NewzIntel.com

Category: Transport

  • MIL-Evening Report: Playing the crime card: do law and order campaigns win votes in Australia?

    Source: The Conversation (Au and NZ) – By Chloe Keel, Lecturer in Criminology and Criminal Justice, Griffith University

    Crime and public safety are usually the domain of state politics. But the Coalition tried to elevate them as key issues for voters in the recent federal election.

    Claiming crime had been “allowed to fester” under Labor, the opposition promised a A$750 million Operation Safer Communities plan, which included police strike teams targeting drugs, a national child sex offender register, and more money for Neighbourhood Watch.

    A Coalition government would also have given grants to community groups to install public lighting, bollards and CCTV cameras.

    But in the end, crime did not appear to be a deciding factor in the election, which was easily won by Labor.

    What does that tell us about leveraging public fear – either existing crime fears and general anxieties, or latent concerns that can be triggered – for political gain in Australia? Can it be a successful strategy?

    Stoking anxiety

    In culturally diverse countries, such as Australia and the United States, law and order rhetoric sometimes calls for supporting aggressive crime policies at the expense of racial and ethnic minorities, many of whom are immigrants.

    These policies can be effective in stoking public fear to win votes. US President Donald Trump’s exhortations on immigration and crime were a significant part of his election campaigns in 2016 and 2024.

    However, what experts call “protective factors”, such as strong communities and social cohesion, are important. They can reduce the influence of political narratives that try to define crime in narrowly punitive or racialised terms.

    Australia is not America

    Our peer-reviewed research, which will be published in the Journal of Criminology, investigated how public concerns about crime and safety in Australia and the US were associated with demographic factors that evolved over time. The study drew on data from the World Values Survey and indicated key differences in what makes Australians and Americans feel unsafe.

    We have found that in Australia in 2018, supporters of left-leaning parties (Labor/Green) reported feeling significantly safer than other voters. However, this gap disappeared when researchers took into account attitudes that blame crime problems on immigrants. This suggests immigrant-blaming in Australia can drive feelings of community fear and insecurity.

    The World Values Survey uncovered a different pattern in the US.

    Between 2011 and 2017, Republican voters reported feeling safer than other Americans – the opposite of Australia’s trend. The political divide in the US couldn’t be explained by immigrant-blaming attitudes. Rather, it was attributed to the “self-isolation” of American conservatives in more culturally homogeneous communities.

    Our study indicated that while immigration continued to influence safety perceptions in the US, it appeared to operate through different mechanisms than in Australia. Racial and ethnic minorities reported greater fear as the 2010s unfolded.

    Social connectedness also plays differently in each country. In Australia, trust in others and confidence in public institutions consistently influences safety perceptions. In the US, these factors have little impact.

    Social scientists have observed that in modern societies, responsibility for personal safety has increasingly shifted from the government to individuals. This trend is strong in the US, where market-focused, neoliberal economic and social policies dominate policies.

    By contrast, European research suggests stronger social welfare systems can reduce safety concerns by addressing underlying economic anxieties. Australia’s more robust social support appears to foster greater feelings of safety.

    Our research indicates social cohesion further helps reduce fear.

    Crime fears are not a vote winner

    Electoral strategies that seek to leverage public insecurities need to be understood in the context of these fear-mitigating factors. Media diversity can also counter fear-based messaging.

    In the 2018 Victorian election, crime became a prominent political issue through racialised commentary targeting “African gangs”. However, it failed to gain decisive political traction.

    Research found fear of crime was relatively rare in Victoria. Media reports of crime and comments by political leaders were distant from their own experiences

    With more diverse news sources and online platforms, political actors can no longer promote narratives unopposed. Fear-based messaging can backfire, especially when it overreaches.

    Outdated strategy

    Perceptions of crime are often shaped by a combination of actual crime rates and broader anxieties about social change, cultural difference, and uncertainty. This is frequently expressed as unease about the increasing presence of culturally diverse groups.

    While the coalition’s pivot to law-and-order rhetoric represented a familiar strategy, Labor positioned itself as the party of unity. This was underscored by Foreign Minister Penny Wong’s declaration after Labor won the election, in which she acknowledged

    […] the power in our 26 million people from more than 300 ancestries […] from the oldest continuing civilisation on the planet and I acknowledge the traditional owners. Friends, we love this country.

    Foreign Minister Penny Wong on election night.

    While harnessing fears of crime and cultural diversity was not effective in this election cycle, this is not the end of law and order politics. But the unique characteristics of this election appear to have rendered the formula less potent.

    Trump’s threat to democracy and the constitutional rule of law in the US may have fostered a sense of solidarity and social cohesion among Australian voters. Our research suggests this helped to mitigate fears about crime.

    The temptation to capitalise on law and order may continue to appeal to politicians. But in Australia, at least, there is no guarantee it will work.

    The authors do not work for, consult, own shares in or receive funding from any company or organisation that would benefit from this article, and have disclosed no relevant affiliations beyond their academic appointment.

    – ref. Playing the crime card: do law and order campaigns win votes in Australia? – https://theconversation.com/playing-the-crime-card-do-law-and-order-campaigns-win-votes-in-australia-256780

    MIL OSI Analysis – EveningReport.nz –

  • MIL-OSI USA: Welch Joins Colleagues in Introducing Resolution Reaffirming U.S.-Canada Partnership 

    US Senate News:

    Source: United States Senator Peter Welch (D-Vermont)
    WASHINGTON, D.C. — U.S. Senator Peter Welch today joined Senators Kevin Cramer (R-N.D.) and Angus King (I-Maine) in introducing a resolution to recognize the U.S.-Canada partnership and its shared interests in economic, energy and critical minerals, and national security. The United States and Canada share three oceans and the world’s longest border. About 400,000 people and more than $2.5 billion worth of goods and services move across the U.S.-Canada border each day. 
    Canada is the largest trading partner for 34 U.S. states, including Vermont. In 2024 alone, trade with Canada accounted for 35% of Vermont’s exports, 67% of imports, and 56% of its total trade. One in four businesses in Vermont relies on trade with Canada and sells more goods to Canada than the next six largest foreign markets combined. In 2023, Vermont exported $150 million just in food and agricultural products to Canada. 
    “Canada is Vermont’s biggest trading partner and one of our most important allies—but first and foremost, they’re our friend. That friendship is based on centuries of trust and mutual respect, and the success of our northern neighbors directly impacts the success of hardworking families, businesses, farms, and manufacturers here in the United States. This administration is challenging that relationship,” said Senator Welch. “Attacks on Canada—whether through rhetoric or reckless trade policy—are eroding the bond between our two countries. Staying rooted in the values that have defined our relationship over time–respect, trust, and friendship–are vital to strengthening our alliance now and in the future.” 
    “Representing a Northern border state, I recognize the importance of the unique partnership between the United States and Canada,” said Senator Cramer. “Not only are our neighbors to the north crucial economic and national security partners, but they are literally our closest ally. This resolution celebrates our closeness and is a testament to the enduring strength, friendship, and importance of the U.S.-Canada alliance across the country and the globe.” 
    “The United States and Canada have always been closely tied; we share our economies, cultures, military interests and more. In fact, in Maine, even our next door neighbor lives right across the border,” said Senator King. “I continue to be proud of the work we have achieved under the American-Canadian Economy and Security (ACES) Caucus alongside my Senate Co-Chair Kevin Cramer, but know that the current situation presents many unfortunate challenges. While I am excited to reintroduce this resolution to reaffirm our two nations’ commitment to one another, we must acknowledge the close ties between our countries to resolve and mitigate any potential disruptions to our intertwined interests. As close trade partners and allies, I look forward to strengthening this close alliance to tackle these shared challenges and seize new opportunities.” 
    Among other provisions, the resolution recognizes the relationship between the United States and Canada is critical to promoting peace, expanding global economic opportunity, and being prepared to respond to unforeseen events. It also reaffirms the bilateral and international alliance between the two countries, which allows both countries to face common threats together and uphold common values, including democracy, human rights, and the rule of law. 
    Additionally, the resolution emphasizes the shared defense and security commitments between the two nations, including the modernization of the North American Aerospace Defense Command (NORAD), joint border security initiatives, and cooperation in combating transnational threats such as illegal migration and fentanyl trafficking. 
    In addition to Senators Welch, Cramer, and King, the resolution is supported by Sens. Mike Crapo (R-Idaho), Maggie Hassan (D-N.H.), Marsha Blackburn (R-Tenn.), Amy Klobuchar (D-Minn.), Susan Collins (R-Maine), Lisa Murkowski (R-Ark.), and Mike Rounds (R-S.D.). A similar resolution was introduced in the House by U.S. Representative Mark Amodei (R-NV-02). 
    Read and download the full text of the resolution. 

    MIL OSI USA News –

  • MIL-OSI USA: Congressman Valadao Fights to Improve Central Valley Roads

    Source: United States House of Representatives – Congressman David G Valadao (CA-21)

    WASHINGTON – Today, Congressman David Valadao (CA-22) led Reps. Sheila Cherfilus-McCormick (FL-20), Vince Fong (CA-20), and Jim Costa (CA-21) in reintroducing the Farm to Market Road Improvement Act. In major agricultural regions like the Central Valley, local roads and bridges are traveled often by heavy trucks hauling up to 80,000 pounds of agricultural freight. This constant strain leads to serious wear and tear, and it’s often local governments left footing the bill. This bipartisan bill would make additional federal resources available to help repair and maintain the infrastructure that keeps America’s food supply chain moving.

    Congressman Valadao introduced the Farm to Market Road Improvement Act in the 118th Congress.

    “The Central Valley is the backbone of our nation’s food supply, but after years of wear and tear from heavy trucks, many of our rural roads are in desperate need of repair,” said Congressman Valadao. “This bipartisan bill gives our communities access to the federal resources needed to repair and strengthen critical infrastructure, and I’m proud to lead this effort to support our farmers, grow our economy, and keep America’s food supply chain moving.”

    “Farmers in the Glades rely on safe, drivable roads that allow them to feed families across both our state and nation,” said Congresswoman Cherfilus-McCormick. “I’m proud to introduce this bipartisan piece of legislation to protect our agricultural backbone, repair local infrastructure, and strengthen our supply chains.”

    “My district is one of the top agricultural producing regions in the nation, and I’m proud to partner with Congressman Valadao to create another resource to improve roadways in the Central Valley,” said Congressman Fong. “By investing in our rural infrastructure we’re supporting the hardworking farmers who feed America and strengthening the supply chain that keeps our economy moving.”

    “Our farmers grow the food that feeds the nation, but they can’t do it without reliable roads to get their goods to market. The Farm to Market Roads Improvement Act ensures that rural communities like those in the San Joaquin Valley aren’t left behind,” said Congressman Costa. “By setting aside dedicated funding for farm-to-market road projects, we’re investing in the backbone of America’s agricultural economy and strengthening our rural infrastructure.” 

    “Reps. Valadao, Cherfilus-McCormick, Fong, and Costa’s legislation directs more federal transportation funding to communities like Tulare County,” said Tulare County Association of Governments Chairman Rudy Mendoza. “Our roads are used not only by residents traveling to work, but by agricultural goods on their way to markets across the world. This bill recognizes the national economic impact of our region and we appreciate our Congressional delegation’s continued support.”

    “Our local economy depends on safe, reliable infrastructure to move agricultural goods efficiently from the fields to the market,” said Kings County Supervisor Doug Verboon. “Farm-to-market roads are vital for connecting growers to processors, distributors, and markets across the region. The Farm to Market Road Improvement Act recognizes the unique transportation needs of rural farming communities and delivers the kind of targeted federal investment needed to maintain and modernize these critical routes.”

    “We welcome Rep. Valadao’s attention on this issue, particularly at a time when investments in our nation’s rural infrastructure continues to lag behind our more urban areas,” said Shannon Douglass, President, California Farm Bureau. “As we like to say—food security is national security—and this legislation would help provide a much-needed boost towards protecting our critical food supply chains.” 

    “Palm Beach County, Florida supports resources to agricultural and rural communities to assist in repairing Farm to Market roads as efficiently as possible, so that agricultural products can be transported safely and quickly from farms to consumers,” said Maria G. Marino, Mayor, Palm Beach County, FL. “We support the legislative efforts of Reps. Valadao, Cherfilus-McCormick, Fong and Costa to define Farm-to-Market Roads in eligible counties, ensuring that 10% of the Rural Transportation Grant Program is directed to these crucial agricultural roadways.”

    Background:

    The Farm to Market Road Improvement Act would create a 10 percent set aside in the Rural Surface Grant Transportation Program for farm to market roads. Farm to market roads would be defined by this legislation as roads within a county that have an annual gross ag production value of at least $1 billion and ag production of at least $500,000 per square mile. Kern, Kings, and Tulare Counties all qualify under these criteria. The DOT and USDA would be required to create, and annually update, a list of covered counties.

    Read the full bill here.

    ###

    MIL OSI USA News –

  • MIL-OSI New Zealand: Dansey Road, Ngongotaha Valley is closed due to a serious crash

    Source: New Zealand Police


    District:

    Bay of Plenty

    At around 8am emergency services received reports of a two-vehicle crash, where there are thought to be serious injuries.

    Traffic is being diverted onto State Highway 5.

    Motorists are asked to take alternate routes if possible.

    ENDS

    MIL OSI New Zealand News –

  • MIL-OSI: Best Same Day Payday Loans for Quick Cash in 2025: MoneyMutual Picked as the Top Pick for Guaranteed Approval

    Source: GlobeNewswire (MIL-OSI)

    Las Vegas, NV, May 21, 2025 (GLOBE NEWSWIRE) —

    In today’s unpredictable economy, financial emergencies rarely come with a warning. A sudden car repair, medical bill, or missed paycheck can send even the most prepared households into a scramble. In such moments, speed isn’t just convenient, it’s essential.

    As Americans increasingly turn to fast, flexible lending options, the demand for same-day payday loans has surged. Just as we expect rapid food delivery and real-time updates, financial solutions must also keep pace. Consumers want cash in hand, not tomorrow, but today.

    Amid a crowded field of lenders and brokers, MoneyMutual has emerged as the leading online platform connecting borrowers with trusted same-day payday loan providers. Recognized for its efficiency, wide lender network, and secure process, MoneyMutual stands out as the top choice for those seeking fast financial relief in a pinch.

    Stay with us as we take a closer look at how MoneyMutual works and why it’s become the go-to resource for same-day lending solutions in 2025.

    >> Consider MoneyMutual for Same Payday Loans >>

    Overview of the Leading Same Day Payday Loan Connection Service – MoneyMutual

    When time is of the essence and financial relief can’t wait, MoneyMutual stands at the forefront of same-day payday loan connection services. With a reputation built on speed, simplicity, and trust, the platform offers a fast and accessible route for borrowers seeking immediate financial support.

    Speed of Potential Funding: One of MoneyMutual’s standout features is its ability to facilitate rapid access to funds, often as soon as the same business day. After submitting a short application, borrowers are swiftly connected with a lender from the platform’s expansive network. If approved, funds can be deposited directly into the applicant’s bank account within hours, depending on the lender’s processing times and bank policies.
    Extensive Lender Network: MoneyMutual doesn’t issue loans directly. Instead, it acts as a trusted intermediary, linking users to an array of verified online payday lenders. This expansive network increases the chances of loan approval by matching borrower needs with the criteria of various lending partners.

    >> Visit MoneyMutual to Find Out More >>

    Key Evaluation Factors

    To determine why MoneyMutual stands out among same-day payday loan connection services, several key factors were assessed, from lender quality to user experience.

    Quality and Size of Lender Network
    MoneyMutual partners with over 60 lenders, ranging from specialized payday providers to short-term installment loan companies. These are vetted for reliability and compliance, offering borrowers a better shot at finding a match tailored to their financial situation.

    Accessibility of Loan Options
    The platform supports a broad range of loan amounts, typically between $100 and $5,000, depending on individual lender terms and borrower qualifications. This flexibility accommodates everything from small emergencies to more urgent, moderate expenses.

    Potential for Rapid Funding
    Once connected with a lender, borrowers may receive funds as quickly as within 24 hours, and in some cases, the same day. This makes MoneyMutual a highly attractive option for those facing time-sensitive financial stressors.

    Platform Usability
    The MoneyMutual website is designed for ease and efficiency, featuring mobile compatibility and streamlined navigation. Borrowers can apply, review offers, and connect with lenders all within minutes.

    Simple Application Process
    Filling out MoneyMutual’s secure online form typically takes under five minutes. Applicants provide basic information about their income, employment status, and banking details. Once submitted, the platform immediately begins matching them with potential lenders.

    Features for Borrowers
    MoneyMutual allows users to compare loan offers from multiple lenders in one place. This increases transparency and empowers users to select the option that best meets their needs.

    Transparency of Lender Terms
    While MoneyMutual itself doesn’t dictate terms, it emphasizes partnerships with lenders that clearly disclose loan amounts, repayment dates, APRs, and fees, a crucial feature in helping borrowers make informed decisions.

    Ease of Navigation
    The website features a clean, modern interface with clear calls-to-action and informative content. Even first-time users will find it intuitive to use on desktop or mobile.

    Typical Loan Parameters
    Loan amounts facilitated through MoneyMutual generally range from $100 to $5,000, with repayment periods often between 14 and 30 days, depending on the lender and state regulations. Some lenders may offer extended terms for installment loans.

    >> Consider MoneyMutual for Same Payday Loans >>

    Pros and Cons of MoneyMutual for Same Day Payday Loans

    In a financial climate where speed often matters most, MoneyMutual has emerged as a go-to marketplace for borrowers seeking same day payday loans. But how does it really stack up? We take a closer look at the platform’s key advantages and potential drawbacks as more Americans turn to short-term lending for emergency expenses.

    Pros:

    • Potential for Fast Fund Access: Many users report receiving funds as soon as the next business day, sometimes even within hours, depending on the lender.
    • Large Network of Participating Lenders: MoneyMutual connects users with a broad pool of lenders, increasing the chances of finding a match, even with less-than-perfect credit.
    • Streamlined Online Application Process: The initial form takes just minutes to complete, making it ideal for time-sensitive borrowing needs.
    • User-Friendly Online Platform: The website is simple to navigate, guiding applicants from inquiry to lender match with minimal friction.
    • Opportunity to Compare Multiple Loan Offers: Users can review different offers and select terms that best align with their needs before committing.

    Cons:

    • MoneyMutual Is Not a Direct Lender: The platform acts as a facilitator, meaning users must evaluate and finalize terms with third-party lenders independently.
    • Loan Terms and Interest Rates Vary by Lender: APRs, repayment windows, and fees differ widely, and borrowers must scrutinize each offer carefully.
    • Payday Loans Typically Involve High Interest Rates and Fees: Even when fast cash is needed, these loans can become costly, especially if rolled over or extended.

    How to Utilize MoneyMutual for Potential Same Day Payday Loans

    As financial pressures grow for millions of Americans, platforms like MoneyMutual are seeing increased usage from borrowers in need of quick cash. Here’s how consumers can navigate the service to potentially access same day payday loans.

    Step-by-Step Process:

    • Visit the Official MoneyMutual Website: Begin by going to MoneyMutual.com, where users can start the loan inquiry process directly from the homepage.
    • Complete the Secure Online Application Form: Applicants are asked to enter basic personal and financial information. The form typically takes just a few minutes and is encrypted to protect sensitive data.
    • Review Loan Offers from Lenders in the Network: Once submitted, the system distributes the application to a network of participating payday lenders. Eligible borrowers may receive multiple offers to compare.
    • Examine Terms and Conditions Carefully Before Accepting: Each lender sets its own rates, fees, and repayment requirements. Experts caution that borrowers should read all terms closely and ensure they understand the total repayment cost before agreeing to any loan.

    With no obligation to accept an offer, MoneyMutual serves as a free intermediary rather than a direct lender. However, borrowers should be aware of state-specific payday loan regulations and consider all financial alternatives before proceeding.

    Types of Short-Term Financial Assistance Facilitated by MoneyMutual

    As rising costs and inflation strain household budgets, Americans are increasingly turning to alternative lending platforms for fast, flexible cash solutions. Among them, MoneyMutual has gained traction as a major online marketplace that connects borrowers with lenders offering a variety of short-term financial products. While the platform itself isn’t a direct lender, it facilitates access to multiple loan types tailored for immediate financial relief.

    Here’s a closer look at the key types of loans available through the MoneyMutual network:

    • Payday Loans: These are brief, high-cost loans intended to cover expenses until the borrower’s next paycheck. Loan amounts are typically small, often between $100 and $1,000, but carry high interest rates and fees. While controversial due to their cost, payday loans remain a common solution for those facing sudden emergencies like utility shutoff notices or medical expenses.
    • Short-Term Loans: This broader category includes installment loans and other forms of lending with short durations, usually ranging from a few weeks to several months. These loans may offer slightly more favorable repayment terms than traditional payday loans and can be used for a variety of needs, such as auto repairs, rent payments, or temporary income disruptions.
    • Bad Credit Loans: For borrowers with low credit scores or limited credit history, MoneyMutual helps facilitate access to lenders willing to work with higher-risk applicants. These loans come with elevated interest rates but offer a vital financial lifeline to consumers often excluded from traditional banking systems.
    • Cash Advances: Cash advances are designed for rapid disbursement, sometimes within 24 hours, and are ideal for extremely time-sensitive expenses. Typically repaid from the borrower’s next paycheck, these loans are often used to bridge the gap between pay periods or when an unexpected cost arises.

