'"

                  $command_5 = "GetValues('Authorization')"

                  $command_6 = "Request.RemoteEndPoint.Address.IPAddressToString"

                  $command_7 = "@(0x4e,0x54,0x4c,0x4d, 0x53,0x53,0x50,0x00,0x02,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x28,0x00,0x00,0x01,0x82,0x00,0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00)"

                  $command_8 = ".AllKeys"

                  

                  $variable_1 = "$NTLMAuthentication" nocase

                  $variable_2 = "$NTLMType2" nocase

                  $variable_3 = "$listener" nocase

                  $variable_4 = "$hostip" nocase

                  $variable_5 = "$request" nocase

                  $variable_6 = "$ntlmt2" nocase

                  $variable_7 = "$NTLMType2Response" nocase

                  $variable_8 = "$buffer" nocase

           condition:

                  5 of ($command_*) 

                  or

                  all of ($variable_*)

    }

    HEADLACE shortcut

    rule APT28_HEADLACE_SHORTCUT {

           meta:

                  description = "Detects the HEADLACE backdoor shortcut dropper. Rule is meant for threat hunting."

           strings:

                  $type = "[InternetShortcut]" ascii nocase

                  $url  = "file://"

                  $edge = "msedge.exe"

                  $icon = "IconFile"

           condition:

                  all of them

    }

    HEADLACE credential dialogbox phishing 

    rule APT28_HEADLACE_CREDENTIALDIALOG {

           meta:

                  description = "Detects scripts used by APT28 to lure user into entering credentials"

           strings:

                  $command_1 = "while($true)"

                  $command_2 = "Get-Credential $(whoami)"

                  $command_3 = "Add-Content"

                  $command_4 = ".UserName"

                  $command_5 = ".GetNetworkCredential().Password"

                  $command_6 = "GetNetworkCredential().Password.Length -ne 0"

           condition:

                  5 of them

    }

    HEADLACE core script

    rule APT28_HEADLACE_CORE {

           meta:

                  description = "Detects HEADLACE core batch scripts"

           strings:

                  $chcp = "chcp 65001" ascii

                  $headless = "start "" msedge --headless=new --disable-gpu" ascii

                  

                  $command_1 = "taskkill /im msedge.exe /f" ascii

                  $command_2 = "whoami>"%programdata%" ascii

                  $command_3 = "timeout" ascii

                  $command_4 = "copy "%programdata%" ascii

                  $non_generic_del_1 = "del /q /f "%programdata%" ascii

                  $non_generic_del_3 = "del /q /f "%userprofile%Downloads" ascii

     

                  $generic_del = "del /q /f" ascii

           condition:

                  (

                          $chcp 

                          and 

                          $headless

                  )

                  and

                  (

                          1 of ($non_generic_del_*)

                          or

                          ($generic_del)

                          or

                          3 of ($command_*)

                  )

    }

    MASEPIE

    rule APT28_MASEPIE {

           meta:

                  description = "Detects MASEPIE python script"

           strings:

                  $masepie_unique_1 = "os.popen('whoami').read()"

                  $masepie_unique_2 = "elif message == 'check'"

                  $masepie_unique_3 = "elif message == 'send_file':"

                  $masepie_unique_4 = "elif message == 'get_file'"

                  $masepie_unique_5 = "enc_mes('ok'"

                  $masepie_unique_6 = "Bad command!'.encode('ascii'"

                  $masepie_unique_7 = "{user}{SEPARATOR}{k}"

                  $masepie_unique_8 = "raise Exception("Reconnect"

           condition:

                  3 of ($masepie_unique_*)

    }

    STEELHOOK

    rule APT28_STEELHOOK {

           meta:

                  description = "Detects APT28's STEELHOOK powershell script"

           strings:

                  $s_1 = "$($env:LOCALAPPDATAGoogleChromeUser DataLocal State)"

                  $s_2 = "$($env:LOCALAPPDATAGoogleChromeUser DataDefaultLogin Data)"

                  $s_3 = "$($env:LOCALAPPDATAMicrosoftEdgeUser DataLocal State)"

                  $s_4 = "$($env:LOCALAPPDATAMicrosoftEdgeUser DataDefaultLogin Data)"

                  $s_5 = "os_crypt.encrypted_key"

                  $s_6 = "System.Security.Cryptography.DataProtectionScope"

                  $s_7 = "[system.security.cryptography.protectdata]::Unprotect"

                  $s_8 = "Invoke-RestMethod"

           condition:

                  all of them

    }

    PSEXEC

    rule GENERIC_PSEXEC {

           meta:

                  description = "Detects SysInternals PSEXEC executable"

           strings:

                  $sysinternals_1 = "SYSINTERNALS SOFTWARE LICENCE TERMS"

                  $sysinternals_2 = "/accepteula"

                  $sysinternals_3 = "SoftwareSysinternals"

                  $network_1 = "%sIPC$"

                  $network_2 = "%sADMIN$%s"

                  $network_3 = "DeviceLanmanRedirector%sipc$"

                  $psexec_1 = "PSEXESVC"

                  $psexec_2 = "PSEXEC-{}-"

                  $psexec_3 = "Copying %s to %s..."

                  $psexec_4 = "gPSINFSVC"

           condition:

                  (

                          ( uint16( 0x0 ) ==0x5a4d )

                          and

                          ( uint16( uint32( 0x3c )) == 0x4550 )

                  )

                  and 

                          filesize < 1024KB

                  and

                  (

                          ( any of ($sysinternals_*) and any of ($psexec_*) )

                          or

                          ( 2 of ($network_*) and 2 of ($psexec_*))

                  )

    }

    The cybersecurity industry provides overlapping cyber threat intelligence, IOCs, and mitigation recommendations related to GRU unit 26165 cyber actors. While not all encompassing, the following are the most notable threat group names related under MITRE ATT&CK G0007 and commonly used within the cybersecurity community: 

    • APT28 [14]
    • Fancy Bear [14]
    • Forest Blizzard [14]
    • Blue Delta [15]

    Note: Cybersecurity companies have different methods of tracking and attributing cyber actors, and this may not be a 1:1 correlation to the U.S. government’s understanding for all activity related to these groupings.

    Further Reference

    To search for the presence of malicious email messages targeting CVE-2023-23397, network defenders may consider using the script published by Microsoft: https://aka.ms/CVE-2023-23397ScriptDoc. 

    For the Impacket TTP, network defenders may consider using the following publicly available Impacket YARA detection rule:
    https://github.com/Neo23x0/signature-base/blob/master/yara/gen_impacket_tools.yar

    Works Cited

    [1] Microsoft. Defending Ukraine: Early Lessons from the Cyber War. 2022. https://blogs.microsoft.com/on-the-issues/2022/06/22/defending-ukraine-early-lessons-from-the-cyber-war/  
    [2] FBI et al. Russian Cyber Actors Use Compromised Routers to Facilitate Cyber Operations. 2024. https://media.defense.gov/2024/Feb/27/2003400753/-1/-1/0/CSA-Russian-Actors-Use-Routers-Facilitate-Cyber_Operations.PDF   
    [3] NSA et al. Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments. 2021. https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/0/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF 
    [4] ANSSI. Campagnes d'attaques du mode opératoire APT28 depuis 2021. 2023. https://cert.ssi.gouv.fr/cti/CERTFR-2023-CTI-009/  
    [5] ANSSI. Targeting and compromise of french entities using the APT28 intrusion set. 2025. https://cert.ssi.gouv.fr/cti/CERTFR-2025-CTI-007/   
    [6] Polish Cyber Command. Detecting Malicious Activity Against Microsoft Exchange Servers. 2023. https://www.wojsko-polskie.pl/woc/articles/aktualnosci-w/detecting-malicious-activity-against-microsoft-exchange-servers/ 
    [7] IBM. Israel-Hamas Conflict Lures to Deliver Headlace Malware. 2023. https://securityintelligence.com/x-force/itg05-ops-leverage-israel-hamas-conflict-lures-to-deliver-headlace-malware/ 
    [8] CERT-UA. APT28: From Initial Attack to Creating Domain Controller Threats in an Hour. 2023. https://cert.gov.ua/article/6276894 
    [9] NSA. Embracing a Zero Trust Security Model. 2021. https://media.defense.gov/2021/Feb/25/2002588479/-1/-1/0/CSI_EMBRACING_ZT_SECURITY_MODEL_UOO115131-21.PDF  
    [10] NSA et al. Keeping PowerShell: Security Measures to Use and Embrace. 2022. https://media.defense.gov/2022/Jun/22/2003021689/-1/-1/0/CSI_KEEPING_POWERSHELL_SECURITY_MEASURES_TO_USE_AND_EMBRACE_20220622.PDF 
    [11] National Institute of Standards and Technology (NIST). Special Publication 800-63B: Digital Identity Guidelines – Authentication and Lifecycle Management. 2020. https://pages.nist.gov/800-63-3/sp800-63b.html 
    [12] NSA. Selecting Secure Multi-factor Authentication Solutions. October 16, 2020. https://media.defense.gov/2024/Jul/31/2003515137/-1/-1/0/MULTIFACTOR_AUTHENTICATION_SOLUTIONS_UOO17091520.PDF  
    [13] NSA and CSA. NSA and CISA Red and Blue Teams Share Top Ten Cybersecurity Misconfigurations. 2023. https://media.defense.gov/2023/Oct/05/2003314578/-1/-1/0/JOINT_CSA_TOP_TEN_MISCONFIGURATIONS_TLP-CLEAR.PDF 

    [14] Department of Justice. Justice Department Conducts Court-Authorized Disruption of Botnet Controlled by the Russian Federation’s Main Intelligence Directorate of the General Staff (GRU). 2024. https://www.justice.gov/archives/opa/pr/justice-department-conducts-court-authorized-disruption-botnet-controlled-russian  
    [15] Recorded Future. GRU’s BlueDelta Targets Key Networks in Europe with Multi-Phase Espionage Campaigns. 2024. https://go.recordedfuture.com/hubfs/reports/CTA-RU-2024-0530.pdf  
     

    Disclaimer of endorsement

    The information and opinions contained in this document are provided "as is" and without any warranties or guarantees. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favoring by the United States Government, and this guidance shall not be used for advertising or product endorsement purposes.

    Purpose

    This document was developed in furtherance of the authoring agencies’ cybersecurity missions, including their responsibilities to identify and disseminate threats and to develop and issue cybersecurity specifications and mitigations. This information may be shared broadly to reach all appropriate stakeholders.

    Contact

    United States organizations

    • National Security Agency (NSA)
    • Cybersecurity and Infrastructure Security Agency (CISA) and Federal Bureau of Investigation (FBI)
      • U.S. organizations are encouraged to reporting suspicious or criminal activity related to information in this advisory to CISA via the agency’s Incident Reporting System, its 24/7 Operations Center (report@cisa.gov or 888-282-0870), or your local FBI field office. When available, please include the following information regarding the incident: date, time, and location of the incident; type of activity; number of people affected; type of equipment user for the activity; the name of the submitting company or organization; and a designated point of contact.
    • Department of Defense Cyber Crime Center (DC3)

    United Kingdom organizations

    Germany organizations

    Czech Republic organizations

    Poland organizations

    Australian organizations

    • Visit cyber.gov.au or call 1300 292 371 (1300 CYBER 1) to report cybersecurity incidents and access alerts and advisories.

    Canadian organizations

    Estonia organizations

    French organizations

    • French organizations are encouraged to report suspicious activity or incident related to information found in this advisory by contacting ANSSI/CERT-FR by email at cert-fr@ssi.gouv.fr or by phone at: 3218 or +33 9 70 83 32 18. 

    See Table 2 through Table 14 for all the threat actor tactics and techniques referenced in this advisory.

    Table 2: Reconnaissance
    Tactic/Technique Title ID Use
    Reconnaissance TA0043 Conducted reconnaissance on at least one entity involved in the production of ICS components for railway management.
    Gather Victim Identity Information: Email Addresses T1589.002 Conducted contact information reconnaissance to identify additional targets in key positions.
    Gather Victim Org Information T1591 Conducted reconnaissance of the cybersecurity department.
    Gather Victim Org Information: Identify Roles T1591.004 Conducted reconnaissance of individuals responsible for coordinating transport.
    Gather Victim Org Information: Business Relationships T1591.002 Conducted reconnaissance of other companies cooperating with the victim entity.
    Gather Victim Host Information T1592 Attempted to enumerate Real Time Streaming Protocol (RTSP) servers hosting IP cameras.
    Table 3: Resource development
    Tactic/Technique Title ID Use
    Compromise Accounts: Email Accounts T1586.002 Sent phishing emails using compromised accounts.
    Compromise Accounts: Cloud Accounts T1586.003 Sent phishing emails using compromised accounts.
    Table 4: Initial Access
    Tactic/Technique Title ID Use
    Trusted Relationship T1199 Conducted follow-on targeting of additional entities in the transportation sector that had business ties to the primary target, exploiting trust relationships to attempt to gain additional access.
    Phishing T1566 Used spearphishing for credentials and delivering malware to gain initial access to targeted entities.
    Phishing: Spearphishing Attachment T1566.001 Sent emails with malicious attachments.
    Phishing: Spearphishing Link T1566.002 Used spearphishing with included links to fake login pages. Sent emails with embedded hyperlinks that downloaded a malicious archive.
    Phishing: Spearphishing Voice T1566.004 Attempted to use voice phishing to gain access to privileged accounts by impersonating IT staff.
    External Remote Services T1133 Exploited Internet-facing infrastructure, including corporate VPNs, to gain initial access to targeted entities.
    Exploit Public-Facing Application T1190 Exploited public vulnerabilities and SQL injection to gain initial access to targeted entities.
    Content Injection T1659 Leveraged a WinRAR vulnerability allowing for the execution of arbitrary code embedded in an archive.
    Table 5: Execution
    Tactic/Technique Title ID Use
    User Execution: Malicious Link T1204.001 Used malicious links to hosted shortcuts in spearphishing.
    User Execution: Malicious File T1204.002 Delivered malware executables via spearphishing.
    Scheduled Task/Job: Scheduled Task T1053.005 Used scheduled tasks to establish persistence.
    Command and Scripting Interpreter T1059 Delivered scripts in spearphishing. Executed arbitrary shell commands.
    Command and Scripting Interpreter: PowerShell T1059.001 PowerShell commands were often used to prepare data for exfiltration.
    Command and Scripting Interpreter: Windows Command Shell T1059.003 Used BAT script in spearphishing.
    Command and Scripting Interpreter: Visual Basic T1059.005 Used VBScript in spearphishing.
    Command and Scripting Interpreter: Python T1059.006 Installed python on infected machines to enable the execution of Certipy.
    Table 6: Persistence
    Tactic/Technique Title ID Use
    Account Manipulation: 
    Additional Email Delegate 
    Permissions

    T1098.002 

    Used manipulation of mailbox permissions to establish sustained email collection. 
    Modify Authentication Process: 
    Multi-Factor Authentication

    T1556.006 

    Enrolled compromised accounts in MFA mechanisms to increase the trust-level of compromised accounts and enable sustained access. 
    Hijack Execution Flow: DLL 
    Search Order Hijacking 
    T1574.001  Used DLL search order hijacking to facilitate malware execution. 
    Boot or Logon Autostart 
    Execution: Registry Run Keys / 
    Startup Folder

    T1547.001 

    Used run keys to establish persistence. 
    Boot or Logon Autostart 
    Execution: Shortcut 
    Modification

    T1547.009 

    Placed malicious shortcuts in the startup folder to establish persistence. 
    Table 7: Defense Evasion
    Tactic/Technique Title ID Use
    Indicator Removal: Clear 
    Windows Event Logs
    T1070.001  Deleted event logs through the wevtutil utility.
    Table 8: Credential access 
    Tactic/Technique Title ID Use

    Brute Force 

    Sent requests with Base64-encoded credentials for the RTSP server, which included publicly documented default credentials, and likely were generic attempts to brute force access to the devices. 

    Brute Force: Password Guessing 

    T1110.001 

    Used credential guessing to gain initial access to targeted entities. 

    Brute Force: Password Spraying 

    T1110.003 

    Used brute force to gain initial access to targeted entities. Conducted a brute force password spray via LDAP. 

    Multi-Factor Authentication Interception 

    Used multi-stage redirectors to provide MFA relaying capabilities in some campaigns. 

    Input Capture 

    Used multi-stage redirectors to provide CAPTCHA relaying capabilities in some campaigns. 

    Forced Authentication 

    Used an Outlook NTLM vulnerability to collect NTLM hashes and credentials via specially crafted Outlook calendar appointment invitations. 

    OS Credential Dumping: NTDS 

    T1003.003 

    Attempted to dump Active Directory NTDS.dit domain databases. 

    Unsecured Credentials: Group Policy Preferences 

    T1552.006 

    Retrieved plaintext passwords via Group Policy Preferences using Get-GPPPassword.py. 

    Table 9: Discovery
    Tactic/Technique Title ID Use

    Account Discovery: Domain Account

    T1087.002

    Used a modified ldap-dump.py to enumerate the Windows environment.

    Table 10: Command and Control
    Tactic/Technique Title ID Use

    Hide Infrastructure 

    T1665 

    Abused SOHO devices to facilitate covert cyber operations, as well as proxy malicious activity, via devices with geolocation in proximity to the target. 

    Proxy: External Proxy 

    T1090.002 

    Actor-controlled servers sent RTSP DESCRIBE requests destined for RTSP servers. 

    Proxy: Multi-hop Proxy 

    T1090.003 

    Used Tor and commercial VPNs as part of their anonymization infrastructure 

    Encrypted Channel 

    T1573 

    Connected to victim infrastructure using encrypted TLS. 

    Multi-Stage Channels 

    T1104 

    Used multi-stage redirectors for campaigns. 

    Table 11: Defense evasion (mobile framework)
    Tactic/Technique Title ID Use

    Execution Guardrails 

    Used multi-stage redirectors to verify browser fingerprints in some campaigns. 

    Execution Guardrails: Geofencing 

    T1627.001 

    Used multi-stage redirectors to verify IP-geolocation in some campaigns. 

    Table 12: Lateral movement
    Tactic/Technique Title ID Use

    Lateral Movement 

    Used native commands and open source tools, such as Impacket and PsExec, to move laterally within the environment. 

    Remote Services: Remote Desktop Protocol 

    T1021.001 

    Moved laterally within the network using RDP. 

    Table 13: Collection
    Tactic/Technique Title ID Use

    Email Collection 

    Retrieved sensitive data from email servers. 

    Email Collection: Remote Email Collection 

    T1114.002 

    Used server data exchange protocols and APIs such as Exchange Web Services (EWS) and IMAP to exfiltrate data from email servers. 

    Automated Collection 

    Used periodic EWS queries to collect new emails. 

    Video Capture 

    Attempted to gain access to the cameras’ feeds. 

    Archive Collected Data 

    Accessed files were archived in .zip files prior to exfiltration. 

    Archive Collected Data: Archive via Utility 

    T1560.001 

    Prepared zip archives for upload to the actors’ infrastructure. 

    Table 14: Exfiltration
    Tactic/Technique Title ID Use

    Exfiltration Over Alternative Protocol 

    Attempted to exfiltrate archived data via a previously dropped OpenSSH binary. 

    Scheduled Transfer 

    Used periodic EWS queries to collect new emails sent and received since the last data exfiltration. 

    Appendix B: CVEs exploited

    Table 15: Exploited CVE information
    CVE  Vendor/Product  Details

    CVE-2023-38831 

    RARLAB WinRAR 

    Allows execution of arbitrary code when a user attempts to view a benign file within a ZIP archive. 

    CVE-2023-23397 

    Microsoft Outlook 

    External actors could send specially crafted emails that cause a connection from the victim to an untrusted location of the actor’s control, leaking the Net-NTLMv2 hash of the victim that the actor could then relay to another service to authenticate as the victim. 

    CVE-2021-44026 

    Roundcube Webmail 

    Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search params. 

    CVE-2020-35730 

    Roundcube Webmail 

    An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16 and 1.4.x before 1.4.10, where a plaintext email message with JavaScript in a link reference element is mishandled by linkref_addindex in rcube_string_replacer.php. 

    CVE-2020-12641 

    Roundcube Webmail 

    Roundcube Webmail before 1.4.4 allows arbitrary code execution via shell metacharacters in a configuration setting for im_convert_path or im_identify_path in rcube_image.php. 

    Appendix C: MITRE D3FEND Countermeasures

    Table 16: MITRE D3FEND countermeasures
    Countermeasure Title  ID  Details 

    Network Isolation 

    Employ appropriate network segmentation. Disable Universal Plug and Play (UPnP), Peer-to-Peer (P2P), and Anonymous Visit features on IP cameras and routers. 

    Access Mediation 

    Limit access and utilize additional attributes (such as device information, environment, and access path) when making access decisions. Configure access controls carefully to ensure that only well-maintained and well-authenticated accounts have access. 

    Inbound Traffic Filtering 

    Implement host firewall rules to block connections from other devices on the network, other than from authorized management devices and servers, to prevent lateral movement. 

    Resource Access Pattern Analysis 

    Use automated tools to audit access logs for security concerns and identify anomalous access requests. 

    Outbound Traffic Filtering 

    Block NTLM/SMB requests to external infrastructure. 

    Platform Monitoring 

    Install EDR/logging/cybersecurity solutions onto high value systems with large amounts of sensitive data such as mail servers and domain controllers. 

    System File Analysis 

    Collect and monitor Windows logs for certain events, especially for events that indicate that a log was cleared unexpectedly. 

    Application Hardening 

    Enable optional security features in Windows to harden endpoints and mitigate initial access techniques. 

    Application-based Process Isolation 

    Enable attack surface reduction rules to prevent executable content from email. 

    Executable Allowlisting 

    Enable attack surface reduction rules to prevent execution of files from globally writeable directories, such as Downloads or %APPDATA%. 

    Execution Isolation 

    Unless users are involved in the development of scripts, limit the execution of scripts (such as batch, JavaScript, and PowerShell) to known scripts. 

    Application Configuration Hardening 

    Disable Windows Host Scripting functionality and configure PowerShell to run in Constrained mode. Disable protocols that use weak authentication (e.g., clear-text passwords, or outdated and vulnerable authentication or encryption protocols) or do not support multi-factor authentication. Turn off other ports/services not in use (e.g., FTP, web interface, etc.). 

    Process Spawn Analysis 

    Use open source SIGMA rules as a baseline for detecting and alerting on suspicious file execution or command parameters. 

    URL Reputation Analysis 

    Use services that provide enhanced browsing services and safe link checking. 

    Network Access Mediation 

    Do not allow incoming traffic, especially logins to systems, from public VPN services. Where possible, logins from public VPNs, including exit nodes in the same country as target systems, should be blocked or, if allowed, alerted on for further investigation. Ensure cameras and other Internet of Things devices are protected by a security appliance, if possible. 

    DNS Denylisting 

    D3-DNSDL 

    Do not allow outgoing traffic to hosting and API mocking services frequently used by malicious actors. 

    Domain Name Reputation Analysis 

    Heuristic detections for web requests to new subdomains may uncover malicious phishing activity. Logging the requests for each sub-domain requested by users on a network, such as in DNS or firewall logs, may enable system administrators to identify new targeting and victims. 

    Multi-factor Authentication 

    Use MFA with strong factors and require regular re-authentication, especially for management accounts. 

    Job Function Access Pattern Analysis 

    D3-JFAPA 

    Implement other mitigations for privileged accounts: including limiting the number of admin accounts, considering using hardware MFA tokens, and regularly reviewing all privileged user accounts. 

    User Account Permissions 

    Separate privileged accounts by role and alert on misuse of privileged accounts. Audit user accounts on all devices to ensure they are an accurate reflection of your organization and that they are being used as expected. 

    Token-based Authentication 

    Reduce reliance on passwords; instead, consider using services like single sign-on. 

    Credential Hardening 

    Do not store passwords in Group Policy Preferences (GPP). Remove all passwords previously included in GPP and change all passwords on the corresponding accounts. 

    Authentication Event Threshholding 

    Use account throttling or account lockout. Throttling progressively increases time delay between successive login attempts. If using account lockout, allow between 5 to 10 attempts before lockout. 

    Strong Password Policy 

    Use a service to check for compromised passwords before using them. 

    Credential Rotation 

    Change all default credentials. 

    Encrypted Tunnels 

    Disable protocols that use weak authentication (e.g., clear-text passwords, or outdated and vulnerable authentication or encryption protocols). Use a VPN for remote connections to devices. 

