Researchers set up a fake start-up company to study fraudulent North Korean IT workers.
Source: Schneier on Security · 2026-10-28
Researchers set up a fake start-up company to study fraudulent North Korean IT workers.
Source: Schneier on Security · 2026-10-28
A critical PHP flaw, leaked Linux kernel reports, a poisoned LiteLLM release, and more, all in seven days. Which threats called for immediate action, and which generated more noise than real danger?
Source: WeLiveSecurity (ESET) · 2026-10-28

Modern phishing campaigns can compromise American businesses without relying on traditional credential theft. Attackers can abuse legitimate cloud services, authentication mechanisms, and trusted business workflows to gain access to corporate accounts while leaving fewer obvious signs behind.
ANY.RUN’s analysis of Skyw4lker, a device code phishing campaign primarily targeting U.S. organizations
Source: The Hacker News · 2026-10-28


Network-connected surveillance cameras are now widespread in both home and enterprise environments, so securing them is essential to safeguarding physical spaces and sensitive assets. As these devices continue to gain new features and network connectivity capabilities, vulnerabilities in their implementation can have significant security implications.
During our research, we discovered a denial-of-service vulnerability that affects Intelbras IP cameras systems. The flaw resides in a firmware update endpoint that is accessible without authentication and allows anyone with access to the local Wi-Fi network to knock cameras offline. A single request disrupts the camera for only about a minute, but sending periodic requests keeps the device offline indefinitely. We reported the issue to Intelbras, monitored the remediation process, validated the fix in the new firmware, and will now demonstrate the exploitation procedure step-by-step.
Following our notification, Intelbras patched the vulnerability and released updated firmware (R.260804) along with update instructions. A candidate ID of CAN-2026-2035970 has been assigned by MITRE following submission, pending the final CVE assignment. Additionally, the Intelbras team recently informed us that MITRE has classified the vulnerability as Medium, assigning it a score of 5.1 under the CVSS 4.0 framework. The issue discussed in this article is no longer present in the latest firmware version.
Intelbras provides firmware files on its official website. While users can manually install these updates via an SD card, the cameras also natively support firmware upgrades over the local network via their web interface and mobile app. We obtained the firmware version v240927 for the iM3B-C (IM3 C) camera, which was the latest available version at the time of our research. According to Intelbras, the same firmware is also compatible with the iMX C, iM4 C, iM5 SC, iME 360 C, and iM7+ FC models. Below, we can view the firmware version and the camera model used as an example.
To provide context, we will explain how the camera’s authentication mechanism works and why it is relevant to accessing the camera’s endpoints. The main firmware component is an ARM binary named sonia, responsible for controlling the kernel drivers used by the camera hardware, authentication, and livestream recording, among other things.
The global.login RPC method handles authentication at the /RPC2_Login endpoint. First, the client, such as the mobile app or a custom script, sends the username and an empty password. The camera responds with an authentication challenge (a set of values to verify the password without transmitting it). This response returns a temporary session, the encryption type in the encryption field, a random value, and a realm (authentication scope). At this stage, a false response is normal and does not indicate a failed login, as the authentication process is not yet complete.
Next, the client calculates the response password from the authentication challenge. It first generates an MD5 (username:realm:original_password) hash as the base. It then calculates a second MD5 (username:random:first_md5) hash, where first_md5 is the result of the previous step. To complete the authentication, the client sends this final result back to /RPC2_Login in a second global.login call, passing the username, calculated password, and temporary session ID.
If the login is accepted, the camera returns true and a new, authenticated session. This session must be used for all subsequent RPC calls, including the camera’s other endpoints, for example, the one that reboots the device or those that expose sensitive information.
The affected endpoint is the firmware upgrade route http://<ip_address>/firmwareUpgrade_service/Demo, which lacks authentication checks; furthermore, it fails to verify whether the firmware is actually valid before initiating the upgrade process. This creates a serious issue because the upgrade requires the camera to reboot, and that is precisely when the problem occurs: the camera enters reboot mode and eventually shuts down, appearing offline to the user and anyone who has the camera registered on their device.
Now that we have outlined how the vulnerability works, we will use a Python script on an iM3B-C camera to exploit it for demonstration purposes. The exploit contacts the camera’s endpoint to upload firmware. Below, we can see sonia creating the endpoint responsible for the firmware upgrade.
Next, the exploit will hit the endpoint and cause the camera to reboot. Consequently, mobile phones running the Intelbras app will lose connection with the registered device. Below, we can see the camera operating normally: the green light is on and the app is showing it is available for viewing.
After the exploit executes, we can see the effects: the camera goes offline and loses connection to the registered devices.
The exploit is quite simple: it sends an HTTP POST request with the firmware, which causes the camera to accept the request and initiate the reboot process. It does not matter whether the firmware is original; the reboot process will start regardless.
After we notified Intelbras about this flaw in the endpoint implementation, the company contacted the OEM vendor. As a result, a new firmware version was released that requires authentication to initiate an update through this endpoint.
Below, we can compare the new firmware, which validates cookies and session data, with the old firmware, which performed no authentication checks and proceeded directly to the update routine.
An attacker can remotely trigger the camera firmware upgrade and reboot process without authenticating or supplying a valid firmware image. This may cause the device to go offline, which results in a denial-of-service condition preventing legitimate users from accessing live monitoring or managing the camera.
The potential impact is significant due to the number of affected users. The Intelbras Mibo Smart app, which the company provides to connect and manage the devices mentioned in this report, has over 4,000,000 downloads. Brazil represents the largest user base, followed by Paraguay, Ecuador, Colombia, Argentina, Chile, Peru, Bolivia, Uruguay, and Venezuela. As a result, exploitation of this issue affects a large number of users.
This is a medium-severity vulnerability that Intelbras is already aware of. The issue has been addressed in a newer firmware release (R.260804 along with update instructions), which mitigates this attack vector. Because the vulnerability directly affects the availability and normal operation of the affected cameras, it is highly recommended that users verify the firmware version currently installed on their devices and update to the latest available version as soon as possible. Keeping the firmware up to date is an essential security practice, especially for internet-connected surveillance devices, as outdated versions may remain exposed to known vulnerabilities.
Source: Securelist (Kaspersky GReAT) · 2026-10-28