    While these financial products can offer short-term relief, experts caution they should be used carefully. Borrowers are urged to read loan terms closely, understand all associated fees, and assess whether repayment timelines align with their income schedule. Platforms like MoneyMutual may provide access, but financial responsibility lies squarely with the borrower.

    Customer Support and Resources Offered by MoneyMutual

    As more consumers turn to online lending marketplaces for fast financial relief, support and transparency have become increasingly important. MoneyMutual offers a basic but functional support system designed to guide users through the lending process.

    Unlike direct lenders, MoneyMutual serves as an intermediary, connecting users with its network of more than 60 short-term lenders. Because of this, its customer support doesn’t extend to loan management or repayment issues, which must be handled directly with the individual lender. However, the platform does provide users with access to key resources that help clarify how the loan matching process works.

    The company maintains a comprehensive FAQ section on its website, offering clear answers to common questions about eligibility, the loan request process, credit requirements, and fund disbursement. The site also outlines what borrowers can expect after being matched with a lender and encourages users to review terms carefully before signing any agreement.

    The platform doesn’t offer live chat or in-depth financial education tools, it emphasizes its role as a free service to connect borrowers with loan offers, placing the responsibility of further communication and decision-making on the user.

    Potential Disbursement Methods Through MoneyMutual’s Network

    As more consumers turn to online lending platforms for fast financial relief, how those funds are delivered becomes just as critical as loan approval itself. MoneyMutual, one of the most recognized payday loan marketplaces, connects borrowers with a wide range of lenders, each offering different methods of disbursing funds.

    • Direct Deposit to Bank Account: The most widely used and efficient method among lenders in the MoneyMutual network is direct deposit. Once approved, borrowers may receive funds directly into their checking account, often within 24 hours. For many facing urgent expenses, this speed and convenience are a significant advantage.
    • Other Methods (Varies by Lender): While direct deposit remains the standard, some lenders may offer alternative electronic disbursement options, such as ACH transfers or prepaid debit card funding. However, availability can vary by lender and borrower location, and these alternatives may affect how quickly funds are accessible.

    Borrowers using MoneyMutual should confirm disbursement methods and timelines directly with their matched lender to ensure there are no delays in accessing their funds.

    Navigating Same Day Payday Loans Responsibly: Important Cautions

    Same day payday loans can serve as a financial lifeline in moments of crisis, but they must be approached with caution. The high interest rates, short repayment terms, and risk of repeat borrowing make them a risky option for most consumers. 

    By understanding the costs, reading loan terms carefully, and seeking alternative financial solutions where possible, borrowers can protect themselves from unnecessary financial hardship. Responsible borrowing begins with informed decision-making, and when in doubt, seeking professional financial guidance is always a wise move.

    Understand the High Costs
    Same day payday loans may provide fast funds, but they are among the most expensive forms of borrowing available. These loans typically carry high interest rates, with annual percentage rates (APRs) that can reach or exceed 300%. 

    In many cases, the fees and interest owed may be nearly as much as the original loan amount. For example, borrowing $300 could cause repaying $375 or more in just two weeks. Without a clear repayment strategy, the costs can escalate quickly, especially if the borrower is forced to extend or roll over the loan.

    Review Loan Terms Carefully
    Payday loans are legally required to disclose all terms and fees, but borrowers often overlook the fine print. Each lender may have different repayment policies, fees for late or missed payments, or clauses that allow for automatic withdrawal from a borrower’s checking account. 

    Carefully reviewing these terms before accepting a loan is essential. Understanding the total repayment amount, due date, and what happens if repayment is delayed can help prevent surprises and avoid spiraling fees.

    Borrow Only What You Can Repay
    It may tempt you to borrow the maximum amount offered, especially when facing financial stress. However, payday loans are due in full within a short timeframe, usually on your next payday. Borrowing more than you can reasonably afford to repay can quickly result in bounced payments, overdraft fees, or the need to take out additional loans.

    A good rule of thumb is to borrow the minimum amount needed and ensure that full repayment can be made from your next paycheck without jeopardizing other essential expenses.

    Be Aware of Short Repayment Periods
    Unlike personal loans or credit cards that allow for flexible monthly payments, payday loans are typically due in a lump sum within 14 to 30 days. This compressed repayment window can strain already tight budgets.

    Missing the repayment deadline can trigger additional fees and result in a cycle of borrowing and debt accumulation. Many borrowers find themselves having to take out new payday loans just to cover the previous ones, further increasing financial stress.

    Consider Alternatives First
    Before committing to a payday loan, it’s worth exploring other, less expensive borrowing options. Credit unions often offer Payday Alternative Loans (PALs), which feature lower interest rates and longer repayment periods. Some banks provide small-dollar personal loans with predictable terms. 

    Other alternatives include negotiating payment plans with utility companies, seeking temporary hardship assistance from local nonprofits, or utilizing buy now, pay later services for specific purchases. These alternatives may not offer instant cash, but they typically come with fewer long-term risks and better repayment flexibility.

    Recognize the Risk of Debt Traps
    One of the most concerning aspects of payday loans is the potential for borrowers to fall into a debt trap. Many payday loan users find themselves unable to repay the full balance on time and must take out another loan to cover the previous one. This cycle of borrowing and repayment often continues for months, with fees compounding at every step. 

    Over time, a small loan can grow into a major debt burden, affecting a borrower’s ability to meet other financial obligations and damaging their overall financial stability.

    Seek Financial Advice if Needed
    For those considering payday loans or currently struggling with repayment, seeking help from a financial advisor or credit counselor can be a valuable step. Nonprofit credit counseling agencies offer free or low-cost services that include budgeting support, debt management plans, and guidance on safer borrowing options. 

    Some states and local governments also provide financial education programs to help consumers better understand loan terms and credit usage. Accessing these resources can provide long-term financial strategies that reduce reliance on high-cost, short-term loans.

    Frequently Asked Questions

    If you’re considering a same-day payday loan, it’s important to understand exactly how these loans work, what they cost, and what to expect from the process. Below are answers to the most common questions borrowers ask before applying.

    What Is a Same-Day Payday Loan?
    A same-day payday loan is a short-term, high-interest loan designed to give borrowers quick access to cash, usually on the same day they apply. These loans are used to cover urgent expenses such as medical bills, car repairs, or unexpected utility payments. The loan amount is usually small (often between $100 and $1,000) and must be repaid in full on your next payday, usually within two to four weeks.

    How Quickly Can I Get the Money?
    If approved, many lenders can deposit funds into your bank account within a few hours or by the end of the business day. However, actual timing depends on when you apply, the lender’s processing speed, and your bank’s deposit policies. Some lenders offer instant funding or same-day direct deposit if applications are submitted early in the day, while others may require overnight processing.

    Do I Need Good Credit to Get a Same-Day Payday Loan?
    No, same-day payday loans are generally accessible to borrowers with poor credit or no credit history at all. Most lenders don’t perform hard credit checks and instead focus on your income, employment status, and ability to repay the loan. Proof of a steady income, a valid ID, and an active checking account are typically the main requirements for approval.

    What Are the Costs Associated With Same-Day Payday Loans?
    Same-day payday loans can be very expensive. While the fees may seem modest upfront, the annual percentage rates (APRs) can reach 300% or more. For example, a $300 loan with a $45 fee for two weeks equates to a 391% APR. Failing to repay the loan on time can lead to additional fees, interest, and in some cases, collection activity. Always review the full cost of borrowing before committing.

    Can I Extend or Roll Over My Payday Loan If I Can’t Repay It on Time?
    Some lenders may offer extensions or rollovers, which allow you to delay repayment by paying an additional fee. However, this often leads to a cycle of debt, as the interest continues to accrue. Rolling over a loan once or multiple times can double or even triple your repayment obligation. If you’re struggling to repay, it’s best to contact the lender early and explore options, or seek help from a nonprofit credit counselor to avoid escalating costs.

    Editorial Note
    This article is provided solely for informational and entertainment purposes. Nothing within should be interpreted as legal, financial, or professional advice. Readers should carry out their own research before participating in payday loans.

    Affiliate Transparency
    This article may include affiliate links. If you click on a link and make a purchase or register, a commission may be earned, at no extra cost to you.

    Syndication and Liability Disclaimer
    Any third-party publishers, media platforms, or syndication partners that republish this content do so understanding that it’s meant for informational purposes only. These entities aren’t responsible for the legality, relevance, or interpretation of the material.

    Contact

    • Company: MoneyMutual
    • Address: 2510 E. Sunset Rd. Ste 6, #85 Las Vegas NV, 89120
    • Email: customerservice@moneymutual.com
    • Phone Support: 844-276-2063

    Attachment

    The MIL Network –

  • MIL-OSI: Best Mobile Tracking & Monitoring App 2025: mSpy Review – Top Mobile Spy App for Hidden Phone Surveillance

    Source: GlobeNewswire (MIL-OSI)

    New York City, NY, May 21, 2025 (GLOBE NEWSWIRE) — In the contemporary era of digitization, the ubiquity of smartphones has redefined our modes of communication and global connectivity.

    Concomitant with this technological progress, the surge of phone surveillance applications has emerged, granting a window into the undertakings and engagements transpiring on these gadgets.

    Track Instantly with the Best Mobile Tracking App – Try mSpy Before It’s Too Late!

    While phone surveillance software wields considerable potential within certain contexts, it is imperative to undertake their employment with a discerning consciousness of accountability and ethical considerations.

    Observing the current landscape, it becomes evident that social media platforms and mobile devices have assumed roles of paramount significance in the contemporary child’s life. Per findings unveiled by the Common Sense Census, a notable 84% of American adolescents within the age cohort of 13 to 18 acquired their initial smartphone during the year 2019. Subsequently, these youths dedicated an average of precisely 7 hours and 22 minutes daily, exclusively engrossed in social media applications and websites.

    ✅ Top Pick: mSpy – Best Mobile Spy & Monitoring App for Hidden Phone Surveillance this year.

    While the internet undeniably furnishes global youngsters with a commendable avenue for unfettered education and communication, it has concurrently engendered a milieu wherein they engage with individuals entirely unfamiliar to them. This virtual realm’s essence necessitates an appraisal of the electronic safety quotient. Young minds stand perpetually exposed to online perils, ranging from cyberbullying and harassment to the insidious realm of sextortion. Beyond this, extensive social media usage harbors the potential to precipitate internet dependency, potentially culminating in social interaction deficits amongst the youthful demographic.

    Don’t Settle for Less: Get the Best Mobile Spy App of 2025 – mSpy Is All You Need

    Advancements in technology are progressing rapidly, and the pervasive presence of smartphones is evident across diverse age groups. People spanning from children to adults rely on various applications and mobile services to facilitate their daily routines. The desire to ensure your children’s well-being in the digital realm, gather pertinent information from your spouse’s mobile device, or optimize workforce efficiency might lead to the inclination of discreetly and autonomously monitoring a specific individual’s Android device.

    However, not all of these options prove to be efficient and valuable. Among the array of spy applications we evaluated, mSpy emerged as our paramount selection after meticulous scrutiny. 

    Why Mobile Tracking Apps Are in High Demand in 2025
    The need for mobile tracking and monitoring apps has surged in 2025. With nearly everyone relying on smartphones for work, social interaction, and entertainment, concerns around digital safety, accountability, and privacy breaches have grown. Parents are more cautious than ever about their children’s online activity. Employers are seeking better ways to monitor company-issued devices. Even individuals in relationships are using tracking apps to rebuild trust or stay informed.
    Monitor Any Device in Stealth Mode – mSpy Is the Best Mobile Tracking App Trusted Worldwide
    Cyberbullying, online predators, screen addiction, and unauthorized data sharing are just a few reasons why mobile tracking solutions are in high demand. At the same time, the rise of remote workforces has made employee monitoring essential for business owners to prevent misuse of company time and resources.
    Apps like mSpy have emerged as tools that provide peace of mind. They offer insight into text messages, GPS locations, app usage, and more—without requiring direct access to the device in real time. These tools are becoming an integral part of modern digital life, helping people feel more secure in a hyper-connected world.
    What to Look For in a Mobile Spy App
    Not all mobile tracking apps are created equal. Some offer advanced features but lack ease of use; others are stealthy but limited in scope. If you’re looking for a phone spy app in 2025, there are several key features to prioritize.
    First, compatibility is crucial—make sure the app works on both Android and iOS devices. Look for real-time GPS tracking, call and SMS logs, social media monitoring, and browsing history access. The app should run discreetly in the background to avoid detection and provide a user-friendly dashboard for accessing tracked data.
    Security is equally important. Top-tier apps use encrypted data channels to ensure privacy, both for the person being monitored and the one viewing the information. Reliable customer support, frequent updates, and clear installation guides also add to a tool’s credibility.
    When evaluating mobile monitoring software, features like geofencing, app usage limits, and screen time analysis can add extra value—especially for parental use. A well-rounded app like mSpy offers all of these while keeping the setup process simple and discreet.
    Full Access. Zero Detection. mSpy Is the Best Mobile Spy App for Hidden Surveillance
    Is Phone Spying Safe & Ethical?
    Phone tracking, when used ethically, can serve as a protective tool. But misuse can raise serious privacy concerns. The line between security and surveillance often comes down to intent—and legality.
    In many countries, it’s legal for parents to monitor the phones of their minor children without consent. Employers may also monitor company-owned devices provided they disclose it in their policies. However, using a spy app to monitor a partner or adult without consent can cross legal and ethical boundaries.
    Apps like mSpy are designed for legitimate use cases, particularly child safety and employee productivity. The app clearly states that users must comply with local laws and have proper authorization. If used responsibly, mSpy can empower users to stay informed and make proactive decisions without violating trust.
    Understanding the ethical framework before using any mobile spy app is critical. When used as intended—for safety, protection, and responsible oversight—it becomes a digital ally rather than an invasion of privacy.

    Top-Rated mSpy Deal: The #1 Phone Monitoring App Is Just a Click Away

    What Is mSpy?

    mSpy is a mobile tracking and monitoring application designed to give users discreet access to key data from smartphones and tablets. Introduced to the market in 2010, the spy application tailored for smartphones provides the capability to clandestinely observe individuals employing the designated device. It seamlessly integrates into employee phones or the devices of your progeny, facilitating real-time oversight of their whereabouts and engagements on the device.
    Leveraging mSpy’s free version, you can meticulously monitor diverse activities, encompassing geographic movements, social media interactions, phone conversations, as well as the dispatch and receipt of messages.

    The apex attribute of this application resides in its inconspicuous functionality, evading detection by the party under scrutiny. It discreetly operates in the backdrop, diligently acquiring information without arousing their awareness.

    Over the course of time, this technology has undergone refinement, with mSpy presently standing as the preeminent application of its genre. Its ascendancy is corroborated by a substantial user base exceeding one million parents who employ it as a means to oversee their children’s pursuits. Furthermore, it proves instrumental for spouses and employers who harbor the intent to gain insights into the activities of their target individuals.

    mSpy encompasses these pivotal features for parental supervision:

    • Online and application filtering — Dictate the permissible applications for your children and the websites they are permitted to access. It’s worth noting that mSpy’s capacity for website filtering is limited to specific blacklisting, without the option to categorically filter websites.
    • Location tracing — Maintain tabs on your child’s whereabouts and their historical movements.
    • Activity summaries — Consolidates and presents insights regarding your child’s device utilization, encompassing their most frequent contacts for messaging and calling, prevalent websites visited, and more.

    In addition to the aforementioned, mSpy boasts an array of supplementary functionalities, inclusive of call and SMS tracking, surveillance of social media applications, a keylogger, and screen recording capabilities.

    Get the Best Mobile Spy App of the Year – Instant mSpy Setup. No Tech Skills Needed.

    How does mSpy work?

    As previously indicated, subsequent to a successful installation of mSpy on the designated mobile device, it will seamlessly operate in the device’s background. It diligently assembles a wide spectrum of data from the said device, encompassing call logs, text messages, instant messaging dialogues, geographic positioning, among others, subsequently transmitting this data to your designated mSpy account.

    Subsequently, accessing your account is a streamlined process. You can effortlessly log into your account utilizing any web browser accessible through diverse devices such as mobile phones, desktops, and laptops, thus facilitating a thorough perusal of the accumulated information as per your convenience.
    Simplified Monitoring in Three Effortless Phases
    To initiate monitoring, you can effortlessly adhere to the ensuing three uncomplicated stages, commencing your child’s device oversight seamlessly.

    First Step: Select a Subscription
    Embark upon your journey by selecting an appropriate subscription plan from the mSpy website, catering to your precise software attribute prerequisites. Subsequently, finalize the purchase by inputting your payment particulars. Following this, an email confirming your transaction will be dispatched to your inbox.

    Second Step: Deploy mSpy onto the Target Device
    Contained within the welcome email is an installation manual, meticulously guiding you through the process of establishing the mSpy application upon the targeted device.

    Third Step: Initiate Surveillance
    With the successful implementation of mSpy upon the designated device, you can seamlessly access your control panel on the mSpy website, thereby commencing an effortless exploration of the acquired data through an intuitively designed dashboard.

    ==> Special Discount: Order Today With Best Price And Special Offers <==

    Primary Features of mSpy

    mSpy has several unique features and we are explaining a few of them that piqued our interest.

    • Supervision and Site Limitation: Embedded within mSpy’s array of functionalities is the capacity to oversee the websites frequented by your child or designated individual, encompassing even bookmarked pages. Moreover, the application stands poised to furnish prompt notifications when particular keywords are inputted into the mobile device. This dynamic attribute can prove notably advantageous for parents, enabling them to attain heightened insights into their children’s online explorations and content consumption.
    • Moreover, an ancillary capability affords you the prerogative to restrict access to specific websites. This provision holds true on the premise that the monitored entity employs any of the prevalent web browsers such as Safari, Chrome, or a native Android browser. 
    • Procure Requisite Insights: The entirety of the data gleaned from the targeted device orchestrates its voyage to your dedicated dashboard on mSpy.com. This hub offers a comprehensive glimpse into the targeted phone’s operating system, memory utilization, as well as particulars regarding the cell provider and installed software version. The dashboard even presents real-time indications of the remaining battery charge. Furthermore, it extends visibility into the habitual usage patterns and synchronization status of the targeted phone.
    • From this vantage point, you wield the authority to either reactivate or entirely disable the software. Additional functionalities encompass log extraction, device locking, log removal, disconnection from the application, data preservation measures in the event of device loss, and the capacity to initiate a device reboot. mSpy endows you with a formidable realm of control, resting at your disposal.
    • Text Communication Surveillance: Beyond telephonic conversations, the mSpy tracking tool extends its reach to encompass transmitted, received, and erased text messages. This capacity affords the means to ascertain whether your child engages in the dissemination of unsuitable content or confidential details, or if such interactions transpire reciprocally.
    • Vigilance Over Virtual Networks: Resonating with akin surveillance solutions like WebWatcher, mSpy facilitates oversight of diverse messaging platforms and social media applications. To avail this elevated functionality, opting for the Premium or Family Kit subscription is a requisite. Additionally, there might be a need to undertake jailbreaking or rooting of the device to unlock this advanced layer of surveillance capability.
    • Contact and Schedule Examination: Employing mSpy empowers you to peruse the compilation of contact identities, email addresses, telephone digits, as well as the tangible address entries, meticulously archived within the target mobile device. Furthermore, you gain the prerogative to scrutinize the calendar itinerary featured on the target device. This extends the capability to remain attuned to scheduled engagements, calendar annotations, and any foreordained appointments.
    • App & Screen Activity: See which apps are installed and how frequently they’re used. You can also block specific apps from running if necessary.
    • Location Surveillance via GPS: Within the realm of parental surveillance, mSpy empowers you to virtually shadow your offspring. The application offers the prowess to trail your child’s spatial trajectory, revealing an encapsulated chronicle of their route history over a designated time span. This granular information encompasses specific addresses and coordinates, affording an exhaustive retrospective and contemporary snapshot of locations traversed.
    • Boundary Delimitation: An innovative facet encompassed within mSpy’s repertoire is the introduction of geofencing. This progressive attribute empowers you to demarcate regions of safety and restraint. As your child enters or departs these predefined zones, you are promptly apprised via email notifications. A supplementary benefit is the integrated mapping feature, which adeptly illustrates the historical trajectory of your child’s movements.
    • Keylogger: mSpy includes a built-in keylogger that records every keystroke made on the device. This is especially helpful for uncovering hidden logins, searches, or messages typed across apps.

    Parental Control? Employee Oversight? mSpy Is the Best Phone Monitoring App for You

    mSpy Pros and Cons

    ✅ Pros:

    • Stealth Mode: Operates invisibly in the background without user detection.
    • Multi-App Monitoring: Tracks major social media platforms.
    • Geofencing & Real-Time Alerts: Great for parents and employers.
    • User-Friendly Dashboard: Clean interface with easy navigation.
    • Cross-Platform Support: Compatible with Android and iPhone.