    Software Update 

    Apply security patches and firmware updates to all devices. Ensure devices are currently supported. Replace devices that are end-of-life. 

    Agent Authentication 

    Ensure authentication is enabled for remote access to devices. If supported on IP cameras, enable authenticated RTSP access only. 

    User Behavior Analysis 

    Review all authentication activity for remote access to make sure it is valid and expected. Investigate any unexpected or unusual activity. 

    MIL OSI USA News -

  • MIL-OSI NGOs: Creative industry figures urge Starmer to act against Gaza genocide- ‘you know what is happening’

    Source: Amnesty International –

    116 leading UK and Irish creatives have urged Keir Starmer to act over Israel’s escalating atrocities in Gaza, criticising UK arms exports, settlement trade, and lack of ICC support – open letter 

    Riz Ahmed, Dame Harriet Walker, Maxine Peake, Nish Kumar, Paloma Faith and others condemn UK government inaction on Gaza 

    The Prime Minister must ‘stand up for justice and human rights’ and ‘words are no longer enough; we need to see action’ – Creatives 

    Artists gather outside Downing Street to hold placards urging the PM to act to stop the genocide and human rights abuses in Gaza 

    Over 100 leading voices from across the UK and Ireland’s film, television, and creative industries including Riz Ahmed, Dame Harriet Walker, Maxine Peake, Nish Kumar, Paloma Faith, Juliet Stevenson and many more have united to call on Prime Minister Keir Starmer to take urgent action in response to Israel’s escalating atrocities in Gaza and the wider Occupied Palestinian Territory (OPT).   

    In a public letter, the group condemn “all attacks on civilians” but emphasise that as well as Israel’s decades-long military occupation, expansion of illegal settlements, and system of apartheid, Israel is committing genocide against Palestinians in Gaza, as described by Amnesty International in its report “You feel Like You Are Subhuman”.  

    “We are deeply troubled by your lack of meaningful action to help deter Israel’s horrifying and calculated violations of Palestinian rights,” the letter states to the Prime Minister. 

    Since October 2023, more than 20,000 children have reportedly been killed in Gaza. The group point to the use of 2,000lb bombs dropped from F-35 fighter jets – supplied with UK-made components – as part of a devastating campaign that includes siege tactics blocking access to food, water, electricity, and medicine for over two million civilians. 

    “You know what is happening,” they write to the Prime Minister, and state “your Government is failing to fulfil its obligation to prevent the ongoing genocide in Gaza.” 

    The letter also highlights a stark double standard in UK policy: banning imports from Russian-occupied Crimea, while allowing trade with Israeli settlements in the illegally Occupied Palestinian Territory. The International Court of Justice has made clear that countries must not support illegal occupations – including through trade.

    In addition to arms and trade, the group call on the UK government to fully support the International Criminal Court’s investigation into alleged war crimes and crimes against humanity in the region. 

    Their demands include: 

    • An immediate suspension of all UK arms exports to Israel 
    • A ban on trade with illegal Israeli settlements in the Occupied Palestinian Territory 
    • Compliance with international legal rulings, including those of the ICJ and ICC 

    The group implores the Prime Minister “to stand up for justice and human rights” and that “words are no longer enough; we need to see action”. 

    Artists gather outside Downing Street to deliver the letter and hold placards urging the PM to act to stop Israel’s genocide and human rights abuses in Gaza. 

    The artists held placards bearing messages from residents of Gaza that capture the urgency and human toll of the crisis: 

    • “I don’t want my child to die hungry” – Gaza Resident, Occupied Gaza 
    • “You may send your child to bring water only for him to return in a body bag” – Gaza Resident, Occupied Gaza 

    These statements are a stark reminder of the daily reality for civilians under Israel’s illegal blockade.  

    About the Signatories 

    This statement by Amnesty International has been endorsed by a coalition of UK-based professionals across the creative industries – filmmakers, actors, writers, artists and cultural leaders – who believe in the power of art, law, and collective voice in the face of injustice. 

    Ahmed Masoud; Aisling Bea; Aiysha Hart; Alan Moore; Alexander McKinnon; Alexei Sayle; Alice Roberts; Alisdair Beckett; King Amrita Acharia; Andrea Arnold Anjli; Mohindra Anneika; Rose Annie Mac; Sir Anish Kapoor CBE; Anoushka Shankar; Dr Ariel Caine; Bernadette O’Brien; Bertie Carvel; President of the Bianca Jagger Human Rights Foundation; Brian Eno; Briony Hannah; Brona C Titley; Charlotte Church; Chipo Chung; David Morrissey; Deborah Frances-White; Declan McKenna; Denise Gough; Emma D’Arcy; Esther Freud; Esther Manito; Fionn O’Loinsigh; Francesca Martinez; Frankie Boyle; Frederico Gaggio; Grace Petrie; Dame Harriet Walter; Himesh Patel; Ian Rickson; Imran Yusuf; Indeyarna Donaldson-Holness; Inua Ellams MBE; Ivor Graeme; Jackie Clune; James Acaster; Jan Pearson; Janie Dee; Jason Fleming; Jay Griffiths; Jen Brister; Jessica Fostekew; Jim Loach; John Higgs; Josie Long; Jolyon Rubinstein; Juliet Stevenson CBE; Kathy Lette; Kerry Godliman; Khalid Abdalla; Ken Loach; Lise Meyer; Lolly Adefope; Louisa Young; Love Ssegga; Mae Martin; Mahtab Hussain; Manjinder Virk; Mariam Haque; Marnie Dickens; Max Porter; Maxine Peake; Dr Michael Hrebeniak; Misan Harriman; Mystery Jets; Nadia Sawalha; Nicola Thorp; Nikesh Patel; Nikesh Shukla; Nikita Gill; Nimmi Harasgama; Nish Kumar; Paapa Essiedu; Paloma Faith; Paul Laverty; Penny Woolcock; Peter Wyer; Rebecca O’Brien; Rida Hamidou; Riz Ahmed; Robin Ince; Robin Morrissey; Roger Hartley; Roisin O’Loughlin; Ruth Lass; Salena Godden; Sam Spruell; Sara Masry; Sarah Agha; Sasha Behar; Selma Dabbagh; Shazia Mirza; Simon Rix; Sonali Bhattacharyya; Stewart Lee; Steve Coogan; Susan Lynch; Suzi Ruffell; Thomas Browne; Thomas Combes; Thusitha Jayasundera; Tobias Menzies; Dame Tracey Emin; Tracey Seaward; Vijay Mistry; Vivian Munn; Young Fathers (all members); Zainab Hassan 

    MIL OSI NGO

  • MIL-OSI United Nations: Experts of the Committee on the Rights of the Child Commend Romania on Deinstitutionalisation Process, Raise Questions on Corporal Punishment and Segregation in Education

    Source: United Nations – Geneva

    The Committee on the Rights of the Child today concluded its review of the combined sixth and seventh periodic reports of Romania, with Committee Experts commending the State on the deinstitutionalisation process of alternative care centres, while raising questions on the prevalence of corporal punishment and measures taken to combat segregation in education. 

    A Committee Expert said she was happy to hear about the programme for the deinstitutionalisation of alternative care centres; this was something Romania should be proud of, as well as all the foster arrangements being made, especially for children with disabilities. 

    Juliana Scerri Ferrante, Committee Expert and Country Taskforce Member, said there seemed to be a lack of parental education programmes around corporal punishment. How could the views of the child be respected if violence was accepted as a disciplinary measure?  Could the Romanian Government take clear steps to train staff and promote child education?  Philip Jaffe, Committee Vice-Chair and Country Taskforce Member, also noted that corporal punishment appeared to remain quite widespread despite being banned in 2004.  What efforts were being made to lower the prevalence and change attitudes among parents and adults? 

    Mr. Jaffe asked what was being done to combat school segregation based on disability, special education needs, and family economic status?  What improvements were being made to increase the improvement of vocational training for older children who may be leaving the school system?  Were there any programmes which specifically targeted economically disadvantaged children?

    The delegation said Romanian legislation completely prohibited violence against children, regardless of the environment.  However, despite the legislation, which was fully aligned with United Nations Conventions, the State needed to fight against mentalities and traditions and to practically change the minds of parents and caregivers, who believed corporal punishment would discipline children better.  Awareness-raising campaigns were being conducted for parents, and mechanisms including hotlines had been developed to support children, including the helpline 119.  Authorities were obligated to launch investigations immediately concerning any allegations of violence against children. 

    The delegation said the Ministry of Education had taken steps to assist children with special educational needs, with the creation of frameworks offering them different kinds of support, based on the type of disability.  Adaptive measures had been taken for Roma children, including stimulating their participation in early education and in summer kindergartens, supporting education in their current language, and translating schoolbooks in their mother tongue, among others.  An increasing number of contracts between schools and the business sector had been recorded, including around 6,000 contracts in the school year 2023/2024. 

    Introducing the report, Helena Omna-Raicu, President of the National Authority for the Protection of Child Rights and Adoption of Romania and head of the delegation, said Romania’s path in recent years had been shaped by profound changes and emerging pressures, including the war in Ukraine and the arrival of thousands of children and families fleeing conflict.  As a neighbouring country, Romania had mobilised rapidly to provide emergency care, protection, psychosocial support, and schooling to children regardless of their nationality. 

    Ms. Omna-Raicu said Romania had made significant progress in certain areas, including in the deinstitutionalisation process.  Of the 167 residential placement centres operating in 2017, 149 had already been closed by the end of March 2025 and over 6,000 children were now benefiting from family-type alternative care.  The remaining 18 placement centres would be closed soon. 

    In closing remarks, Rinchen Chophel, Committee Expert and Country Taskforce Coordinator, reiterated the Committee’s appreciation for the Government of Romania’s support to Ukrainian refugees, particularly children.  Significant progress had been made from the last reporting period to the current one, with many looking forward beyond the dialogue. 

    In her closing remarks, Ms. Omna-Raicu, expressed deep gratitude for the dialogue.  The Committee’s concerns regarding urban disparities were noted.  Romania would treat the Committee’s recommendations as an opportunity for deeper transformation. 

     

    The delegation of Romania was comprised of representatives from the National Authority for the Protection of Child Rights and Adoption; the Ministry of Education and Research; the Ministry of Justice; the Ministry of Health; the Ministry of Labour, Family, Youth and Social Security; the Ministry of Foreign Affairs; the General Inspectorate of the Romanian Police; the General Inspectorate for Immigration; the National Administration of Penitentiaries; the Prosecutor’s Office; the National Health Insurance Authority; and the Permanent Mission of Romania to the United Nations Office at Geneva. 

    Summaries of the public meetings of the Committee can be found here, while webcasts of the public meetings can be found here. The programme of work of the Committee’s ninety-ninth session and other documents related to the session can be found here.

    The Committee will next meet in public at 3 p.m. on Wednesday, 21 May to begin its consideration of the combined fifth and sixth periodic reports of Qatar (CRC/C/QAT/5-6).

    Report

    The Committee has before it the combined sixth and seventh periodic reports of Romania (CRC/C/ROU/6-7).

    Presentation of Report

    HELENA OMNA-RAICU, President of the National Authority for the Protection of Child Rights and Adoption of Romania and head of the delegation, said Romania’s path in recent years had been shaped by profound changes and emerging pressures, including the war in Ukraine and the arrival of thousands of children and families fleeing conflict.  As a neighbouring country, Romania had mobilised rapidly to provide emergency care, protection, psychosocial support, and schooling to children regardless of their nationality.  The State was proud to have established the first Blue Dot in the region at the border crossing with Ukraine and launched the use of the Child Protection Information Management System Primero in only a couple of months after the onset of the refugee crisis, ensuring registration and case management for almost 40,000 refugee children.

    Several new national strategies had been developed for 2021-2027 which aimed to address child poverty and wellbeing, including the national strategy for the protection and promotion of children’s rights “protected children, safe Romania” 2023-2027, and the national strategy on social inclusion and poverty reduction 2022-2027, among others.   Romania had also adopted and begun the implementation of the child guarantee national action plan 2023-2030, which aimed to reduce the number of children at risk of poverty or social exclusion by at least 500,000 by 2030. Romania had seen a measurable decline in the proportion of children at risk of poverty and social exclusion from 41.5 per cent in 2022 to 33.8 per cent in 2024. 

    In April 2024, law 100/2024 was approved which included specific amendments to several laws relevant for social assistance.  The new emergency ordinance no. 96/2024, approved in June 2024 regarding the provision of humanitarian support and assistance by the Romanian State to foreign citizens or stateless persons in special situations coming from the area of the armed conflict in Ukraine, established the legal framework providing refugees with access to a wide range of key national statutory services. Another significant legislative change was enacted by amending law 272/2004 in December 2024, which now mandated the participation of children in public decision-making processes. 

    There had also been several significant programmes launched, including modernising the unique national number 119 for reporting cases of abuse, neglect, exploitation and any other form of violence against children; the development of community services for children and families to prevent separation and support the family reintegration of children from the special protection system; and the development of 200 integrated community centres and 150 daycare centres for children, among others.  Despite these advances, challenges remained, including disparities between rural and urban areas. 

    However, Romania had made significant progress in certain areas, including in the deinstitutionalisation process.  Of the 167 residential placement centres operating in 2017, 149 had already been closed by the end of March 2025 and over 6,000 children were now benefiting from family-type alternative care.  The remaining 18 placement centres would be closed soon.  The use of European Union structural funds had also supported the training of over 11,000 foster carers.  A new programme had also been introduced, aimed to scale-up integrated community-services in 2,000 marginalised rural communities, combining social assistance, health, education, and other types of social support.  Over 800 million euros of European Social Funds were planned for enhancing access to social services for the most vulnerable, including children and their families.

    The State had also expanded support for children at risk of early school leaving by using the early warning mechanism in education, of which around 50,000 participants from 6,950 institutions had completed the training programme.  Targeted policies had been developed that supported the reintegration of children who dropped out during the pandemic, and more resources were reaching schools in deprived communities.  In health, the role of community nurses and Roma health mediators had grown, and work continued to improve access to services for vulnerable groups. 

    Pilot projects on mental health for children had laid the groundwork for more systemic change, with mental health services for children and adolescents being expanded. However, challenges remained in ensuring equitable access to quality services in rural and marginalised areas, addressing shortages of specialised personnel, and improving early identification and intervention for children with developmental delays or disabilities.

    Romania was committed to reducing the number of children affected by poverty and social exclusion by at least 500,000.  The State would also pursue the complete closure of old-type residential centres, with every child in alternative care placed in family-based or community settings. Romania was committed to translating the pledges made during the first-ever global ministerial conference on ending violence against children held at the end of 2024 in Bogota, Columbia, into realities for children. 

    In education, the State aimed to increase the early childhood education enrolment rate by at least 22 per cent for children aged zero to three and at least 95 per cent for children aged four to six.  There would be a focus on improving mental health services for children and linking schools, families, and health providers more effectively, aiming to reduce preventable mortality by 20 per cent compared to 2021 levels for children of all ages.   Finally, Romania would ensure that children had a role in shaping systems through participatory budgeting, monitoring, and children and youth-led policy platforms. Romania remained committed to fully implementing the Convention and to contributing to the global effort to advance child rights everywhere.

    Questions by Committee Experts

    RINCHEN CHOPHEL, Committee Expert and Country Taskforce Coordinator, said Romania had achieved a lot since the last report, which the Committee was happy about. Romania’s assistance to the Ukrainian refugees and children should be noted.  There had been significant legislative achievements, particularly the amendments to law 272.  What measures were in place to ensure effective implementation of the law?  The national strategy on social inclusion and poverty reduction 2022-2027, and the child guarantee national action plan 2023-2030 were very welcome developments.  How had these impacted on measures to promote and protect children? Had an assessment been undertaken to evaluate the impact of the national strategy. 

    While welcoming increased allocations to certain sectors, the Coordinator asked what measures were in place to develop a child-friendly budgeting process?  What was the current status of the complaints mechanism in the country for reporting all forms of abuse and violence for children? What had been done to inform children of their right to file a complaint?  Had professionals working with children been trained on receiving complaints concerning children and the Convention? 

    The establishment of the child Ombudsman in 2018 was a crucial step in the right direction, and the Government should be congratulated for that.  What was the current status of the institution?  How did it connect with children?  The Committee noted the State party’s awareness raising activities on the Convention with appreciation, including the translation of the Committee’s general comments into Romanian.  How did these efforts extend to rural children? 

    JULIANA SCERRI FERRANTE, Committee Expert and Country Taskforce Member, asked if the national strategy for school de-segregation been adopted?  If not, then when would this occur?  What measures had been taken to address hate speech? Did the permanent committee set up in every education unit offer a complaints mechanism to children?  If not, how could children complain in schools? 

    What had been done to decrease discrimination against the Roma population?  What efforts had been made to promote the inclusion of Roma in mainstream schooling?  How was discrimination against children with disabilities tackled in education?  There was concern that Romanian law did not define valid reasons on which minor marriages could be authorised and this was left to the discretion of the authorities.  What training was provided to apply the best interests of the child? What approaches had been taken to reduce the preventable mortality of children under five years old?  What was the position of the Romanian Government on the proposed amendment to law 272 regarding lesbian, gay, bisexual, transgender and intersex children?

    There seemed to be a lack of parental education programmes around corporal punishment. How could the views of the child be respected if violence was accepted as a disciplinary measure?  Could the Romanian Government take clear steps to train staff and promote child education?  How were child labour laws enforced?  How would the Romanian Government establish a child participation mechanism?  Were refugee and asylum-seeking children involved in decisions which affected them? Were children provided information on their rights? 

    What measures were being taken to strengthen the capacity of the social welfare services? How were children with disabilities prioritised in reform measures?  What was being done to combat the illicit transfer of children abroad?  Had bilateral agreements been conducted in this regard?  Was the Romanian Government carrying out measures to understand the impact of prison on children?  How were they supported when their parents were incarcerated?  What support was available for young people leaving institutional care? 

    SOPHIE KILADZE, Committee Chair and Country Taskforce Member, said the adoption of law 105/22 providing for automatic birth registration should be considered as positive.  Could more information be provided about how the law worked in practice?  Were there any plans to introduce a statelessness determination procedure?  Was data on statelessness which concerned children disaggregated?  What measures were in place to protect children from excessive screen use?  How did Romania deal with artificial intelligence as a European Union member? Romania had one of the lowest levels of digital skills in the European Union; what measures were being undertaken to promote digital literacy among children, as well as parents? 

    PHILIP JAFFE, Committee Vice-Chair and Country Taskforce Member, said it was wonderful that strong pledges had been made at the global ministerial conference on ending violence against children in Bogota.  How was Romania implementing its mission as a pathfinding global alliance country?  It seemed Romanian children were in need of protection against high levels of physical and sexual violence.  One of the pledges made in Bogota was to conduct a prevalence study on sexual abuse; had the State moved forward with this study?  Were there dedicated teams drawing up the comprehensive framework and strategy which had been promised?  One pledge had been to enhance children’s participation regarding issues of violence.  What efforts had the Government made to ensure that there was a clear public understanding that all forms of violence against children needed to be reported? 

    Corporal punishment appeared to remain quite widespread despite being banned in 2004. What efforts were made to lower the prevalence and change attitudes among parents and adults?  It was encouraging that Romania had been one of 40 countries to recently join a statement of the Human Rights Council, expressing children’s right to protection from corporal punishment.  How was bullying and cyber bullying being addressed at all levels of legislative policy?  Could more information about the child helplines be provided? 

    Was it true that around seven to eight per cent of girls in Romania were married before the age of 18, with that percentage rising to around 20 per cent in the Roma community? What was being done in response to this? Was it true that charges had been dropped against a 17-year-old boy who entered into a non-formal marriage with an 11-year-old girl?  What policy was in practice in the health sector regarding surgical interventions and intersex children?  What were the guidelines to protect their bodily integrity until these children were capable of providing consent? 

    Responses by the Delegation

    The delegation said the law on child protection now included clear provisions which made it compulsory for public administrative bodies to involve children in consultations regarding issues which concerned them.  The national strategy on children’s rights was recently adopted and another national action plan was elaborated; these plans were complimentary. This was a comprehensive package which would help the Government to better implement all necessary measures. An assessment of the national strategy had been undertaken.  The State was now piloting a system which would indicate how to establish a model of financing where children would be considered as a different group that would benefit from a different budget. 

    The national programme for schooling in Romania ensured children received food support at schools to increase the enrolment rate and participation.  School supplies were also provided for all school grades. Two hundred euros were provided for the purchase of technology, and remedial lessons were provided to students coming from disadvantaged communities.  Recently, the scholarship system had been extended to encompass more disadvantaged groups. 

    Funds allocated to primary medical care had registered a continuous annual increase.  Just last year, the fund allocated to primary care increased by 24 per cent.  The national observatory was a big achievement for Romania and aimed to identify the children most at risk of being separated from their families, based on indicators.  Training was being conducted on the use of the observatory to ensure the data provided was reliable.   

    The hearing of minors in justice proceedings took place in special rooms, and a psychologist was always required to be present.  The new national strategy for the development of the judicial system provided for another 10 hearing rooms across the country.  There were specially designated prosecutors to handle cases involving minors.  The child Ombudsman was fully operational and cooperated with all institutions.  It had a functioning complaints mechanism.  If an incident was notified to the Ombudsman, an investigation started, which concluded with a set of recommendations sent to the institution responsible to correct the situation.  

    Civil society representatives were part of the consultative groups established at the national level.  A methodology had been issued and piloted regarding identifying and banning segregation within the educational sector.  The measures focused on ensuring an inclusive education.  Any kind of discrimination on criteria such as ethnicity, religion or sex was completely forbidden within the educational system.  Specific places in high schools were allocated for Roma students and students with disabilities.  To ensure access to high quality education, educational services had been developed starting from early education to prevent early dropout and absenteeism.     

    A set of programmes had been introduced, including a monthly allowance for children up to the age of 18, as well as parental leave.  There was also a minimum income support which supported families with children. Emergency ordinance no.96 was developed specifically for children from Ukraine and their families. 

    There was a dedicated intergovernmental group which addressed the subject of forced marriage, with the aim of drafting legislative projects in this regard.  Concerning infant mortality and the number of deaths under one year of age, a regionalised system of care had been introduced to ensure each neonate was born in a medical unit which could provide the services necessary for their care, thereby reducing infant mortality.  An important national programme was in place which contained around 15 interventions, established in partnership with the United Nations Children’s Fund.  Another programme provided 900 neonatal incubators around the country. 

    A significant number of services had been established to help families in vulnerable situations. A special programme was launched last year on the minimum inclusion income, which focused on how to assist parents within the labour market.  The State was aware of a lack of social assistance in rural areas, which was where the most vulnerable communities lived.  Interventions were directed, including food packages, and local administrative capacities would be developed. 

    A programme had been developed which aimed to establish hearing rooms for children in courts, and 29 hearing rooms were completed in April 2024.  The rooms were used by the Prosecutors and police officers when they had victims who were minors.  The rooms were child-friendly and specially designed with toys.  The child did not see the other people participating in the hearing.  A new strategy adopted in 2025 provided for the need for an additional 10 hearing rooms in the near future. 

    All social services were functioning based on a set of minimum quality standards, which were verified by the national agency for social inspection.   With the United Nations Children’s Fund, Romania was piloting a project which would identify and train foster families to care specifically for children with disabilities.  A child entering the special protection system was prioritised to be reintegrated in a family environment.  Adoption was considered the best solution in this regard, and this could only be decided by a court.  Priority was offered to domestic adoption, but international adoption could be considered after one year. 

    Amendments had been made to allow special spaces for visits in prison with children.  Such spaces were now available in all prison facilities within the Romanian penitentiary system.  There were cooperation protocols in place with the United Nations Children’s Fund and Save the Children which supported parents to develop their parental skills and improve their relationship with their children. The State was aware of the need to develop programmes which addressed the needs of children and adults and improved the relationship within the family.

    The Ministry of Education aimed to develop digital competencies among students and parents. During the pandemic, all students were provided with laptops and digital devices to keep up with the educational process.  In a new initiative launched in partnership with Microsoft, the Ministry of Education had announced the development of a project concerning artificial intelligence for increasing the school performance of students.  A project was also being implemented aimed at improving the digital skills of civil servants. 