    ❌ Cons:

    • Some Features Require Rooting or Jailbreaking: Advanced tools need extra steps.
    • Pricing Is Subscription-Based: No one-time purchase option.
    • No Live Call Recording: Restricted due to privacy laws in many regions.

    Despite these limitations, mSpy remains one of the most balanced spy apps for those seeking depth without unnecessary complexity.

    Protect What Matters with the Best Phone Monitoring App – Start with mSpy Now
    Compatibility of mSpy application Across Mobile Devices

    mSpy extends its compatibility umbrella over an extensive array of mobile phones and tablets, encompassing the following:

    • iOS 7 through 9.1 for mSpy with jailbreak. In scenarios where the targeted iPhone remains unjailbroken, data transfer is routed through iCloud storage, facilitating mSpy functionality on any phone with iOS 7 or higher.
    • Android 4 or subsequent iterations, although certain advanced facets of the application may solely be accessible on rooted Android devices.
    • Mac OS X variants encompassing 10.9 Mavericks, 10.8 Mountain Lion, 10.7 Lion, 10.11 El Capitan, and 10.10 Yosemite.

    Costing of mSpy
    Outlined below is the cost framework for mSpy’s mobile phone monitoring services:

    mSpy Basic Plan
    1-month subscription: $39.99 3 

    mSpy Premium Plan
    1-month subscription: $59.99 3-month subscription:

    mSpy Family Kit
    Moreover, the company introduces the Family Kit, facilitating concurrent oversight of 3 devices. This package is available at the ensuing rates: 12-month subscription: $199.99

    mSpy Refund Policy: What You Need to Know

    mSpy offers a 14-day refund window for first-time subscribers, but only under specific conditions.

    ✅ Eligible for Refund:

    • You experience technical issues that mSpy’s support team cannot resolve.
    • Your refund request is submitted within 14 days of purchase.
    • The request pertains to your initial subscription (not renewals or additional purchases). 

    ❌ Not Eligible for Refund:

    • You change your mind or make an accidental purchase.
    • The target device is incompatible, lacks internet access, or has been reset.
    • You refuse to follow installation instructions or decline technical assistance.
    • You lack physical access to the target device or cannot unlock it.
    • You fail to reinstall mSpy after an OS update or factory reset.
    • You lose your private encryption key, resulting in data loss.
    • You attempt to use mSpy on unsupported operating systems (e.g., Symbian, Windows Phone, BlackBerry 10).

    How to Request a Refund:

    • Email your request to refund@mspy.com.
    • Include your order details and the reason for the refund.
    • Note: Refund requests are not accepted via live chat or phone. 

    The Phone Monitoring App You Can Trust – Try mSpy Risk-Free
    mSpy Installation Guide: Step-by-Step

    For Android Devices:

    1. Purchase your mSpy plan
    2. Access installation guide in your dashboard
    3. Enable app installation from unknown sources
    4. Install the app on the target device
    5. Hide the app icon (automatic)
    6. Start monitoring via your web account

    For iPhones:

    1. Buy mSpy and log in to your account
    2. Enter iCloud credentials of the target phone
    3. Enable backup sync (2FA must be off)
    4. Start tracking through your dashboard

    Total setup time: Under 10 minutes in most cases
    No ongoing access required once installed
    Secure & Track Remotely with the Best Mobile Tracking App – mSpy Limited Offer On Now!
    Exploring the mSpy Free Trial 

    Embark on a 7-day exploration of the mSpy free trial to ascertain its potential merits. Upon initiation, you will be granted unrestricted access to all functionalities, acquainting yourself with the benefits it bestows.

    This trial stint is instrumental in unveiling the capacity to invisibly and remotely oversee any mobile device. The process is straightforward: navigate to mSpy.com, select an appropriate subscription plan, and opt for the free trial alternative.

    Following a week of experiential utilization, you possess the liberty to either perpetuate the subscription or opt for its termination. Should you aspire to delve into its efficacy sans financial commitment, the avenue of this complimentary trial beckons.

    Get An Exclusive Limited Time Discount on mSpy

    Is mSpy Legal to Use?

    The legality of mobile tracking apps depends on how they’re used:

    • ✅ Legal for Parental Monitoring: Parents can track their minor children’s phones.
    • ✅ Legal on Company Devices: Employers can monitor work-issued devices with employee consent or policy documentation.
    • ❌ Illegal Without Consent: It’s unlawful in many regions to spy on a spouse, adult, or partner without permission.

    mSpy emphasizes responsible usage. Users must confirm that they own the device or have legal permission before installing the software. The platform clearly disclaims liability for misuse.
    If used within the bounds of law and intent, mSpy is a powerful and compliant solution for modern digital monitoring.
    Why Wait? The Best Phone Monitoring App (mSpy) Is Ready – Real-Time GPS, Social Media Logs & More

    mSpy vs Competitors

    mSpy vs FlexiSPY

    FlexiSPY offers live call interception and ambient recording—features mSpy avoids for legal reasons. However, mSpy wins on ease of use, stealth, and customer support.

    mSpy vs uMobix

    uMobix has strong social media tracking, but its dashboard is less intuitive. mSpy provides a better overall user experience and is more stable on iOS.

    mSpy vs Cocospy

    Cocospy is beginner-friendly but lacks depth. mSpy offers more advanced features, such as keyword alerts, geofencing, and in-depth logs.
    In side-by-side comparisons, mSpy consistently delivers the best combination of reliability, discretion, and monitoring power.

    Why mSpy Earns Its Reputation as a Premier Mobile Surveillance App

    • Budget-Friendly Vigilance: mSpy emerges as a cost-effective avenue, facilitating the scrutiny of your child’s digital interactions or mobile pursuits for a mere fraction of a dollar per day.
    • Effortless Deployment: Installation proves a straightforward endeavor, requiring less than 10 minutes for comprehensive setup completion.
    • Concealed Operation: The application seamlessly functions in a concealed background mode, rendering it entirely imperceptible to the marked user.
    • Timely Updates: The flow of updated information from the target device remains uninterrupted, with data refresh cycles occurring every 5 minutes.
    • Comprehensive Assistance: A robust network of 24/7 multilingual support ensures that you receive the requisite guidance and aid throughout your journey with mSpy.
    • Unwavering Dependability and Security: mSpy embodies an unwavering commitment to reliability and security. All procured data undergoes encryption and safeguards, rendering it a steadfast and secure mobile monitoring solution.

    Track Smarter in 2025 – mSpy Is the Best Mobile Tracking App for Safe, Legal Use

    FAQs About mSpy Apps

    Q1: Is mSpy visible on the phone?
    No, once installed, mSpy runs in stealth mode and is not visible to the device user.
    Q2: Does mSpy work with the latest iOS and Android versions?
    Yes. mSpy supports Android 13/14 and iOS 17, with ongoing updates to maintain compatibility.
    Q3: What happens if the phone restarts or updates?
    The app auto-restarts in most cases and continues tracking unless uninstalled.
    Q4: Can I install mSpy without touching the phone?
    Only on iPhones with iCloud backup enabled and no 2FA. Android phones require brief physical access.
    Q5: What are people saying on Reddit or forums?
    Reddit users generally report that mSpy is dependable, especially for parental control. Some voice privacy concerns, but these are tied to misuse rather than flaws in the app.

    Click Here to Get mSpy From Its Official website

    mSpy Real User Reviews

    Jenna T. – Dallas, TX (Parent)

    “I needed a way to monitor my teenage son’s online behavior after some late-night messages raised concerns. mSpy helped me keep track of his activity without making him feel violated. It’s been a life-saver.”
    Raj M. – San Jose, CA (Employer)
    “We issued company phones last year and suspected misuse. mSpy provided the visibility we needed without disrupting work. The dashboard is intuitive, and the alerts help us spot problems early.”
    Carla R. – Atlanta, GA (Concerned Spouse)
    “mSpy gave me the peace of mind I was looking for. I had suspicions, and while it wasn’t easy, the clarity helped us have an honest conversation. It’s discreet and effective.”
    Peter N. – Chicago, IL (Tech Blogger)
    “As someone who tests monitoring tools, mSpy stands out for its reliability and feature richness. It’s not the cheapest, but it delivers value, especially for less tech-savvy users.”
    See Their Calls, Chats & GPS – All From Your Dashboard with the Best Mobile Tracking App

    How mSpy Helps Prevent Digital Dangers

    The digital world is filled with unseen threats, especially for children and vulnerable users. mSpy plays a preventive role by giving parents and guardians real-time insights into mobile behavior—often before something harmful occurs.
    For example, cyberbullying often starts subtly, through text messages or social media. With mSpy’s keyword alert system and message monitoring, red flags can be detected early. Parents can intervene before emotional damage is done.
    Online predators are another concern. They typically engage victims through apps like Snapchat, Instagram, and WhatsApp. mSpy allows guardians to review conversations across these platforms, revealing inappropriate behavior or grooming tactics.
    Screen addiction is also on the rise. With app usage tracking, parents can understand where time is being spent and set digital boundaries. For employers, mSpy prevents productivity loss by identifying inappropriate device use during work hours.
    By offering visibility and early intervention tools, mSpy becomes more than just a spy app—it becomes a layer of digital protection.

    Can You Trust Spy Apps? Reputation Check & Scam Warning Signs

    The spy app industry is filled with copycats, scams, and malware-laced programs. Knowing who to trust is essential—and mSpy stands out for good reason.
    What Makes a Spy App Trustworthy?

    • Official website distribution only
    • Transparent pricing and feature lists
    • Clear legal use policy
    • Regular updates and live customer support

    mSpy checks every box. It’s not found on suspicious third-party app stores or fake marketplaces. The company has been in operation for over 10 years, with a verifiable user base and global presence.
    Red Flags to Avoid

    • Apps offering “undetectable call recording” without any legal disclaimer
    • Download links through sketchy APK sites
    • No refund policy or support contact

    Before installing any tracking tool, check reviews, legal policies, and trust ratings. If it looks too good to be true, it probably is.

    Best Mobile Spy App for Parents, Employers & Partners – Get mSpy Now
    Troubleshooting Guide: What to Do If mSpy Stops Working
    Even reliable apps can run into issues—especially after OS updates or permission resets. If mSpy stops syncing or collecting data, here’s what to do:
    Step 1: Check Internet Connection
    The app needs internet access to sync data. Ensure the target phone is connected to Wi-Fi or mobile data.
    Step 2: Revisit Permissions
    Go to the phone’s settings and ensure permissions like GPS, contacts, and storage are still enabled for mSpy.
    Step 3: Confirm App Visibility
    Make sure the app hasn’t been removed or flagged by antivirus software. If necessary, reinstall following the original setup guide.
    Step 4: Contact Support
    mSpy has 24/7 live chat support. Log in to your dashboard and connect with their team for personalized assistance.
    With the right response, most issues can be resolved within minutes—and your monitoring resumes without disruption.
    Best Mobile Spy App for Android & iPhone – Track Without Being Detected with mSpy
    The Final Conclusion

    After conducting a comprehensive exploration, juxtaposing the positives and negatives, we have arrived at a definitive conclusion. The pivotal question emerges: Does mSpy stand as a prudent investment, or is it best to avert its usage?

    Our exhaustive analysis of mSpy customer feedback resoundingly echoes the sentiment of admiration. This accord resonates with our own assessment, solidifying the stance that mSpy represents a high-value proposition, replete with an array of commendable attributes and exceptional customer assistance. It is our conviction that mSpy reigns as the preeminent tracking application, proficiently catering to the needs of those seeking to discreetly oversee the actions of their employees, children, or other individuals. It stands as a potent conduit to discreetly peruse incoming calls and dispatched messages, all while evading the awareness of the subject under observation.

    The stalwart customer support infrastructure, coupled with the seamless integration of routine updates to ensure a user-friendly experience, fuels our belief that mSpy’s enduring value will persist in the foreseeable future. Notably, mSpy extends a suite of preeminent monitoring features, further enhancing its allure.

    The Phone Monitoring App You Can Trust – Try mSpy Risk-Free

    Project name: mSpy
    Londynska 730/59,
    Vinohrady,
    120 00 Praha,
    Czech Republic
    Media Contact:
    Company website: https://www.mspy.com/
    email: support@mspy.com
    USA (toll-free): +1 855 896 00 41

    Disclosure: The claim “#1 Choice in the United States” reflects our personal opinion and is not supported by independent market research.
    mSpy is intended strictly for legal use only. Installing monitoring software on a device you do not own, or without proper consent, may violate local laws. In most jurisdictions, you are required to notify the device owner before installation.
    Unauthorized use could lead to civil or criminal penalties. You are fully responsible for ensuring lawful use of the software.
    We strongly recommend consulting a licensed legal advisor before installing or using mSpy on any device.
    All trademarks, logos, and brand names mentioned are the property of their respective owners. References to third-party products or services are for identification purposes only and do not constitute endorsements.
    Always refer to the official website of the loan provider for the most accurate and up-to-date product terms, pricing, and eligibility requirements.

    Content Accuracy Disclaimer

    Every effort has been made to ensure the accuracy of the information presented in this article. However, due to the dynamic nature of product formulations, promotions, and availability, details may change without notice. The publisher makes no warranties or representations as to the current completeness or accuracy of any content, including product claims, pricing, or ingredient lists.
    It is the responsibility of the reader to verify product information directly through the official website or manufacturer prior to making a purchasing decision. Any reliance placed on the information in this article is done strictly at your own risk.

    Affiliate Disclosure
    This article may contain affiliate links. If you purchase a product or service through these links, the publisher may earn a commission at no additional cost to you. These commissions help support the creation of in-depth reviews and educational wellness content.
    The publisher only promotes products that have been independently evaluated and deemed potentially beneficial to readers. However, this compensation may influence the content, topics, or products discussed in this article. The views and opinions expressed are those of the author and do not necessarily reflect the official policy or position of any affiliate partner or product provider.

    Attachment

    The MIL Network –

  • MIL-OSI New Zealand: Northland accident: Delays SH1 near North Mangapai Intersection

    Source: New Zealand Police

    Motorists in Northland are advised to avoid travelling on State Highway One between the North Mangapai Intersection and Mata.

    A two vehicle accident on Oakleigh Wharf Road is causing major delays.

    Police advise one of the vehicles is a large truck which is blocking the road and may take some time to move.

    Traffic is backed-up several kilometres in both directions.

    Emergency services are at the scene.

    Motorists are advised to use alternative routes and avoid the area.

    ENDS

    MIL OSI New Zealand News –

  • MIL-OSI USA: Training on Camp Guernsey will close Emigrant Hill Road temporarily for training

    Source: US State of Wyoming

    CAMP GUERNSEY JOINT TRAINING CENTER, Wyo. – Training at Camp Guernsey Joint Training Center’s North Training Area will cause traffic delays on Emigrant Hill Road and significant noise hazards for the surrounding community June 4 to 11, 2025, Guernsey, Wyoming, due to indirect artillery firing over the road.

    The Wyoming National Guard thanks the community for their continued support.
    For more information, please call Lt. Col. LaQuendin Counts at 307-836-7638 or Wyoming National Guard at 307-772-5309 or look for updates on the Camp Guernsey Joint Training Center Facebook page, found here: https://www.facebook.com/CampGuernseyJTC/ .

    MIL OSI USA News –

  • MIL-OSI USA: Senators Coons, Barrasso introduce bipartisan bill to expand access to mental health services for seniors

    US Senate News:

    Source: United States Senator for Delaware Christopher Coons
    WASHINGTON – U.S. Senators Chris Coons (D-Del.) and John Barrasso (R-Wyo.) introduced the Expanding Seniors Access to Mental Health Services Act. The bill would improve Medicare beneficiaries’ access to licensed clinical social workers. By providing these mental health professionals with the opportunity to participate in the Medicare program when delivering services in skilled nursing facilities, this bill expands the number of mental health providers available to Delaware’s seniors.  
    “Increasing access to clinical social workers improves seniors’ mental health and gives them hope no matter where they live,” said Senator Coons. “Unfortunately, outdated Medicare rules prevent too many older Americans from receiving support from social workers in skilled nursing facilities. The bipartisan Expanding Seniors Access to Mental Health Services Act fixes these rules and expands Medicare coverage to allow social workers to provide the best care to seniors when they need it most.”
    “As a doctor, I know how vital it is for seniors to have access to mental health services,” said Senator Barrasso. “In particular, for those living in rural communities, finding a mental health provider is challenging. This is why I am proud to support bipartisan solutions that help more patients get the care they need.”
    “On behalf of the National Association of Social Workers?–?Delaware Chapter, we thank Senator?Chris?Coons for championing the bipartisan Expanding Seniors Access to Mental Health Services Act,” said Molly?J.?Arbogast, Executive Director of NASW Delaware. “Delaware’s social workers are eager to meet our neighbors where they are, whether that is in a skilled-nursing facility, a community clinic, or their own living rooms, but outdated Medicare rules keep too many people waiting. This bill cuts red tape, recognizes the full value of clinical social work, and gives older adults and people with disabilities quicker access to the evidence-based care they deserve.”
    “We strongly support the Expanding Seniors Access to Mental Health Services Act and applaud Senators Coons and Barrasso for prioritizing nursing home residents’ mental health through expanded Medicare coverage of these essential services in long term and post-acute care settings. This bill also helps short-term patients at skilled nursing facilities maintain trusted relationships with their preferred clinical social workers—promoting continuity of care as well as safer, more successful transitions back to the community. Enabling seniors to access these services is a vital step in addressing the growing mental and behavioral health needs of older adults,” said Cheryl Heiks, Executive Director of Delaware Health Care Facilities Association.
    “On behalf of the National Association of Social Workers—Wyoming Chapter, we extend our heartfelt thanks to Senator John Barrasso for his leadership on the bipartisan Expanding Seniors Access to Mental Health Services Act,” said Nathan Stahley, Executive Director of NASW Wyoming. “Modernizing outdated Medicare regulations is essential to expanding access to mental health services for individuals in Wyoming and across the country. This vital legislation cuts through unnecessary red tape, elevates the role of clinical social workers, and ensures that older adults and people with disabilities can receive the timely, evidence-based care they need and deserve.”
    “The National Association of Social Workers (NASW) applauds Senators John Barrasso and Chris Coons for introducing the bipartisan Expanding Seniors Access to Mental Health Services Act. Passage of this legislation is critical to the health and well-being of Medicare beneficiaries, for our nation and the social work profession,” said NASW CEO Anthony Estreet, PhD, MBA, LCSW-C. “It will help Medicare beneficiaries access desperately needed, high-quality mental health services clinical social workers are authorized to perform under state law, and it will remove a significant barrier to mental health care provided by independent clinical social workers to older adults and people with disabilities in skilled nursing facilities.”
    The Expanding Seniors Access to Mental Health Services Act ensures clinical social workers can provide psychosocial services to patients in nursing homes, and the full range of Health and Behavior Assessment and Intervention (HBAI) services within their scope of practice.
    The text of the bill is available here.

    MIL OSI USA News –

  • MIL-OSI Security: Major strike against Italian-Albanian drug trafficking network: 52 suspects targeted

    Source: Eurojust

    During the action day, authorities in both countries seized assets worth at least several millions euros, including apartments and companies, as well as various luxury vehicles. . Large amounts of cash and quantities of cocaine and heroin were also seized. A full and complete evaluation of the seizures will be carried out in the coming days.

    No complete estimate of the total profits of the cooperation between the three OCGs is available. However, information obtained through the JIT shows that the criminal networks were involved in payments, often in cash, of close to EUR 5 million and the trafficking of at least 1 800 kilos of cocaine and heroin.

    Investigations into the linked criminal organisations were initiated in 2016 by the Public Prosecutor’s Office of Bari and the Special Anti-Corruption and Organised Crime Prosecutor’s Office of Tirana and the Albanian Police. On the Albanian side, one OCG, which operated from Durres, was responsible for the transport and wholesale distribution of large quantities of cocaine, heroin and cannabis trafficked between the Balkans, Northern Europe, South America and Puglia in Italy.

    Two Italian-led criminal gangs carried out the cutting and packaging of illicit drugs and supplied cocaine and heroin from Latin America and Turkey to local gangs in organisations in Bari, Brindisi and Lecce.

    The arrests in Italy and Albania are the result of a long-term collaboration through the JIT. This involved the use of wiretaps, intensive video surveillance, the monitoring of suspects and the analysis of encrypted chats. These chats were decrypted following intensive cooperation through Eurojust.

    Since 2020, Eurojust has supported the authorities in Italy and Albania with the JIT. Furthermore, the Agency provided assistance with the execution of requests for Mutual Legal Assistance during the action day and gave cross-border judicial support. Albania is one of the twelve countries outside the European Union with a Liaison Prosecutor at Eurojust. The investigations were also coordinated and supported by the office of the dedicated security expert at the Italian Embassy in Tirana.

    The judicial cooperation between Italy and Albania has already proven effective in recent years. Between 2018 and 2021, the Anti-Mafia Investigation Directorate of Bari issued and executed 118 arrest warrants against alleged drug traffickers operating in both countries. As a result, various defendants were sentenced up to 20 years imprisonment.