    Romania had a dedicated national child help line.  It was toll-free and operational 24/7.  Those operating the calls were specialised counsellors who could refer the cases to the relevant authorities.  Another helpline just referred cases to social services.  The 119 helpline was a recent development, operational from any place in Romania and accessible to children and adults.  After the first year, it had been well received and was being regularly used to inform on any situation concerning a child. 

    Rape of a minor and sexual assault against a minor had been introduced as acts within the Criminal Code.  Rape committed by an adult against a minor under the age of 18 was punished by a prison sentence of between seven to 12 years.

    Questions by Committee Experts

    PHILIP JAFFE, Committee Vice-Chair and Country Taskforce Member, said one in 20 people in Romania held a disability certificate, with around 80,000 being children. What were the difficulties faced by certain groups of children to receive this certificate, including rural children?  Were there any awareness-raising campaigns for rural minorities and poor families regarding their entitlement to services?  Could more information be provided about Romania’s strategy for persons with disabilities?  How were the number and expertise of professionals being scaled up?  To what degree had the State embraced a human-rights approach to disability, as opposed to a medical model of disability?  How many children were still left in institutions? When would such institutions all be closed? 

    There were two recent laws on pre-university education and higher education; could more information be provided about the implementation of these laws?  What was the level of gross domestic product dedicated to education in Romania?  Was there a direct pipeline to hear about the concerns of children within the education system and were these concerns taken seriously?  What was being done to combat school segregation based on disability, special education needs, and family economic status?  Figures suggested that 40 per cent of children with disabilities had limited access to education.  What steps were being made to improve education for children under the age of three? What improvements were being made to increase the improvement of vocational training for older children who may be leaving the school system?  Were there any programmes which specifically targeted economically disadvantaged children?  What was the mission of the Ministry of Youth? 

    SOPHIE KILADZE, Committee Chair and Country Taskforce Member, asked if sufficient resources were dedicated to the capacity building of medical personnel? Did all children have access to health care, including health insurance?  How were vaccinations promoted in the country?  How was breast feeding promoted?  Child obesity was an issue of concern; how was this combatted? Was there a hot meals programme? 

    Mental health was a very important issue.  Was data on mental health being disaggregated, including on suicide?  Was there a comprehensive strategy and action plan regarding the issue of mental health?  Were quality mental health services available in rural and remote areas? According to alarming information, the country had the highest number of adolescent mothers across the European Union. What steps would the State undertake to prevent adolescent pregnancies and subsequent abortions?  Would Romania make reproductive education part of the curriculum? 

    What measures were in place to address drugs or substance abuse?  Were there treatments available for children?  Romania had made substantial efforts for Ukrainian children and other groups of refugees.  How would the State integrate these children long-term?  Were there delays in the enrolment of refugee children and their families into the social services system?  Would amendments be considered in the asylum law to end the detention of families at the legislative level?  Did unaccompanied migrant children have access to services, including psychosocial support and disability services?  Were there any barriers which could hinder access to education? 

    What measures were being undertaken to end child labour, including begging?  What was being done to assist children in street situations?  How were perpetrators investigated and brought to justice?  Were there quality services for child victims of trafficking in place? Was the system of child justice established across the country?  Were adequate financial resources allocated to it?  Was free legal aid available to children in conflict with the law?  Was the detention of children used only as a last resort?  If yes, did it comply with international standards? 

    RINCHEN CHOPHEL, Committee Expert and Country Taskforce Coordinator, said one in five children were affected by severe material and social deprivation, which was concerning.  What was the reality on the ground?  The minimum social assistance package had been introduced; could more information be provided on it?  Romania was increasingly vulnerable to droughts, heatwaves, floods and landslides, and it was also grappling with water pollution.  How had the national strategies pertaining to climate change helped to address the challenges of the environment and climate change in the country? What measures were being adopted to take into account children’s needs and views in the development of specific policies, including disaster-preparedness plans?  Were child rights impact assessments carried out when dealing with the business sector? 

    A Committee Expert asked what the national coverage of vaccinations was in the country?  Romania had an epidemic of measles; how did the population react to vaccinations?  How was confidence being built in vaccines?  Were people familiar with the law on rape?  What happened once the 30-day limit for registering births had elapsed? 

    Responses by the Delegation

    Romanian legislation completely prohibited violence against children, regardless of the environment.  However, despite the legislation, which was fully aligned with United Nations Conventions, the State needed to fight against mentalities and traditions and to practically change the minds of parents and caregivers, who believed corporal punishment would discipline children better.  Awareness-raising campaigns were being conducted for parents, and mechanisms including hotlines had been developed to support children, including the helpline 119. 

    Authorities were obligated to launch investigations immediately concerning any allegations of violence against children.  Romania was committed to continuing these efforts and to changing social norms and mentalities.  The numbers of cases of violence against children was increasing, which meant people were becoming more aware of the issue and reporting it. 

    Since 2016, the methodology applied in Romania clearly distinguished between the concept of disability and special education needs.  In Romania, the deinstitutionalisation process was one of the most important commitments of the Government, and the process was now concluding. Currently, out of the 167 residential centres operating in 2017, 149 had already been closed, and more than 6,000 children were benefiting from alternative care.  The legal framework stated that no placement centre could operate without the approved closure plan.  The deinstitutionalisation process also involved finding better alternative and family-based care for children.   Only 18 placement centres remained in the process of being closed, and by 2026 no such centre would be operating in Romania.  The State was still aiming to find family-style solutions for children with disabilities, and a project was being developed with the United Nations Children’s Fund to this end.

    If a birth was declared after the 30-day deadline but less than one year after the birth, the birth certificate could be issued based on approval from the mayor.  If the birth declaration was made more than one year after the birth, the certificate needed to be approved by the mayor and other administrative bodies. 

    More than 2.8 million students were enrolled in the 2023/2024 school year in Romania.  For high school, there had been a significant decrease in dropouts from 2.5 per cent in 2017 to 0.8 per cent in 2024. Around 4.5 per cent of the budget was allocated to education.  The Ministry of Education had taken steps to assist children with special educational needs, with the creation of frameworks offering them different kinds of support, based on the type of disability.  For students with temporary special needs, the law of education presented special measures, including the implementation of schooling hospitals, or schooling at home for those who were required to be in hospital or at home for medical reasons. 

    Adaptive measures had been taken for Roma children, including stimulating their participation in early education and in summer kindergartens, supporting education in their current language, and translating schoolbooks in their mother tongue, among others.  More than 66,000 teachers had been trained in digital and multimedia use.  An increasing number of contracts between schools and the business sector had been recorded, around 6,000 contracts in the school year 2023/2024.  Most teachers had been trained to create open educational resources.  Significant funds had been allocated to modernising rest room facilities in schools. 

    Any student could submit complaints of discrimination via an established framework.  Students benefitted from representation in the school system through several platforms.  The national strategy for sustainable development issued the methodology of the “green week programme”, which contributed to preschoolers and students’ competence in understanding basic concepts of climate change, to initiate individual and protective action to protect the environment.  Teachers were obliged to obtain 90 transferrable professional credits every five years, through attending courses offered by Romanian training houses.

    In recent years, infant mortality had remained relatively stable in Romania.  From 2023 to 2024, the number of doctors treating children increased by five per cent.  Regarding children’s access to medical services, all children were insured in Romania and benefitted from basic medical services across all sectors of health care.  The national health insurance fund also reimbursed certain services.  The Ministry of Health had launched a vaccination campaign in partnership with the Red Cross, to raise awareness of parents; this had been accompanied by a “catch-up” vaccination schedule, resulting in 1,500 children being vaccinated.  A protocol had been signed with the Orthodox Church to establish an active partnership to create a framework for anyone facing a possible cancer diagnosis, offering support.   

    World Breastfeeding Week was celebrated in August each year, as breastfeeding remained one of the most effective ways to provide children with the best start in life. Breast feeding recommendations had been developed with partners, including the World Health Organization, and were relayed to medical practitioners at the local level.  Around 200 integrated community centres would be restructured, elevated and equipped.  A television broadcast had been created to promote the importance of breastfeeding in the first six months of a child’s life.   

    Information and education campaigns had been carried out for children, parents and teachers about the benefits of a healthy diet and the consequences of unhealthy eating. Around 1,000 people had benefited from the campaign.  Substance abuse could be detected by family doctors and psychological services could be recommended.  The national health insurance house implemented the national mental health programme, providing treatment for persons with substance abuses, and ensuring specific treatment for patients with depressive disorders. 

    Questions by Committee Experts 

    RINCHEN CHOPHEL, Committee Expert and Country Taskforce Coordinator, said the Government had approved a social assistance programme in 2011 which targeted all communes, but was underfinanced; could more information be provided?  The Environment Week presented was an excellent initiative; how was it being utilised? 

    JULIANA SCERRI FERRANTE, Committee Expert and Country Taskforce Member, asked if there were any supervision orders, where children remained with their family but were supervised?  Were there age assessment procedures during the asylum procedure?  What rights did children applying for asylum have?  Could they appeal any decisions? 

    PHILIP JAFFE, Committee Vice-Chair and Country Taskforce Member, said according to research by the United Nations Children’s Fund, Romanian girls felt much lonelier than Romanian boys.  Was there a reason for this gap? 

    SOPHIE KILADZE, Committee Chair and Country Taskforce Member, asked for clarification on case management coordination? 

    A Committee Expert noted the prevalence of women among the large delegation and asked if women generally had an important and high-profile position in Romania, or if this only occurred when discussing children?  Had there been any programmes to prevent violence?  Had the concept of gender been fully institutionalised? Were teachers trained in detecting signs of violence?  What was the prevalence of child marriage in the country?  What about figures for marriages which were not officially recorded? Had there been any programmes to prevent the phenomenon or sanctions? 

    Was there any mapping of the at-risk populations in the country of female genital mutilation? Was female genital mutilation prohibited in law?  What was the most updated action on sexual exploitation?  Was there any cross-border cooperation between Romania and neighbouring countries?  Did Ukrainian children born in Romania have access to Romanian citizenship?  Did rape victims have access to emergency contraception?

    Another Expert asked about vaccinations from children aged zero to 12; was there distrust in the population when it came to vaccines?  It seemed that tuberculosis was a public health issue.  What was being done in the field of treatment? Were there children whose births had not been declared, particularly among refugees, Roma and migrants?

    A Committee Expert asked about the new concept introduced by the Parliament on parental alienation.  How had this concept been consulted on, particularly with children?  How would the best interests of the child be ensured? What specific measures were being taken to reduce school dropout and improve access to quality education for Roma children?  What mechanisms were in place to monitor and support Roma children who were at risk of dropping out? 

    Another Committee Expert said she was happy to hear about the programme for the deinstitutionalisation of alternative care centres; this was something Romania should be proud of, as well as all the foster arrangements being made, especially for children with disabilities.  What was the State doing to support the families of children with disabilities, particularly those with severe disabilities? 

    Responses by the Delegation 

    The delegation said emergency contraception was available to those who had experienced sexual assault and could be obtained without a prescription.  Adolescent pregnancies were a major concern for the Romanian public health system.  Contraceptives and medical devices were provided free of charge through family centres and through gynaecological departments, where abortions were performed upon request.  Romania was one of the first European countries to offer non-discriminatory HIV/AIDS treatment. 

    Refugees were granted a monthly allowance, one-month’s accommodation, and access to education for minors.  Legislation in the field of asylum provided for beneficiaries to apply for family reunification when family members were not in Romania.  Identity documents needed to be provided to prove family links. Family reunification of unaccompanied minors was carried out with the best interest of the child in mind. Minors from immigrant backgrounds benefitted from the same rights as minors who were Romanian citizens. Romanian language courses provided teaching support, textbooks and workbooks developed on linguistic levels according to the European Union framework.  Priority for asylum applications was given to unaccompanied minors. 

    Medical forensic expertise was used when an asylum applicant could not prove their age and there were serious doubts about their ethnicity.  The declared age of the asylum applicant was accepted if their refusal to undergo the medical expertise was based on compelling reasons.  The assessment was performed with full respect for the minor’s dignity and in as least invasive way as possible. 

    Investigations in child and human trafficking were undertaken by specialists with supervision from specialised prosecutors.  Through law 229/2024, the Romanian Parliament aimed to discourage sex tourism and the pimping of minors.  More than 1,200 criminal cases had been identified regarding child trafficking. The General Inspectorate of Romanian Police organised regular sessions for border police and 

    non-governmental organizations, with the purpose of identifying victims.  More than 125 trainings had been carried out to over 4,000 workers who may encounter trafficking victims through their work. The National Agency against Trafficking in Persons and the Directorate for Investigating Organised Crime had implemented a national action plan in the fight against human trafficking to improve the awareness of at-risk groups. 

    In 2024, prosecutors from the Directorate for Investigating Organised Crime took part in 35 seminars regarding identifying child victims, compensation for victims, international cooperation, and online sexual exploitation of children, among other topics.  A public awareness campaign had been launched relating to sexual acts between adults and minors.  The message stated that a sexual act committed against a minor of 16 years or under constituted rape, if the age gap was more than five years, and punishments applied. 

    According to Romanian legislation, minors benefited from free legal aid, whether they committed a crime, or if they were victims of a crime.  The Romanian penal system limited sanctions in regard to minors, and measures for deprivation of liberty were only given as a last resort and could only be ordered by a court. 

    The integrated social services project aimed to develop the academic knowledge of professionals working in the social assistance field, and to develop concrete measures for vulnerable groups of people. 

    During “green week”, schools organised activities around several topics relating to the environment.  These were uploaded on a specialised platform dedicated to education on climate change and varied from one educational cycle to another.  The Ministry of Education had developed a programme, the mechanism of early-living alert, which focused on early education for Roma children. 

    In Romania, social services were obligated to identify children in a risk situation.  Children could remain within families and be monitored by social services until the risks were removed.  The parental alienation provision was introduced in all cases relating to violence and neglect.  It was recommended that this provision be removed, as these measures should only be applied by the courts.  There were many trainings offered to judges on methods relating to children’s rights.  Social workers were also trained to provide necessary assistance to visiting parents. Social services could only assist; they could not intervene and solve disputes between parents. 

    Closing Remarks

    RINCHEN CHOPHEL, Committee Expert and Country Taskforce Coordinator, reiterated the Committee’s appreciation for the Government of Romania’s support to Ukrainian refugees, particularly children.  The State was encouraged to continue to undertake these activities which were important for solidarity for children.  Significant progress had been made from the last reporting period to the current one, with many looking forward beyond the dialogue.  This was an indication of the Government’s commitment towards children.  As the country moved forward, it was important to put emphasis on implementation and ensure vulnerable children did not miss out. 

    HELENA OMNA-RAICU, President of the National Authority for the Protection of Child Rights and Adoption of Romania and head of the delegation, expressed deep gratitude for the dialogue.  The delegation welcomed the Committee’s emphasis on equality, accountability and sustainability, and would underpin the next stage of the State’s deinstitutionalisation journey.  The Committee’s concerns regarding urban disparities were noted.  It was recognised that rights delayed were rights denied, and the State was committed to accelerating affirmative action. Romania would treat the Committee’s recommendations as an opportunity for deeper transformation. 

    SOPHIE KILADZE, Committee Chair, thanked the delegation for the fruitful dialogue and commended its members for their clear and comprehensive answers.  Ms. Kiladze extended her best regards to the children of Romania. 

    ___________

    Produced by the United Nations Information Service in Geneva for use of the media; 
    not an official record. English and French versions of our releases are different as they are the product of two separate coverage teams that work independently.

     

     

    CRC25.013E

    MIL OSI United Nations News

  • MIL-OSI: U.S. Growth Strategy: Boralex Signs Contracts for Two New York Solar Projects Totaling 450 MW

    Source: GlobeNewswire (MIL-OSI)

    MONTREAL, May 21, 2025 (GLOBE NEWSWIRE) — Boralex Inc. (“Boralex” or the “Company”) (TSX: BLX) is pleased to announce it has entered into a Renewable Energy Standard Agreement with the New York State Energy Research and Development Authority (NYSERDA) to procure Tier-1 RECs from each of its Fort Covington Solar Project and Two Rivers Solar Project, totaling 450 MW. The signing of these contracts marks a significant milestone in Boralex’s contribution to renewable energy in New York and in the Company’s development in this promising market.

    These contracts were awarded as part of NYSERDA’s 2024 Renewable Energy Standard Competitive Solicitation for the purchase of New York Tier-1 Eligible Renewable Energy Certificates (RECs). Each REC represents the environmental attributes of one megawatt-hour of electricity generated from an eligible renewable source such as solar energy.

    The two solar facilities will be located in Franklin and St. Lawrence Counties in upstate New York, with permit applications currently under review by the state Office of Renewable Energy Siting and Electric Transmission:

    “New York is committed to building a clean energy economy, and Boralex is honored to meaningfully contribute toward achieving the State’s renewable energy targets,” said Patrick Decostre, President and Chief Executive Officer of Boralex. “We appreciate NYSERDA’s confidence in our projects. New York State is a strategic growth market for Boralex, and we are proud to support the State’s renewed commitment to advancing clean energy infrastructure.”

    “Our execution of these contracts for the Fort Covington and Two Rivers projects reflects Boralex’s strategic focus on growing our U.S. renewable energy platform,” added Hugues Girardin, Executive Vice President, General Manager North America, Boralex. “We are extremely proud of our teams, whose expertise and dedication continue to drive Boralex’s successful expansion across North America in response to the consistently strong demand for green electricity.”

    “Renewable energy projects like Fort Covington and Two Rivers, are crucial to New York’s clean energy transition,” said NYSERDA President and CEO Doreen M. Harris. “Additionally, public-private partnerships like this will bring meaningful benefits to Franklin and St. Lawrence counties by spurring economic investments and delivering affordable and locally-sourced energy to residents of these communities.”

    “This is very exciting news for our town and the state as it looks to achieve its climate goals,” said Mark Peets, Supervisor of the Town of Brasher. “Throughout the development of this project, Boralex has done an excellent job communicating  the benefits to our community. They’ve listened to our concerns and, more importantly, made meaningful project changes that have helped build trust and support. We look forward to the hundreds of construction jobs, and tens of millions of dollars in economic development these projects will provide.”

    “These developments are great news for our community and the surrounding area,” said Susan Bellor, Supervisor, Town of Massena. “I very much look forward to continuing to strengthen the relationship between Boralex and our town, and I’m excited about the long-term positive economic impact the project will have – not only for the participating landowners, but the broader community.”

    “Small towns like ours don’t often get opportunities like this,” said Pat Manchester, Supervisor of the Town of Fort Covington. “The Fort Covington Solar Project represents a major investment in our community and our future. We’re excited about the jobs, increased tax revenues, and the momentum it brings for sustainable economic growth. Boralex has been a transparent, responsive partner throughout this process, and we’re proud to host a project of this scale and significance.”

    Construction of both projects is expected to begin in 2026, and are expected to be commissioned in 2028. They will bring substantial economic, social, and environmental benefits to New York State and to local communities. Once constructed, the projects will together provide enough energy to power approximately 105,000 homes, support approximately 300 to 400 construction jobs, and create long-term operational roles, further strengthening the local economy and advancing the State’s transition to clean energy.

    Caution Regarding Forward-Looking Statements  

    Some of the statements contained in this press release, including those regarding the start of construction of the projects and their commissioning, are forward-looking statements based on current expectations, within the meaning of securities legislation. Boralex would like to point out that, by their very nature, forward-looking statements involve risks and uncertainties such that its results or the measure it adopts could differ materially from those indicated by or underlying these statements, or could have an impact on the degree of realization of a particular forward-looking statement. Unless otherwise specified by the Company, the forward-looking statements do not take into account the possible impact on its activities, transactions, non-recurring items or other exceptional items announced or occurring after the statements are made. There can be no assurance as to the materialization of the results, performance, or achievements as expressed or implied by forward-looking statements. The reader is cautioned not to place undue reliance on such forward-looking statements. Unless required to do so under applicable securities legislation, Boralex management does not assume any obligation to update or revise forward-looking statements to reflect new information, future events or other changes. 

    About Boralex

    At Boralex, we have been providing affordable renewable energy accessible to everyone for over 30 years. As a leader in the Canadian market and France’s largest independent producer of onshore wind power, we also have facilities in the United States and development projects in the United Kingdom. Over the past five years, our installed capacity has increased by more than 50% to over 3.2 GW. We are developing a portfolio of projects in development and construction of more than 8 GW in wind, solar and storage projects, guided by our values and our corporate social responsibility (CSR) approach. Through profitable and sustainable growth, Boralex is actively participating in the fight against global warming. Thanks to our fearlessness, our discipline, our expertise and our diversity, we continue to be an industry leader. Boralex’s shares are listed on the Toronto Stock Exchange under the ticker symbol BLX.

    For more information, visit boralex.com or sedarplus.com. Follow us on Facebook, LinkedIn and Instagram.

    For more information

    MEDIA INVESTOR RELATIONS
    Camille Laventure
    Senior Advisor, Public Affairs and External Communications

    Boralex Inc.

    438 883-8580
    camille.laventure@boralex.com

    Stéphane Milot
    Vice President, Investor Relations and Financial Planning and Analysis

    Boralex Inc.

    514 213-1045
    stephane.milot@boralex.com

       
    MEDIA – NORTH AMERICA  
    Zachary Hutchins
    Manager, Public Affairs and Communications

    Boralex Inc.

    518 727-6155
    zachary.hutchins@boralex.com

     

    Source: Boralex inc.        

    The MIL Network

  • MIL-OSI USA: MEDIA ADVISORY: Sanders to Call on Republicans to Support Trump, Lower Prescription Drug Prices

    US Senate News:

    Source: United States Senator for Vermont – Bernie Sanders
    WASHINGTON, May 21 – After President Trump issued a vague executive order claiming to slash drug costs by linking them to international prices, Sen. Bernie Sanders (I-Vt.), Ranking Member of the Senate Committee on Health, Education, Labor, and Pensions (HELP), today announced he would ask for unanimous consent on the Senate floor to pass legislation that would actually do just that by ensuring Americans pay no more than people in other countries for the exact same prescription drug, forcing anyone who opposes actually lowering drug prices to rise in opposition.
    On May 5, 2025, President Trump issued an executive order entitled “Delivering Most-Favored-Nation Prescription Drug Pricing to American Patients.” In that order, he proposes a “a rulemaking plan to impose most-favored-nation pricing” but does not cite specific legislative authority. As a result, the executive order will be blocked by the courts. Congressional action is needed.
    The Prescription Drug Price Relief Act will put an end to the greed of the pharmaceutical industry and help save lives by lowering drug prices. This legislation would ensure Americans do not pay more for prescription drugs than the median price paid in Canada, the United Kingdom, France, Germany and Japan.
    Details:
    What: Sen. Sanders floor speech calling for unanimous consent to pass legislation to make sure Americans pay no more than people in other countries for prescription drugs
    When: Wednesday, May 21, 2025 at 3:00 p.m. ET
    Where: Senate floor. His remarks will also be livestreamed on Sanders’ social media.

    MIL OSI USA News

  • MIL-OSI Europe: Joint statement by the leaders of France, the United Kingdom and Canada on the situation in Gaza and the West Bank

    Source: France-Diplomatie – Ministry of Foreign Affairs and International Development

    Published on May 21, 2025

    Lire la version

    We strongly oppose the expansion of Israel’s military operations in Gaza. The level of human suffering in Gaza is intolerable. Yesterday’s announcement that Israel will allow a basic quantity of food into Gaza is wholly inadequate. We call on the Israeli Government to stop its military operations in Gaza and immediately allow humanitarian aid to enter Gaza. This must include engaging with the UN to ensure a return to delivery of aid in line with humanitarian principles. We call on Hamas to release immediately the remaining hostages they have so cruelly held since 7 October 2023.

    The Israeli Government’s denial of essential humanitarian assistance to the civilian population is unacceptable and risks breaching international humanitarian law. We condemn the abhorrent language used recently by members of the Israeli Government, threatening that, in their despair at the destruction of Gaza, civilians will start to relocate. Permanent forced displacement is a breach of international humanitarian law.

    Israel suffered a heinous attack on 7 October. We have always supported Israel’s right to defend Israelis against terrorism. But this escalation is wholly disproportionate.

    We will not stand by while the Netanyahu Government pursues these egregious actions. If Israel does not cease the renewed military offensive and lift its restrictions on humanitarian aid, we will take further concrete actions in response.