    This week’s operation was carried out at the request of and by the following authorities:

    • Italy: Public Prosecutor’s Office Bari – District Anti-Mafia Directorate; Anti-Mafia Investigation Directorate Bari, under the coordination of the National Anti-Mafia and Anti-Terrorism Directorate Rome, with support of the Office of the Security Expert at the Italian Embassy in Tirana
    • Albania: Special Anti-Corruption and Organised Crime Prosecutor’s Office (SPAK) of Tirana; Albanian Police

    MIL Security OSI –

  • MIL-OSI Economics: IPAA Urges Preservation of Carried Interest Tax Provision

    Source: Independent Petroleum Association of America

    Headline: IPAA Urges Preservation of Carried Interest Tax Provision

    May 21, 2025 IPAA Urges Preservation of Carried Interest Tax Provision

    Dear Speaker Johnson and Majority Leader Thune:

    On behalf of America’s independent oil and natural gas producers, the Independent Petroleum Association of America (IPAA) urges you to help preserve the current tax treatment of carried interest to protect energy investment, support job creation, and ensure the continued growth of a resilient, domestically powered energy economy. …

    The carried interest structure is a well-established mechanism that rewards long-term investment and risk-taking. It is particularly critical in the oil and natural gas industry, where smaller, independent companies often partner with private equity investors to raise the capital needed to explore, drill, and produce America’s energy resources. Nowhere is this model more embedded-or more vital-than in the Gulf Coast states, where these partnerships drive innovation, economic growth, and energy resilience. …

    Continue Reading

    MIL OSI Economics –

  • MIL-OSI United Nations: 21 May 2025 Note for Media Seventy-eighth World Health Assembly – Daily update: 21 May 2025

    Source: World Health Organisation

    A “health financing emergency” must drive country-led, data-driven solutions

    Ministers from multiple countries hit by the abrupt cuts in external funding for health agreed on the urgent need for country-owned and implemented strategies – and a laser-sharp focus on health data – at a ministerial dialogue co-hosted by WHO and the Susan Thompson Buffett Foundation at the Seventy-eighth World Health Assembly.

    Opening remarks by Professor Senait Fisseha, Vice President of Global Programs at the Susan Thompson Buffett Foundation, and Dr Tedros Adhanom Ghebreyesus, WHO Director-General, set the tone by noting that the crisis presents an opportunity for a turnaround in how health financing policies and health data systems are built and operated.

    Specifically, this is a time for countries to reduce their reliance on external health information systems and external financing; build out their domestic data infrastructure, from vital statistics to downstream impact and return-on-investment; and establish resilient systems designed to withstand shocks, so that access to essential services is protected.

    Professor Fisseha called on countries “to use this moment to rethink data and financing in a way that best meets your needs and the needs of your people […] For countries to truly lead and for funders and development partners to start to learn how to follow. Data and financing are a natural place to start because that is where ministers are telling us to start.”

    Dr Tedros said, “From expanding domestic financing to pioneering real-time data systems, many of you are advancing solutions that are scalable, sustainable and rooted in equity. Data and sustainable financing are not just technical matters. They are political choices. They shape who is reached, how quickly, and with what quality of care. And they determine whether we progress or fall behind.”

    Ministers from Barbados, Central African Republic, Egypt, Liberia, Malawi, Rwanda and Sierra Leone, and representatives from the African Union and the World Bank, among others, shared experiences and advice on concrete actions to strengthen data systems, health financing and planning – urging intensified collaboration in the future. They also spoke of the need to leverage the digital transformation and thereby increase transparency and accountability.

    Also discussed: strategies to improve domestic financing capacity while maximizing impact include: strengthening tax administration; exploring revenue sources such as taxes on such items as food, alcohol and tobacco; setting up population-wide mandatory health coverage schemes, coupled with subsidies for low-income households and vulnerable population groups; promoting strategic purchasing of health supplies; prioritizing health in public spending; and integrating externally-funded programmes into domestic financing systems and priorities. 

    Later this week the Assembly will take up the proposed WHA Health Financing Resolution. 

    Related links

    WHO Director-General’s opening remarks at the Strategic Roundtable: Data and Sustainable Financing: Twin Foundations to Accelerate UHC – 21 May 2025

    Report on the health conditions in the occupied Palestinian territory, including east Jerusalem, and in the occupied Syrian Golan

    On 21 May 2025, the Seventy-eighth World Health Assembly noted a report from the Director-General, outlining WHO’s humanitarian and emergency health response in the occupied Palestinian territory, including east Jerusalem, and in the occupied Syrian Golan, from January 2024 to February 2025.

    A report on the health conditions in the occupied Syrian Golan couldn’t be provided this year again due to the ongoing situation and the lack of disaggregated health data on the Syrian population. Member States were invited to provide guidance on how to support WHO and partners to restore essential health services across Syria and enable a WHO field-assessment mission to the occupied Syrian Golan.   

    Member States expressed grave concerns over the deterioration of the health system in Gaza, including forced displacement, overcrowding and deteriorating sanitation, and attacks on health, stressing the need for concerted action to address the dire health needs.

    A number of Member States presented draft decisions asking the Director-General to continue reporting on the health conditions in the occupied Palestinian territory, including east Jerusalem, and in the occupied Syrian Golan, and more specifically on food insecurity and malnutrition in the Gaza Strip, and to continue supporting the Palestinian and Syrian health systems. The decision was adopted.

    Related documents

    A78/16: Health conditions in the occupied Palestinian territory, including east Jerusalem, and in the occupied Syrian Golan

    A78/B/CONF./1: Health conditions in the occupied Palestinian territory, including east Jerusalem, and in the occupied Syrian Golan

    A78/B/CONF./1 Add.1: Financial and administrative implications for the Secretariat of decisions proposed for adoption by the Health Assembly

    MIL OSI United Nations News –

  • MIL-OSI USA: Rep. Weber Announces $138 Million in Army Corps Funding for Southeast Texas Projects

    Source: United States House of Representatives – Congressman Randy Weber (14th District of Texas)

    Rep. Weber Announces $138 Million in Army Corps Funding for Southeast Texas Projects

    Washington, May 16, 2025

    Washington, D.C. – Today, U.S Rep. Randy Weber (TX-14) announced that Southeast Texas waterway projects will receive $138,380,000 in funding in the U.S. Army Corps of Engineers FY 2025 Army Civil Work Plan.

    “This is great news for Southeast Texas, America’s energy capital,” said Rep. Weber. “Our ports and waterways are the lifeblood of our economy and keeping them well-maintained is critical to preserving our nation’s leadership in commerce and energy. I’m grateful the Trump administration recognizes the strategic importance of our region. I will continue fighting for the infrastructure investments our communities deserve.:

    Operation & Maintenance projects in Texas’ 14th District were awarded:

    • $900,000 for the Channel to Port Bolivar. The Channel to Port Bolivar shallow-draft navigation project consists of a 14-foot deep by 200-foot wide channel that is 950 feet long. It extends from the entrance to Galveston Bay (Bolivar Roads) northward to the west point of Bolivar Island. The channel is heavily utilized by the Texas Department of Transportation and the Galveston-to-Port Bolivar Ferry System.
    • $13,150,000 for Freeport Harbor. The Freeport Harbor deep-draft navigation project consists of a 45-foot deep by 400-foot wide channel that is 8.5 miles long, extending from the Gulf of America, through a jetty-protected inlet, to a turning basin at the Freeport port facilities. The project also includes two rock jetties, 1.46 and 1.64 miles in length.
    • $47,975,000 for Galveston Harbor and Channel. The Galveston Entrance Channel is the main entrance for Galveston, Texas City, and the Houston Ship Channel. This deep-draft project includes a 45-foot deep by 800-foot wide channel that is 23.9 miles long, stretching from the Gulf of America through a jetty-protected inlet into Galveston Bay, to the port facilities at Galveston Harbor.
    • $50,000 for Chocolate Bayou. The Chocolate Bayou navigation project is a shallow-draft waterway, 13 feet deep by 125 feet wide and approximately 8.2 miles long. It extends from the Gulf Intracoastal Waterway (GIWW) at Mile Marker 376 through Chocolate Bay and Chocolate Bayou to port facilities located between Galveston and Freeport in Brazoria County, Texas.
    • $40,550,000 for the Gulf Intracoastal Waterway. The Texas portion of the GIWW extends from the Sabine River to Port Isabel, Texas, and includes several tributary channels. It features a 12-foot deep by 125-foot wide, shallow-draft channel stretching 423 miles along the Texas Coast. The GIWW includes flood gates at the Brazos River and navigation locks at the Colorado River, along with mooring basins and buoys at 11 locations supporting heavy barge traffic.
    • $25,075,000 for the Sabine-Neches Waterway. The Sabine-Neches Waterway (SNWW) is a federally constructed deep-draft navigation project serving the Ports of Port Arthur, Beaumont, and Orange in Jefferson and Orange Counties, Texas, and Cameron and Calcasieu Parishes, Louisiana. The waterway includes 97 miles of navigation channels in three main segments: a jetty-protected entrance channel 42 feet deep and 500 to 800 feet wide; a 40-foot deep, 400-foot wide channel to Beaumont via the Neches River; and a 30-foot deep, 200-foot wide channel to Orange via the Sabine River.
    • $10,680,000 for the Texas City Ship Channel. The Texas City Ship Channel deep-draft navigation project includes a 45-foot deep by 400-foot wide and 9.4-mile-long channel, extending from the intersection of Galveston Harbor and the Houston Ship Channel to a turning basin and Industrial Canal at the Port of Texas City.

    Rep. Weber added: “This is not just about dredging or infrastructure—it’s about jobs, national security, and Texas leading the way. I will always stand up for the hardworking men and women who rely on these waterways to fuel our economy and keep America strong.”

    MIL OSI USA News –

  • MIL-OSI USA: CMS Rolls Out Aggressive Strategy to Enhance and Accelerate Medicare Advantage Audits

    Source: US Department of Health and Human Services

    Agency Will Begin Auditing All Eligible Medicare Advantage Contracts Each Payment Year and Add Resources to Expedite Completion of 2018 to 2024 Audits

    Today, the Centers for Medicare & Medicaid Services (CMS) announced a significant expansion of its auditing efforts for Medicare Advantage (MA) plans. Beginning immediately, CMS will audit all eligible MA contracts for each payment year in all newly initiated audits and invest additional resources to expedite the completion of audits for payment years 2018 through 2024.

    MIL OSI USA News –

  • MIL-OSI USA: Wyoming Veterans Commission wraps up first-ever Veteran Services Symposium in Casper

    Source: US State of Wyoming

    Wyoming National Guard

    By Joseph Coslett Jr.

     CASPER, Wyo.  — The Wyoming Veterans Commission concluded its inaugural Veteran Services Symposium at Casper College, Casper, Wyoming, bringing together more than 150 service providers, advocates and leaders from across the state to strengthen the network of care for Wyoming’s veterans.

    The event centered on working together and capacity-building, providing attendees with tools to better serve veterans and their families. The two-day agenda featured keynote presentations, workshops, and discussions on topics such as post-traumatic stress disorder and moral injury, grant writing, veteran caregiving, personality types in team dynamics, and even emerging risks related to artificial intelligence scams.

    Wyoming Governor Mark Gordon joined the event to present six peer-nominated individuals and organizations with the prestigious “Excellence in Service to Veterans” award. The award recipients are as follows: Tami Dietz, Wyoming Military Department Soldier and Family Readiness; Todd Bray, DownRange Warriors; Scott O’Hare, Volunteers of America Northern Rockies; Darrell Haugen, Veterans’ Rock; Charlie & Jennifer Wilson,  Soldiers House of Fremont County; Dr. John R. McPherson, D.D.S., P.C & Staff, McPherson Dental.

    “These awards are about more than recognition—they’re a testament to the dedication of those who choose to stand beside our veterans every day,” Gordon said. “Wyoming owes a great debt to those who have served, and events like this are how we make sure we’re doing everything possible to support them.”

    Sandy McFarland, Deputy Director of the Wyoming Veterans Commission and lead organizer of the event, said the symposium exceeded expectations and highlighted the collective will across Wyoming to do better for its veterans.

    “This event was about moving from isolated effort to coordinated impact,” McFarland said. “We want to empower the people who serve veterans—whether they work for the VA, a nonprofit, or in a local community—to build partnerships that truly change lives.”

    Among the sessions were presentations from Val Burgess, who shared the preserved voices and stories of World War II POWs from Stalag Luft III, and a workshop hosted by Ben Patton, founder of the Patton Veterans Project, which uses filmmaking as a method to reduce isolation for veterans coping with PTSD.

    “The strength of this symposium was in the real stories,” said Tim Shepherd, Director of the Veterans Commission. “You couldn’t walk away from those sessions without a deeper understanding of what our veterans have endured—and how we can meet them where they are.”

    The symposium concluded with a Veteran Resource Fair, where federal, state, and nonprofit partners came together for a one-stop-shop event providing VA benefit support, legal resources, mental health access and more.

    Looking ahead, the Wyoming Veterans Commission intends to build on this momentum, making the Veteran Services Symposium an annual event.

    “This is just the beginning,” McFarland added. “We are building a statewide movement rooted in empathy, coordination, and results. Veterans deserve nothing less.”

    MIL OSI USA News –

  • MIL-OSI USA: “We will never let that happen again” — Wyoming honors its veterans across the state 

    Source: US State of Wyoming

    Wyoming National Guard 

    By Joseph Coslett Jr. 

     CHEYENNE, Wyo. – On May 10, 2025, the State of Wyoming paid tribute to its Veterans in a series of ceremonies as part of the annual Veterans Welcome Home Day.  

    Gov. Mark Gordon, U.S. Senator John Barrasso and U.S. Representative Harriet Hageman joined leaders from the Wyoming Military Department and the Wyoming Veterans Commission, traveled across the state to thank those who served—especially Veterans from the Korean and Vietnam Wars who were never properly welcomed home. 

    The daylong journey began at sunrise in Cheyenne and included four official ceremonies in Afton, Riverton, Sheridan and concluded in Wheatland. At each stop, the Governor, First Lady Jennie Gordon, Maj. Gen. Greg Porter, Adjutant General of Wyoming, and other dignitaries met with Veterans and their families, delivering remarks and expressing gratitude for their service. 

    Speaking to a room filled with Veterans and their loved ones, Porter reflected on the significance of the moment by connecting it to the broader legacy of American service. He reminded attendees that just weeks earlier, on April 19, the nation had observed the 250th anniversary of the “shot heard ‘round the world” at Lexington and Concord—an event that began a long lineage of Americans willing to fight for freedom. 

    “Over that time, America’s done a pretty good job of bringing its [servicemembers] home—with two exceptions: the Korean War and the Vietnam War,” Porter said. “Our Vietnam Veterans faced a far different return. They probably wished for an apathetic return. They faced derision, sarcasm, and hate in some cases—certainly disrespect. The purpose of these Welcome Home ceremonies is to take a moment to pause and recommit that we will never let that happen again as a nation.” 

    Gordon echoed that message, “This day is about saying, ‘Thank you for your service—welcome home.’ That gratitude extends to the families, too. Our Veterans carry a legacy that began with citizens who marched barefoot through snow because they believed in what this country stood for. In the military, we never leave anyone behind. As a nation, we should never leave a Veteran behind.” 

    As part of the ceremony, the official proclamation was read declaring March 30, 2025, as Wyoming Veterans Welcome Home Day, recognizing the moment in history when U.S. troops completed their withdrawal from Vietnam in 1973. The proclamation recounts how many Veterans returned to a country divided by politics and conflict, and how they were met not with honor—but with silence, scorn or worse. 

    “Members of the United States armed forces who served bravely and faithfully for the United States were caught in the crossfire of public debate about the involvement of the United States in the Vietnam War, and many were met with such disrespect that military leaders recommended Soldiers not wear their military uniforms as they returned home.”

    The proclamation goes on to honor all Veterans, particularly those from the Korean and Vietnam Wars, and urges citizens to recognize their service “not just today but every day.” 

    After the speeches concluded, Governor Gordon took time to greet each Veteran in attendance, shaking hands and presenting a personalized challenge coin as a token of thanks.  

    Also present were Wyoming Veterans Commission Chairman Command Sgt. Maj. (Ret.) Ken Persson, Sr., and Director Col. (Ret.) Tim Sheppard, both of whom played key roles in organizing the day’s events and honoring those who once returned home without recognition. 

    As the day came to a close, the message that echoed from community to community was simple but profound: Wyoming remembers. Wyoming is grateful. And Wyoming will never forget. 

    For more information on Veterans Welcome Home Day or to learn about available resources for Veterans, contact the Wyoming Veterans Commission at (307) 777-8152. 

    MIL OSI USA News –

  • MIL-OSI Security: Richmond felon sentenced to five years in prison for latest firearms conviction

    Source: United States Bureau of Alcohol Tobacco Firearms and Explosives (ATF)

    RICHMOND, Va. – A Richmond man was sentenced today to five years in prison for possession of a firearm by a convicted felon.

    According to court documents, on March 16, 2023, Richmond Police detectives performed a traffic stop on a vehicle with no front license plate. James Marvin Smith, 43, was driving the vehicle. While speaking with Smith and a passenger, the detectives observed a crumpled lottery ticket near the cupholders and noticed that the passenger had white powder on his nose. The detectives asked Smith and the passenger to get out of the car.

    While searching the vehicle for drug evidence, a detective found a firearm and a detached extended magazine. The firearm had one round of ammunition in the chamber and the magazine was loaded with 21 rounds of ammunition.

    Prior to his arrest, Smith had been convicted of, among other crimes, possession of heroin, obstruction of justice, resisting arrest with force, possession of cocaine, breaking and entering, using a firearm in the commission of a felony, robbery, unlawful wounding, illegal possession of a firearm, assault and battery, possession of a firearm by a convicted violent felon, and grand larceny. As a previously convicted felon, Smith cannot legally possess a firearm or ammunition.

    Erik S. Siebert, U.S. Attorney for the Eastern District of Virginia; Anthony A. Spotswood, Special Agent in Charge of the Bureau of Alcohol, Tobacco, Firearms and Explosives Washington Field Division; Rick Edwards, Chief of Richmond Police; and Colette Wallace McEachin, Commonwealth’s Attorney for the City of Richmond, made the announcement after sentencing by Senior U.S. District Judge John A. Gibney Jr.

    Special Assistant U.S. Attorney Katherine E. Groover, an Assistant Commonwealth’s Attorney with the Richmond Commonwealth’s Attorney Office, prosecuted the case.

    This case is part of Project Safe Neighborhoods (PSN), a program bringing together all levels of law enforcement and the communities they serve to reduce violent crime and gun violence, and to make our neighborhoods safer for everyone. On May 26, 2021, the Department launched a violent crime reduction strategy strengthening PSN based on these core principles: fostering trust and legitimacy in our communities, supporting community-based organizations that help prevent violence from occurring in the first place, setting focused and strategic enforcement priorities, and measuring the results.

    A copy of this press release is located on the website of the U.S. Attorney’s Office for the Eastern District of Virginia. Related court documents and information are located on the website of the District Court for the Eastern District of Virginia or on PACER by searching for Case No. 3:24-cr-23.

    MIL Security OSI –

  • MIL-OSI Security: Convicted Felon Sentenced To Prison For Carjacking On College Campus Using A “Ghost Gun”

    Source: United States Bureau of Alcohol Tobacco Firearms and Explosives (ATF)

    CHARLOTTE, N.C. – A man who used a privately made and unregistered firearm, commonly known as a “ghost gun,” to carjack a vehicle on a college campus was sentenced yesterday to seven years in prison for a firearms offense, announced Russ Ferguson, U.S. Attorney for the Western District of North Carolina. Mark Jordan Williams, 37, was also ordered to serve three years of supervised release following the completion of his prison term.

    Alicia Jones, Special Agent in Charge of the U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF), Charlotte Field Division, joins U.S. Attorney Ferguson in making today’s announcement.

    According to court documents and court proceedings, on March 23, 2023, an individual identified as L.C. was sitting in a Jeep Wrangler, parked on the campus of the University of North Carolina-Charlotte. Court records show that Williams approached the vehicle, pointed a handgun at L.C. and ordered L.C. out of the car. Williams then took L.C.’s phone, got into the Jeep, and drove away. Williams was located and arrested later that evening while inside the Jeep. When Williams was arrested, a .40 caliber Polymer 80 handgun was recovered from inside the vehicle as well. During the investigation, law enforcement determined that Williams has multiple prior criminal convictions and he prohibited from possessing a firearm.

    On January 9, 2025, Williams pleaded guilty to possession and brandishing of a firearm in furtherance of a crime of violence. He is in federal custody and will be transferred to the custody of the Federal Bureau of Prisons upon designation of a federal facility. 

    The ATF investigated the case and the U.S. Attorney’s Office in Charlotte handled the prosecution.

     

    MIL Security OSI –

  • MIL-OSI USA: NASA-French Satellite Spots Large-Scale River Waves for First Time

    Source: NASA

    In a first, researchers from NASA and Virginia Tech used satellite data to measure the height and speed of potentially hazardous flood waves traveling down U.S. rivers. The three waves they tracked were likely caused by extreme rainfall and by a loosened ice jam. While there is currently no database that compiles satellite data on river flood waves, the new study highlights the potential of space-based observations to aid hydrologists and engineers, especially those working in communities along river networks with limited flood control structures such as levees and flood gates.
    Unlike ocean waves, which are ordinarily driven by wind and tides, and roll to shore at a steady clip, river waves (also called flood or flow waves) are temporary surges stretching tens to hundreds of miles. Typically caused by rainfall or seasonal snowmelt, they are essential to shuttling nutrients and organisms down a river. But they can also pose hazards: Extreme river waves triggered by a prolonged downpour or dam break can produce floods.
    “Ocean waves are well known from surfing and sailing, but rivers are the arteries of the planet. We want to understand their dynamics,” said Cedric David, a hydrologist at NASA’s Jet Propulsion Laboratory in Southern California and a coauthor of a new study published May 14 in Geophysical Research Letters.

    Measuring Speed and Size
    To search for river waves for her doctoral research, lead author Hana Thurman of Virginia Tech turned to a spacecraft launched in 2022. The SWOT (Surface Water and Ocean Topography) satellite is a collaboration between NASA and the French space agency CNES (Centre National d’Études Spatiales). It is surveying the height of nearly all of Earth’s surface waters, both fresh and salty, using its sensitive Ka-band Radar Interferometer (KaRIn). The instrument maps the elevation and width of water bodies by bouncing microwaves off the surface and timing how long the signal takes to return.
    “In addition to monitoring total storage of waters in lakes and rivers, we zoom in on dynamics and impacts of water movement and change,” said Nadya Vinogradova Shiffer, SWOT program scientist at NASA Headquarters in Washington.
    Thurman knew that SWOT has helped scientists track rising sea levels near the coast, spot tsunami slosh, and map the seafloor, but could she identify river height anomalies in the data indicating a wave on the move?
    She found that the mission had caught three clear examples of river waves, including one that arose abruptly on the Yellowstone River in Montana in April 2023. As the satellite passed overhead, it observed a 9.1-foot-tall (2.8-meter-tall) crest flowing toward the Missouri River in North Dakota. It was divided into a dramatic 6.8-mile-long (11-kilometer-long) peak followed by a more drawn‐out tail. These details are exciting to see from orbit and illustrate the KaRIn instrument’s uniquely high spatial resolution, Thurman said.
    Sleuthing through optical Sentinel-2 imagery of the area, she determined that the wave likely resulted from an ice jam breaking apart upstream and releasing pent-up water.
    The other two river waves that Thurman and the team found were triggered by rainfall runoff. One, spotted by SWOT starting on Jan. 25, 2024, on the Colorado River south of Austin, Texas, was associated with the largest flood of the year on that section of river. Measuring over 30 feet (9 meters) tall and 166 miles (267 kilometers) long, it traveled around 3.5 feet (1.07 meters) per second for over 250 miles (400 kilometers) before discharging into Matagorda Bay.
    The other wave originated on the Ocmulgee River near Macon, Georgia, in March 2024. Measuring over 20 feet (6 meters) tall and extending more than 100 miles (165 kilometers), it traveled about a foot (0.33 meters) per second for more than 124 miles (200 kilometers).
    “We’re learning more about the shape and speed of flow waves, and how they change along long stretches of river,” Thurman said. “That could help us answer questions like, how fast could a flood get here and is infrastructure at risk?”
    Complementary Observations
    Engineers and water managers measuring river waves have long relied on stream gauges, which record water height and estimate discharge at fixed points along a river. In the United States, stream gauge networks are maintained by agencies including the U.S. Geological Survey. They are sparser in other parts of the world.
    “Satellite data is complementary because it can help fill in the gaps,” said study supervisor George Allen, a hydrologist and remote sensing expert at Virginia Tech.
    If stream gauges are like toll booths clocking cars as they pass, SWOT is like a traffic helicopter taking snapshots of the highway.
    The wave speeds that SWOT helped determine were similar to those calculated using gauge data alone, Allen said, showing how the satellite could help monitor waves in river basins without gauges. Knowing where and why river waves develop can help scientists tracking changing flood patterns around the world.
    Orbiting Earth multiple times each day, SWOT is expected to observe some 55% of large-scale floods at some stage in their life cycle. “If we see something in the data, we can say something,” David said of SWOT’s potential to flag dangerous floods in the making. “For a long time, we’ve stood on the banks of our rivers, but we’ve never seen them like we are now.”
    More About SWOT
    The SWOT satellite was jointly developed by NASA and CNES, with contributions from the Canadian Space Agency (CSA) and the UK Space Agency. NASA’s Jet Propulsion Laboratory, managed for the agency by Caltech in Pasadena, California, leads the U.S. component of the project. For the flight system payload, NASA provided the Ka-band radar interferometer (KaRIn) instrument, a GPS science receiver, a laser retroreflector, a two-beam microwave radiometer, and NASA instrument operations. The Doppler Orbitography and Radioposition Integrated by Satellite system, the dual frequency Poseidon altimeter (developed by Thales Alenia Space), the KaRIn radio-frequency subsystem (together with Thales Alenia Space and with support from the UK Space Agency), the satellite platform, and ground operations were provided by CNES. The KaRIn high-power transmitter assembly was provided by CSA.
    News Media Contacts
    Jane J. Lee / Andrew WangJet Propulsion Laboratory, Pasadena, Calif.818-354-0307 / 626-379-6874Written by Sally Younger2025-074

    MIL OSI USA News –

  • MIL-OSI USA: How Big is Space? We Asked a NASA Expert: Episode: 61

    Source: NASA

    [embedded content]

    How big is space?
    Space is really big. Thinking about our solar system, let’s imagine you could get in a car and drive to Pluto at highway speeds. It would take you about 6,000 years to get there.
    When we start to think about other stars outside of our solar system, we need to think about
    another unit of distance. This is why astronomers use the unit light-years.
    Light travels at 186,000 miles per second. One light year is about 6 trillion miles. The closest star to our Sun is about four light years away.
    Our own Milky Way galaxy is about 100,000 light-years across.
    We know from deep field images of the universe that there are hundreds of billions, perhaps a trillion other galaxies.
    Using some of the deepest images yet from the James Webb Space Telescope, we’ve been able to see galaxies that emitted their light about 13 and a half billion years ago.
    Now, here’s a really important thing. Because the universe is expanding, those most distant galaxies are actually much further away than 13 and a half billion light years.
    I’m glossing over some math here, but we can estimate that the observable universe is about 92 billion light-years across. But we’re pretty sure that the universe is even bigger than what we can see.
    And here’s where things get really weird, we don’t actually know if the universe is finite or infinite.
    As much as we’ve learned about the universe, science has no reliable estimate of the actual size of the entire universe.
    [END VIDEO TRANSCRIPT]
    Full Episode List
    Full YouTube Playlist

    MIL OSI USA News –

  • MIL-OSI USA: Discovery Alert: A Possible Perpendicular Planet

    Source: NASA

    A newly discovered planetary system, informally known as 2M1510, is among the strangest ever found. An apparent planet traces out an orbit that carries it far over the poles of two brown dwarfs. This pair of mysterious objects – too massive to be planets, not massive enough to be stars – also orbit each other. Yet a third brown dwarf orbits the other two at an extreme distance.

    In a typical arrangement, as in our solar system, families of planets orbit their parent stars in more-or-less a flat plane – the orbital plane – that matches the star’s equator. The rotation of the star, too, aligns with this plane. Everyone is “coplanar:” flat, placid, stately.
    Not so for possible planet 2M1510 b (considered a “candidate planet” pending further measurements). If confirmed, the planet would be in a “polar orbit” around the two central brown dwarfs – in other words, its orbital plane would be perpendicular to the plane in which the two brown dwarfs orbit each other. Take two flat disks, merge them together at an angle in the shape of an X, and you have the essence of this orbital configuration.
    “Circumbinary” planets, those orbiting two stars at once, are rare enough. A circumbinary orbiting at a 90-degree tilt was, until now, unheard of. But new measurements of this system, using the ESO (European Southern Observatory) Very Large Telescope in Chile, appear to reveal what scientists previously only imagined. 

    The method by which the study’s science team teased out the planet’s vertiginous existence is itself a bit of a wild ride. The candidate planet cannot be detected the way most exoplanets – planets around other stars – are found today: the “transit” method, a kind of mini-eclipse, a tiny dip in starlight when the planet crosses the face of its star.
    Instead they used the next most prolific method, “radial velocity” measurements. Orbiting planets cause their stars to rock back and forth ever so slightly, as the planets’ gravity pulls the stars one way and another; that pull causes subtle, but measurable, shifts in the star’s light spectrum. Add one more twist to the detection in this case: the push-me-pull-you effect of the planet on the two brown dwarfs’ orbit around each other. The path of the brown dwarf pair’s 21-day mutual orbit is being subtly altered in a way that can only be explained, the study’s authors conclude, by a polar-orbiting planet.

    Only 16 circumbinary planets – out of more than 5,800 confirmed exoplanets – have been found by scientists so far, most by the transit method. Twelve of those were found using NASA’s now-retired Kepler Space Telescope, the mission that takes the prize for the most transit detections (nearly 2,800). Scientists have observed a small number of debris disks and “protoplanetary” disks in polar orbits, and suspected that polar-orbiting planets might be out there as well. They seem at last to have turned one up.

    An international science team led by Thomas A. Baycroft, a Ph.D. student in astronomy and astrophysics at the University of Birmingham, U.K., published a paper describing their discovery in the journal “Science Advances” in April 2025. The planet was entered into NASA’s Exoplanet Archive on May 1, 2025. The system’s full name is 2MASS J15104786-281874 (2M1510 for short).

    MIL OSI USA News –

  • MIL-OSI USA: Russian GRU Targeting Western Logistics Entities and Technology Companies

    News In Brief – Source: US Computer Emergency Readiness Team

    Executive Summary

    This joint cybersecurity advisory (CSA) highlights a Russian state-sponsored cyber campaign targeting Western logistics entities and technology companies. This includes those involved in the coordination, transport, and delivery of foreign assistance to Ukraine. Since 2022, Western logistics entities and IT companies have faced an elevated risk of targeting by the Russian General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (85th GTsSS), military unit 26165—tracked in the cybersecurity community under several names (see “Cybersecurity Industry Tracking”). The actors’ cyber espionage-oriented campaign, targeting technology companies and logistics entities, uses a mix of previously disclosed tactics, techniques, and procedures (TTPs). The authoring agencies expect similar targeting and TTP use to continue.

    Executives and network defenders at logistics entities and technology companies should recognize the elevated threat of unit 26165 targeting, increase monitoring and threat hunting for known TTPs and indicators of compromise (IOCs), and posture network defenses with a presumption of targeting.

    This cyber espionage-oriented campaign targeting logistics entities and technology companies uses a mix of previously disclosed TTPs and is likely connected to these actors’ wide scale targeting of IP cameras in Ukraine and bordering NATO nations.

    The following authors and co-sealers are releasing this CSA:

    • United States National Security Agency (NSA)
    • United States Federal Bureau of Investigation (FBI)
    • United Kingdom National Cyber Security Centre (NCSC-UK)
    • Germany Federal Intelligence Service (BND) Bundesnachrichtendienst
    • Germany Federal Office for Information Security (BSI) Bundesamt für Sicherheit in der Informationstechnik
    • Germany Federal Office for the Protection of the Constitution (BfV) Bundesamt für Verfassungsschutz
    • Czech Republic Military Intelligence (VZ)  Vojenské zpravodajství
    • Czech Republic National Cyber and Information Security Agency (NÚKIB) Národní úřad pro kybernetickou a informační bezpečnost
    • Czech Republic Security Information Service (BIS) Bezpečnostní informační služba
    • Poland Internal Security Agency (ABW) Agencja Bezpieczeństwa Wewnętrznego
    • Poland Military Counterintelligence Service (SKW) Służba Kontrwywiadu Wojskowego
    • United States Cybersecurity and Infrastructure Security Agency (CISA)
    • United States Department of Defense Cyber Crime Center (DC3)
    • United States Cyber Command (USCYBERCOM)
    • Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC)
    • Canadian Centre for Cyber Security (CCCS)
    • Danish Defence Intelligence Service (DDIS) Forsvarets Efterretningstjeneste
    • Estonian Foreign Intelligence Service (EFIS) Välisluureamet
    • Estonian National Cyber Security Centre (NCSC-EE) Küberturvalisuse keskus
    • French Cybersecurity Agency (ANSSI) Agence nationale de la sécurité des systèmes d’information
    • Netherlands Defence Intelligence and Security Service (MIVD) Militaire Inlichtingen- en Veiligheidsdienst
       

    Download the PDF version of this report:

    Russian GRU Targeting Western Logistics Entities and Technology Companies (PDF, 1,081KB)

    For a downloadable list of IOCs, visit:

    Introduction

    For over two years, the Russian GRU 85th GTsSS, military unit 26165—commonly known in the cybersecurity community as APT28, Fancy Bear, Forest Blizzard, BlueDelta, and a variety of other identifiers—has conducted this campaign using a mix of known tactics, techniques, and procedures (TTPs), including reconstituted password spraying capabilities, spearphishing, and modification of Microsoft Exchange mailbox permissions.
    In late February 2022, multiple Russian state-sponsored cyber actors increased the variety of cyber operations for purposes of espionage, destruction, and influence—with unit 26165 predominately involved in espionage. [1] As Russian military forces failed to meet their military objectives and Western countries provided aid to support Ukraine’s territorial defense, unit 26165 expanded its targeting of logistics entities and technology companies involved in the delivery of aid. These actors have also targeted Internet-connected cameras at Ukrainian border crossings to monitor and track aid shipments.
    Note: This advisory uses the MITRE ATT&CK® for Enterprise framework, version 17. See Appendix A: MITRE ATT&CK tactics and techniques for a table of the threat actors’ activity mapped to MITRE ATT&CK tactics and techniques. This advisory uses the MITRE D3FEND® framework, version 1.0.

    Description of Targets

    The GRU unit 26165 cyber campaign against Western logistics providers and technology companies has targeted dozens of entities, including government organizations and private/commercial entities across virtually all transportation modes: air, sea, and rail. These actors have targeted entities associated with the following verticals within NATO member states, Ukraine, and at international organizations: 

    •  Defense Industry
    • Transportation and Transportation Hubs (ports, airports, etc.)
    • Maritime
    • Air Traffic Management
    • IT Services

    In the course of the targeting lifecycle, unit 26165 actors identified and conducted follow-on targeting of additional entities in the transportation sector that had business ties to the primary target, exploiting trust relationships to attempt to gain additional access [T1199].

    The actors also conducted reconnaissance on at least one entity involved in the production of industrial control system (ICS) components for railway management, though a successful compromise was not confirmed [TA0043].

    The countries with targeted entities include the following, as illustrated in Figure 1:

    • Bulgaria
    • Czech Republic
    • France
    • Germany
    • Greece
    • Italy
    • Moldova
    • Netherlands
    • Poland
    • Romania
    • Slovakia
    • Ukraine
    • United States
       
    Figure 1: Countries with Targeted Entities

    Initial Access TTPs

    To gain initial access to targeted entities, unit 26165 actors used several techniques to gain initial access to targeted entities, including (but not limited to):

    The actors abused vulnerabilities associated with a range of brands and models of small office/home office (SOHO) devices to facilitate covert cyber operations, as well as proxy malicious activity via devices with geolocation in proximity to the target [T1665]. [2]

    Credential Guessing/Brute Force

    Unit 26165 actors’ credential guessing [T1110.001] operations in this campaign exhibit some similar characteristics to those disclosed in the previous CSA “Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments.” [3] Based on victim network investigations, the current iteration of this TTP employs a similar blend of anonymization infrastructure, including the use of Tor and commercial VPNs [T1090.003]. The actors frequently rotated the IP addresses used to further hamper detection. All observed connections were made via encrypted TLS [T1573]. 

    Spearphishing

    GRU unit 26165 actors’ spearphishing emails included links [T1566.002] leading to fake login pages impersonating a variety of government entities and Western cloud email providers’ webpages. These webpages were typically hosted on free third-party services or compromised SOHO devices and often used legitimate documents associated with thematically similar entities as lures. The subjects of spearphishing emails were diverse and ranged from professional topics to adult themes. Phishing emails were frequently sent via compromised accounts or free webmail accounts [T1586.002, T1586.003]. The emails were typically written in the target’s native language and sent to a single targeted recipient. 

    Some campaigns employed multi-stage redirectors [T1104] verifying IP-geolocation [T1627.001] and browser fingerprints [T1627] to protect credential harvesting infrastructure or provide multifactor authentication (MFA) [T1111] and CAPTCHA relaying capabilities [T1056]. Connecting endpoints failing the location checks were redirected to a benign URL [T1627], such as msn.com. Redirector services used include:

    • Webhook[.]site
    • FrgeIO
    • InfinityFree
    • Dynu
    • Mocky
    • Pipedream
    • Mockbin[.]org

    The actors also used spearphishing to deliver malware (including HEADLACE and MASEPIE) executables [T1204.002] delivered via third-party services and redirectors [T1566.002], scripts in a mix of languages [T1059] (including BAT [T1059.003] and VBScript [T1059.005]) and links to hosted shortcuts [T1204.001].

    CVE Usage

    Throughout this campaign, GRU unit 26165 weaponized an Outlook NTLM vulnerability (CVE-2023-23397) to collect NTLM hashes and credentials via specially crafted Outlook calendar appointment invitations [T1187]. [4],[5] These actors also used a series of Roundcube CVEs (CVE-2020-12641, CVE-2020-35730, and CVE-2021-44026) to execute arbitrary shell commands [T1059], gain access to victim email accounts, and retrieve sensitive data from email servers [T1114].

    Since at least fall 2023, the actors leveraged a WinRAR vulnerability (CVE-2023-38831) allowing for the execution of arbitrary code embedded in an archive as a means of initial access [T1659]. The actors sent emails with malicious attachments [T1566.001] or embedded hyperlinks [T1566.002] that downloaded a malicious archive prepared using this CVE. 

    Post-Compromise TTPs

    After an initial compromise using one of the above techniques, unit 26165 actors conducted contact information reconnaissance to identify additional targets in key positions [T1589.002]. The actors also conducted reconnaissance of the cybersecurity department [T1591], individuals responsible for coordinating transport [T1591.004], and other companies cooperating with the victim entity [T1591.002].

    The actors used native commands and open source tools, such as Impacket and PsExec, to move laterally within the environment [TA0008]. Multiple Impacket scripts were used as .exe files, in addition to the python versions, depending on the victim environment. The actors also moved laterally within the network using Remote Desktop Protocol (RDP) [T1021.001] to access additional hosts and attempt to dump Active Directory NTDS.dit domain databases [T1003.003] using native Active Directory Domain Services commands, such as in Figure 2: Example Active Directory Domain Services command:

    C:Windowssystem32ntdsutil.exe "activate instance ntds" ifm "create full C:temp[a-z]{3}" quit quit

    Figure 2: Example Active Directory Domain Services command

    Additionally, GRU unit 26165 actors used the tools Certipy and ADExplorer.exe to exfiltrate information from the Active Directory. The actors installed python [T1059.006] on infected machines to enable the execution of Certipy. Accessed files were archived in .zip files prior to exfiltration [T1560]. The actors attempted to exfiltrate archived data via a previously dropped OpenSSH binary [T1048].

    Incident response investigations revealed that the actors would take steps to locate and exfiltrate lists of Office 365 users and set up sustained email collection. The actors used manipulation of mailbox permissions [T1098.002] to establish sustained email collection at compromised logistics entities, as detailed in a Polish Cybercommand blog. [6]

    After initial authentication, unit 26165 actors would change accounts’ folder permissions and enroll compromised accounts in MFA mechanisms to increase the trust-level of compromised accounts and enable sustained access [T1556.006]. The actors leveraged python scripts to retrieve plaintext passwords via Group Policy Preferences [T1552.006] using Get-GPPPassword.py and a modified ldap-dump.py to enumerate the Windows environment [T1087.002] and conduct a brute force password spray [T1110.003] via Lightweight Directory Access Protocol (LDAP). The actors would additionally delete event logs through the wevtutil utility [T1070.001].

    After gaining initial access to the network, the actors pursued further access to accounts with access to sensitive information on shipments, such as train schedules and shipping manifests. These accounts contained information on aid shipments to Ukraine, including: 

    • sender,
    • recipient,
    • train/plane/ship numbers,
    • point of departure,
    • destination,
    • container registration numbers,
    • travel route, and
    • cargo contents. 

    In at least one instance, the actors attempted to use voice phishing [T1566.004] to gain access to privileged accounts by impersonating IT staff.

    Malware

    Unit 26165’s use of malware in this campaign ranged from gaining initial access to establishing persistence and exfiltrating data. In some cases, the attack chain resulted in multiple pieces of malware being deployed in succession. The actors used dynamic link library (DLL) search order hijacking [T1574.001] to facilitate malware execution. There were a number of known malware variants tied to this campaign against logistics sector victims, including:

    • HEADLACE [7]
    • MASEPIE [8]

    While other malware variants, such as OCEANMAP and STEELHOOK, [8] were not directly observed targeting logistics or IT entities, their deployment against victims in other sectors in Ukraine and other Western countries suggest that they could be deployed against logistics and IT entities should the need arise. 

    Persistence

    In addition to the abovementioned mailbox permissions abuse, unit 26165 actors also used scheduled tasks [T1053.005], run keys [T1547.001], and placed malicious shortcuts [T1547.009] in the startup folder to establish persistence. 