    We oppose any attempt to expand settlements in the West Bank. Israel must halt settlements which are illegal and undermine the viability of a Palestinian state and the security of both Israelis and Palestinians.  We will not hesitate to take further action, including targeted sanctions.

    We strongly support the efforts led by the United States, Qatar and Egypt to secure an immediate ceasefire in Gaza. It is a ceasefire, the release of all remaining hostages and a long-term political solution that offer the best hope of ending the agony of the hostages and their families, alleviating the suffering of civilians in Gaza, ending Hamas’ control of Gaza and achieving a pathway to a two-state solution, consistent with the goals of the 18 June conference in New York co-chaired by Saudi Arabia and France. These negotiations need to succeed, and we must all work towards the implementation of a two-state solution, which is the only way to bring long-lasting peace and security that both Israelis and Palestinians deserve, and ensure long-term stability in the region.

    We will continue to work with the Palestinian Authority, regional partners, Israel and the United States to finalize consensus on arrangements for Gaza’s future, building on the Arab plan. We affirm the important role of the High-level Two-State Solution Conference at the UN in June in building international consensus around this aim. And we are committed to recognising a Palestinian State as a contribution to achieving a two-state solution and are prepared to work with others to this end./.

    MIL OSI Europe News

  • MIL-OSI Global: Israel allows a ‘limited’ amount of aid back into Gaza, where the humanitarian situation is desperate

    Source: The Conversation – UK – By Sarah Schiffling, Deputy Director of the HUMLOG (Humanitarian Logistics and Supply Chain Management Research) Institute, Hanken School of Economics

    After 11 weeks of blockading the flow of humanitarian aid into Gaza, the Israeli government asked the UN to resume “limited” aid deliveries on May 18. The move came amid growing international outrage over what the UN secretary-general, António Guterres, has called a “policy of siege and starvation” in Gaza that “makes a mockery of international law”.

    Israel cleared nine aid trucks on Monday, May 19, only five of which entered Gaza. The Israeli military says closer to 100 trucks were inspected the following day. But, according to the UN, none of this aid has been distributed yet.

    It also goes without saying that even 100 aid trucks per day will not satisfy the desperate needs of Gaza’s 2.1 million inhabitants. The British, French and Canadian leaders have criticised Israel’s decision to allow a “basic amount of food” to enter the territory as “wholly inadequate”.

    The blockade has caused the already desperate humanitarian situation in Gaza to deteriorate further. Food security experts from the UN-backed Integrated Food Security Phase Classification platform say the entire territory is now facing crisis levels of food insecurity, with 22% of the population at risk of starvation.


    Get your news from actual experts, straight to your inbox. Sign up to our daily newsletter to receive all The Conversation UK’s latest coverage of news and research, from politics and business to the arts and sciences.


    The World Food Programme ran out of supplies in Gaza in late April. Other organisations have had the same problem. This has caused 60% of community kitchens, which many Gazans rely on for a daily meal, to close down. Many food items are now unavailable and diets are extremely limited, largely consisting of bread and pulses.

    Prices of what little food is available have also skyrocketed. The price of wheat flour, for example, has risen by more than 4,000% since the start of the 11-week long blockade. And with 90% of households in Gaza experiencing financial hardship, it is impossible for many people to buy essentials.

    Cooking oil is no longer available and firewood has become scarce. The majority of people now burn waste, making cooking unsafe and unhealthy. On top of this, the healthcare system is on the brink of collapse and access to clean drinking water is very limited.

    At the same time, the efforts of humanitarian organisations to combat malnutrition have nearly come to a standstill because they lack necessary supplies. Malnutrition makes people more susceptible to disease.

    Militarising aid delivery

    The Israeli prime minister, Benjamin Netanyahu, said it was necessary to resume aid to Gaza because Israel’s allies would not tolerate “images of mass starvation”. The move has still been criticised by some Israeli politicians, with hardline defence minister Israel Katz calling it a “grave mistake”.

    For now, aid will enter Gaza through established mechanisms. But the US and Israel are backing a proposal for a new aid delivery system involving private companies. The system will be managed by a newly formed independent American aid organisation called the Gaza Humanitarian Foundation (GHF), which expects to become operational by the end of May.

    The GHF plans to set up what it is calling “secure distribution sites” in southern and central Gaza. From these sites, it will distribute food, hygiene kits and medical supplies initially to 1.2 million people – eventually scaling-up operations to cover the whole population. The GHF says it will coordinate with the IDF but that its sites will be protected by private military contractors.

    While the GHF claims to have secured funding and be in the process of procuring large amounts of goods, no details are currently available to the public on this massive undertaking. The plan has received widespread criticism and has been rejected by the UN.

    The main criticism of the plan is that it violates so-called humanitarian principles. It is generally accepted that humanitarian action is based upon four main principles: humanity, neutrality, impartiality and independence.

    The principle of humanity states that suffering must be addressed wherever it is found, with a special focus on the most vulnerable people. Neutrality means that, in an armed conflict, humanitarian aid should not favour any side.

    Impartiality requires that humanitarian aid is provided based solely on need without any discrimination. And independence means that humanitarian objectives should be autonomous of political, economic, military or other objectives.

    Humanitarian bodies argue that the GHF’s plan does not stand up to these principles. It would force people to travel long distances to acquire heavy aid goods, so excludes those who are less mobile and more vulnerable.

    Meanwhile, humanitarian organisations have rejected the plan as a “humanitarian cover for a military strategy of control and dispossession”. They have raised concerns that the limited number of food distribution sites, as well as their location, could encourage the forced displacement of Palestinians from northern Gaza.

    Satellite images showing the construction of sites in Gaza that are expected to be used as aid distribution centres also suggest they will be close to Israeli military bases. While private security contractors will secure the distribution sites, the mere presence of military forces so close by may make people hesitant to approach for fear of being targeted.

    UN agencies and other humanitarian organisations have refused to participate in the proposed plan. Any involvement with a plan that is allegedly aligned with Israel’s military strategy could undermine the ability of the UN to play a meaningful humanitarian role in Gaza in the future. And it would also be seen as an endorsement of the militarisation of aid delivery around the world.

    As humanitarian experts point out, there is already an established system for providing aid to Gaza. Humanitarian organisations have the people, distribution networks and the necessary goods – 160,000 pallets full of them – in place. Almost 9,000 aid trucks are ready to be dispatched across the border as soon as Israel allows it.

    During the ceasefire earlier in 2025, UN agencies and humanitarian organisations demonstrated how quickly they could scale-up a predictable and accountable delivery of aid to those in need all across Gaza. This can be done again.

    The authors do not work for, consult, own shares in or receive funding from any company or organisation that would benefit from this article, and have disclosed no relevant affiliations beyond their academic appointment.

    ref. Israel allows a ‘limited’ amount of aid back into Gaza, where the humanitarian situation is desperate – https://theconversation.com/israel-allows-a-limited-amount-of-aid-back-into-gaza-where-the-humanitarian-situation-is-desperate-257137

    MIL OSI – Global Reports

  • MIL-OSI Global: A Leopard-Skin Hat by Anne Serre explores what its like being human in relation to other human beings

    Source: The Conversation – UK – By Leigh Wilson, Professor of English Literature, University of Westminster

    The French writer Anne Serre has been very clear in interviews that she has no truck with a type of fiction that is fashionable in the UK at the moment. Readers drawn to fiction that blurs the line with autobiography – what Serre calls “the story of someone’s life, or of an episode in that life, passing itself off as a novel” – are, in her view, being “sold a lemon”.

    She is clear, too, about her reason: “The whole point of a novel should be that we don’t know who is speaking.” This seemingly simple claim undoes so much new fiction in English – fiction as memoir, fiction in the first person, autofiction in which you always know who is speaking.

    This feeling of Serre’s also underpins and invigorates A Leopard-Skin Hat, her fourth work, which has been translated by Mark Hutchinson and was nominated for the International Booker prize.

    Published in France in 2008 as Un chapeau léopard, A Leopard-Skin Hat is a novel about a friendship between its protagonists, a woman called Fanny and a man known throughout only as “the Narrator”. However, while he is a writer, he is not the narrator of this novel.


    Looking for something good? Cut through the noise with a carefully curated selection of the latest releases, live events and exhibitions, straight to your inbox every fortnight, on Fridays. Sign up here.


    The narrator of A Leopard-Skin Hat is not named, although they do sometimes refer to themselves as “I”. Other than this, they are a mystery. What they tell us, though, is the story of Fanny and the Narrator’s friendship over 20 years, years during which the Narrator sees Fanny gradually lose the fight against madness (the novel’s word) and, in the end, death.

    We know early on that Fanny will die at the age of 43, that isn’t a mystery, but what the novel centres on is how mysterious others are to us, and how we narrate to try to understand people who are not us, but whom we love.

    What is most extraordinary about Serre’s novel is the way it shows us two friends doing very ordinary things – going out for dinner, going on holiday, walking in the countryside and swimming in lakes – but shows us through this the strangeness and complexity of friendship, love and of life.

    It’s not just the mysterious narrator, though, that distinguishes Serre’s novel from so many of the orthodoxies of contemporary fiction in English. Against the advice of every creative writing course, A Leopord-Skin Hat tells rather than shows.

    It is largely written in the tense that in English is known as the past habitual, which uses the conditional or a description of what used to happen. What the narrator tells us is hardly ever rooted in “scenes”, where we enter into the present of the world of the novel and listen to characters talking to each other. Describing Fanny’s pilfering of the titular leopard-skin hat, for example, we are told: “She would tell you about the theft with the amused and somewhat shamefaced air of a little girl and, were she to put on the hat, would resemble the woman she might have been”.

    There is no dialogue in the novel until the last two pages. Its use of the past habitual and the almost absence of dialogue could make for a coolness or a lack of emotional engagement, but its effect is the opposite.

    The narrative position is not tricksy. Actually, the best writing that experiments with narrative position – from Virginia Woolf, through W.G. Sebald to Lucy Ellman’s Ducks, Newburyport – does so in order to represent as faithfully as possible what it is like to be a human being in relation to other human beings. At the centre of such experiments is the question, how can we know other people?

    While Fanny’s death is the melancholy heart of the novel, in its final, amazing chapter – which switches from the past habitual to the present tense – the narrator recounts Fanny’s experiences after death, as the narrator character cannot, and as only the unknown narrators of novels can. As she ascends into the sky, Fanny becomes Fanny:

    Here she is, then, continuing her ascent, her hand still on her head, her blue eyes wide open and inhabited at last. Inhabited by someone who nobody ever saw on earth, I can assure you. Someone not unlike the woman in the leopard-skin hat, only better; less mysterious, fully present from head to toe. For the first time in I don’t know how long, Fanny is once again the woman she used to be.

    The unknown narrators of novels can tell us who other people really are; we can never know that ourselves. All we can do is read novels and love those other people anyway.

    Leigh Wilson does not work for, consult, own shares in or receive funding from any company or organisation that would benefit from this article, and has disclosed no relevant affiliations beyond their academic appointment.

    ref. A Leopard-Skin Hat by Anne Serre explores what its like being human in relation to other human beings – https://theconversation.com/a-leopard-skin-hat-by-anne-serre-explores-what-its-like-being-human-in-relation-to-other-human-beings-257167

    MIL OSI – Global Reports

  • MIL-OSI Global: How the UK-EU deal turns the page on Brexit – and what happens next

    Source: The Conversation – UK – By Magdalena Frennhoff Larsén, Associate Professor in Politics and International Relations, University of Westminster

    At their first bilateral summit since Brexit, UK and EU leaders set out a range of areas they will seek to forge closer ties. European Council President António Costa, European Commission President Ursula von der Leyen and British Prime Minister Keir Starmer hailed the agreement as a historic landmark deal that opens a new chapter in the EU-UK relationship.

    But it is only the beginning of – potentially long – negotiations to thrash out the details of closer cooperation in areas like trade, youth mobility and energy.

    As the two parties sit down at the negotiating table, they will, for the first time since Brexit, agree on how to make trade and cooperation easier. For example, one anticipated agreement will align UK food safety and animal health standards with those of the EU, thereby removing the need for most border checks and ease the flow of agriculture and food products between the two parties. And the expected youth mobility scheme will allow young people to travel, work and study in the EU and the UK for a limited period of time.


    Want more politics coverage from academic experts? Every week, we bring you informed analysis of developments in government and fact check the claims being made.

    Sign up for our weekly politics newsletter, delivered every Friday.


    The looming negotiations will be relatively narrow in scope. The Withdrawal Agreement and the Trade and Cooperation Agreement still provide the basis for the EU-UK relationship. The UK is not compromising on its red lines of not joining the single market, the customs union or allowing free movement of people.

    The negotiations will consequently not fundamentally alter the current relationship. While the impact of the agreements may be significant for specific sectors, the overall economic impact is expected to be relatively modest.

    This is not to say that the upcoming negotiations will be easy or void of controversies. Over the next months, negotiators will have to agree on quotas, time limits, exceptions and financial contributions. Compromises and trade-offs will have to be found.

    There will be domestic resistance on both sides. Concerns have already emerged that France might oppose the participation of British defence companies in EU defence procurement programmes.

    And in the UK, critics argue that the decision to dynamically align UK rules and standards with those of the EU in certain sectors will make the country a rule-taker once again.

    But the answer to the question on many people’s minds: “Will this bring us back to all those years of difficult and protracted Brexit negotiations?” is no – this time around, things are different.

    In comparison with the Brexit negotiations, these negotiations should be far easier and swifter. They are less consequential and backed by strong political will from both sides.

    Recent polling indicates that both Britons and EU citizens favour a closer relationship between the UK and the EU.

    The agreement reached at the summit is seen as the first concrete manifestation of Starmer’s long sought-after reset of the relationship.

    Moving on

    The Brexit negotiations focused on establishing less cooperation compared with when the UK was a member of the EU. It was a question of addressing increasing barriers to trade and cooperation – something many perceived as a lose-lose situation. The upcoming negotiations, on the other hand, are seen to lead towards a win-win reset of relations. The parties enter the negotiations with a mindset of finding solutions that increase trade and facilitate cooperation.

    The UK is now negotiating as an independent, sovereign country. During the Brexit negotiations the UK was an EU member (or a closely aligned former member in the case of the negotiations of the Trade and Cooperation Agreement).

    It was thus important for the EU to make the benefits of membership clear and to discourage other members from leaving. As a result, it drove a hard bargain and the UK had limited influence on the negotiations.

    However, unlike the UK – where Brexit has never fully disappeared from the political debate – the EU moved on quickly after Brexit. In Brussels, many now consider the UK an independent but like-minded strategic partner.

    This is seen not least in the area of security, where the two parties agreed on a security and defence partnership. They set out a framework for closer cooperation in areas of joint interest, such as sanctions, information sharing and cybersecurity, and allowing them to better respond to shared global challenges and uncertainties.

    Zooming out, the geopolitical picture has changed dramatically since the Brexit negotiations. With the war in Ukraine and the resulting instability in Europe, combined with the shifting priorities of US foreign policy, there is now an even greater need for EU-UK cooperation.

    Magdalena Frennhoff Larsén does not work for, consult, own shares in or receive funding from any company or organisation that would benefit from this article, and has disclosed no relevant affiliations beyond their academic appointment.

    ref. How the UK-EU deal turns the page on Brexit – and what happens next – https://theconversation.com/how-the-uk-eu-deal-turns-the-page-on-brexit-and-what-happens-next-257158

    MIL OSI – Global Reports

  • MIL-OSI China: MOFA sincerely appreciates international support for Taiwan’s bid to participate in WHO and WHA

    Source: Republic of Taiwan – Ministry of Foreign Affairs

    May 19, 2025  

    No. 163  

    The 78th World Health Assembly (WHA) is opening in Geneva on May 19. Following proactive efforts by the Ministry of Foreign Affairs (MOFA) and related overseas missions, Taiwan’s bid to participate in the WHA has received staunch and concrete support from the Group of Seven (G7), the executive and legislative branches of government of more than 50 countries, the European Union, the European Parliament, and representative offices of like-minded nations in Taiwan. MOFA expresses sincere appreciation for this support.

     

    Eleven of Taiwan’s diplomatic allies, as members of the World Health Organization (WHO), submitted a proposal to the WHO Secretariat to invite Taiwan to participate in the WHA as an observer, requesting that the proposal be included as a supplementary item on this year’s WHA agenda. Saint Lucia Prime Minister Philip J. Pierre personally wrote a letter urging WHO Director-General Tedros Adhanom Ghebreyesus to invite Taiwan to attend the WHA. The parliaments of Guatemala, Palau, and Saint Christopher and Nevis adopted resolutions backing Taiwan.

     

    The magnitude of support for Taiwan from like-minded countries has continued to grow. The current US administration has publicly endorsed Taiwan’s international participation more than 10 times. This includes a joint statement issued at the US-Japan leaders’ summit by President Donald Trump and Prime Minister Shigeru Ishiba in February, which for the first time contained text advocating Taiwan’s meaningful involvement in international organizations. US Secretary of State Marco Rubio reaffirmed firm US support for Taiwan’s international participation during his congressional confirmation hearing as well as in interviews and joint statements issued at two meetings with the foreign ministers of Japan and the Republic of Korea. The United States twice spoke up for Taiwan at the WHO Executive Board session held in February. In April, it publicly refuted China’s misuse of United Nations General Assembly (UNGA) Resolution 2758 at the UN Security Council for the first time, reiterating that the resolution did not preclude Taiwan’s participation in the UN system or other multilateral fora. In terms of US congressional support, the House of Representatives passed the Taiwan International Solidarity Act without opposition on May 5. The act urged the US government to resist China’s efforts to suppress Taiwan through mischaracterization of UNGA Resolution 2758. In addition, nine US state legislatures approved resolutions backing Taiwan’s involvement in international organizations.

     

    Furthermore, in a joint statement issued following a meeting in March, the G7 foreign ministers reaffirmed support for Taiwan’s meaningful participation in international organizations. On May 15, the European Union expressed a similar stance and recognized the extraordinary contributions Taiwan can make through its digital healthcare capabilities. In February, the European Parliament overwhelmingly adopted a resolution on the implementation of the EU Common Foreign and Security Policy, which backed Taiwan’s meaningful participation in relevant world bodies. 

    High-ranking European officials who publicly spoke up for Taiwan included Italian Deputy Prime Minister and Minister of Foreign Affairs Antonio Tajani, Irish Deputy Prime Minister and Minister for Foreign Affairs and Trade Simon Harris, Australian Minister for Foreign Affairs Penny Wong, Swedish Minister for Foreign Affairs Maria Malmer Stenergard, and Swedish Minister for Social Affairs and Public Health Jakob Forssmed. A total of 534 members of the European Parliament and 29 national parliaments across Europe cosigned a letter of the Formosa Club reaffirming support for Taiwan. The World Medical Association and other professional groups endorsed Taiwan’s participation in WHO and the WHA as they had done in the past.

     

    MOFA thanks the representative offices in Taiwan of the United Kingdom, France, Australia, Canada, the Czech Republic, Germany, Japan, and Lithuania for issuing a joint statement for the fifth year prior to the WHA affirming the immense benefits that Taiwan could bring to WHA discussions. The statement also emphasized that there was no legitimate reason for Taiwan’s exclusion from the WHA and that Taiwan’s absence would undermine the spirit of inclusive global public health cooperation and safety that WHO’s founding documents called for.

     

    MOFA points out that these positive developments fully demonstrate that China’s unreasonable obstruction of Taiwan’s participation in WHO has gained little traction or support among nations worldwide. MOFA reiterates that UNGA Resolution 2758 and WHA Resolution 25.1 make no mention of Taiwan, have nothing to do with Taiwan, and therefore cannot be cited as a legal basis for precluding Taiwan from participating in WHO or other international organizations or multilateral mechanisms or fora. MOFA asks that the WHO Secretariat listen closely to member countries, stop further condoning political manipulation by China, and instead work to realize WHO’s goals of “Leaving No One Behind” and “One World for Health” so as to fulfill its responsibility to maintain and improve the health and well-being of all people. MOFA also asks that Taiwan be allowed full and unobstructed participation in all WHO meetings, mechanisms, and activities, including the WHA. (E)

    MIL OSI China News

  • MIL-OSI: TSplus Releases Remote Support Android V4: Smarter, Broader, and Now Compatible with Android TV

    Source: GlobeNewswire (MIL-OSI)

    LYON, France, May 21, 2025 (GLOBE NEWSWIRE) — TSplus is proud to announce the release of version 4 of its Remote Support app for Android. This major update marks a new step in the continuous evolution of the product, bringing increased compatibility, refined performance, and broader usability. As part of TSplus ongoing commitment to accessible, powerful remote assistance tools, this version introduces full support for Android TVs — opening the door to exciting new use cases in both home and professional environments.

    Constant Improvements Make Remote Support for Android a Versatile Product

    Since the start of the year, TSplus has consistently delivered improvements to its Remote Support Android application. With each update, the app has grown in performance, compatibility, and usability. Now, with the release of Version 4, a major milestone has been reached: full support for Android TVs.

    This latest version expands device compatibility to include arm32 and x86 architectures, adding over 2,300 new models and bringing the total supported Android devices to 22,720 (source: Google Play Store). These two architectures are commonly found in Android TV-based devices thanks to their affordability and broad adoption in commercial hardware.

    In France, for instance, Free’s Freebox Player Pop — a popular Triple Play AndroidTV box — now runs the Remote Support app seamlessly. This enhancement marks a key step forward in TSplus’ mission to make remote assistance accessible everywhere, even in living rooms and on public-facing digital signage.

    Remote Support for Android: A Game-Changer for IT Maintenance and Remote Assistance

    With the new Android TV compatibility, Remote Support for Android V4 unlocks powerful new use cases:

    • Home or Office: Use Viewer mode to support others or cast a PowerPoint presentation from PC to TV when HDMI isn’t available.
    • Retail & Fast Food: Troubleshoot self-service ordering kiosks at restaurants like McDonald’s.
    • Public Transport: Remotely access ticket machines or schedule display boards in train, tram, and bus stations.
    • Airports: Provide support to digital signage and interactive displays.
    • Cinema & Events: Maintain or configure ticket ordering stations.
    • And more!

    The Sharer mode allows users to securely share their screen and receive help from a remote technician, even without a touchscreen. Meanwhile, Viewer mode lets support agents control Android sessions directly — all while ensuring a smooth and intuitive user experience on devices not traditionally designed for remote control.

    With improved navigation for AndroidTV, optimized network usage, and support for D-PAD and global action commands, this update brings meaningful upgrades for technicians and users alike.

    TSplus invites users to download the latest version of Remote Support Android directly from the Google Play Store.

    For IT professionals and helpdesk teams, this update opens new doors to efficient, secure remote support — wherever Android is running!

    Press Contact: Caleb Zaharris Marketing Director caleb.zaharris@tsplus.net

    Photos accompanying this announcement are available at
    https://www.globenewswire.com/NewsRoom/AttachmentNg/51b4bf7f-a371-4ce3-939c-bd59d38aa9b1

    https://www.globenewswire.com/NewsRoom/AttachmentNg/6f55f588-02bc-41ed-89f2-510ac0e7dc41

    The MIL Network

  • MIL-OSI USA: Jayapal, Sanders, Colleagues Introduce Bill to Make Public Colleges and Universities Tuition Free

    Source: United States House of Representatives – Congresswoman Pramila Jayapal (7th District of Washington)

    WASHINGTON, DC – As President Trump and congressional Republicans are working overtime to make college unaffordable and unattainable for millions of working-class families in order to provide tax breaks to billionaires, Rep. Pramila Jayapal (D-Wash.) and Sen. Bernie Sanders (I-Vt.), Ranking Member of the Senate Committee on Health, Education, Labor, and Pensions (HELP), today introduced legislation to make public colleges and universities tuition free for 95% of students. The College for All Act would be the most transformative investment in higher education in 60 years and would substantially improve the lives of millions of students throughout the United States.

    “Congress can and must ensure that working families never have to take out crushing loans to purse an education,” said Jayapal. “The College for All Act will free students from a lifetime of debt, invest in working people, and transform higher education across America by making a degree more accessible to poor and working families across this country. This is more important now than ever as Trump continues to attack education in this country through attempts to strip funding from universities and to dismantle the Department of Education.”