    Exfiltration

    GRU unit 26165 actors used a variety of methods for data exfiltration that varied based on the victim environment, including both malware and living off the land binaries. PowerShell commands [T1059.001] were often used to prepare data for exfiltration; for example, the actors prepared zip archives [T1560.001] for upload to their own infrastructure. 

    The actors also used server data exchange protocols and Application Programming Interfaces (APIs) such as Exchange Web Services (EWS) and Internet Message Access Protocol (IMAP) [T1114.002] to exfiltrate data from email servers. In multiple instances, the actors used periodic EWS queries [T1119] to collect new emails sent and received since the last data exfiltration [T1029]. The actors typically used infrastructure in close geographic proximity to the victim. Long gaps between exfiltration, the use of trusted and legitimate protocols, and the use of local infrastructure allowed for long-term collection of sensitive data to go undetected. 

    Connections to Targeting of IP Cameras

    In addition to targeting logistics entities, unit 26165 actors likely used access to private cameras at key locations, such as near border crossings, military installations, and rail stations, to track the movement of materials into Ukraine. The actors also used legitimate municipal services, such as traffic cams. 

    The actors targeted Real Time Streaming Protocol (RTSP) servers hosting IP cameras primarily located in Ukraine as early as March 2022 in a large-scale campaign, which included attempts to enumerate devices [T1592] and gain access to the cameras’ feeds [T1125]. Actor-controlled servers sent RTSP DESCRIBE requests destined for RTSP servers, primarily hosting IP cameras [T1090.002]. The DESCRIBE requests were crafted to obtain access to IP cameras located on logically distinct networks from that of the routers that received the request. The requests included Base64-encoded credentials for the RTSP server, which included publicly documented default credentials and likely generic attempts to brute force access to the devices [T1110]. An example of an RTSP request is shown in Figure 3.

    DESCRIBE rtsp://[IP ADDRESS] RTSP/1.0

    CSeq: 1

    Authorization: Basic

    User-Agent: WebClient

    Accept: application/sdp

    DESCRIBE rtsp://[IP ADDRESS] RTSP/1.0

    CSeq: 2

    Authorization: Digest username="admin", realm="[a-f0-9]{12}", algorithm="MD5", nonce="[a-f0-9]{32}", uri="", response="[a-f0-9]{32}"

    User-Agent: WebClient

    Accept: application/sdp

    Figure 3: Example RTSP request

    Successful RTSP 200 OK responses contained a snapshot of the IP camera’s image and IP camera metadata such as video codec, resolution, and other properties depending on the IP camera’s configuration. 

    From a sample available to the authoring agencies of over 10,000 cameras targeted via this effort, the geographic distribution of victims showed a strong focus on cameras in Ukraine and border countries, as shown in Table 1:

    Table 1: Geographic distribution of targeted IP cameras
    Country Percentage of Total Attempts
    Ukraine 81.0%
    Romania 9.9%
    Poland 4.0%
    Hungary 2.8%
    Slovakia 1.7%
    Others 0.6%

    Mitigation Actions

    General Security Mitigations

    Architecture and Configuration

    • Employ appropriate network segmentation [D3-NI] and restrictions to limit access and utilize additional attributes (such as device information, environment, and access path) when making access decisions [D3-AMED].
      • Consider Zero Trust principles when designing systems. Base product choices on how those products can solve specific risks identified as part of the end-to-end design. [9]
    • Ensure that host firewalls and network security appliances (e.g., firewalls) are configured to only allow legitimately needed data flows between devices and servers to prevent lateral movement [D3-ITF]. Alert on attempts to connect laterally between host devices or other unusual data flows.
    • Use automated tools to audit access logs for security concerns and identify anomalous access requests [D3-RAPA].
    • For organizations using on-premises authentication and email services, block and alert on NTLM/SMB requests to external infrastructure [D3-OTF].
    • Utilize endpoint, detection, and response (EDR) and other cybersecurity solutions on all systems, prioritizing high value systems with large amounts of sensitive data such as mail servers and domain controllers [D3-PM] first.
      • Perform threat and attack modeling to understand how sensitive systems may be compromised within an organization’s specific architecture and security controls. Use this to develop a monitoring strategy to detect compromise attempts and select appropriate products to enact this strategy.
    • Collect and monitor Windows logs for certain events, especially for events that indicate that a log was cleared unexpectedly [D3-SFA].
    • Enable optional security features in Windows to harden endpoints and mitigate initial access techniques [D3-AH]:
      • Enable attack surface reduction rules to prevent executable content from email [D3-ABPI].
      • Enable attack surface reduction rules to prevent execution of files from globally writeable directories, such as Downloads or %APPDATA% [D3-EAL].
      • Unless users are involved in the development of scripts, limit the local execution of scripts (such as batch scripts, VBScript, JScript/JavaScript, and PowerShell [10]) to known scripts [D3-EI], and audit execution attempts.
      • Disable Windows Host Scripting functionality and configure PowerShell to run in Constrained mode [D3-ACH].
    • Where feasible, implement allowlisting for applications and scripts to limit execution to only those needed for authorized activities, blocking all others by default [D3-EAL].
    • Consider using open source SIGMA rules as a baseline for detecting and alerting on suspicious file execution or command parameters [D3-PSA].
    • Use services that provide enhanced browsing services and safe link checking [D3-URA]. Significant reductions in successful spearphishing attempts were noted when email providers began offering link checking and automatic file detonation to block malicious content.
    • Where possible, block logins from public VPNs, including exit nodes in the same country as target systems, or, if they need to be allowed, alert on them for further investigation. Most organizations should not need to allow incoming traffic, especially logins to systems, from VPN services [D3-NAM].
    • Educate users to only use approved corporate systems for relevant government and military business and avoid the use of personal accounts on cloud email providers to conduct official business. Network administrators should also audit both email and web request logs to detect such activity.

    Many organizations may not need to allow outgoing traffic to hosting and API mocking services, which are frequently used by GRU unit 26165. Organizations should consider alerting on or blocking the following services, with exceptions allowlisted for legitimate activity [D3-DNSDL].

    • *.000[.]pe
    • *.1cooldns[.]com
    • *.42web[.]io
    • *.4cloud[.]click
    • *.accesscan[.]org
    • *.bumbleshrimp[.]com
    • *.camdvr[.]org
    • *.casacam[.]net
    • *.ddnsfree[.]com
    • *.ddnsgeek[.]com
    • *.ddnsguru[.]com
    • *.dynuddns[.]com
    • *.dynuddns[.]net
    • *.free[.]nf
    • *.freeddns[.]org
    • *.frge[.]io
    • *.glize[.]com
    • *.great-site[.]net
    • *.infinityfreeapp[.]com
    • *.kesug[.]com
    • *.loseyourip[.]com
    • *.lovestoblog[.]com
    • *.mockbin[.]io
    • *.mockbin[.]org
    • *.mocky[.]io
    • *.mybiolink[.]io
    • *.mysynology[.]net
    • *.mywire[.]org
    • *.ngrok[.]io
    • *.ooguy[.]com
    • *.pipedream[.]net
    • *.rf[.]gd
    • *.urlbae[.]com
    • *.webhook[.]site
    • *.webhookapp[.]com
    • *.webredirect[.]org
    • *.wuaze[.]com

    Heuristic detections for web requests to new subdomains, including of the above providers, may uncover malicious phishing activity [D3-DNRA]. Logging the requests for each sub-domain requested by users on a network, such as in DNS or firewall logs, may enable system administrators to identify new targeting and victims.

    Identity and Access Management

    Organizations should take measures to ensure strong access controls and mitigate against common credential theft techniques: 

    • Use MFA with strong factors, such as passkeys or PKI smartcards, and require regular re-authentication [D3-MFA]. [11], [12] Strong authentication factors are not guessable using dictionary techniques, so they resist brute force attempts.
    • Implement other mitigations for privileged accounts: including limiting the number of admin accounts, considering using hardware MFA tokens, and regularly reviewing all privileged user accounts [D3-JFAPA].
    • Separate privileged accounts by role and alert on misuse of privileged accounts [D3-UAP]. For example, email administrator accounts should be different from domain administrator accounts.
    • Reduce reliance on passwords; instead, consider using services like single sign-on [D3-TBA].
      • For organizations using on-premises authentication and email services, plan to disable NTLM entirely and migrate to more robust authentication processes such as PKI certificate authentication.
    • Do not store passwords in Group Policy Preferences (GPP). Remove all passwords previously included in GPP and change all passwords on the corresponding accounts [D3-CH]. [13]
    • Use account throttling or account lockout [D3-ANET]:
      • Throttling is preferred to lockout. Throttling progressively increases time delay between successive login attempts.
      • Account lockout can leave legitimate users unable to access their accounts and requires access to an account recovery process.
      • Account lockout can provide a malicious actor with an easy way to launch a Denial of Service (DoS).
      • If using lockout, then allowing 5 to 10 attempts before lockout is recommended.
    • Use a service to check for compromised passwords before using them [D3-SPP]. For example, “Have I Been Pwned” can be used to check whether a password has been previously compromised without disclosing the potential password.
    • Change all default credentials [D3-CRO] and disable protocols that use weak authentication (e.g., clear-text passwords or outdated and vulnerable authentication or encryption protocols) or do not support multi-factor authentication [D3-ACH] [D3-ET]. Always configure access controls carefully to ensure that only well-maintained and well-authenticated accounts have access. [13]

    IP Camera Mitigations

    The following mitigation techniques for IP cameras can be used to defend against this type of malicious activity:

    • Ensure IP cameras are currently supported. Replace devices that are out of support.
    • Apply security patches and firmware updates to all IP cameras [D3-SU].
    • Disable remote access to the IP camera, if unnecessary [D3-ITF].
    • Ensure cameras are protected by a security appliance, if possible, such as by using a firewall to prevent communication with the camera from IP addresses not on an allowlist [D3-NAM].
    • If remote access to IP camera feeds is required, ensure authentication is enabled [D3-AA] and use a VPN to connect remotely [D3-ET]. Use MFA for management accounts if supported [D3-MFA].
    • Disable Universal Plug and Play (UPnP), Peer-to-Peer (P2P), and Anonymous Visit features on IP cameras and routers [D3-NI].
    • Turn off other ports/services not in use (e.g., FTP, web interface, etc.) [D3-ACH].
    • If supported, enable authenticated RTSP access only [D3-AA].
    • Review all authentication activity for remote access to make sure it is valid and expected [D3-UBA]. Investigate any unexpected or unusual activity.
    • Audit IP camera user accounts to ensure they are an accurate reflection of your organization and that they are being used as expected [D3-UAP].
    • Configure, tune, and monitor logging—if available—on the IP camera.

    Indicators of Compromise (IOCs)

    Note: Specific IoCs may no longer be actor controlled, may themselves be compromised infrastructure or email accounts, or may be shared infrastructure such as public VPN or Tor exit nodes. Care should be taken when basing triaging logs or developing detection rules on these indicators. GRU unit 26165 almost certainly uses extensive further infrastructure and TTPs not specifically listed in this report.

    Utilities and scripts

    Legitimate utilities

    Unauthorized or unusual use of the following legitimate utilities can be an indication of a potential compromise:

    • ntdsutil – A legitimate Windows executable used by threat actors to export contents of Active Directory
    • wevtutil – A legitimate Windows executable used by threat actors to delete event logs
    • vssadmin – A legitimate Windows executable possibly used by threat actors to make a copy of the server’s C: drive
    • ADexplorer – A legitimate window executable to view, edit, and backup Active Directory Certificate Services
    • OpenSSH – The Windows version of a legitimate open source SSH client
    • schtasks – A legitimate Windows executable used to create persistence using scheduled tasks
    • whoami – A legitimate Windows executable used to retrieve the name of the current user
    • tasklist – A legitimate Windows executable used to retrieve the list of running processes
    • hostname – A legitimate Windows executable used to retrieve the device name
    • arp – A legitimate Windows executable used to retrieve the ARP table for mapping the network environment
    • systeminfo – A legitimate Windows executable used to retrieve a comprehensive summary of device and operating system information
    • net – A legitimate Windows executable used to retrieve detailed user information
    • wmic – A legitimate Windows executable used to interact with Windows Management Instrumentation (WMI), such as to retrieve letters assigned to logical partitions on storage drives
    • cacls – A legitimate Windows executable used to modify permissions on files
    • icacls – A legitimate Windows executable used to modify permissions to files and handle integrity levels and ownership
    • ssh – A legitimate Windows executable used to establish network shell connections
    • reg – A legitimate Windows executable used to add to or modify the system registry 

    Note: Additional heuristics are needed for effective hunting for these and other living off the land (LOTL) binaries to avoid being overwhelmed by false positives if these legitimate management tools are used regularly. See the joint guide, Identifying and Mitigating Living Off the Land Techniques, for guidance on developing a multifaceted cybersecurity strategy that enables behavior analytics, anomaly detection, and proactive hunting, which are part of a comprehensive approach to mitigating cyber threats that employ LOTL techniques.

    Malicious scripts

    • Certipy – An open source python tool for enumerating and abusing Active Directory Certificate Services
    • Get-GPPPassword.py – An open source python script for finding insecure passwords stored in Group Policy Preferences
    • ldap-dump.py – A script for enumerating user accounts and other information in Active Directory
    • Hikvision backdoor string: “YWRtaW46MTEK”

    Suspicious command lines

    While the following utilities are legitimate, and using them with the command lines shown may also be legitimate, these command lines are often used during malicious activities and could be an indication of a compromise:

    • edge.exe “-headless-new -disable-gpu”
    • ntdsutil.exe “activate instance ntds” ifm “create full C:temp[a-z]{3}” quit quit
    • ssh -Nf
    • schtasks /create /xml

    Outlook CVE Exploitation IOCs

    • md-shoeb@alfathdoor[.]com[.]sa
    • jayam@wizzsolutions[.]com
    • accounts@regencyservice[.]in
    • m.salim@tsc-me[.]com
    • vikram.anand@4ginfosource[.]com
    • mdelafuente@ukwwfze[.]com
    • sarah@cosmicgold469[.]co[.]za
    • franch1.lanka@bplanka[.]com
    • commerical@vanadrink[.]com
    • maint@goldenloaduae[.]com
    • karina@bhpcapital[.]com
    • tv@coastalareabank[.]com
    • ashoke.kumar@hbclife[.]in
    • 213[.]32[.]252[.]221
    • 124[.]168[.]91[.]178
    • 194[.]126[.]178[.]8
    • 159[.]196[.]128[.]120

    Commonly Used Webmail Providers

    • portugalmail[.]pt
    • mail-online[.]dk
    • email[.]cz
    • seznam[.]cz

    Malicious Archive Filenames Involving CVE-2023-38831

    • calc.war.zip
    • news_week_6.zip
    • Roadmap.zip
    • SEDE-PV-2023-10-09-1_EN.zip
    • war.zip
    • Zeyilname.zip

    Brute Forcing IP Addresses

    Disclaimer: These IP addresses date June 2024 through August 2024. The authoring agencies recommend organizations investigate or vet these IP addresses prior to taking action, such as blocking.

    June 2024 July 2024 August 2024
    192[.]162[.]174[.]94 207[.]244[.]71[.]84 31[.]135[.]199[.]145 79[.]184[.]25[.]198 91[.]149[.]253[.]204  
    103[.]97[.]203[.]29 162[.]210[.]194[.]2 31[.]42[.]4[.]138 79[.]185[.]5[.]142 91[.]149[.]254[.]75  
    209[.]14[.]71[.]127   46[.]112[.]70[.]252 83[.]10[.]46[.]174 91[.]149[.]255[.]122  
    109[.]95[.]151[.]207   46[.]248[.]185[.]236 83[.]168[.]66[.]145 91[.]149[.]255[.]19  
        64[.]176[.]67[.]117 83[.]168[.]78[.]27 91[.]149[.]255[.]195  
        64[.]176[.]69[.]196 83[.]168[.]78[.]31   91[.]221[.]88[.]76  
        64[.]176[.]70[.]18 83[.]168[.]78[.]55   93[.]105[.]185[.]139  
        64[.]176[.]70[.]238 83[.]23[.]130[.]49   95[.]215[.]76[.]209  
        64[.]176[.]71[.]201 83[.]29[.]138[.]115   138[.]199[.]59[.]43  
        70[.]34[.]242[.]220 89[.]64[.]70[.]69   147[.]135[.]209[.]245  
        70[.]34[.]243[.]226 90[.]156[.]4[.]204   178[.]235[.]191[.]182  
        70[.]34[.]244[.]100 91[.]149[.]202[.]215   178[.]37[.]97[.]243  
        70[.]34[.]245[.]215 91[.]149[.]203[.]73   185[.]234[.]235[.]69  
        70[.]34[.]252[.]168 91[.]149[.]219[.]158 192[.]162[.]174[.]67  
        70[.]34[.]252[.]186 91[.]149[.]219[.]23   194[.]187[.]180[.]20  
        70[.]34[.]252[.]222 91[.]149[.]223[.]130   212[.]127[.]78[.]170  
        70[.]34[.]253[.]13 91[.]149[.]253[.]118 213[.]134[.]184[.]167
        70[.]34[.]253[.]247   91[.]149[.]253[.]198    
        70[.]34[.]254[.]245 91[.]149[.]253[.]20    

    Detections

    Customized NTLM listener

    rule APT28_NTLM_LISTENER {

           meta:

                  description = "Detects NTLM listeners including APT28's custom one"

           strings:

                  $command_1 = "start-process powershell.exe -WindowStyle hidden"

                  $command_2 = "New-Object System.Net.HttpListener"

                  $command_3 = "Prefixes.Add('http://localhost:8080/')"

                  $command_4 = "-match 'Authorization'"

                  $command_5 = "GetValues('Authorization')"

                  $command_6 = "Request.RemoteEndPoint.Address.IPAddressToString"

                  $command_7 = "@(0x4e,0x54,0x4c,0x4d, 0x53,0x53,0x50,0x00,0x02,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x28,0x00,0x00,0x01,0x82,0x00,0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00)"

                  $command_8 = ".AllKeys"

                  

                  $variable_1 = "$NTLMAuthentication" nocase

                  $variable_2 = "$NTLMType2" nocase

                  $variable_3 = "$listener" nocase

                  $variable_4 = "$hostip" nocase

                  $variable_5 = "$request" nocase

                  $variable_6 = "$ntlmt2" nocase

                  $variable_7 = "$NTLMType2Response" nocase

                  $variable_8 = "$buffer" nocase

           condition:

                  5 of ($command_*) 

                  or

                  all of ($variable_*)

    }

    HEADLACE shortcut

    rule APT28_HEADLACE_SHORTCUT {

           meta:

                  description = "Detects the HEADLACE backdoor shortcut dropper. Rule is meant for threat hunting."

           strings:

                  $type = "[InternetShortcut]" ascii nocase

                  $url  = "file://"

                  $edge = "msedge.exe"

                  $icon = "IconFile"

           condition:

                  all of them

    }

    HEADLACE credential dialogbox phishing 

    rule APT28_HEADLACE_CREDENTIALDIALOG {

           meta:

                  description = "Detects scripts used by APT28 to lure user into entering credentials"

           strings:

                  $command_1 = "while($true)"

                  $command_2 = "Get-Credential $(whoami)"

                  $command_3 = "Add-Content"

                  $command_4 = ".UserName"

                  $command_5 = ".GetNetworkCredential().Password"

                  $command_6 = "GetNetworkCredential().Password.Length -ne 0"

           condition:

                  5 of them

    }

    HEADLACE core script

    rule APT28_HEADLACE_CORE {

           meta:

                  description = "Detects HEADLACE core batch scripts"

           strings:

                  $chcp = "chcp 65001" ascii

                  $headless = "start "" msedge --headless=new --disable-gpu" ascii

                  

                  $command_1 = "taskkill /im msedge.exe /f" ascii

                  $command_2 = "whoami>"%programdata%" ascii

                  $command_3 = "timeout" ascii

                  $command_4 = "copy "%programdata%" ascii

                  $non_generic_del_1 = "del /q /f "%programdata%" ascii

                  $non_generic_del_3 = "del /q /f "%userprofile%Downloads" ascii

     

                  $generic_del = "del /q /f" ascii

           condition:

                  (

                          $chcp 

                          and 

                          $headless

                  )

                  and

                  (

                          1 of ($non_generic_del_*)

                          or

                          ($generic_del)

                          or

                          3 of ($command_*)

                  )

    }

    MASEPIE

    rule APT28_MASEPIE {

           meta:

                  description = "Detects MASEPIE python script"

           strings:

                  $masepie_unique_1 = "os.popen('whoami').read()"

                  $masepie_unique_2 = "elif message == 'check'"

                  $masepie_unique_3 = "elif message == 'send_file':"

                  $masepie_unique_4 = "elif message == 'get_file'"

                  $masepie_unique_5 = "enc_mes('ok'"

                  $masepie_unique_6 = "Bad command!'.encode('ascii'"

                  $masepie_unique_7 = "{user}{SEPARATOR}{k}"

                  $masepie_unique_8 = "raise Exception("Reconnect"

           condition:

                  3 of ($masepie_unique_*)

    }

    STEELHOOK

    rule APT28_STEELHOOK {

           meta:

                  description = "Detects APT28's STEELHOOK powershell script"

           strings:

                  $s_1 = "$($env:LOCALAPPDATAGoogleChromeUser DataLocal State)"

                  $s_2 = "$($env:LOCALAPPDATAGoogleChromeUser DataDefaultLogin Data)"

                  $s_3 = "$($env:LOCALAPPDATAMicrosoftEdgeUser DataLocal State)"

                  $s_4 = "$($env:LOCALAPPDATAMicrosoftEdgeUser DataDefaultLogin Data)"

                  $s_5 = "os_crypt.encrypted_key"

                  $s_6 = "System.Security.Cryptography.DataProtectionScope"

                  $s_7 = "[system.security.cryptography.protectdata]::Unprotect"

                  $s_8 = "Invoke-RestMethod"

           condition:

                  all of them

    }

    PSEXEC

    rule GENERIC_PSEXEC {

           meta:

                  description = "Detects SysInternals PSEXEC executable"

           strings:

                  $sysinternals_1 = "SYSINTERNALS SOFTWARE LICENCE TERMS"

                  $sysinternals_2 = "/accepteula"

                  $sysinternals_3 = "SoftwareSysinternals"

                  $network_1 = "%sIPC$"

                  $network_2 = "%sADMIN$%s"

                  $network_3 = "DeviceLanmanRedirector%sipc$"

                  $psexec_1 = "PSEXESVC"

                  $psexec_2 = "PSEXEC-{}-"

                  $psexec_3 = "Copying %s to %s..."

                  $psexec_4 = "gPSINFSVC"

           condition:

                  (

                          ( uint16( 0x0 ) ==0x5a4d )

                          and

                          ( uint16( uint32( 0x3c )) == 0x4550 )

                  )

                  and 

                          filesize < 1024KB

                  and

                  (

                          ( any of ($sysinternals_*) and any of ($psexec_*) )

                          or

                          ( 2 of ($network_*) and 2 of ($psexec_*))

                  )

    }

    The cybersecurity industry provides overlapping cyber threat intelligence, IOCs, and mitigation recommendations related to GRU unit 26165 cyber actors. While not all encompassing, the following are the most notable threat group names related under MITRE ATT&CK G0007 and commonly used within the cybersecurity community: 

    • APT28 [14]
    • Fancy Bear [14]
    • Forest Blizzard [14]
    • Blue Delta [15]

    Note: Cybersecurity companies have different methods of tracking and attributing cyber actors, and this may not be a 1:1 correlation to the U.S. government’s understanding for all activity related to these groupings.

    Further Reference

    To search for the presence of malicious email messages targeting CVE-2023-23397, network defenders may consider using the script published by Microsoft: https://aka.ms/CVE-2023-23397ScriptDoc. 

    For the Impacket TTP, network defenders may consider using the following publicly available Impacket YARA detection rule:
    https://github.com/Neo23x0/signature-base/blob/master/yara/gen_impacket_tools.yar

    Works Cited

    [1] Microsoft. Defending Ukraine: Early Lessons from the Cyber War. 2022. https://blogs.microsoft.com/on-the-issues/2022/06/22/defending-ukraine-early-lessons-from-the-cyber-war/  
    [2] FBI et al. Russian Cyber Actors Use Compromised Routers to Facilitate Cyber Operations. 2024. https://media.defense.gov/2024/Feb/27/2003400753/-1/-1/0/CSA-Russian-Actors-Use-Routers-Facilitate-Cyber_Operations.PDF   
    [3] NSA et al. Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments. 2021. https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/0/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF 
    [4] ANSSI. Campagnes d'attaques du mode opératoire APT28 depuis 2021. 2023. https://cert.ssi.gouv.fr/cti/CERTFR-2023-CTI-009/  
    [5] ANSSI. Targeting and compromise of french entities using the APT28 intrusion set. 2025. https://cert.ssi.gouv.fr/cti/CERTFR-2025-CTI-007/   
    [6] Polish Cyber Command. Detecting Malicious Activity Against Microsoft Exchange Servers. 2023. https://www.wojsko-polskie.pl/woc/articles/aktualnosci-w/detecting-malicious-activity-against-microsoft-exchange-servers/ 
    [7] IBM. Israel-Hamas Conflict Lures to Deliver Headlace Malware. 2023. https://securityintelligence.com/x-force/itg05-ops-leverage-israel-hamas-conflict-lures-to-deliver-headlace-malware/ 
    [8] CERT-UA. APT28: From Initial Attack to Creating Domain Controller Threats in an Hour. 2023. https://cert.gov.ua/article/6276894 
    [9] NSA. Embracing a Zero Trust Security Model. 2021. https://media.defense.gov/2021/Feb/25/2002588479/-1/-1/0/CSI_EMBRACING_ZT_SECURITY_MODEL_UOO115131-21.PDF  
    [10] NSA et al. Keeping PowerShell: Security Measures to Use and Embrace. 2022. https://media.defense.gov/2022/Jun/22/2003021689/-1/-1/0/CSI_KEEPING_POWERSHELL_SECURITY_MEASURES_TO_USE_AND_EMBRACE_20220622.PDF 
    [11] National Institute of Standards and Technology (NIST). Special Publication 800-63B: Digital Identity Guidelines – Authentication and Lifecycle Management. 2020. https://pages.nist.gov/800-63-3/sp800-63b.html 
    [12] NSA. Selecting Secure Multi-factor Authentication Solutions. October 16, 2020. https://media.defense.gov/2024/Jul/31/2003515137/-1/-1/0/MULTIFACTOR_AUTHENTICATION_SOLUTIONS_UOO17091520.PDF  
    [13] NSA and CSA. NSA and CISA Red and Blue Teams Share Top Ten Cybersecurity Misconfigurations. 2023. https://media.defense.gov/2023/Oct/05/2003314578/-1/-1/0/JOINT_CSA_TOP_TEN_MISCONFIGURATIONS_TLP-CLEAR.PDF 

    [14] Department of Justice. Justice Department Conducts Court-Authorized Disruption of Botnet Controlled by the Russian Federation’s Main Intelligence Directorate of the General Staff (GRU). 2024. https://www.justice.gov/archives/opa/pr/justice-department-conducts-court-authorized-disruption-botnet-controlled-russian  
    [15] Recorded Future. GRU’s BlueDelta Targets Key Networks in Europe with Multi-Phase Espionage Campaigns. 2024. https://go.recordedfuture.com/hubfs/reports/CTA-RU-2024-0530.pdf  
     

    Disclaimer of endorsement

    The information and opinions contained in this document are provided "as is" and without any warranties or guarantees. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favoring by the United States Government, and this guidance shall not be used for advertising or product endorsement purposes.

    Purpose

    This document was developed in furtherance of the authoring agencies’ cybersecurity missions, including their responsibilities to identify and disseminate threats and to develop and issue cybersecurity specifications and mitigations. This information may be shared broadly to reach all appropriate stakeholders.

    Contact

    United States organizations

    • National Security Agency (NSA)
    • Cybersecurity and Infrastructure Security Agency (CISA) and Federal Bureau of Investigation (FBI)
      • U.S. organizations are encouraged to reporting suspicious or criminal activity related to information in this advisory to CISA via the agency’s Incident Reporting System, its 24/7 Operations Center (report@cisa.gov or 888-282-0870), or your local FBI field office. When available, please include the following information regarding the incident: date, time, and location of the incident; type of activity; number of people affected; type of equipment user for the activity; the name of the submitting company or organization; and a designated point of contact.
    • Department of Defense Cyber Crime Center (DC3)

    United Kingdom organizations

    Germany organizations

    Czech Republic organizations

    Poland organizations

    Australian organizations

    • Visit cyber.gov.au or call 1300 292 371 (1300 CYBER 1) to report cybersecurity incidents and access alerts and advisories.

    Canadian organizations

    Estonia organizations

    French organizations

    • French organizations are encouraged to report suspicious activity or incident related to information found in this advisory by contacting ANSSI/CERT-FR by email at cert-fr@ssi.gouv.fr or by phone at: 3218 or +33 9 70 83 32 18. 

    See Table 2 through Table 14 for all the threat actor tactics and techniques referenced in this advisory.

    Table 2: Reconnaissance
    Tactic/Technique Title ID Use
    Reconnaissance TA0043 Conducted reconnaissance on at least one entity involved in the production of ICS components for railway management.
    Gather Victim Identity Information: Email Addresses T1589.002 Conducted contact information reconnaissance to identify additional targets in key positions.
    Gather Victim Org Information T1591 Conducted reconnaissance of the cybersecurity department.
    Gather Victim Org Information: Identify Roles T1591.004 Conducted reconnaissance of individuals responsible for coordinating transport.
    Gather Victim Org Information: Business Relationships T1591.002 Conducted reconnaissance of other companies cooperating with the victim entity.
    Gather Victim Host Information T1592 Attempted to enumerate Real Time Streaming Protocol (RTSP) servers hosting IP cameras.
    Table 3: Resource development
    Tactic/Technique Title ID Use
    Compromise Accounts: Email Accounts T1586.002 Sent phishing emails using compromised accounts.
    Compromise Accounts: Cloud Accounts T1586.003 Sent phishing emails using compromised accounts.
    Table 4: Initial Access
    Tactic/Technique Title ID Use
    Trusted Relationship T1199 Conducted follow-on targeting of additional entities in the transportation sector that had business ties to the primary target, exploiting trust relationships to attempt to gain additional access.
    Phishing T1566 Used spearphishing for credentials and delivering malware to gain initial access to targeted entities.
    Phishing: Spearphishing Attachment T1566.001 Sent emails with malicious attachments.
    Phishing: Spearphishing Link T1566.002 Used spearphishing with included links to fake login pages. Sent emails with embedded hyperlinks that downloaded a malicious archive.
    Phishing: Spearphishing Voice T1566.004 Attempted to use voice phishing to gain access to privileged accounts by impersonating IT staff.
    External Remote Services T1133 Exploited Internet-facing infrastructure, including corporate VPNs, to gain initial access to targeted entities.
    Exploit Public-Facing Application T1190 Exploited public vulnerabilities and SQL injection to gain initial access to targeted entities.
    Content Injection T1659 Leveraged a WinRAR vulnerability allowing for the execution of arbitrary code embedded in an archive.
    Table 5: Execution
    Tactic/Technique Title ID Use
    User Execution: Malicious Link T1204.001 Used malicious links to hosted shortcuts in spearphishing.
    User Execution: Malicious File T1204.002 Delivered malware executables via spearphishing.
    Scheduled Task/Job: Scheduled Task T1053.005 Used scheduled tasks to establish persistence.
    Command and Scripting Interpreter T1059 Delivered scripts in spearphishing. Executed arbitrary shell commands.
    Command and Scripting Interpreter: PowerShell T1059.001 PowerShell commands were often used to prepare data for exfiltration.
    Command and Scripting Interpreter: Windows Command Shell T1059.003 Used BAT script in spearphishing.
    Command and Scripting Interpreter: Visual Basic T1059.005 Used VBScript in spearphishing.
    Command and Scripting Interpreter: Python T1059.006 Installed python on infected machines to enable the execution of Certipy.
    Table 6: Persistence
    Tactic/Technique Title ID Use
    Account Manipulation: 
    Additional Email Delegate 
    Permissions

    T1098.002 

    		 Used manipulation of mailbox permissions to establish sustained email collection. 
    Modify Authentication Process: 
    Multi-Factor Authentication

    T1556.006 

    		 Enrolled compromised accounts in MFA mechanisms to increase the trust-level of compromised accounts and enable sustained access. 
    Hijack Execution Flow: DLL 
    Search Order Hijacking     		 T1574.001  Used DLL search order hijacking to facilitate malware execution. 
    Boot or Logon Autostart 
    Execution: Registry Run Keys / 
    Startup Folder

    T1547.001 

    		 Used run keys to establish persistence. 
    Boot or Logon Autostart 
    Execution: Shortcut 
    Modification

    T1547.009 

    		 Placed malicious shortcuts in the startup folder to establish persistence. 
    Table 7: Defense Evasion
    Tactic/Technique Title ID Use
    Indicator Removal: Clear 
    Windows Event Logs    		 T1070.001  Deleted event logs through the wevtutil utility.
    Table 8: Credential access 
    Tactic/Technique Title ID Use

    Brute Force 

    Sent requests with Base64-encoded credentials for the RTSP server, which included publicly documented default credentials, and likely were generic attempts to brute force access to the devices. 

    Brute Force: Password Guessing 

    T1110.001 

    Used credential guessing to gain initial access to targeted entities. 

    Brute Force: Password Spraying 

    T1110.003 

    Used brute force to gain initial access to targeted entities. Conducted a brute force password spray via LDAP. 

    Multi-Factor Authentication Interception 

    Used multi-stage redirectors to provide MFA relaying capabilities in some campaigns. 

    Input Capture 

    Used multi-stage redirectors to provide CAPTCHA relaying capabilities in some campaigns. 

    Forced Authentication 

    Used an Outlook NTLM vulnerability to collect NTLM hashes and credentials via specially crafted Outlook calendar appointment invitations. 

    OS Credential Dumping: NTDS 

    T1003.003 

    Attempted to dump Active Directory NTDS.dit domain databases. 

    Unsecured Credentials: Group Policy Preferences 

    T1552.006 

    Retrieved plaintext passwords via Group Policy Preferences using Get-GPPPassword.py. 
    Table 9: Discovery
    Tactic/Technique Title ID Use

    Account Discovery: Domain Account

    T1087.002

    Used a modified ldap-dump.py to enumerate the Windows environment.
    Table 10: Command and Control
    Tactic/Technique Title ID Use

    Hide Infrastructure 

    		 T1665 

    Abused SOHO devices to facilitate covert cyber operations, as well as proxy malicious activity, via devices with geolocation in proximity to the target. 

    Proxy: External Proxy 

    		 T1090.002 

    Actor-controlled servers sent RTSP DESCRIBE requests destined for RTSP servers. 

    Proxy: Multi-hop Proxy 

    		 T1090.003 

    Used Tor and commercial VPNs as part of their anonymization infrastructure 

    Encrypted Channel 

    		 T1573 

    Connected to victim infrastructure using encrypted TLS. 

    Multi-Stage Channels 

    		 T1104 

    Used multi-stage redirectors for campaigns. 
    Table 11: Defense evasion (mobile framework)
    Tactic/Technique Title ID Use

    Execution Guardrails 

    Used multi-stage redirectors to verify browser fingerprints in some campaigns. 

    Execution Guardrails: Geofencing 

    T1627.001 

    Used multi-stage redirectors to verify IP-geolocation in some campaigns. 
    Table 12: Lateral movement
    Tactic/Technique Title ID Use

    Lateral Movement 

    Used native commands and open source tools, such as Impacket and PsExec, to move laterally within the environment. 

    Remote Services: Remote Desktop Protocol 

    T1021.001 

    Moved laterally within the network using RDP. 
    Table 13: Collection
    Tactic/Technique Title ID Use

    Email Collection 

    Retrieved sensitive data from email servers. 

    Email Collection: Remote Email Collection 

    T1114.002 

    Used server data exchange protocols and APIs such as Exchange Web Services (EWS) and IMAP to exfiltrate data from email servers. 

    Automated Collection 

    Used periodic EWS queries to collect new emails. 

    Video Capture 

    Attempted to gain access to the cameras’ feeds. 

    Archive Collected Data 

    Accessed files were archived in .zip files prior to exfiltration. 

    Archive Collected Data: Archive via Utility 

    T1560.001 

    Prepared zip archives for upload to the actors’ infrastructure. 
    Table 14: Exfiltration
    Tactic/Technique Title ID Use

    Exfiltration Over Alternative Protocol 

    Attempted to exfiltrate archived data via a previously dropped OpenSSH binary. 

    Scheduled Transfer 

    Used periodic EWS queries to collect new emails sent and received since the last data exfiltration. 

    Appendix B: CVEs exploited

    Table 15: Exploited CVE information
    CVE  Vendor/Product  Details

    CVE-2023-38831 

    RARLAB WinRAR 

    Allows execution of arbitrary code when a user attempts to view a benign file within a ZIP archive. 

    CVE-2023-23397 

    Microsoft Outlook 

    External actors could send specially crafted emails that cause a connection from the victim to an untrusted location of the actor’s control, leaking the Net-NTLMv2 hash of the victim that the actor could then relay to another service to authenticate as the victim. 

    CVE-2021-44026 

    Roundcube Webmail 

    Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search params. 

    CVE-2020-35730 

    Roundcube Webmail 

    An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16 and 1.4.x before 1.4.10, where a plaintext email message with JavaScript in a link reference element is mishandled by linkref_addindex in rcube_string_replacer.php. 

    CVE-2020-12641 

    Roundcube Webmail 

    Roundcube Webmail before 1.4.4 allows arbitrary code execution via shell metacharacters in a configuration setting for im_convert_path or im_identify_path in rcube_image.php. 

    Appendix C: MITRE D3FEND Countermeasures

    Table 16: MITRE D3FEND countermeasures
    Countermeasure Title  ID  Details 

    Network Isolation 

    Employ appropriate network segmentation. Disable Universal Plug and Play (UPnP), Peer-to-Peer (P2P), and Anonymous Visit features on IP cameras and routers. 

    Access Mediation 

    Limit access and utilize additional attributes (such as device information, environment, and access path) when making access decisions. Configure access controls carefully to ensure that only well-maintained and well-authenticated accounts have access. 

    Inbound Traffic Filtering 

    Implement host firewall rules to block connections from other devices on the network, other than from authorized management devices and servers, to prevent lateral movement. 

    Resource Access Pattern Analysis 

    Use automated tools to audit access logs for security concerns and identify anomalous access requests. 

    Outbound Traffic Filtering 

    Block NTLM/SMB requests to external infrastructure. 

    Platform Monitoring 

    Install EDR/logging/cybersecurity solutions onto high value systems with large amounts of sensitive data such as mail servers and domain controllers. 

    System File Analysis 

    Collect and monitor Windows logs for certain events, especially for events that indicate that a log was cleared unexpectedly. 

    Application Hardening 

    Enable optional security features in Windows to harden endpoints and mitigate initial access techniques. 

    Application-based Process Isolation 

    Enable attack surface reduction rules to prevent executable content from email. 

    Executable Allowlisting 

    Enable attack surface reduction rules to prevent execution of files from globally writeable directories, such as Downloads or %APPDATA%. 

    Execution Isolation 

    Unless users are involved in the development of scripts, limit the execution of scripts (such as batch, JavaScript, and PowerShell) to known scripts. 

    Application Configuration Hardening 

    Disable Windows Host Scripting functionality and configure PowerShell to run in Constrained mode. Disable protocols that use weak authentication (e.g., clear-text passwords, or outdated and vulnerable authentication or encryption protocols) or do not support multi-factor authentication. Turn off other ports/services not in use (e.g., FTP, web interface, etc.). 

    Process Spawn Analysis 

    Use open source SIGMA rules as a baseline for detecting and alerting on suspicious file execution or command parameters. 

    URL Reputation Analysis 

    Use services that provide enhanced browsing services and safe link checking. 

    Network Access Mediation 

    Do not allow incoming traffic, especially logins to systems, from public VPN services. Where possible, logins from public VPNs, including exit nodes in the same country as target systems, should be blocked or, if allowed, alerted on for further investigation. Ensure cameras and other Internet of Things devices are protected by a security appliance, if possible. 

    DNS Denylisting 

    D3-DNSDL 

    Do not allow outgoing traffic to hosting and API mocking services frequently used by malicious actors. 

    Domain Name Reputation Analysis 

    Heuristic detections for web requests to new subdomains may uncover malicious phishing activity. Logging the requests for each sub-domain requested by users on a network, such as in DNS or firewall logs, may enable system administrators to identify new targeting and victims. 

    Multi-factor Authentication 

    Use MFA with strong factors and require regular re-authentication, especially for management accounts. 

    Job Function Access Pattern Analysis 

    D3-JFAPA 

    Implement other mitigations for privileged accounts: including limiting the number of admin accounts, considering using hardware MFA tokens, and regularly reviewing all privileged user accounts. 

    User Account Permissions 

    Separate privileged accounts by role and alert on misuse of privileged accounts. Audit user accounts on all devices to ensure they are an accurate reflection of your organization and that they are being used as expected. 

    Token-based Authentication 

    Reduce reliance on passwords; instead, consider using services like single sign-on. 

    Credential Hardening 

    Do not store passwords in Group Policy Preferences (GPP). Remove all passwords previously included in GPP and change all passwords on the corresponding accounts. 

    Authentication Event Threshholding 

    Use account throttling or account lockout. Throttling progressively increases time delay between successive login attempts. If using account lockout, allow between 5 to 10 attempts before lockout. 

    Strong Password Policy 

    Use a service to check for compromised passwords before using them. 

    Credential Rotation 

    Change all default credentials. 

    Encrypted Tunnels 

    Disable protocols that use weak authentication (e.g., clear-text passwords, or outdated and vulnerable authentication or encryption protocols). Use a VPN for remote connections to devices. 

    Software Update 

    Apply security patches and firmware updates to all devices. Ensure devices are currently supported. Replace devices that are end-of-life. 