    “In a highly competitive global economy where technology is changing the very nature of work and the jobs we perform, we need the best educated workforce in the world,” said Sanders. “Our nation used to lead the world in the percentage of adults with a college degree. Today, we are in 11th place behind countries like Japan, South Korea, Canada, the United Kingdom and Switzerland. That is not a prescription for a strong American economy of the future. It is a prescription for failure. Instead of increasing the cost of college in order to give more tax breaks to billionaires, we have a better idea. We are going to make public colleges and universities tuition free so that working class students can succeed and are not burdened with a lifetime of debt.”

    Making public colleges and universities tuition free is not a radical idea. In 1944, as World War II was coming to an end, the U.S. government made free higher education available to all those who served in the armed forces. That act not only improved the financial well-being of the Greatest Generation, but it also laid the groundwork for the greatest expansion of the American middle class in U.S history. Moreover, over 50 years ago, many of our most prestigious public colleges and universities were also tuition free or virtually tuition free.

    Since this legislation was first introduced ten years ago, several colleges and universities in America have provided free tuition for working class and middle class students including every state college in New Mexico, the State University of New York, the University of Texas, the University of Wisconsin, and Arkansas State University.

    Other wealthy countries like France, Germany, Denmark, Sweden, Norway and Finland have made their public colleges and universities tuition free or virtually tuition free because they understand the value of investing in their young people.

    The College for All Act would guarantee tuition-free community college for all students and allow students from single households earning up to $150,000 a year, and married households earning up to $300,000 a year, to attend college without fear of being saddled with student loan debt.

    The College for All Act would also:

    • Double the maximum Pell Grant award for students enrolled at public and private non-profit colleges;
    • Establish a $10 billion grant program to improve student outcomes and address equity gaps at underfunded public colleges and universities;
    • Triple federal TRIO program funding;
    • Double GEAR UP funding; and
    • Double mandatory funding for Historically Black Colleges and Universities, Tribal Colleges and Universities (HBCUs), and other Minority-Serving Institutions (MSIs).

    Read the bill text here.

    Read a summary of the bill here.

    Issues: Arts & Education

    MIL OSI USA News

  • MIL-OSI: Sidetrade introduces first-ever AI Cash Collection Agent, autonomous and interactive

    Source: GlobeNewswire (MIL-OSI)

    New AI-native agent shifts Order-to-Cash from smart automation to autonomous execution, live today throughout global finance teams

    Sidetrade, the global leader in AI-powered Order-to-Cash applications, has today unveiled a seismic breakthrough in enterprise finance; the world’s first-ever AI Cash Collection Agent, operating live and autonomously from a digital standpoint.

    Powered by Sidetrade’s Data Lake, the new Aimie orchestrates Order-to-Cash (O2C) processes, executing phone calls, interacting with debtor clients, escalating and flagging issues or exceptions for human follow-up actions where necessary. Announced at the Gartner CFO & Finance Executive Conference today, this launch marks a decisive leap beyond automation.

    Ushering in a new era for CFOs, Global Business Services, and Shared Services
    In the current economic climate, traditional financial systems, rule-based automation, large teams handling low-value calls, and follow-up email campaigns have all revealed their limitations. The race for competitiveness is not just won with automation. It is also won with speed, precision, and the ability to make sense of vast and fragmented data. Chief Financial Officers (CFOs), Global Business Services, and Shared Services leaders must accelerate cash flow generation, reduce operational overheads, and scale faster.

    Aimie is now agentic. Designed as an enterprise teammate, her first capability is being an autonomous Cash Collection Agent, trained on $7.2 trillion in payment experiences and insights from 40 million buyers worldwide. “Simply put, Aimie does not wait for instructions,” said Rob Harvey, Chief Product Officer at Sidetrade. “Aimie does much more than merely follow a script; she makes decisions. That’s the real breakthrough. Agentic AI propels Order-to-Cash processes beyond automation into autonomous decision-making, unlocking new levers for sustainable financial performance. By combining human oversight with self-directed agents, we are creating an opening for more adaptive, scalable finance operations, where manual processes do not hold back growth.”

    Aimie’s Cash Collection Agent is ready for deployment across Europe and North America:

    • Autonomous outbound calling (first contact calls, follow-up calls, voicemail messages) with personalized dialogues suited to every situation;
    • Outcome qualification with automatic case updates;
    • Escalation when a material risk is detected.

    Unlike static bots, Aimie continuously learns from live outcomes, adjusts outreach strategies, and refines prioritization using predictive signals from Sidetrade’s Data Lake.

    Championing consistency to elevate performance
    Early adopters are already experiencing real-world impact. “What I love most about Aimie isn’t the cost savings; it’s her consistency,” said Stephen Dyer, VP Credit & Collections at OpenText. “I manage 100+ collectors globally, and inconsistency is inevitable. Aimie guaranteed precise, repeatable execution which is a game-changer! She also helps to reshape the modern customer 360, enabling us to move past traditional customer experiences toward a data-driven, personalized relationship that can be replicated at scale.”

    Aimie empowers Sidetrade customers with distinctive capabilities:

    • Rapidly learning a company’s culture, products, and terminology, adapting communication in a way that feels native to their brand.
    • Engaging in interactive, qualified conversations with thousands of buyers at scale, acting as a fully-fledged game-changer for managing massive SMB account portfolios, at low cost.
    • Speaking up to 29 languages: allowing for seamless cash collection in local languages and contexts.
    • Making 1,000 outbound calls daily, operating 24/5.
    • Accelerating cash flow by scaling the most effective channel in collections: outbound calling.

    Aimie takes on the high-volume, low-value tasks that drain finance teams, automating repetitive work with consistency, wherever the geography. The results? Reduced administrative burden on accounts receivable, so talent can refocus on strategic impact. Speaking with early adopters, Harvey commented: “They are not worried about a robot taking their job… because most of them already feel like they are doing the robot’s job. Moreover, they are aware that if we fail to design an AI co-worker, tomorrow’s finance will feel less human as they will be stuck talking to accounts payable robots instead of solving real strategic problems.”

    Building on CFOs economic environment
    Aimie’s unique advantage is Sidetrade’s Data Lake, which manages 10 payment events per second across one billion transactions, making it the largest real-time O2C behavioral database in the market. “Aimie’s intelligence comes from context-rich data, not just clever LLM’s,” said Mark Sheldon, Sidetrade’s Chief Technology Officer. “Generic AI systems lack the contextual data needed to operate as domain experts. But Aimie does. With $7.2 trillion in behavioral payment signals, Aimie adapts with pinpoint precision, and she keeps learning. Finance departments gain access to a new resource: tireless and infinitely scalable.”

    Sidetrade has been training finance-specific models since 2015, with generative capabilities added in 2024. The AI Cash Collection Agent is part of a broader rollout of Sidetrade’s new agentic AI, which includes purpose-built agentic functionalities for email auto-response, portal data extraction, and cash application exception handling. As an AI orchestrator, Aimie coordinates a team of domain-specific agents to run the O2C cycle autonomously. “AI goes agentic,” stated Harvey. “Each agent operates independently to process thousands of customer emails and payments per day. Together, they represent a step-change in how finance teams execute their O2C processes.”

    Sheldon concluded: “Short-term, what companies need to define is the level of autonomy they are willing to delegate to agents, the role human oversight should play, and how best to optimize their resources in this new paradigm. Rather than giving in to fears around agentic AI or human replaceability, I encourage business leaders to rethink the role of people within organizations that fully harness this technological shift. The most forward-thinking leaders already augment operational efficiency while repositioning their teams toward higher-value, strategic work.”

    Aimie, Sidetrade’s AI Cash Collection Agent, is now available for early adopters. Meet Aimie, here.

    Media relations @Sidetrade
    Christelle Dhrif                +33 6 10 46 72 00          cdhrif@sidetrade.com
    About Sidetrade (www.sidetrade.com)
    Sidetrade (Euronext Growth: ALBFR.PA) provides a SaaS platform designed to revolutionize how cash flow is secured and accelerated. Leveraging its new-generation agentic AI, nicknamed Aimie, Sidetrade analyzes $7.2 trillion worth of B2B payment transactions daily in its Cloud, thereby anticipating customer payment behavior and the attrition risk of 40 million buyers worldwide. Sidetrade has a global reach, with 400+ talented employees based in Europe, the United States, and Canada, serving global businesses in more than 85 countries. Among them: AGFA, BMW Financial Services, Bunzl, DXC, Engie, Inmarsat, KPMG, Lafarge, Manpower, Morningstar, Page, Randstad, Safran, Saint-Gobain, Securitas, Siemens, UGI, Veolia.
    For further information, visit us at www.sidetrade.com and follow @Sidetrade on LinkedIn.
    In the event of any discrepancy between the French and English versions of this press release, only the English version is to be taken into account.

    Attachment

    The MIL Network

  • MIL-OSI: Credit Agricole Sa: The Crelan Group and Crédit Agricole announce the signing of an agreement for a long-term partnership

    Source: GlobeNewswire (MIL-OSI)

    Press release

    Brussels, Montrouge, 21 May 2025

    The Crelan Group and Crédit Agricole
    announce the signing of an agreement
    for a long-term partnership

    • The Crelan Group and the Crédit Agricole Group have announced a new strategic partnership that will enable Crelan’s customers to benefit from a wider range of banking products and services.
    • This agreement will allow Crelan to ramp up its commercial development and organic growth, and Crédit Agricole to ensure the development of its business lines in Belgium.

    What does the agreement entail?

    The partnership, which entails the Crédit Agricole Group obtaining a minority stake of 9.9% in Crelan, includes commercial collaborations in the areas of asset management (with Amundi), private banking and wealth management (with Indosuez Wealth Management/Bank Degroof Petercam) and leasing (with CA Leasing & Factoring).

    Crelan and the Crédit Agricole Group also intend to establish other joint commercial initiatives in the near future.

    “Crelan and Crédit Agricole share the same vision and approach to cooperative banking. By sharing our expertise, we will become stronger and offer a wider range of high-quality banking services. Our shared cooperative DNA will be what cements our partnership, for the benefit of our customers, our cooperators and society as a whole.” Philippe Voisin, CEO of Crelan.

    We are thrilled to be supporting Crelan – a major Belgian cooperative bank – in its development objectives, through the recognised expertise of our asset management, wealth management and leasing businesses.” Olivier Gavalda, Chief Executive Officer of Crédit Agricole S.A.

    “Through this partnership with Crédit Agricole, we will be able to broaden our range of services for our individual customers. But it will also allow us to renew our long-term commitment to self-employed individuals and SMEs with tailored financing solutions.Joris Cnockaert, CCO of Crelan.

    What will change for Crelan?

    Crelan is a cooperative bank firmly established in Belgium. The entirety of the deposits will remain invested in Belgium. The network of independent agents will continue to ensure proximity to customers. In addition, by joining forces with Crédit Agricole, Crelan will fully preserve its cooperative model and its founding values, thereby guaranteeing its commitment to its cooperative shareholders.

    What are the financial implications?

    The conclusion of commercial agreements will have a positive impact on the revenues of both groups.
    This minority stake will have a positive financial impact of around 2% on Crelan’s consolidated 2025 transitional CET1 capital ratio and a non-material impact on the Crédit Agricole Group’s CET1 ratio.

    The Crelan Group and Crédit Agricole plan to finalise the partnership agreement in the coming months, subject to final negotiations.

    About the Crelan Group
    The financial group ranks fifth among Belgian retail banks in terms of total assets. The Crelan group is represented by two bank brands: Crelan and Europabank. At 31 December 2024, the Crelan group had: 4327 employees (including staff members, independent bank agents, and their employees), 727 branches, 296,751 cooperative shareholders, nearly 1.7 million customers, and €55.8 billion in total assets. In addition, the banking group manages €44.3 billion in customer deposits, €16.5 billion in off-balance sheet investments, and supports Belgian households and businesses with €49.5 billion in loans.

    About Crédit Agricole
    The Crédit Agricole Group is the leading financial provider of the French economy and one of the leading banking players in Europe. As European leader in retail banking, the Group is also the leading asset manager, bankinsurer and third-largest project financing institution.
    With its strong cooperative and mutualist foundations, 157,000 employees and 27,423 local and regional bank directors, the Crédit Agricole Group is a responsible and useful bank serving 54 million customers and 12.1 million members.
    Thanks to its universal customer-focused banking model – based on the close cooperation between its retail banks and their related businesses – the Crédit Agricole Group supports its customers in their projects in France and throughout the world: day-to-day banking, real estate and consumer loans, savings, insurance, asset management, real estate, leasing, factoring, and corporate and investment banking.
    Serving the economy, Crédit Agricole also stands out for its dynamic and innovative corporate social responsibility policy. It is based on a pragmatic approach that informs the entire Group and empowers every employee to take action.

      
    Crelan press contact

    Caroline Beauvois, Press & Corporate Communication Expert
    Tel: + 32 (0) 475 82 09 34
    Mail: press@crelan.be

    Crédit Agricole press contacts

    Olivier Tassain: olivier.tassain@credit-agricole-sa.fr – +33 6 75 90 26 66
    Alexandre Barat: alexandre.barat@credit-agricole-sa.fr – +33 6 19 73 60 28
    Bénédicte Gouvert: benedicte.gouvert@ca-fnca.fr – +33 1 49 53 43 64

    All our press releases can be found at: https://www.credit-agricole.com/en

    Attachment

    The MIL Network

  • MIL-OSI Asia-Pac: MOFA sincerely appreciates international support for Taiwan’s bid to participate in WHO and WHA

    Source: Republic of China Taiwan

    May 19, 2025  
    No. 163  

    The 78th World Health Assembly (WHA) is opening in Geneva on May 19. Following proactive efforts by the Ministry of Foreign Affairs (MOFA) and related overseas missions, Taiwan’s bid to participate in the WHA has received staunch and concrete support from the Group of Seven (G7), the executive and legislative branches of government of more than 50 countries, the European Union, the European Parliament, and representative offices of like-minded nations in Taiwan. MOFA expresses sincere appreciation for this support.
     
    Eleven of Taiwan’s diplomatic allies, as members of the World Health Organization (WHO), submitted a proposal to the WHO Secretariat to invite Taiwan to participate in the WHA as an observer, requesting that the proposal be included as a supplementary item on this year’s WHA agenda. Saint Lucia Prime Minister Philip J. Pierre personally wrote a letter urging WHO Director-General Tedros Adhanom Ghebreyesus to invite Taiwan to attend the WHA. The parliaments of Guatemala, Palau, and Saint Christopher and Nevis adopted resolutions backing Taiwan.
     
    The magnitude of support for Taiwan from like-minded countries has continued to grow. The current US administration has publicly endorsed Taiwan’s international participation more than 10 times. This includes a joint statement issued at the US-Japan leaders’ summit by President Donald Trump and Prime Minister Shigeru Ishiba in February, which for the first time contained text advocating Taiwan’s meaningful involvement in international organizations. US Secretary of State Marco Rubio reaffirmed firm US support for Taiwan’s international participation during his congressional confirmation hearing as well as in interviews and joint statements issued at two meetings with the foreign ministers of Japan and the Republic of Korea. The United States twice spoke up for Taiwan at the WHO Executive Board session held in February. In April, it publicly refuted China’s misuse of United Nations General Assembly (UNGA) Resolution 2758 at the UN Security Council for the first time, reiterating that the resolution did not preclude Taiwan’s participation in the UN system or other multilateral fora. In terms of US congressional support, the House of Representatives passed the Taiwan International Solidarity Act without opposition on May 5. The act urged the US government to resist China’s efforts to suppress Taiwan through mischaracterization of UNGA Resolution 2758. In addition, nine US state legislatures approved resolutions backing Taiwan’s involvement in international organizations.
     
    Furthermore, in a joint statement issued following a meeting in March, the G7 foreign ministers reaffirmed support for Taiwan’s meaningful participation in international organizations. On May 15, the European Union expressed a similar stance and recognized the extraordinary contributions Taiwan can make through its digital healthcare capabilities. In February, the European Parliament overwhelmingly adopted a resolution on the implementation of the EU Common Foreign and Security Policy, which backed Taiwan’s meaningful participation in relevant world bodies. 
    High-ranking European officials who publicly spoke up for Taiwan included Italian Deputy Prime Minister and Minister of Foreign Affairs Antonio Tajani, Irish Deputy Prime Minister and Minister for Foreign Affairs and Trade Simon Harris, Australian Minister for Foreign Affairs Penny Wong, Swedish Minister for Foreign Affairs Maria Malmer Stenergard, and Swedish Minister for Social Affairs and Public Health Jakob Forssmed. A total of 534 members of the European Parliament and 29 national parliaments across Europe cosigned a letter of the Formosa Club reaffirming support for Taiwan. The World Medical Association and other professional groups endorsed Taiwan’s participation in WHO and the WHA as they had done in the past.
     
    MOFA thanks the representative offices in Taiwan of the United Kingdom, France, Australia, Canada, the Czech Republic, Germany, Japan, and Lithuania for issuing a joint statement for the fifth year prior to the WHA affirming the immense benefits that Taiwan could bring to WHA discussions. The statement also emphasized that there was no legitimate reason for Taiwan’s exclusion from the WHA and that Taiwan’s absence would undermine the spirit of inclusive global public health cooperation and safety that WHO’s founding documents called for.
     
    MOFA points out that these positive developments fully demonstrate that China’s unreasonable obstruction of Taiwan’s participation in WHO has gained little traction or support among nations worldwide. MOFA reiterates that UNGA Resolution 2758 and WHA Resolution 25.1 make no mention of Taiwan, have nothing to do with Taiwan, and therefore cannot be cited as a legal basis for precluding Taiwan from participating in WHO or other international organizations or multilateral mechanisms or fora. MOFA asks that the WHO Secretariat listen closely to member countries, stop further condoning political manipulation by China, and instead work to realize WHO’s goals of “Leaving No One Behind” and “One World for Health” so as to fulfill its responsibility to maintain and improve the health and well-being of all people. MOFA also asks that Taiwan be allowed full and unobstructed participation in all WHO meetings, mechanisms, and activities, including the WHA. (E)

    MIL OSI Asia Pacific News

  • MIL-OSI USA: NEWS: Sanders, Jayapal, Colleagues Introduce Bill to Make Public Colleges and Universities Tuition Free

    US Senate News:

    Source: United States Senator for Vermont – Bernie Sanders
    WASHINGTON, May 21 – As President Trump and congressional Republicans are working overtime to make college unaffordable and unattainable for millions of working-class families in order to provide tax breaks to billionaires, Sen. Bernie Sanders (I-Vt.), Ranking Member of the Senate Committee on Health, Education, Labor, and Pensions (HELP), Rep. Pramila Jayapal (D-Wash.), and nine Senate colleagues, today introduced legislation to make public colleges and universities tuition free for 95% of students. The College for All Act would be the most transformative investment in higher education in 60 years and would substantially improve the lives of millions of students throughout the United States.
    Joining Sanders as cosponsors are Sens. Richard Blumenthal (D-Conn.), Alex Padilla (D-Calif.), Chris Murphy (D-Conn.), Peter Welch (D-Vt.), Elizabeth Warren (D-Mass.), Ed Markey (D-Mass.), Chris Van Hollen (D-Md.), Jeff Merkley (D-Ore.) and Cory Booker (D-N.J.).
    “In a highly competitive global economy where technology is changing the very nature of work and the jobs we perform, we need the best educated workforce in the world,” said Sanders. “Our nation used to lead the world in the percentage of adults with a college degree. Today, we are in 11th place behind countries like Japan, South Korea, Canada, the United Kingdom and Switzerland. That is not a prescription for a strong American economy of the future. It is a prescription for failure. Instead of increasing the cost of college in order to give more tax breaks to billionaires, we have a better idea. We are going to make public colleges and universities tuition free so that working class students can succeed and are not burdened with a lifetime of debt.”
    “Congress can and must ensure that working families never have to take out crushing loans to purse an education,” said Jayapal. “The College for All Act will free students from a lifetime of debt, invest in working people, and transform higher education across America by making a degree more accessible to poor and working families across this country. This is more important now than ever as Trump continues to attack education in this country through attempts to strip funding from universities and to dismantle the Department of Education.”
    Making public colleges and universities tuition free is not a radical idea. In 1944, as World War II was coming to an end, the U.S. government made free higher education available to all those who served in the armed forces. That act not only improved the financial well-being of the Greatest Generation, but it also laid the groundwork for the greatest expansion of the American middle class in U.S history. Moreover, over 50 years ago, many of our most prestigious public colleges and universities were also tuition free or virtually tuition free.
    Since this legislation was first introduced ten years ago, several colleges and universities in America have provided free tuition for working class and middle class students including every state college in New Mexico, the State University of New York, the University of Texas, the University of Wisconsin, and Arkansas State University.
    Other wealthy countries like France, Germany, Denmark, Sweden, Norway and Finland have made their public colleges and universities tuition free or virtually tuition free because they understand the value of investing in their young people.
    The College for All Act would guarantee tuition-free community college for all students and allow students from single households earning up to $150,000 a year, and married households earning up to $300,000 a year, to attend college without fear of being saddled with student loan debt.
    The College for All Act would also:
    Double the maximum Pell Grant award for students enrolled at public and private non-profit colleges;
    Establish a $10 billion grant program to improve student outcomes and address equity gaps at underfunded public colleges and universities;
    Triple federal TRIO program funding;
    Double GEAR UP funding; and
    Double mandatory funding for Historically Black Colleges and Universities, Tribal Colleges and Universities (HBCUs), and other Minority-Serving Institutions (MSIs).
    Read the bill text here.
    Read a summary of the bill here.

    MIL OSI USA News

  • MIL-OSI Europe: European Union – Foreign Affairs Council meeting of May 20 (21 May 2025)

    Source: France-Diplomatie – Ministry of Foreign Affairs and International Development

    France took part in the EU’s Foreign Affairs Council meeting in Brussels on May 20. This meeting focused on the situation in Ukraine and the Middle East.

    With regard to Ukraine, France welcomed the adoption of an ambitious sanctions package against Russia – the 17th – which must now be further strengthened, as that country is still refusing to negotiate a peace agreement. France is determined to continue current efforts to give Ukraine solid security guarantees.

    France reiterated its strong condemnation of the expansion of Israeli military operations in Gaza and its blockade against humanitarian aid, which violates the principles of international law. France stressed its strong concern over Israel’s settlement policy and underscored the need for an agreement by Member States on sanctions against violent settlers and entities that promote settlement activity. It also called on the EU to take concrete measures, including the reexamination of the association agreement between the EU and Israel, and commended the High Representative’s announcement in this regard at the end of the meeting. France reaffirmed its commitment to the two-State solution and noted its efforts to ensure its implementation at the conference it will co-chair with Saudi Arabia this June in New York.

    As for Syria, France supported the decision to lift economic sanctions against the country. This historic decision is the concrete expression of the commitments France made to the transition authorities with a view to supporting Syria’s economic recovery and transition process. France also emphasized that the easing of sanctions should go hand in hand with solid guarantees on transparency, the proper use of international funds and respect for our political conditions. The EU will have to continue ensuring that priority challenges are taken into account, especially the fight against terrorism. At France’s initiative, the EU member States also pledged to adopt sanctions against the perpetrators of human rights violations committed in Syria since the fall of Bashar al-Assad.

    MIL OSI Europe News

  • MIL-OSI Global: Eldest daughters often carry the heaviest burdens – insights from Madagascar

    Source: The Conversation – Africa – By Claire Ricard, Research Fellow at CERDI, Université Clermont Auvergne (UCA)

    In recent years, the term “eldest daughter syndrome” has gained traction on social media, as many firstborn daughters share how they had to grow up faster. They often took on caregiving and supportive roles in their families.

    In high-income countries, research shows that these responsibilities often bring long-term benefits. Firstborn daughters – and sons – tend to have higher educational attainment and stronger cognitive skills. They also enjoy better job prospects and salaries.

    Some studies in low- and middle-income countries have found similar positive effects of being the eldest. But others have found the opposite.

    In low-income contexts, economic constraints, cultural practices – such as the involvement of extended families in child-rearing – and inheritance norms may produce very different effects.

    Our research brings new insights by examining these dynamics in Madagascar. It is one of the world’s poorest countries. Birth order there strongly shapes the transition to adulthood, especially for firstborn children.

    Progress in understanding birth order effects in low-income countries is held back by the lack of detailed, sibling-level data. Our study used a dataset that followed individuals from the ages of 10 to 22, capturing their transition from adolescence to adulthood. It collected detailed information on education, work, health, marriage, and migration. The dataset also captured key demographic and educational details for all living full siblings of each respondent.