    Agent Authentication 

    Ensure authentication is enabled for remote access to devices. If supported on IP cameras, enable authenticated RTSP access only. 

    User Behavior Analysis 

    Review all authentication activity for remote access to make sure it is valid and expected. Investigate any unexpected or unusual activity. 

    MIL OSI USA News -

  • MIL-OSI USA: Russian GRU Cyber Actors Targeting Western Logistics Entities and Tech Companies

    News In Brief – Source: US Computer Emergency Readiness Team

    Today, CISA, the National Security Agency, the Federal Bureau of Investigation, and other U.S. and international partners released a joint Cybersecurity Advisory, Russian GRU Targeting Western Logistics Entities and Technology Companies.  

    This advisory details a Russian state-sponsored cyber espionage-oriented campaign targeting technology companies and logistics entities, including those involved in the coordination, transport, and delivery of foreign assistance to Ukraine.

    Russian General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center, military unit 26165 cyber actors are using a mix of previously disclosed tactics, techniques, and procedures (TTPs) and are likely connected to these actors’ widescale targeting of IP cameras in Ukraine and bordering NATO nations.

    Executives and network defenders at logistics entities and technology companies should recognize the elevated threat of until 26165 targeting, increase monitoring and threat hunting for known TTPs and indicators of compromise, and posture network defenses with a presumption of targeting. For more information on Russian state-sponsored threat actor activity, see CISA’s Russia Cyber Threat Overview and Advisories page. 

    MIL OSI USA News –

  • MIL-OSI USA: Lt. Gov. Luke – VNR – Hawaiʻi Schools Win ‘Super Sleuth’ Award in Internet Speeds Mapping Effort

    Source: US State of Hawaii

    Lt. Gov. Luke – VNR – Hawaiʻi Schools Win ‘Super Sleuth’ Award in Internet Speeds Mapping Effort

    Posted on May 20, 2025 in Latest Department News, Newsroom

    STATE OF HAWAIʻI
    KA MOKU ʻĀINA O HAWAIʻI

     

    SYLVIA LUKE
    LIEUTENANT GOVERNOR
    KE KEʻENA O KA HOPE KIAʻĀINA

    FOR IMMEDIATE RELEASE

    May 20, 2025

    Hawaiʻi Schools Win ‘Super Sleuth’ Award in Internet Speeds Mapping Effort

    Connect Kākou’s Digital Detectives Initiative included 6,000 participants statewide

    Lt. Gov. Luke with Robert Louis Stevenson Middle School (left) and Kona Pacific Charter School (right).

     

    (Videos/Photos Courtesy: Connect Kākou)

    HONOLULU – Lieutenant Governor Sylvia Luke announced today that more than 6,000 Hawaiʻi residents, many of them students, participated in the Digital Detectives campaign to map internet speeds across the state. Part of the Connect Kākou initiative, Digital Detectives aimed to close the digital divide by identifying areas in need of urgent broadband infrastructure improvements.

    By taking a simple 30-second internet speed test last October, residents provided valuable data to help ensure federal funding is directed where it is most needed. Classes from Robert Louis Stevenson Middle School and Kona Pacific Charter School received the top Digital Detectives Super Sleuth Awards for student participation and classroom reporting. The classes received a visit from Lieutenant Governor Luke and a gift card for classroom supplies.

    “Thanks to the thousands of students and their teachers who participated in Digital Detectives, we now have a clearer picture of Hawaiʻi’s internet speeds and where improvements are most needed,” said Lieutenant Governor Luke. “Reliable internet is crucial for education, future careers, and so much more. We were thrilled to see so many students taking part in shaping a more connected future for our state.

    “Digital Detectives encouraged our students to become active participants in expanding internet access for their communities,” said Ken Hiraki, executive director of the Public Schools Foundation. “By turning a simple classroom activity into meaningful data for our state, students had a front row seat to civic engagement and real-world impact.”

    Results from the internet speed tests have been aggregated to provide a more comprehensive view of connectivity across the state. Construction of fiber-optic internet lines in underserved areas is expected to begin as early as this year.

    Connect Kākou is a State of Hawai‘i initiative led by Lieutenant Governor Luke, in collaboration with the Hawai‘i Broadband and Digital Equity Office (HBDEO), the University of Hawai‘i, the Department of Hawaiian Home Lands (DHHL), and multiple state and county agencies. Connect Kākou is working to ensure people from all walks of life have reliable access to high-speed internet and the tools and knowledge to safely and confidently use the internet. Visit www.connectkakou.org to learn more.

    # # #

    Media Contact:

    Shari Nishijima

    Communications Director

    Office of the Lieutenant Governor

    Cell: (808) 978-0867

    Jordan Ozaki

    iQ 360 Inc.

    Cell: (808) 294-7712

    MIL OSI USA News –

  • MIL-OSI USA: DBEDT NEWS RELEASE: HAWAI‘I APRIL UNEMPLOYMENT RATE REMAINS AT 2.9 PERCENT

    Source: US State of Hawaii

    DBEDT NEWS RELEASE: HAWAI‘I APRIL UNEMPLOYMENT RATE REMAINS AT 2.9 PERCENT

    Posted on May 20, 2025 in Latest Department News, Newsroom

     

     

    STATE OF HAWAIʻI

    KA MOKU ʻĀINA O HAWAIʻI

    JOSH GREEN, M.D.
    GOVERNOR

    KE KIAʻĀINA

    DEPARTMENT OF BUSINESS, ECONOMIC DEVELOPMENT AND TOURISM

    KA ʻOIHANA HOʻOMOHALA PĀʻOIHANA, ʻIMI WAIWAI A HOʻOMĀKAʻIKAʻI

     

    RESEARCH AND ECONOMIC ANALYSIS DIVISION

     

    JAMES KUNANE TOKIOKA

    DIRECTOR

    KA LUNA HOʻOKELE

     

    1. EUGENE TIAN

    CHIEF STATE ECONOMIST

    HAWAI‘I APRIL UNEMPLOYMENT RATE REMAINS AT 2.9 PERCENT 

    Jobs Increased by 17,000 Year-Over-Year

    FOR IMMEDIATE RELEASE

    May 20, 2025

    HONOLULU — The Hawai‘i State Department of Business, Economic Development and Tourism (DBEDT) today announced that the seasonally adjusted unemployment rate for April was 2.9 percent, the same as in March. In April, 668,650 persons were employed and 19,650 were unemployed, for a total seasonally adjusted labor force of 688,300 statewide. Nationally, the seasonally adjusted unemployment rate was 4.2 percent in April, the same as in March.

    The unemployment rate figures for the state of Hawai‘i and the U.S. in this release are seasonally adjusted in accordance with U.S. Bureau of Labor Statistics (BLS) methodology. The not-seasonally adjusted rate for the state was 2.5 percent in April, compared to 2.4 percent in March.

    Industry Payroll Employment (Establishment Survey)

    In a separate measure of employment, total nonagricultural jobs increased by 1,500 month-over-month, from March 2025 to April 2025. Job gains were experienced in Leisure & Hospitality (+1,900); Private Education & Health Services (+1,100); Trade, Transportation & Utilities (+500); Professional & Business Services (+400); Construction (+300); and Information (+100). Within Leisure & Hospitality, the rise in employment primarily occurred in Food Services & Drinking Places. Within Private Education & Health Services, the bulk of job gains were spread out over the subsectors of Health Care & Social Assistance. Employment in Manufacturing remained unchanged. Job losses occurred in Financial Activities (-200); and Other Services (-200). Government employment went down by 2,400 jobs, primarily due to below average over-the-month change in staffing at both the Department of Education and the University of Hawai‘i system. Year-over-year, nonfarm jobs have gone up by 17,000, or 2.7 percent.

     

    Technical Notes:

    Labor Force Components

    The concepts and definitions used by the Local Area Unemployment Statistics (LAUS) program are the same as those used in the Current Population Survey for the national labor force data:

    • Civilian labor force. Included are all persons in the civilian noninstitutional population ages 16 and older classified as either employed or unemployed. (See the definitions below.)
    • Employed persons. These are all persons who, during the reference week (the week including the twelfth day of the month), (a) did any work as paid employees, worked in their own business or profession or on their own farm, or worked 15 hours or more as unpaid workers in an enterprise operated by a member of their family, or (b) were not working but who had jobs from which they were temporarily absent because of vacation, illness, bad weather, childcare problems, maternity or paternity leave, labor-management dispute, job training, or other family or personal reasons, whether or not they were paid for the time off or were seeking other jobs. Each employed person is counted only once, even if he or she holds more than one job.
    • Unemployed persons. Included are all persons who had no employment during the reference week, were available for work, except for temporary illness and had made specific efforts to find employment sometime during the four-week period ending with the reference week. Persons who were waiting to be recalled to a job from which they had been laid off need not have been looking for work to be classified as unemployed.
    • Unemployment rate. The unemployed percent of the civilian labor force [i.e., 100 times (unemployed/civilian labor force)].

    Seasonal Adjustment

    The seasonal fluctuations in the number of employed and unemployed persons reflect hiring and layoff patterns that accompany regular events such as the winter holiday season and the summer vacation season. These variations make it difficult to tell whether month-to-month changes in employment and unemployment are due to normal seasonal patterns or to changing economic conditions. Therefore, the BLS uses a statistical technique called seasonal adjustment to address these issues. This technique uses the history of the labor force data and the job count data to identify the seasonal movements and to calculate the size and direction of these movements. A seasonal adjustment factor is then developed and applied to the estimates to eliminate the effects of regular seasonal fluctuations on the data. Seasonally adjusted statistical series enable more meaningful data comparisons between months or with an annual average.

    Current Population (Household) Survey (CPS)

    A survey conducted for employment status in the week that includes the twelfth day of each month generates the unemployment rate statistics, which is a separate survey from the Establishment Survey that yields the industry job counts. The CPS survey contacts approximately 1,000 households in Hawai‘i to determine an individual’s current employment status. Employed persons consist of 1) all persons who did any work for pay or profit during the survey reference week, 2) all persons who did at least 15 hours of unpaid work in a family owned enterprise operated by someone in their household and 3) all persons who were temporarily absent from their regular jobs, whether they were paid or not. Persons considered unemployed are those that do not have a job, have actively looked for work in the prior four weeks and are available for work. Temporarily laid-off workers are counted as unemployed, whether or not they have engaged in a specific job-seeking activity. Persons not in the labor force are those who are not classified as employed or unemployed during the survey reference week.

    Benchmark Changes to Local Area Unemployment Statistics Data

    Statewide and sub-state data for 2019 to 2024 have revised inputs and data for 1990 to 2024 have been re-estimated to reflect revised population controls and model re-estimation.

    Change to Monthly Employment Estimates

    This release incorporates revised job count figures for the seasonally adjusted series. The revised data reflects historical corrections applied to unadjusted super sector or sector-level series dating back from 2018 through 2024. For years, analysts with the state of Hawai‘i Department of Labor and Industrial Relations Research and Statistics Office have developed monthly employment estimates for Hawai‘i and its metropolitan areas. These estimates were based on a monthly survey of Hawai‘i businesses and analysts’ knowledge about our local economies. Beginning with the production of preliminary estimates for March 2011, responsibility for the production of state and metropolitan area (MSA) estimates were transitioned from individual state agencies to the U.S. Bureau of Labor Statistics (BLS).

    For Hawai‘i, this means the transition of statewide, Honolulu and Kahului-Wailuku MSA estimates for both the seasonally adjusted and not-seasonally adjusted areas are produced by BLS. State agencies will continue to provide the BLS with information on local events that may affect the estimates, such as strikes or large layoffs/hiring at businesses not covered by the survey and to disseminate and analyze the Current Employment Statistics (CES) estimates for local data users. BLS feels this change is designed to improve the cost efficiency of the CES program and to reduce the potential bias in state and area estimates. A portion of the cost savings generated by this change is slated to be directed toward raising survey response rates in future years, which will decrease the level of statistical error in the CES estimates. Until then, state analysts feel this change could result in increased month-to-month variability for the industry employment numbers, particularly for Hawai‘i’s counties and islands. BLS can be reached at 202-691-6555 for any questions about these estimates.

    The not-seasonally adjusted job estimates for Hawai‘i County, Kaua‘i County, Maui, Moloka‘i and Lāna‘i are produced by the state of Hawai‘i Department of Business, Economic Development and Tourism.

    Labor Force Estimates for Small Areas

    Labor Force estimates for the islands within Maui County (Maui, Moloka‘i and Lānai) are produced by the state of Hawai‘i Department of Business, Economic Development and Tourism.

    Seasonally Adjusted Labor Force and Unemployment Estimates for Honolulu and Maui County

    BLS publishes smoothed seasonally adjusted civilian labor force and unemployment estimates for all metropolitan areas, which includes the City and County of Honolulu and Maui County.

    BLS releases this data each month in the Metropolitan Area Employment and Unemployment news release. The schedule is available at http://www.bls.gov/news.release/metro.toc.htm.

    Alternative Measures of Labor Underutilization

     

    Alternative Measures of Labor Underutilization for States, Second Quarter of 2024 through First Quarter of 2025 Averages  
    Area Measure  
    U-1 U-2 U-3 U-4 U-5 U-6
                 
    United States 1.5 2.0 4.1 4.3 5.0 7.7
                 
    Hawai‘i 0.7 1.2 3.0 3.1 3.9 6.2

     

    The six alternative labor underutilization state measures based on the Current Population Survey (CPS) and compiled on a four-quarter moving-average basis defined as:

    U-1, persons unemployed 15 weeks or longer, as a percent of the civilian labor force;

    U-2, job losers and persons who completed temporary jobs, as a percent of the civilian labor force;

    U-3, total unemployed, as a percent of the civilian labor force (this is the definition used for the official unemployment rate);

    U-4, total unemployed plus discouraged workers, as a percent of the civilian labor force plus discouraged workers;

    U-5, total unemployed, plus discouraged workers, plus all other marginally attached workers*, as a percent of the civilian labor force plus all marginally attached workers; and

    U-6, total unemployed, plus all marginally attached workers, plus total employed part-time for economic reasons, as a percent of the civilian labor force plus all marginally attached workers.

    *Individuals who want and are available for work, and who have looked for a job sometime in the prior 12 months (or since the end of their last job if they had one within the past 12 months) but were not counted as unemployed because they had not searched for work in the four weeks preceding the survey, for such reasons as childcare or transportation problems, for example. Discouraged workers are a subset of the marginally attached.

    Please note that the state unemployment rates (U-3) that are shown are derived directly from the CPS. As a result, these U-3 measures may differ from the official state unemployment rates for the latest four-quarter period. The latter are estimates developed from statistical models that incorporate CPS estimates, as well as input data from other sources, such as state unemployment claims data.

    # # #

    Media contacts:

     

    Dr. Eugene Tian

    Chief State Economist

    Research and Economic Analysis Division

    Department of Business, Economic Development and Tourism, State of Hawai‘i

    Phone: 808-586-2470

    Email: [email protected]

    Laci Goshi

    Communications Officer

    Department of Business, Economic Development and Tourism, State of Hawai‘i

    Cell: 808-518-5480

    Email: [email protected]

    MIL OSI USA News –

  • MIL-OSI USA: Senator Hassan Slams GOP’s $490 Billion Medicare Cut in Tax Bill

    US Senate News:

    Source: United States Senator for New Hampshire Maggie Hassan
    WASHINGTON – U.S. Senator Maggie Hassan (D-NH), Ranking Member of the Senate Finance Subcommittee on Health, responded to a new analysis from the non-partisan Congressional Budget Office finding that the plan put forward by President Trump and Congressional Republicans to give corporate special interests and billionaires a tax break increases the deficit by $2.3 trillion, which will trigger a $490 billion automatic cut to Medicare over the next 10 years.
    “Seniors pay into Medicare their entire life, based on the promise that it will provide them with health care when they retire. It is absolutely ridiculous that Republicans want to take hundreds of billions of dollars away from Medicare in order to provide more tax giveaways to corporate special interests and billionaires,” said Senator Hassan, Ranking Member of the Senate Finance Subcommittee on Health. “At a time when we should be working to make health care more affordable, Congressional Republicans instead continue to push ahead with this partisan tax giveaway paid for by exploding the deficit and cutting Medicare, Medicaid, and Affordable Care Act, which will only increase health care costs for millions of Americans across the country.” 
    The non-partisan Congressional Budget Office analysis finds that because the Congressional Republican plan increases the deficit by $2.3 trillion, it will trigger automatic cuts of $490 billion to Medicare. More than 60 million American seniors are enrolled in Medicare. An additional recent non-partisan analysis of the Republican tax plan finds that the legislation will also result in 13.7 million Americans losing their health insurance by 2034 because of proposed cuts to Medicaid and the Affordable Care Act.  

    MIL OSI USA News –

  • MIL-OSI Europe: Answer to a written question – Delegation of competences in the area of immigration and border control to Catalonia – E-001003/2025(ASW)

    Source: European Parliament

    The Schengen Borders Code[1] defines a border guard as ‘any public official assigned, in accordance with national law, to a border crossing point or along the border or the immediate vicinity of that border who carries out […] border control tasks’ . It follows that Member States have discretion in designating the public officials authorised to exercise the functions of border guards. In accordance with Article 39(1)(d) of the Schengen Borders Code, Member States are required to notify the Commission of the list of the national services responsible for border control.

    As for Frontex, the European Border and Coast Guard ( EBCG) Regulation[2] clarifies that the EBCG shall implement European integrated border management as a shared responsibility of the Agency and of the national authorities responsible for border management, including coast guards, as well as the national authorities responsible for return. Member States retain primary responsibility for the management of their sections of the external borders. It remains the prerogative of the Member State to designate the responsible national authorities to cooperate with Frontex in the implementation of these tasks.

    • [1] Regulation (EU) 2016/399 of the European Parliament and of the Council of 9 March 2016 on a Union Code on the rules governing the movement of persons across borders (Schengen Borders Code).
    • [2] Regulation (EU) 2019/1896 of the European Parliament and of the Council of 13 November 2019 on the European Border and Coast Guard and repealing Regulations (EU) No 1052/2013 and (EU) 2016/1624.
    Last updated: 21 May 2025

    MIL OSI Europe News –

  • MIL-OSI Europe: Agenda – Thursday, 22 May 2025 – Brussels

    Source: European Parliament

    16 Deliberations of the Committee on Petitions in 2023
    Gheorghe Falcă (A10-0063/2025) 
        – Amendments Wednesday, 14 May 2025, 13:00
    11 Amending Regulation (EU) 2023/956 as regards simplifying and strengthening the carbon border adjustment mechanism
    Antonio Decaro (A10-0085/2025) 
        – Amendments; rejection Monday, 19 May 2025, 13:00
    8 Modification of customs duties applicable to imports of certain goods originating in or exported from the Russian Federation and the Republic of Belarus
    Inese Vaidere (A10-0087/2025) 
        – Amendments; rejection Monday, 19 May 2025, 13:00
    27 Granting equivalence to Moldova and Ukraine for field inspections and seed production
    Veronika Vrecionová (A10-0043/2025) 
        – Amendments; rejection Wednesday, 14 May 2025, 13:00
    28 Amendments to the Capital Requirements Regulation as regards securities financing transactions under the net stable funding ratio
        – Amendments; rejection Wednesday, 14 May 2025, 13:00
    Texts put to the vote on Thursday Tuesday, 20 May 2025, 16:00

    MIL OSI Europe News –

  • MIL-OSI Europe: Agenda – Wednesday, 21 May 2025 – Brussels

    Source: European Parliament

    11 Amending Regulation (EU) 2023/956 as regards simplifying and strengthening the carbon border adjustment mechanism
    Antonio Decaro (A10-0085/2025) 
        – Amendments; rejection Monday, 19 May 2025, 13:00
    Texts put to the vote on Thursday Tuesday, 20 May 2025, 16:00

    MIL OSI Europe News –

  • MIL-OSI Europe: Answer to a written question – Including Mexican drug cartels on the EU list of terrorist organisations – E-000631/2025(ASW)

    Source: European Parliament

    The Council has not discussed the possible inclusion of Mexican cartels on the list of persons, groups and entities covered by the measures in Article 2 and 3 of Common Position 2001/931/CFSP (‘CP 931’) .

    The Council can, at any time, adopt a decision to add additional persons, groups, or entities to the above-mentioned list, or to remove persons, groups or entities from that list. The listing of a person, group or entity under CP 931 must satisfy the conditions laid down in Article 1(2) to 1(4) of that Common Position, which, inter alia, provides a definition of ‘terrorist act’ and ‘persons, groups and entities involved in terrorist acts’ for this purpose.

    As regards the question on coordination with the United States on drug-related matters, EU-US cooperation on combatting transnational organised crime and drug trafficking is a central focus of the longstanding EU-US Dialogue on Justice and Home Affairs held at ministerial and senior official level twice a year. The EU and the United States also regularly hold an EU-US Dialogue on Drugs in order to exchange information, strengthen bilateral cooperation and enhance coordination of actions undertaken globally to address drug-related issues. The discussions in these meetings focus on reducing d rug supply by enhancing security, reducing drug demand through prevention, treatment and care services, and addressing drug-related harm, in line with the EU Drugs Strategy 2021-2025.

    Last updated: 21 May 2025

    MIL OSI Europe News –