    We found that firstborns in Madagascar transition into adulthood earlier than their younger siblings. They are more likely to leave school early. They enter the workforce sooner and marry at younger ages. For example, fourth-born children are 1.5 percentage points less likely than firstborns to have never attended school, and 1.1 percentage points more likely to complete post-secondary education.
    Or, third-borns are 23% less likely to marry at age 19 than firstborns.

    Our findings suggest that later-born children benefit from greater parental investment in education. This leads to better schooling outcomes and delayed entry into the labour market.

    Birth order and the transition to adulthood

    In Madagascar, early marriage can be a way for families to ease financial pressure. This is especially true since daughters typically join their husband’s household.

    When it comes to marriage, we find that later-born children are less likely to marry early than their firstborn siblings – especially after age 17. This trend holds for both boys and girls. The difference appears earlier for girls, which aligns with their younger average age at marriage.

    Interestingly, second-born girls are not significantly less likely to marry than their older sisters. This suggests that the eldest daughter does not always bear the full brunt of early marriage risk.
    Firstborn daughters often take on caregiving and household roles. These responsibilities may delay their marriage slightly, as families rely on them for day-to-day support.

    What explains these birth order effects?

    We did not observe significant differences in cognitive skills (like reasoning) or non-cognitive traits (like personality) between firstborns and their younger siblings. Cognitive abilities were assessed through oral and written math and French tests administered at home. These findings contrast with evidence from wealthier countries, where firstborns often outperform their siblings in both cognitive and non-cognitive domains. This may result from greater early parental investment.

    In Madagascar, child development may rely less on direct parental input and more on interactions within the extended family. This is consistent with the concept of fihavanana, a cultural principle that emphasises solidarity and mutual support within the extended family.
    Rather than benefiting mostly from parental quality time, children – especially later-borns – may develop their cognitive and non-cognitive skills through broader social networks. These include relatives and older siblings.

    We also explored whether gender preferences might help explain the differences in outcomes. For instance, if later-born children were disproportionately boys, it could suggest that parents continued having children in hopes of having a son. This could lead to more resources being allocated to that later-born boy. However, our data show an even distribution of boys and girls among later-born children. This suggests that gender-based stopping rules are unlikely to explain the patterns we observe.

    Instead, our findings point to economic constraints as the main driver for firstborns transitioning into adulthood earlier than their younger siblings.

    In poorer households, particularly in rural areas, firstborn children are often asked to help out financially. This often comes at the cost of their own education. Later-born children, by contrast, receive more investment in their schooling. This may compensate for their limited access to other resources, such as land.

    We find no birth order advantage in wealthier households or among families where parents have some education. This again highlights poverty as a key factor shaping these patterns.

    The double burden of being firstborn

    To sum up, our research shows that, in Madagascar, both male and female firstborns face an earlier transition into adulthood. They leave school and enter the labour market sooner. They marry earlier, although firstborn girls may be at slightly lower risk of early marriage than their younger sisters.

    This suggests that, in poor countries, the eldest daughter syndrome is not just about emotional and care-giving responsibilities. It may also come with fewer educational opportunities, greater economic pressure, and an earlier end to childhood. A true double burden for disadvantaged girls. Economic constraints within households largely explain this pattern.

    But the story is not only one of constraint. The absence of differences in cognitive and non-cognitive skills suggests that broader community ties, rooted in fihavanana and extended kinship networks, help cushion the impact of early responsibility. These collective structures may not erase inequality, but they offer a vital source of resilience.

    As policymakers and practitioners look for ways to promote educational equity, it’s worth remembering that some of the most overlooked trade-offs happen within households. Reducing the weight of those trade-offs – through financial support, community-based programmes, or school retention efforts – could help ensure that the future of one child doesn’t come at the expense of another.

    Claire Ricard receives funding from the program “Investissements d’avenir” (ANR-10-LABX-14-01). She’s affiliated to Université Clermont Auvergne, CNRS, IRD, CERDI, F-63000, Clermont-Ferrand and works as an Economist at IDinsight, Rabat, Morocco.

    Francesca Marchetta receives funding from the program “Investissements d’avenir” (ANR-10-LABX-14-01).
    She’s affiliated to Université Clermont Auvergne, CNRS, IRD, CERDI, F-63000, Clermont-Ferrand and with PEP (Partnership for Economic Policy).

    ref. Eldest daughters often carry the heaviest burdens – insights from Madagascar – https://theconversation.com/eldest-daughters-often-carry-the-heaviest-burdens-insights-from-madagascar-255785

    MIL OSI – Global Reports

  • MIL-OSI Global: Why was St-Pierre-Miquelon targeted by both Donald Trump and a French politician?

    Source: The Conversation – Canada – By Paco Milhiet, Visiting fellow au sein de la Rajaratnam School of International Studies ( NTU-Singapour), chercheur associé à l’Institut catholique de Paris, Institut catholique de Paris (ICP)

    St-Pierre-Miquelon is a small French archipelago off the coast of Newfoundland in the northwestern Atlantic Ocean.

    A map of St-Pierre-Miquelon and its exclusive economic zone.
    (Eric Gaba)

    The territory is just 244 square kilometres with a population of only 5,800. Nonetheless, it’s recently been in the global spotlight due to its inclusion in a wave of tariffs imposed by the United States — and because of a controversial remark from a French presidential hopeful suggesting undocumented migrants should be deported there.

    These recent events provide an opportunity to examine the complex historical and geopolitical entanglements surrounding St-Pierre-Miquelon and involving France, Canada and the United States.

    Last French territory in the region

    Visited by Indigenous Peoples for nearly 5,000 years, St-Pierre-Miquelon became known to European sailors in the late 15th century and was officially claimed for France by Jacques Cartier in 1536.

    The archipelago soon emerged as a strategic base for French fishermen engaged in cod fishing and whaling. Over the ensuing centuries, the islands were fiercely contested by France and Great Britain, changing hands multiple times before being definitively restored to French control in 1816.

    In the 20th century, the archipelago was at the heart of recurring fishing disputes between Canada and France.

    These peaked in 1988 with events that included the seizure of fishing vessels, the recall of ambassadors and violations of existing agreements. Despite historic treaty-based rights, France’s access to fishing grounds declined after Canada’s 1992 cod moratorium and an arbitration ruling that gave St-Pierre-Miquelon an exclusive economic zone of just 38 kilometres around the archipelago, except for a 16-kilometre swath extending 320 kilometres south.

    Both these events had major economic repercussions for St-Pierre-Miquelon.

    Hefty tariff

    Today, the territory’s economy is small — less than 0.001 per cent of France’s GDP — and it depends heavily on public funds and external provisions, particularly from neighbouring Canada.

    Nevertheless, the territory was initially included among the targets of the so-called Liberation Day tariffs announced U.S. President Donald Trump in April. It was singled out with a hefty 50 per cent import duty, temporarily making it one of the most heavily taxed territories in the world, matched only by the landlocked African country of Lesotho.

    Although Trump reversed course and reduced the tariff to 10 per cent a few days later, the original decision was perplexing given the archipelago’s minimal economic weight and its peripheral geopolitical position. Why was this St-Pierre-Michelon targeted so brutally by the Trump administration?

    Halibut geopolitics

    St-Pierre-Miquelon and the U.S. had a balanced trade relationship from 2010 to 2025, until a sharp discrepancy appeared in July 2024. The U.S. imported US$3.4 million worth of goods from the islands, exporting only $100,000 over the entire year.

    This resulted in a reported trade imbalance of 3,300 per cent for the year 2024, which the U.S. government appears to have interpreted as evidence of a 99 per cent tariff imposed by the territory, applying the same flawed algorithm on other countries.

    Why was there such a discrepancy in July 2024?

    According to several reports, this statistical anomaly is actually the result of a long-standing dispute between France and Canada over fishing quotas in the waters surrounding St-Pierre-Miquelon.

    Traditionally, the territory mainly exports seafood products to France and Canada, and almost none to the U.S.

    But in June 2024, a French vessel offloaded several tons of halibut — an expensive fish in high culinary demand — in Saint-Pierre.

    While the catch was made in international waters and was technically legal, it occurred amid ongoing tensions between France and Canada over halibut stocks and the sustainability of the species in the area.

    Because of these tensions, the catch was redirected to the U.S. market and sold for the aforementioned US$3.4 million, an outcome that ultimately triggered the tariffs imposed by the Trump administration.

    France and Canada reached an agreement on halibut later in 2024. But their “halibut war” was just the latest example of recurring disputes between the two countries over fishing quotas in the waters off the Grand Banks of Newfoundland, one of the world’s richest fishing grounds.

    The heavy tariffs imposed by the U.S. on St-Pierre-Miquelon, even though they were swiftly reversed, wer therefore an indirect consequence of the long-standing tensions between France and Canada.

    A new Alcatraz?

    Within days of St-Pierre-Miquelon recovering from the tariff shock, it was once again thrust into the spotlight.

    This time, Laurent Wauquiez, a moderate right-wing presidential contender in France, suggested migrants under deportation orders known as obligations de quitter le territoire français — or OQTF — should be given two options: either be detained in St-Pierre-Miquelon or return to their countries of origin.

    It’s not the first time politicians have proposed deporting prisoners to French overseas territories.

    The suggestion is aligned with France’s historical use of these territories as sites for penal colonies, most notably in Cayenne in French Guyana and New Caledonia in the South Pacific.

    Wauquiez’s remarks were widely condemned as contemptuous and colonial in tone, including by members of the government.

    In response, local authorities in St-Pierre-Miquelon tried to capitalize on the controversy by launching a humorous media campaign that reappropriated the OQTF acronym.

    Social media ads from St-Pierre-Miquelon officials on the deportation proposal by Laurent Wauquiez.
    (Compiled by Paco Milhiet)

    Their goal was to shift the narrative and highlight the archipelago’s appeal: low unemployment, strong public safety, outstanding natural landscapes and a peaceful, family-friendly quality of life — and, hopefully, free from hefty American tariffs.

    Paco Milhiet does not work for, consult, own shares in or receive funding from any company or organisation that would benefit from this article, and has disclosed no relevant affiliations beyond their academic appointment.

    ref. Why was St-Pierre-Miquelon targeted by both Donald Trump and a French politician? – https://theconversation.com/why-was-st-pierre-miquelon-targeted-by-both-donald-trump-and-a-french-politician-256662

    MIL OSI – Global Reports

  • MIL-OSI Africa: Eldest daughters often carry the heaviest burdens – insights from Madagascar

    Source: The Conversation – Africa – By Claire Ricard, Research Fellow at CERDI, Université Clermont Auvergne (UCA)

    In recent years, the term “eldest daughter syndrome” has gained traction on social media, as many firstborn daughters share how they had to grow up faster. They often took on caregiving and supportive roles in their families.

    In high-income countries, research shows that these responsibilities often bring long-term benefits. Firstborn daughters – and sons – tend to have higher educational attainment and stronger cognitive skills. They also enjoy better job prospects and salaries.

    Some studies in low- and middle-income countries have found similar positive effects of being the eldest. But others have found the opposite.

    In low-income contexts, economic constraints, cultural practices – such as the involvement of extended families in child-rearing – and inheritance norms may produce very different effects.

    Our research brings new insights by examining these dynamics in Madagascar. It is one of the world’s poorest countries. Birth order there strongly shapes the transition to adulthood, especially for firstborn children.

    Progress in understanding birth order effects in low-income countries is held back by the lack of detailed, sibling-level data. Our study used a dataset that followed individuals from the ages of 10 to 22, capturing their transition from adolescence to adulthood. It collected detailed information on education, work, health, marriage, and migration. The dataset also captured key demographic and educational details for all living full siblings of each respondent.

    We found that firstborns in Madagascar transition into adulthood earlier than their younger siblings. They are more likely to leave school early. They enter the workforce sooner and marry at younger ages. For example, fourth-born children are 1.5 percentage points less likely than firstborns to have never attended school, and 1.1 percentage points more likely to complete post-secondary education. Or, third-borns are 23% less likely to marry at age 19 than firstborns.

    Our findings suggest that later-born children benefit from greater parental investment in education. This leads to better schooling outcomes and delayed entry into the labour market.

    Birth order and the transition to adulthood

    In Madagascar, early marriage can be a way for families to ease financial pressure. This is especially true since daughters typically join their husband’s household.

    When it comes to marriage, we find that later-born children are less likely to marry early than their firstborn siblings – especially after age 17. This trend holds for both boys and girls. The difference appears earlier for girls, which aligns with their younger average age at marriage.

    Interestingly, second-born girls are not significantly less likely to marry than their older sisters. This suggests that the eldest daughter does not always bear the full brunt of early marriage risk. Firstborn daughters often take on caregiving and household roles. These responsibilities may delay their marriage slightly, as families rely on them for day-to-day support.

    What explains these birth order effects?

    We did not observe significant differences in cognitive skills (like reasoning) or non-cognitive traits (like personality) between firstborns and their younger siblings. Cognitive abilities were assessed through oral and written math and French tests administered at home. These findings contrast with evidence from wealthier countries, where firstborns often outperform their siblings in both cognitive and non-cognitive domains. This may result from greater early parental investment.

    In Madagascar, child development may rely less on direct parental input and more on interactions within the extended family. This is consistent with the concept of fihavanana, a cultural principle that emphasises solidarity and mutual support within the extended family. Rather than benefiting mostly from parental quality time, children – especially later-borns – may develop their cognitive and non-cognitive skills through broader social networks. These include relatives and older siblings.

    We also explored whether gender preferences might help explain the differences in outcomes. For instance, if later-born children were disproportionately boys, it could suggest that parents continued having children in hopes of having a son. This could lead to more resources being allocated to that later-born boy. However, our data show an even distribution of boys and girls among later-born children. This suggests that gender-based stopping rules are unlikely to explain the patterns we observe.

    Instead, our findings point to economic constraints as the main driver for firstborns transitioning into adulthood earlier than their younger siblings.

    In poorer households, particularly in rural areas, firstborn children are often asked to help out financially. This often comes at the cost of their own education. Later-born children, by contrast, receive more investment in their schooling. This may compensate for their limited access to other resources, such as land.

    We find no birth order advantage in wealthier households or among families where parents have some education. This again highlights poverty as a key factor shaping these patterns.

    The double burden of being firstborn

    To sum up, our research shows that, in Madagascar, both male and female firstborns face an earlier transition into adulthood. They leave school and enter the labour market sooner. They marry earlier, although firstborn girls may be at slightly lower risk of early marriage than their younger sisters.

    This suggests that, in poor countries, the eldest daughter syndrome is not just about emotional and care-giving responsibilities. It may also come with fewer educational opportunities, greater economic pressure, and an earlier end to childhood. A true double burden for disadvantaged girls. Economic constraints within households largely explain this pattern.

    But the story is not only one of constraint. The absence of differences in cognitive and non-cognitive skills suggests that broader community ties, rooted in fihavanana and extended kinship networks, help cushion the impact of early responsibility. These collective structures may not erase inequality, but they offer a vital source of resilience.

    As policymakers and practitioners look for ways to promote educational equity, it’s worth remembering that some of the most overlooked trade-offs happen within households. Reducing the weight of those trade-offs – through financial support, community-based programmes, or school retention efforts – could help ensure that the future of one child doesn’t come at the expense of another.

    – Eldest daughters often carry the heaviest burdens – insights from Madagascar
    – https://theconversation.com/eldest-daughters-often-carry-the-heaviest-burdens-insights-from-madagascar-255785

    MIL OSI Africa

  • MIL-OSI Security: Russian GRU Targeting Western Logistics Entities and Technology Companies

    Source: US Department of Homeland Security

    Executive Summary

    This joint cybersecurity advisory (CSA) highlights a Russian state-sponsored cyber campaign targeting Western logistics entities and technology companies. This includes those involved in the coordination, transport, and delivery of foreign assistance to Ukraine. Since 2022, Western logistics entities and IT companies have faced an elevated risk of targeting by the Russian General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (85th GTsSS), military unit 26165—tracked in the cybersecurity community under several names (see “Cybersecurity Industry Tracking”). The actors’ cyber espionage-oriented campaign, targeting technology companies and logistics entities, uses a mix of previously disclosed tactics, techniques, and procedures (TTPs). The authoring agencies expect similar targeting and TTP use to continue.

    Executives and network defenders at logistics entities and technology companies should recognize the elevated threat of unit 26165 targeting, increase monitoring and threat hunting for known TTPs and indicators of compromise (IOCs), and posture network defenses with a presumption of targeting.

    This cyber espionage-oriented campaign targeting logistics entities and technology companies uses a mix of previously disclosed TTPs and is likely connected to these actors’ wide scale targeting of IP cameras in Ukraine and bordering NATO nations.

    The following authors and co-sealers are releasing this CSA:

    • United States National Security Agency (NSA)
    • United States Federal Bureau of Investigation (FBI)
    • United Kingdom National Cyber Security Centre (NCSC-UK)
    • Germany Federal Intelligence Service (BND) Bundesnachrichtendienst
    • Germany Federal Office for Information Security (BSI) Bundesamt für Sicherheit in der Informationstechnik
    • Germany Federal Office for the Protection of the Constitution (BfV) Bundesamt für Verfassungsschutz
    • Czech Republic Military Intelligence (VZ)  Vojenské zpravodajství
    • Czech Republic National Cyber and Information Security Agency (NÚKIB) Národní úřad pro kybernetickou a informační bezpečnost
    • Czech Republic Security Information Service (BIS) Bezpečnostní informační služba
    • Poland Internal Security Agency (ABW) Agencja Bezpieczeństwa Wewnętrznego
    • Poland Military Counterintelligence Service (SKW) Służba Kontrwywiadu Wojskowego
    • United States Cybersecurity and Infrastructure Security Agency (CISA)
    • United States Department of Defense Cyber Crime Center (DC3)
    • United States Cyber Command (USCYBERCOM)
    • Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC)
    • Canadian Centre for Cyber Security (CCCS)
    • Danish Defence Intelligence Service (DDIS) Forsvarets Efterretningstjeneste
    • Estonian Foreign Intelligence Service (EFIS) Välisluureamet
    • Estonian National Cyber Security Centre (NCSC-EE) Küberturvalisuse keskus
    • French Cybersecurity Agency (ANSSI) Agence nationale de la sécurité des systèmes d’information
    • Netherlands Defence Intelligence and Security Service (MIVD) Militaire Inlichtingen- en Veiligheidsdienst
       

    Download the PDF version of this report:

    Russian GRU Targeting Western Logistics Entities and Technology Companies (PDF, 1,081KB)

    For a downloadable list of IOCs, visit:

    Introduction

    For over two years, the Russian GRU 85th GTsSS, military unit 26165—commonly known in the cybersecurity community as APT28, Fancy Bear, Forest Blizzard, BlueDelta, and a variety of other identifiers—has conducted this campaign using a mix of known tactics, techniques, and procedures (TTPs), including reconstituted password spraying capabilities, spearphishing, and modification of Microsoft Exchange mailbox permissions.
    In late February 2022, multiple Russian state-sponsored cyber actors increased the variety of cyber operations for purposes of espionage, destruction, and influence—with unit 26165 predominately involved in espionage. [1] As Russian military forces failed to meet their military objectives and Western countries provided aid to support Ukraine’s territorial defense, unit 26165 expanded its targeting of logistics entities and technology companies involved in the delivery of aid. These actors have also targeted Internet-connected cameras at Ukrainian border crossings to monitor and track aid shipments.
    Note: This advisory uses the MITRE ATT&CK® for Enterprise framework, version 17. See Appendix A: MITRE ATT&CK tactics and techniques for a table of the threat actors’ activity mapped to MITRE ATT&CK tactics and techniques. This advisory uses the MITRE D3FEND® framework, version 1.0.

    Description of Targets

    The GRU unit 26165 cyber campaign against Western logistics providers and technology companies has targeted dozens of entities, including government organizations and private/commercial entities across virtually all transportation modes: air, sea, and rail. These actors have targeted entities associated with the following verticals within NATO member states, Ukraine, and at international organizations: 

    •  Defense Industry
    • Transportation and Transportation Hubs (ports, airports, etc.)
    • Maritime
    • Air Traffic Management
    • IT Services

    In the course of the targeting lifecycle, unit 26165 actors identified and conducted follow-on targeting of additional entities in the transportation sector that had business ties to the primary target, exploiting trust relationships to attempt to gain additional access [T1199].

    The actors also conducted reconnaissance on at least one entity involved in the production of industrial control system (ICS) components for railway management, though a successful compromise was not confirmed [TA0043].

    The countries with targeted entities include the following, as illustrated in Figure 1:

    • Bulgaria
    • Czech Republic
    • France
    • Germany
    • Greece
    • Italy
    • Moldova
    • Netherlands
    • Poland
    • Romania
    • Slovakia
    • Ukraine
    • United States
       
    Figure 1: Countries with Targeted Entities

    Initial Access TTPs

    To gain initial access to targeted entities, unit 26165 actors used several techniques to gain initial access to targeted entities, including (but not limited to):

    The actors abused vulnerabilities associated with a range of brands and models of small office/home office (SOHO) devices to facilitate covert cyber operations, as well as proxy malicious activity via devices with geolocation in proximity to the target [T1665]. [2]

    Credential Guessing/Brute Force

    Unit 26165 actors’ credential guessing [T1110.001] operations in this campaign exhibit some similar characteristics to those disclosed in the previous CSA “Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments.” [3] Based on victim network investigations, the current iteration of this TTP employs a similar blend of anonymization infrastructure, including the use of Tor and commercial VPNs [T1090.003]. The actors frequently rotated the IP addresses used to further hamper detection. All observed connections were made via encrypted TLS [T1573]. 

    Spearphishing

    GRU unit 26165 actors’ spearphishing emails included links [T1566.002] leading to fake login pages impersonating a variety of government entities and Western cloud email providers’ webpages. These webpages were typically hosted on free third-party services or compromised SOHO devices and often used legitimate documents associated with thematically similar entities as lures. The subjects of spearphishing emails were diverse and ranged from professional topics to adult themes. Phishing emails were frequently sent via compromised accounts or free webmail accounts [T1586.002, T1586.003]. The emails were typically written in the target’s native language and sent to a single targeted recipient. 

    Some campaigns employed multi-stage redirectors [T1104] verifying IP-geolocation [T1627.001] and browser fingerprints [T1627] to protect credential harvesting infrastructure or provide multifactor authentication (MFA) [T1111] and CAPTCHA relaying capabilities [T1056]. Connecting endpoints failing the location checks were redirected to a benign URL [T1627], such as msn.com. Redirector services used include:

    • Webhook[.]site
    • FrgeIO
    • InfinityFree
    • Dynu
    • Mocky
    • Pipedream
    • Mockbin[.]org

    The actors also used spearphishing to deliver malware (including HEADLACE and MASEPIE) executables [T1204.002] delivered via third-party services and redirectors [T1566.002], scripts in a mix of languages [T1059] (including BAT [T1059.003] and VBScript [T1059.005]) and links to hosted shortcuts [T1204.001].

    CVE Usage

    Throughout this campaign, GRU unit 26165 weaponized an Outlook NTLM vulnerability (CVE-2023-23397) to collect NTLM hashes and credentials via specially crafted Outlook calendar appointment invitations [T1187]. [4],[5] These actors also used a series of Roundcube CVEs (CVE-2020-12641, CVE-2020-35730, and CVE-2021-44026) to execute arbitrary shell commands [T1059], gain access to victim email accounts, and retrieve sensitive data from email servers [T1114].

    Since at least fall 2023, the actors leveraged a WinRAR vulnerability (CVE-2023-38831) allowing for the execution of arbitrary code embedded in an archive as a means of initial access [T1659]. The actors sent emails with malicious attachments [T1566.001] or embedded hyperlinks [T1566.002] that downloaded a malicious archive prepared using this CVE. 

    Post-Compromise TTPs

    After an initial compromise using one of the above techniques, unit 26165 actors conducted contact information reconnaissance to identify additional targets in key positions [T1589.002]. The actors also conducted reconnaissance of the cybersecurity department [T1591], individuals responsible for coordinating transport [T1591.004], and other companies cooperating with the victim entity [T1591.002].

    The actors used native commands and open source tools, such as Impacket and PsExec, to move laterally within the environment [TA0008]. Multiple Impacket scripts were used as .exe files, in addition to the python versions, depending on the victim environment. The actors also moved laterally within the network using Remote Desktop Protocol (RDP) [T1021.001] to access additional hosts and attempt to dump Active Directory NTDS.dit domain databases [T1003.003] using native Active Directory Domain Services commands, such as in Figure 2: Example Active Directory Domain Services command:

    C:Windowssystem32ntdsutil.exe "activate instance ntds" ifm "create full C:temp[a-z]{3}" quit quit

    Figure 2: Example Active Directory Domain Services command

    Additionally, GRU unit 26165 actors used the tools Certipy and ADExplorer.exe to exfiltrate information from the Active Directory. The actors installed python [T1059.006] on infected machines to enable the execution of Certipy. Accessed files were archived in .zip files prior to exfiltration [T1560]. The actors attempted to exfiltrate archived data via a previously dropped OpenSSH binary [T1048].

    Incident response investigations revealed that the actors would take steps to locate and exfiltrate lists of Office 365 users and set up sustained email collection. The actors used manipulation of mailbox permissions [T1098.002] to establish sustained email collection at compromised logistics entities, as detailed in a Polish Cybercommand blog. [6]

    After initial authentication, unit 26165 actors would change accounts’ folder permissions and enroll compromised accounts in MFA mechanisms to increase the trust-level of compromised accounts and enable sustained access [T1556.006]. The actors leveraged python scripts to retrieve plaintext passwords via Group Policy Preferences [T1552.006] using Get-GPPPassword.py and a modified ldap-dump.py to enumerate the Windows environment [T1087.002] and conduct a brute force password spray [T1110.003] via Lightweight Directory Access Protocol (LDAP). The actors would additionally delete event logs through the wevtutil utility [T1070.001].

    After gaining initial access to the network, the actors pursued further access to accounts with access to sensitive information on shipments, such as train schedules and shipping manifests. These accounts contained information on aid shipments to Ukraine, including: 

    • sender,
    • recipient,
    • train/plane/ship numbers,
    • point of departure,
    • destination,
    • container registration numbers,
    • travel route, and
    • cargo contents. 

    In at least one instance, the actors attempted to use voice phishing [T1566.004] to gain access to privileged accounts by impersonating IT staff.

    Malware

    Unit 26165’s use of malware in this campaign ranged from gaining initial access to establishing persistence and exfiltrating data. In some cases, the attack chain resulted in multiple pieces of malware being deployed in succession. The actors used dynamic link library (DLL) search order hijacking [T1574.001] to facilitate malware execution. There were a number of known malware variants tied to this campaign against logistics sector victims, including:

    • HEADLACE [7]
    • MASEPIE [8]

    While other malware variants, such as OCEANMAP and STEELHOOK, [8] were not directly observed targeting logistics or IT entities, their deployment against victims in other sectors in Ukraine and other Western countries suggest that they could be deployed against logistics and IT entities should the need arise. 

    Persistence

    In addition to the abovementioned mailbox permissions abuse, unit 26165 actors also used scheduled tasks [T1053.005], run keys [T1547.001], and placed malicious shortcuts [T1547.009] in the startup folder to establish persistence. 

    Exfiltration

    GRU unit 26165 actors used a variety of methods for data exfiltration that varied based on the victim environment, including both malware and living off the land binaries. PowerShell commands [T1059.001] were often used to prepare data for exfiltration; for example, the actors prepared zip archives [T1560.001] for upload to their own infrastructure. 

    The actors also used server data exchange protocols and Application Programming Interfaces (APIs) such as Exchange Web Services (EWS) and Internet Message Access Protocol (IMAP) [T1114.002] to exfiltrate data from email servers. In multiple instances, the actors used periodic EWS queries [T1119] to collect new emails sent and received since the last data exfiltration [T1029]. The actors typically used infrastructure in close geographic proximity to the victim. Long gaps between exfiltration, the use of trusted and legitimate protocols, and the use of local infrastructure allowed for long-term collection of sensitive data to go undetected. 

    Connections to Targeting of IP Cameras

    In addition to targeting logistics entities, unit 26165 actors likely used access to private cameras at key locations, such as near border crossings, military installations, and rail stations, to track the movement of materials into Ukraine. The actors also used legitimate municipal services, such as traffic cams. 

    The actors targeted Real Time Streaming Protocol (RTSP) servers hosting IP cameras primarily located in Ukraine as early as March 2022 in a large-scale campaign, which included attempts to enumerate devices [T1592] and gain access to the cameras’ feeds [T1125]. Actor-controlled servers sent RTSP DESCRIBE requests destined for RTSP servers, primarily hosting IP cameras [T1090.002]. The DESCRIBE requests were crafted to obtain access to IP cameras located on logically distinct networks from that of the routers that received the request. The requests included Base64-encoded credentials for the RTSP server, which included publicly documented default credentials and likely generic attempts to brute force access to the devices [T1110]. An example of an RTSP request is shown in Figure 3.

    DESCRIBE rtsp://[IP ADDRESS] RTSP/1.0

    CSeq: 1

    Authorization: Basic

    User-Agent: WebClient

    Accept: application/sdp

    DESCRIBE rtsp://[IP ADDRESS] RTSP/1.0

    CSeq: 2

    Authorization: Digest username="admin", realm="[a-f0-9]{12}", algorithm="MD5", nonce="[a-f0-9]{32}", uri="", response="[a-f0-9]{32}"

    User-Agent: WebClient

    Accept: application/sdp

    Figure 3: Example RTSP request

    Successful RTSP 200 OK responses contained a snapshot of the IP camera’s image and IP camera metadata such as video codec, resolution, and other properties depending on the IP camera’s configuration. 

    From a sample available to the authoring agencies of over 10,000 cameras targeted via this effort, the geographic distribution of victims showed a strong focus on cameras in Ukraine and border countries, as shown in Table 1:

    Table 1: Geographic distribution of targeted IP cameras
    Country Percentage of Total Attempts
    Ukraine 81.0%
    Romania 9.9%
    Poland 4.0%
    Hungary 2.8%
    Slovakia 1.7%
    Others 0.6%

    Mitigation Actions

    General Security Mitigations

    Architecture and Configuration

    • Employ appropriate network segmentation [D3-NI] and restrictions to limit access and utilize additional attributes (such as device information, environment, and access path) when making access decisions [D3-AMED].
      • Consider Zero Trust principles when designing systems. Base product choices on how those products can solve specific risks identified as part of the end-to-end design. [9]
    • Ensure that host firewalls and network security appliances (e.g., firewalls) are configured to only allow legitimately needed data flows between devices and servers to prevent lateral movement [D3-ITF]. Alert on attempts to connect laterally between host devices or other unusual data flows.
    • Use automated tools to audit access logs for security concerns and identify anomalous access requests [D3-RAPA].
    • For organizations using on-premises authentication and email services, block and alert on NTLM/SMB requests to external infrastructure [D3-OTF].
    • Utilize endpoint, detection, and response (EDR) and other cybersecurity solutions on all systems, prioritizing high value systems with large amounts of sensitive data such as mail servers and domain controllers [D3-PM] first.
      • Perform threat and attack modeling to understand how sensitive systems may be compromised within an organization’s specific architecture and security controls. Use this to develop a monitoring strategy to detect compromise attempts and select appropriate products to enact this strategy.
    • Collect and monitor Windows logs for certain events, especially for events that indicate that a log was cleared unexpectedly [D3-SFA].
    • Enable optional security features in Windows to harden endpoints and mitigate initial access techniques [D3-AH]:
      • Enable attack surface reduction rules to prevent executable content from email [D3-ABPI].
      • Enable attack surface reduction rules to prevent execution of files from globally writeable directories, such as Downloads or %APPDATA% [D3-EAL].
      • Unless users are involved in the development of scripts, limit the local execution of scripts (such as batch scripts, VBScript, JScript/JavaScript, and PowerShell [10]) to known scripts [D3-EI], and audit execution attempts.
      • Disable Windows Host Scripting functionality and configure PowerShell to run in Constrained mode [D3-ACH].
    • Where feasible, implement allowlisting for applications and scripts to limit execution to only those needed for authorized activities, blocking all others by default [D3-EAL].
    • Consider using open source SIGMA rules as a baseline for detecting and alerting on suspicious file execution or command parameters [D3-PSA].
    • Use services that provide enhanced browsing services and safe link checking [D3-URA]. Significant reductions in successful spearphishing attempts were noted when email providers began offering link checking and automatic file detonation to block malicious content.
    • Where possible, block logins from public VPNs, including exit nodes in the same country as target systems, or, if they need to be allowed, alert on them for further investigation. Most organizations should not need to allow incoming traffic, especially logins to systems, from VPN services [D3-NAM].
    • Educate users to only use approved corporate systems for relevant government and military business and avoid the use of personal accounts on cloud email providers to conduct official business. Network administrators should also audit both email and web request logs to detect such activity.

    Many organizations may not need to allow outgoing traffic to hosting and API mocking services, which are frequently used by GRU unit 26165. Organizations should consider alerting on or blocking the following services, with exceptions allowlisted for legitimate activity [D3-DNSDL].

    • *.000[.]pe
    • *.1cooldns[.]com
    • *.42web[.]io
    • *.4cloud[.]click
    • *.accesscan[.]org
    • *.bumbleshrimp[.]com
    • *.camdvr[.]org
    • *.casacam[.]net
    • *.ddnsfree[.]com
    • *.ddnsgeek[.]com
    • *.ddnsguru[.]com
    • *.dynuddns[.]com
    • *.dynuddns[.]net
    • *.free[.]nf
    • *.freeddns[.]org
    • *.frge[.]io
    • *.glize[.]com
    • *.great-site[.]net
    • *.infinityfreeapp[.]com
    • *.kesug[.]com
    • *.loseyourip[.]com
    • *.lovestoblog[.]com
    • *.mockbin[.]io
    • *.mockbin[.]org
    • *.mocky[.]io
    • *.mybiolink[.]io
    • *.mysynology[.]net
    • *.mywire[.]org
    • *.ngrok[.]io
    • *.ooguy[.]com
    • *.pipedream[.]net
    • *.rf[.]gd
    • *.urlbae[.]com
    • *.webhook[.]site
    • *.webhookapp[.]com
    • *.webredirect[.]org
    • *.wuaze[.]com

    Heuristic detections for web requests to new subdomains, including of the above providers, may uncover malicious phishing activity [D3-DNRA]. Logging the requests for each sub-domain requested by users on a network, such as in DNS or firewall logs, may enable system administrators to identify new targeting and victims.

    Identity and Access Management

    Organizations should take measures to ensure strong access controls and mitigate against common credential theft techniques: 

    • Use MFA with strong factors, such as passkeys or PKI smartcards, and require regular re-authentication [D3-MFA]. [11], [12] Strong authentication factors are not guessable using dictionary techniques, so they resist brute force attempts.
    • Implement other mitigations for privileged accounts: including limiting the number of admin accounts, considering using hardware MFA tokens, and regularly reviewing all privileged user accounts [D3-JFAPA].
    • Separate privileged accounts by role and alert on misuse of privileged accounts [D3-UAP]. For example, email administrator accounts should be different from domain administrator accounts.
    • Reduce reliance on passwords; instead, consider using services like single sign-on [D3-TBA].
      • For organizations using on-premises authentication and email services, plan to disable NTLM entirely and migrate to more robust authentication processes such as PKI certificate authentication.
    • Do not store passwords in Group Policy Preferences (GPP). Remove all passwords previously included in GPP and change all passwords on the corresponding accounts [D3-CH]. [13]
    • Use account throttling or account lockout [D3-ANET]:
      • Throttling is preferred to lockout. Throttling progressively increases time delay between successive login attempts.
      • Account lockout can leave legitimate users unable to access their accounts and requires access to an account recovery process.
      • Account lockout can provide a malicious actor with an easy way to launch a Denial of Service (DoS).
      • If using lockout, then allowing 5 to 10 attempts before lockout is recommended.
    • Use a service to check for compromised passwords before using them [D3-SPP]. For example, “Have I Been Pwned” can be used to check whether a password has been previously compromised without disclosing the potential password.
    • Change all default credentials [D3-CRO] and disable protocols that use weak authentication (e.g., clear-text passwords or outdated and vulnerable authentication or encryption protocols) or do not support multi-factor authentication [D3-ACH] [D3-ET]. Always configure access controls carefully to ensure that only well-maintained and well-authenticated accounts have access. [13]

    IP Camera Mitigations

    The following mitigation techniques for IP cameras can be used to defend against this type of malicious activity:

    • Ensure IP cameras are currently supported. Replace devices that are out of support.
    • Apply security patches and firmware updates to all IP cameras [D3-SU].
    • Disable remote access to the IP camera, if unnecessary [D3-ITF].
    • Ensure cameras are protected by a security appliance, if possible, such as by using a firewall to prevent communication with the camera from IP addresses not on an allowlist [D3-NAM].
    • If remote access to IP camera feeds is required, ensure authentication is enabled [D3-AA] and use a VPN to connect remotely [D3-ET]. Use MFA for management accounts if supported [D3-MFA].
    • Disable Universal Plug and Play (UPnP), Peer-to-Peer (P2P), and Anonymous Visit features on IP cameras and routers [D3-NI].
    • Turn off other ports/services not in use (e.g., FTP, web interface, etc.) [D3-ACH].
    • If supported, enable authenticated RTSP access only [D3-AA].
    • Review all authentication activity for remote access to make sure it is valid and expected [D3-UBA]. Investigate any unexpected or unusual activity.
    • Audit IP camera user accounts to ensure they are an accurate reflection of your organization and that they are being used as expected [D3-UAP].
    • Configure, tune, and monitor logging—if available—on the IP camera.

    Indicators of Compromise (IOCs)

    Note: Specific IoCs may no longer be actor controlled, may themselves be compromised infrastructure or email accounts, or may be shared infrastructure such as public VPN or Tor exit nodes. Care should be taken when basing triaging logs or developing detection rules on these indicators. GRU unit 26165 almost certainly uses extensive further infrastructure and TTPs not specifically listed in this report.

    Utilities and scripts

    Legitimate utilities

    Unauthorized or unusual use of the following legitimate utilities can be an indication of a potential compromise:

    • ntdsutil – A legitimate Windows executable used by threat actors to export contents of Active Directory
    • wevtutil – A legitimate Windows executable used by threat actors to delete event logs
    • vssadmin – A legitimate Windows executable possibly used by threat actors to make a copy of the server’s C: drive
    • ADexplorer – A legitimate window executable to view, edit, and backup Active Directory Certificate Services
    • OpenSSH – The Windows version of a legitimate open source SSH client
    • schtasks – A legitimate Windows executable used to create persistence using scheduled tasks
    • whoami – A legitimate Windows executable used to retrieve the name of the current user
    • tasklist – A legitimate Windows executable used to retrieve the list of running processes
    • hostname – A legitimate Windows executable used to retrieve the device name
    • arp – A legitimate Windows executable used to retrieve the ARP table for mapping the network environment
    • systeminfo – A legitimate Windows executable used to retrieve a comprehensive summary of device and operating system information
    • net – A legitimate Windows executable used to retrieve detailed user information
    • wmic – A legitimate Windows executable used to interact with Windows Management Instrumentation (WMI), such as to retrieve letters assigned to logical partitions on storage drives
    • cacls – A legitimate Windows executable used to modify permissions on files
    • icacls – A legitimate Windows executable used to modify permissions to files and handle integrity levels and ownership
    • ssh – A legitimate Windows executable used to establish network shell connections
    • reg – A legitimate Windows executable used to add to or modify the system registry 

    Note: Additional heuristics are needed for effective hunting for these and other living off the land (LOTL) binaries to avoid being overwhelmed by false positives if these legitimate management tools are used regularly. See the joint guide, Identifying and Mitigating Living Off the Land Techniques, for guidance on developing a multifaceted cybersecurity strategy that enables behavior analytics, anomaly detection, and proactive hunting, which are part of a comprehensive approach to mitigating cyber threats that employ LOTL techniques.

    Malicious scripts

    • Certipy – An open source python tool for enumerating and abusing Active Directory Certificate Services
    • Get-GPPPassword.py – An open source python script for finding insecure passwords stored in Group Policy Preferences
    • ldap-dump.py – A script for enumerating user accounts and other information in Active Directory
    • Hikvision backdoor string: “YWRtaW46MTEK”

    Suspicious command lines

    While the following utilities are legitimate, and using them with the command lines shown may also be legitimate, these command lines are often used during malicious activities and could be an indication of a compromise:

    • edge.exe “-headless-new -disable-gpu”
    • ntdsutil.exe “activate instance ntds” ifm “create full C:temp[a-z]{3}” quit quit
    • ssh -Nf
    • schtasks /create /xml

    Outlook CVE Exploitation IOCs

    • md-shoeb@alfathdoor[.]com[.]sa
    • jayam@wizzsolutions[.]com
    • accounts@regencyservice[.]in
    • m.salim@tsc-me[.]com
    • vikram.anand@4ginfosource[.]com
    • mdelafuente@ukwwfze[.]com
    • sarah@cosmicgold469[.]co[.]za
    • franch1.lanka@bplanka[.]com
    • commerical@vanadrink[.]com
    • maint@goldenloaduae[.]com
    • karina@bhpcapital[.]com
    • tv@coastalareabank[.]com
    • ashoke.kumar@hbclife[.]in
    • 213[.]32[.]252[.]221
    • 124[.]168[.]91[.]178
    • 194[.]126[.]178[.]8
    • 159[.]196[.]128[.]120

    Commonly Used Webmail Providers

    • portugalmail[.]pt
    • mail-online[.]dk
    • email[.]cz
    • seznam[.]cz

    Malicious Archive Filenames Involving CVE-2023-38831

    • calc.war.zip
    • news_week_6.zip
    • Roadmap.zip
    • SEDE-PV-2023-10-09-1_EN.zip
    • war.zip
    • Zeyilname.zip

    Brute Forcing IP Addresses

    Disclaimer: These IP addresses date June 2024 through August 2024. The authoring agencies recommend organizations investigate or vet these IP addresses prior to taking action, such as blocking.

    June 2024 July 2024 August 2024
    192[.]162[.]174[.]94 207[.]244[.]71[.]84 31[.]135[.]199[.]145 79[.]184[.]25[.]198 91[.]149[.]253[.]204  
    103[.]97[.]203[.]29 162[.]210[.]194[.]2 31[.]42[.]4[.]138 79[.]185[.]5[.]142 91[.]149[.]254[.]75  
    209[.]14[.]71[.]127   46[.]112[.]70[.]252 83[.]10[.]46[.]174 91[.]149[.]255[.]122  
    109[.]95[.]151[.]207   46[.]248[.]185[.]236 83[.]168[.]66[.]145 91[.]149[.]255[.]19  
        64[.]176[.]67[.]117 83[.]168[.]78[.]27 91[.]149[.]255[.]195  
        64[.]176[.]69[.]196 83[.]168[.]78[.]31   91[.]221[.]88[.]76  
        64[.]176[.]70[.]18 83[.]168[.]78[.]55   93[.]105[.]185[.]139  
        64[.]176[.]70[.]238 83[.]23[.]130[.]49   95[.]215[.]76[.]209  
        64[.]176[.]71[.]201 83[.]29[.]138[.]115   138[.]199[.]59[.]43  
        70[.]34[.]242[.]220 89[.]64[.]70[.]69   147[.]135[.]209[.]245  
        70[.]34[.]243[.]226 90[.]156[.]4[.]204   178[.]235[.]191[.]182  
        70[.]34[.]244[.]100 91[.]149[.]202[.]215   178[.]37[.]97[.]243  
        70[.]34[.]245[.]215 91[.]149[.]203[.]73   185[.]234[.]235[.]69  
        70[.]34[.]252[.]168 91[.]149[.]219[.]158 192[.]162[.]174[.]67  
        70[.]34[.]252[.]186 91[.]149[.]219[.]23   194[.]187[.]180[.]20  
        70[.]34[.]252[.]222 91[.]149[.]223[.]130   212[.]127[.]78[.]170  
        70[.]34[.]253[.]13 91[.]149[.]253[.]118 213[.]134[.]184[.]167
        70[.]34[.]253[.]247   91[.]149[.]253[.]198    
        70[.]34[.]254[.]245 91[.]149[.]253[.]20    

    Detections

    Customized NTLM listener

    rule APT28_NTLM_LISTENER {

           meta:

                  description = "Detects NTLM listeners including APT28's custom one"

           strings:

                  $command_1 = "start-process powershell.exe -WindowStyle hidden"

                  $command_2 = "New-Object System.Net.HttpListener"

                  $command_3 = "Prefixes.Add('http://localhost:8080/')"

                  $command_4 = "-match 'Authorization'"

                  $command_5 = "GetValues('Authorization')"

                  $command_6 = "Request.RemoteEndPoint.Address.IPAddressToString"

                  $command_7 = "@(0x4e,0x54,0x4c,0x4d, 0x53,0x53,0x50,0x00,0x02,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x28,0x00,0x00,0x01,0x82,0x00,0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00)"

                  $command_8 = ".AllKeys"

                  

                  $variable_1 = "$NTLMAuthentication" nocase

                  $variable_2 = "$NTLMType2" nocase

                  $variable_3 = "$listener" nocase

                  $variable_4 = "$hostip" nocase

                  $variable_5 = "$request" nocase

                  $variable_6 = "$ntlmt2" nocase

                  $variable_7 = "$NTLMType2Response" nocase

                  $variable_8 = "$buffer" nocase

           condition:

                  5 of ($command_*) 

                  or

                  all of ($variable_*)

    }

    HEADLACE shortcut

    rule APT28_HEADLACE_SHORTCUT {

           meta:

                  description = "Detects the HEADLACE backdoor shortcut dropper. Rule is meant for threat hunting."

           strings:

                  $type = "[InternetShortcut]" ascii nocase

                  $url  = "file://"

                  $edge = "msedge.exe"

                  $icon = "IconFile"

           condition:

                  all of them

    }

    HEADLACE credential dialogbox phishing 

    rule APT28_HEADLACE_CREDENTIALDIALOG {

           meta:

                  description = "Detects scripts used by APT28 to lure user into entering credentials"

           strings:

                  $command_1 = "while($true)"

                  $command_2 = "Get-Credential $(whoami)"

                  $command_3 = "Add-Content"

                  $command_4 = ".UserName"

                  $command_5 = ".GetNetworkCredential().Password"

                  $command_6 = "GetNetworkCredential().Password.Length -ne 0"

           condition:

                  5 of them

    }

    HEADLACE core script

    rule APT28_HEADLACE_CORE {

           meta:

                  description = "Detects HEADLACE core batch scripts"

           strings:

                  $chcp = "chcp 65001" ascii

                  $headless = "start "" msedge --headless=new --disable-gpu" ascii

                  

                  $command_1 = "taskkill /im msedge.exe /f" ascii

                  $command_2 = "whoami>"%programdata%" ascii

                  $command_3 = "timeout" ascii

                  $command_4 = "copy "%programdata%" ascii

                  $non_generic_del_1 = "del /q /f "%programdata%" ascii

                  $non_generic_del_3 = "del /q /f "%userprofile%Downloads" ascii

     

                  $generic_del = "del /q /f" ascii

           condition:

                  (

                          $chcp 

                          and 

                          $headless

                  )

                  and

                  (

                          1 of ($non_generic_del_*)

                          or

                          ($generic_del)

                          or

                          3 of ($command_*)

                  )

    }

    MASEPIE

    rule APT28_MASEPIE {

           meta:

                  description = "Detects MASEPIE python script"

           strings:

                  $masepie_unique_1 = "os.popen('whoami').read()"

                  $masepie_unique_2 = "elif message == 'check'"

                  $masepie_unique_3 = "elif message == 'send_file':"

                  $masepie_unique_4 = "elif message == 'get_file'"

                  $masepie_unique_5 = "enc_mes('ok'"

                  $masepie_unique_6 = "Bad command!'.encode('ascii'"

                  $masepie_unique_7 = "{user}{SEPARATOR}{k}"

                  $masepie_unique_8 = "raise Exception("Reconnect"

           condition:

                  3 of ($masepie_unique_*)

    }

    STEELHOOK

    rule APT28_STEELHOOK {

           meta:

                  description = "Detects APT28's STEELHOOK powershell script"

           strings:

                  $s_1 = "$($env:LOCALAPPDATAGoogleChromeUser DataLocal State)"

                  $s_2 = "$($env:LOCALAPPDATAGoogleChromeUser DataDefaultLogin Data)"

                  $s_3 = "$($env:LOCALAPPDATAMicrosoftEdgeUser DataLocal State)"

                  $s_4 = "$($env:LOCALAPPDATAMicrosoftEdgeUser DataDefaultLogin Data)"

                  $s_5 = "os_crypt.encrypted_key"

                  $s_6 = "System.Security.Cryptography.DataProtectionScope"

                  $s_7 = "[system.security.cryptography.protectdata]::Unprotect"

                  $s_8 = "Invoke-RestMethod"

           condition:

                  all of them

    }

    PSEXEC

    rule GENERIC_PSEXEC {

           meta:

                  description = "Detects SysInternals PSEXEC executable"

           strings:

                  $sysinternals_1 = "SYSINTERNALS SOFTWARE LICENCE TERMS"

                  $sysinternals_2 = "/accepteula"

                  $sysinternals_3 = "SoftwareSysinternals"

                  $network_1 = "%sIPC$"

                  $network_2 = "%sADMIN$%s"

                  $network_3 = "DeviceLanmanRedirector%sipc$"

                  $psexec_1 = "PSEXESVC"

                  $psexec_2 = "PSEXEC-{}-"

                  $psexec_3 = "Copying %s to %s..."

                  $psexec_4 = "gPSINFSVC"

           condition:

                  (

                          ( uint16( 0x0 ) ==0x5a4d )

                          and

                          ( uint16( uint32( 0x3c )) == 0x4550 )

                  )

                  and 

                          filesize < 1024KB

                  and

                  (

                          ( any of ($sysinternals_*) and any of ($psexec_*) )

                          or

                          ( 2 of ($network_*) and 2 of ($psexec_*))

                  )

    }

    The cybersecurity industry provides overlapping cyber threat intelligence, IOCs, and mitigation recommendations related to GRU unit 26165 cyber actors. While not all encompassing, the following are the most notable threat group names related under MITRE ATT&CK G0007 and commonly used within the cybersecurity community: 

    • APT28 [14]
    • Fancy Bear [14]
    • Forest Blizzard [14]
    • Blue Delta [15]

    Note: Cybersecurity companies have different methods of tracking and attributing cyber actors, and this may not be a 1:1 correlation to the U.S. government’s understanding for all activity related to these groupings.

    Further Reference

    To search for the presence of malicious email messages targeting CVE-2023-23397, network defenders may consider using the script published by Microsoft: https://aka.ms/CVE-2023-23397ScriptDoc

    For the Impacket TTP, network defenders may consider using the following publicly available Impacket YARA detection rule:
    https://github.com/Neo23x0/signature-base/blob/master/yara/gen_impacket_tools.yar

    Works Cited

    [1] Microsoft. Defending Ukraine: Early Lessons from the Cyber War. 2022. https://blogs.microsoft.com/on-the-issues/2022/06/22/defending-ukraine-early-lessons-from-the-cyber-war/  
    [2] FBI et al. Russian Cyber Actors Use Compromised Routers to Facilitate Cyber Operations. 2024. https://media.defense.gov/2024/Feb/27/2003400753/-1/-1/0/CSA-Russian-Actors-Use-Routers-Facilitate-Cyber_Operations.PDF   
    [3] NSA et al. Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments. 2021. https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/0/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF 
    [4] ANSSI. Campagnes d'attaques du mode opératoire APT28 depuis 2021. 2023. https://cert.ssi.gouv.fr/cti/CERTFR-2023-CTI-009/  
    [5] ANSSI. Targeting and compromise of french entities using the APT28 intrusion set. 2025. https://cert.ssi.gouv.fr/cti/CERTFR-2025-CTI-007/   
    [6] Polish Cyber Command. Detecting Malicious Activity Against Microsoft Exchange Servers. 2023. https://www.wojsko-polskie.pl/woc/articles/aktualnosci-w/detecting-malicious-activity-against-microsoft-exchange-servers/ 
    [7] IBM. Israel-Hamas Conflict Lures to Deliver Headlace Malware. 2023. https://securityintelligence.com/x-force/itg05-ops-leverage-israel-hamas-conflict-lures-to-deliver-headlace-malware/ 
    [8] CERT-UA. APT28: From Initial Attack to Creating Domain Controller Threats in an Hour. 2023. https://cert.gov.ua/article/6276894 
    [9] NSA. Embracing a Zero Trust Security Model. 2021. https://media.defense.gov/2021/Feb/25/2002588479/-1/-1/0/CSI_EMBRACING_ZT_SECURITY_MODEL_UOO115131-21.PDF  
    [10] NSA et al. Keeping PowerShell: Security Measures to Use and Embrace. 2022. https://media.defense.gov/2022/Jun/22/2003021689/-1/-1/0/CSI_KEEPING_POWERSHELL_SECURITY_MEASURES_TO_USE_AND_EMBRACE_20220622.PDF 
    [11] National Institute of Standards and Technology (NIST). Special Publication 800-63B: Digital Identity Guidelines – Authentication and Lifecycle Management. 2020. https://pages.nist.gov/800-63-3/sp800-63b.html 
    [12] NSA. Selecting Secure Multi-factor Authentication Solutions. October 16, 2020. https://media.defense.gov/2024/Jul/31/2003515137/-1/-1/0/MULTIFACTOR_AUTHENTICATION_SOLUTIONS_UOO17091520.PDF  
    [13] NSA and CSA. NSA and CISA Red and Blue Teams Share Top Ten Cybersecurity Misconfigurations. 2023. https://media.defense.gov/2023/Oct/05/2003314578/-1/-1/0/JOINT_CSA_TOP_TEN_MISCONFIGURATIONS_TLP-CLEAR.PDF 

    [14] Department of Justice. Justice Department Conducts Court-Authorized Disruption of Botnet Controlled by the Russian Federation’s Main Intelligence Directorate of the General Staff (GRU). 2024. https://www.justice.gov/archives/opa/pr/justice-department-conducts-court-authorized-disruption-botnet-controlled-russian  
    [15] Recorded Future. GRU’s BlueDelta Targets Key Networks in Europe with Multi-Phase Espionage Campaigns. 2024. https://go.recordedfuture.com/hubfs/reports/CTA-RU-2024-0530.pdf  
     

    Disclaimer of endorsement

    The information and opinions contained in this document are provided "as is" and without any warranties or guarantees. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favoring by the United States Government, and this guidance shall not be used for advertising or product endorsement purposes.

    Purpose

    This document was developed in furtherance of the authoring agencies’ cybersecurity missions, including their responsibilities to identify and disseminate threats and to develop and issue cybersecurity specifications and mitigations. This information may be shared broadly to reach all appropriate stakeholders.

    Contact

    United States organizations

    • National Security Agency (NSA)
    • Cybersecurity and Infrastructure Security Agency (CISA) and Federal Bureau of Investigation (FBI)
      • U.S. organizations are encouraged to reporting suspicious or criminal activity related to information in this advisory to CISA via the agency’s Incident Reporting System, its 24/7 Operations Center (report@cisa.gov or 888-282-0870), or your local FBI field office. When available, please include the following information regarding the incident: date, time, and location of the incident; type of activity; number of people affected; type of equipment user for the activity; the name of the submitting company or organization; and a designated point of contact.
    • Department of Defense Cyber Crime Center (DC3)

    United Kingdom organizations

    Germany organizations

    Czech Republic organizations

    Poland organizations

    Australian organizations

    • Visit cyber.gov.au or call 1300 292 371 (1300 CYBER 1) to report cybersecurity incidents and access alerts and advisories.

    Canadian organizations

    Estonia organizations

    French organizations

    • French organizations are encouraged to report suspicious activity or incident related to information found in this advisory by contacting ANSSI/CERT-FR by email at cert-fr@ssi.gouv.fr or by phone at: 3218 or +33 9 70 83 32 18. 

    See Table 2 through Table 14 for all the threat actor tactics and techniques referenced in this advisory.

    Table 2: Reconnaissance
    Tactic/Technique Title ID Use
    Reconnaissance TA0043 Conducted reconnaissance on at least one entity involved in the production of ICS components for railway management.
    Gather Victim Identity Information: Email Addresses T1589.002 Conducted contact information reconnaissance to identify additional targets in key positions.
    Gather Victim Org Information T1591 Conducted reconnaissance of the cybersecurity department.
    Gather Victim Org Information: Identify Roles T1591.004 Conducted reconnaissance of individuals responsible for coordinating transport.
    Gather Victim Org Information: Business Relationships T1591.002 Conducted reconnaissance of other companies cooperating with the victim entity.
    Gather Victim Host Information T1592 Attempted to enumerate Real Time Streaming Protocol (RTSP) servers hosting IP cameras.
    Table 3: Resource development
    Tactic/Technique Title ID Use
    Compromise Accounts: Email Accounts T1586.002 Sent phishing emails using compromised accounts.
    Compromise Accounts: Cloud Accounts T1586.003 Sent phishing emails using compromised accounts.
    Table 4: Initial Access
    Tactic/Technique Title ID Use
    Trusted Relationship T1199 Conducted follow-on targeting of additional entities in the transportation sector that had business ties to the primary target, exploiting trust relationships to attempt to gain additional access.
    Phishing T1566 Used spearphishing for credentials and delivering malware to gain initial access to targeted entities.
    Phishing: Spearphishing Attachment T1566.001 Sent emails with malicious attachments.
    Phishing: Spearphishing Link T1566.002 Used spearphishing with included links to fake login pages. Sent emails with embedded hyperlinks that downloaded a malicious archive.
    Phishing: Spearphishing Voice T1566.004 Attempted to use voice phishing to gain access to privileged accounts by impersonating IT staff.
    External Remote Services T1133 Exploited Internet-facing infrastructure, including corporate VPNs, to gain initial access to targeted entities.
    Exploit Public-Facing Application T1190 Exploited public vulnerabilities and SQL injection to gain initial access to targeted entities.
    Content Injection T1659 Leveraged a WinRAR vulnerability allowing for the execution of arbitrary code embedded in an archive.
    Table 5: Execution
    Tactic/Technique Title ID Use
    User Execution: Malicious Link T1204.001 Used malicious links to hosted shortcuts in spearphishing.
    User Execution: Malicious File T1204.002 Delivered malware executables via spearphishing.
    Scheduled Task/Job: Scheduled Task T1053.005 Used scheduled tasks to establish persistence.
    Command and Scripting Interpreter T1059 Delivered scripts in spearphishing. Executed arbitrary shell commands.
    Command and Scripting Interpreter: PowerShell T1059.001 PowerShell commands were often used to prepare data for exfiltration.
    Command and Scripting Interpreter: Windows Command Shell T1059.003 Used BAT script in spearphishing.
    Command and Scripting Interpreter: Visual Basic T1059.005 Used VBScript in spearphishing.
    Command and Scripting Interpreter: Python T1059.006 Installed python on infected machines to enable the execution of Certipy.
    Table 6: Persistence
    Tactic/Technique Title ID Use
    Account Manipulation: 
    Additional Email Delegate 
    Permissions
    Used manipulation of mailbox permissions to establish sustained email collection. 
    Modify Authentication Process: 
    Multi-Factor Authentication
    Enrolled compromised accounts in MFA mechanisms to increase the trust-level of compromised accounts and enable sustained access. 
    Hijack Execution Flow: DLL 
    Search Order Hijacking 
    T1574.001  Used DLL search order hijacking to facilitate malware execution. 
    Boot or Logon Autostart 
    Execution: Registry Run Keys / 
    Startup Folder

    T1547.001 

    Used run keys to establish persistence. 
    Boot or Logon Autostart 
    Execution: Shortcut 
    Modification

    T1547.009 

    Placed malicious shortcuts in the startup folder to establish persistence. 
    Table 7: Defense Evasion
    Tactic/Technique Title ID Use
    Indicator Removal: Clear 
    Windows Event Logs
    T1070.001  Deleted event logs through the wevtutil utility.
    Table 8: Credential access 
    Tactic/Technique Title ID Use

    Brute Force 

    Sent requests with Base64-encoded credentials for the RTSP server, which included publicly documented default credentials, and likely were generic attempts to brute force access to the devices. 

    Brute Force: Password Guessing 

    Used credential guessing to gain initial access to targeted entities. 

    Brute Force: Password Spraying 

    Used brute force to gain initial access to targeted entities. Conducted a brute force password spray via LDAP. 

    Multi-Factor Authentication Interception 

    Used multi-stage redirectors to provide MFA relaying capabilities in some campaigns. 

    Input Capture 

    Used multi-stage redirectors to provide CAPTCHA relaying capabilities in some campaigns. 

    Forced Authentication 

    Used an Outlook NTLM vulnerability to collect NTLM hashes and credentials via specially crafted Outlook calendar appointment invitations. 

    OS Credential Dumping: NTDS 

    Attempted to dump Active Directory NTDS.dit domain databases. 

    Unsecured Credentials: Group Policy Preferences 

    Retrieved plaintext passwords via Group Policy Preferences using Get-GPPPassword.py. 

    Table 9: Discovery
    Tactic/Technique Title ID Use

    Account Discovery: Domain Account

    T1087.002

    Used a modified ldap-dump.py to enumerate the Windows environment.

    Table 10: Command and Control
    Tactic/Technique Title ID Use

    Hide Infrastructure 

    T1665 

    Abused SOHO devices to facilitate covert cyber operations, as well as proxy malicious activity, via devices with geolocation in proximity to the target. 

    Proxy: External Proxy 

    T1090.002 

    Actor-controlled servers sent RTSP DESCRIBE requests destined for RTSP servers. 

    Proxy: Multi-hop Proxy 

    T1090.003 

    Used Tor and commercial VPNs as part of their anonymization infrastructure 

    Encrypted Channel 

    T1573 

    Connected to victim infrastructure using encrypted TLS. 

    Multi-Stage Channels 

    T1104 

    Used multi-stage redirectors for campaigns. 

    Table 11: Defense evasion (mobile framework)
    Tactic/Technique Title ID Use

    Execution Guardrails 

    Used multi-stage redirectors to verify browser fingerprints in some campaigns. 

    Execution Guardrails: Geofencing 

    Used multi-stage redirectors to verify IP-geolocation in some campaigns. 

    Table 12: Lateral movement
    Tactic/Technique Title ID Use

    Lateral Movement 

    Used native commands and open source tools, such as Impacket and PsExec, to move laterally within the environment. 

    Remote Services: Remote Desktop Protocol 

    Moved laterally within the network using RDP. 

    Table 13: Collection
    Tactic/Technique Title ID Use

    Email Collection 

    Retrieved sensitive data from email servers. 

    Email Collection: Remote Email Collection 

    Used server data exchange protocols and APIs such as Exchange Web Services (EWS) and IMAP to exfiltrate data from email servers. 

    Automated Collection 

    Used periodic EWS queries to collect new emails. 

    Video Capture 

    Attempted to gain access to the cameras’ feeds. 

    Archive Collected Data 

    Accessed files were archived in .zip files prior to exfiltration. 

    Archive Collected Data: Archive via Utility 

    Prepared zip archives for upload to the actors’ infrastructure. 

    Table 14: Exfiltration
    Tactic/Technique Title ID Use

    Exfiltration Over Alternative Protocol 

    Attempted to exfiltrate archived data via a previously dropped OpenSSH binary. 

    Scheduled Transfer 

    Used periodic EWS queries to collect new emails sent and received since the last data exfiltration. 

    Appendix B: CVEs exploited

    Table 15: Exploited CVE information
    CVE  Vendor/Product  Details

    RARLAB WinRAR 

    Allows execution of arbitrary code when a user attempts to view a benign file within a ZIP archive. 

    Microsoft Outlook 

    External actors could send specially crafted emails that cause a connection from the victim to an untrusted location of the actor’s control, leaking the Net-NTLMv2 hash of the victim that the actor could then relay to another service to authenticate as the victim. 

    Roundcube Webmail 

    Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search params. 

    Roundcube Webmail 

    An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16 and 1.4.x before 1.4.10, where a plaintext email message with JavaScript in a link reference element is mishandled by linkref_addindex in rcube_string_replacer.php. 

    Roundcube Webmail 

    Roundcube Webmail before 1.4.4 allows arbitrary code execution via shell metacharacters in a configuration setting for im_convert_path or im_identify_path in rcube_image.php. 

    Appendix C: MITRE D3FEND Countermeasures

    Table 16: MITRE D3FEND countermeasures
    Countermeasure Title  ID  Details 

    Network Isolation 

    Employ appropriate network segmentation. Disable Universal Plug and Play (UPnP), Peer-to-Peer (P2P), and Anonymous Visit features on IP cameras and routers. 

    Access Mediation 

    Limit access and utilize additional attributes (such as device information, environment, and access path) when making access decisions. Configure access controls carefully to ensure that only well-maintained and well-authenticated accounts have access. 

    Inbound Traffic Filtering 

    Implement host firewall rules to block connections from other devices on the network, other than from authorized management devices and servers, to prevent lateral movement. 

    Resource Access Pattern Analysis 

    Use automated tools to audit access logs for security concerns and identify anomalous access requests. 

    Outbound Traffic Filtering 

    Block NTLM/SMB requests to external infrastructure. 

    Platform Monitoring 

    Install EDR/logging/cybersecurity solutions onto high value systems with large amounts of sensitive data such as mail servers and domain controllers. 

    System File Analysis 

    Collect and monitor Windows logs for certain events, especially for events that indicate that a log was cleared unexpectedly. 

    Application Hardening 

    Enable optional security features in Windows to harden endpoints and mitigate initial access techniques. 

    Application-based Process Isolation 

    Enable attack surface reduction rules to prevent executable content from email. 

    Executable Allowlisting 

    Enable attack surface reduction rules to prevent execution of files from globally writeable directories, such as Downloads or %APPDATA%. 

    Execution Isolation 

    Unless users are involved in the development of scripts, limit the execution of scripts (such as batch, JavaScript, and PowerShell) to known scripts. 

    Application Configuration Hardening 

    Disable Windows Host Scripting functionality and configure PowerShell to run in Constrained mode. Disable protocols that use weak authentication (e.g., clear-text passwords, or outdated and vulnerable authentication or encryption protocols) or do not support multi-factor authentication. Turn off other ports/services not in use (e.g., FTP, web interface, etc.). 

    Process Spawn Analysis 

    Use open source SIGMA rules as a baseline for detecting and alerting on suspicious file execution or command parameters. 

    URL Reputation Analysis 

    Use services that provide enhanced browsing services and safe link checking. 

    Network Access Mediation 

    Do not allow incoming traffic, especially logins to systems, from public VPN services. Where possible, logins from public VPNs, including exit nodes in the same country as target systems, should be blocked or, if allowed, alerted on for further investigation. Ensure cameras and other Internet of Things devices are protected by a security appliance, if possible. 

    DNS Denylisting 

    Do not allow outgoing traffic to hosting and API mocking services frequently used by malicious actors. 

    Domain Name Reputation Analysis 

    Heuristic detections for web requests to new subdomains may uncover malicious phishing activity. Logging the requests for each sub-domain requested by users on a network, such as in DNS or firewall logs, may enable system administrators to identify new targeting and victims. 

    Multi-factor Authentication 

    Use MFA with strong factors and require regular re-authentication, especially for management accounts. 

    Job Function Access Pattern Analysis 

    Implement other mitigations for privileged accounts: including limiting the number of admin accounts, considering using hardware MFA tokens, and regularly reviewing all privileged user accounts. 

    User Account Permissions 

    Separate privileged accounts by role and alert on misuse of privileged accounts. Audit user accounts on all devices to ensure they are an accurate reflection of your organization and that they are being used as expected. 

    Token-based Authentication 

    Reduce reliance on passwords; instead, consider using services like single sign-on. 

    Credential Hardening 

    Do not store passwords in Group Policy Preferences (GPP). Remove all passwords previously included in GPP and change all passwords on the corresponding accounts. 

    Authentication Event Threshholding 

    Use account throttling or account lockout. Throttling progressively increases time delay between successive login attempts. If using account lockout, allow between 5 to 10 attempts before lockout. 

    Strong Password Policy 

    Use a service to check for compromised passwords before using them. 

    Credential Rotation 

    Change all default credentials. 

    Encrypted Tunnels 

    Disable protocols that use weak authentication (e.g., clear-text passwords, or outdated and vulnerable authentication or encryption protocols). Use a VPN for remote connections to devices. 

    Software Update 

    Apply security patches and firmware updates to all devices. Ensure devices are currently supported. Replace devices that are end-of-life. 

    Agent Authentication 

    Ensure authentication is enabled for remote access to devices. If supported on IP cameras, enable authenticated RTSP access only. 

    User Behavior Analysis 

    Review all authentication activity for remote access to make sure it is valid and expected. Investigate any unexpected or unusual activity. 

    MIL Security OSI -

  • MIL-OSI: IP Fabric Advances Security Posture Assurance with Firewall Discovery and Simulation

    Source: GlobeNewswire (MIL-OSI)

    BOSTON, May 21, 2025 (GLOBE NEWSWIRE) — IP Fabric, the Automated Infrastructure Assurance Platform, today announced advanced firewall management features that close critical security and compliance gaps. The latest release includes firewall filtering simulation, transparent firewall discovery and visualization, enhanced compliance checks and granular access controls. These capabilities give enterprises full visibility into how traffic is encrypted, filtered and enforced — helping teams detect misconfigurations, ensure that every firewall is discovered and modeled, and create triggers to automate responses to risk in partnership with the firewall management systems already in use.

    Up to 20% of a network — including the critical firewalls that block malicious traffic and access — are improperly configured in enterprise companies. IT leaders carry a fiduciary responsibility to ensure infrastructure is secure, compliant and cost-effective, starting with a complete understanding of network assets and behavior. Security assessors and regulatory auditors know this, which is why firewall configurations are integral to controls outlined in global frameworks like NIST, CIS, ISO 27001 and SOC 2. IP Fabric’s latest release shows exactly how all firewalls, segmentation and encrypted traffic behave in the real world to reduce risk created by gaps in defense, strengthen protection and speed audit preparation.

    “Infrastructure defense shouldn’t live in silos, but too often our tools and teams do,” said Pavel Bykov, CEO and co-founder of IP Fabric. “We’re giving IT and security teams a shared, end-to-end understanding of how traffic flows, including how it’s encrypted, filtered and enforced across transparent firewalls and IPSec tunnels. When you can visualize devices, end-to-end paths, misconfigurations and gaps in your defense in context, you can take informed action to strengthen your security posture, prove continuous compliance and avoid unbudgeted costs.”

    Key security and compliance enhancements in IP Fabric 7.2

    1. Modern firewall filtering simulation: See how traffic is allowed or blocked by URLs, threat feeds and domain names.

    2. Transparent firewall discovery and visualization: Visualize Layer 2 firewalls and encrypted tunnels to improve monitoring and detect gaps in defense. Now supporting Palo Alto Networks, FortiGate and Firepower firewalls.

    3. Enhanced compliance and intent checks: Identify all devices in the traffic path, map CVEs to vulnerable assets and run tailored checks to spot misconfigurations faster in support of global security frameworks such as NIST, CIS, ISO 27001 and SOC 2.

    4. Granular user access controls for security extensions: Restrict who can deploy or edit automation scripts to prevent unauthorized changes and support compliance.

    5. Next-generation firewall management: Ensure security posture consistently among firewalls both on-prem and in the public cloud, regardless of vendor. Trigger changes based on up-to-date insights into compliance and network behavior.

    By delivering unparalleled visibility and control into security policies, firewall enforcement and compliance posture, IP Fabric’s latest release empowers enterprises to close security gaps before attackers exploit them.

    For a complete list of features included in IP Fabric 7.2 visit the company blog.

    About IP Fabric
    IP Fabric is the industry’s leading automated infrastructure assurance platform, offering a continuously validated view of cloud, network and security infrastructure to improve stability, security and spend. Within minutes, the platform creates a unified view of devices, state, configurations and interdependencies, normalizing multi-vendor data and revealing operational truth through automated intent checks. By uncovering risks and providing actionable insights, IP Fabric empowers enterprises to accelerate IT and business transformation while reducing costs. Trusted by industry leaders like Red Hat, Major League Baseball and Air France, IP Fabric delivers the foundation for a secure and modern infrastructure.

    Learn more at ipfabric.io and follow the company on LinkedIn.

    Media Contact
    Liesse Jayalath
    ipfabric@lookleftmarketing.com

    A photo accompanying this announcement is available at https://www.globenewswire.com/NewsRoom/AttachmentNg/90b60f9f-ceea-4df0-8039-81e631394f01

    The MIL Network