Alabama attorney Larry Grissett was checking Facebook in late September when he saw a news story about a man he represented in a murder trial more than 40 years ago. According to the article, a federal judge had just vacated the conviction of that client, Charles McCrory.
Grissett was stunned. He later summed up his reaction: “Vindication.”
McCrory was 26 years old when he was accused of brutally killing his wife in the small town of Andalusia. He insisted he was innocent — and Grissett believed him. There was no evidence connecting McCrory to the crime; prosecutors seized on a supposed bite mark found on his wife’s body, which a state expert claimed to match to McCrory’s teeth.
Grissett was never convinced by the so-called bite mark. At McCrory’s 1985 trial, he said, Grissett’s own dentist sat through the expert testimony and found it preposterous. “He says, ‘There’s no way that guy can say that,’ Grissett recalled. “I mean, anybody with common sense would know that.”
In a September 21 ruling describing the case against McCrory as “thin,” Trump-appointed Judge R. Austin Huffaker Jr., zeroed in on this junk forensic science. Not only would the alleged bite mark not be allowed into evidence today, Huffaker wrote, bite-mark analysis itself “is grossly unreliable and unsupported by relevant scientific bodies. It amounts to nothing more than rank speculation.”
Unless the state moves to retry him within the next six months, Huffaker concluded, McCrory must be released from prison.
The ruling was not only momentous for McCrory, who has insisted on his innocence for more than four decades, but it also marked a new victory in the long legal battle against junk forensics — and the discredited discipline of bite-mark analysis specifically.
“Everybody sees this was junk science. You don’t have to be a scientist to understand that.”
Yet more than a month after the decision, McCrory remains behind bars with no sense of when he might walk out. Although his lawyers asked the court to free him on bond pending the state’s decision to release or retry him, the Alabama attorney general’s office filed a motion last week asking Huffaker to reconsider his order overturning the conviction. The state’s appeals will likely drag out McCrory’s ordeal through the holidays and into next year.
In a statement, McCrory’s current legal team praised Huffaker’s “explicit acknowledgment that criminal convictions based on discredited bitemark evidence cannot stand.” Mark Loudon-Brown, senior attorney at the Southern Center for Human Rights, and Chris Fabricant, director of strategic litigation for the Innocence Project, said they are “grateful for the decision and look forward to continuing our fight to bring Mr. McCrory home.”
In 2022, The Intercept published a lengthy investigation into McCrory’s case, detailing the flaws in the state’s conviction. The case attracted additional media coverage, highlighting the problem of junk forensic science. Despite the glaring problems with the evidence against McCrory, Alabama courts have routinely rejected his appeals and in 2023, the state’s parole board denied McCrory release.
Julie Bond McCrory’s body was found inside her home in Andalusia on May 31, 1985. Her head was bashed in, and she’d been repeatedly stabbed in the chest. The couple’s son Chad, then 3 years old, was found unharmed in his bed. Police quickly pointed to McCrory as their only suspect: He and Julie were separated, and McCrory had been having an affair. At trial, the theory seemed to be that he’d savagely murdered Julie to be free from her.
The police investigation was cursory at best. Detectives found no physical evidence to connect McCrory to the bloody crime. Meanwhile, they ignored some evidence altogether, including two windows in Julie’s bedroom that were found open, but which investigators failed to dust for fingerprints. Police also failed to consider an alternate suspect, a man who worked at an excavating company bordering the McCrorys’ backyard and who, just weeks after Julie’s murder, committed a home invasion rape of another local woman. He was convicted and sent to prison for that crime.
Ultimately, the state latched onto a single piece of physical evidence against McCrory: a pair of small indentations on the back of Julie’s right arm, which prosecutors concluded was a bite mark made by McCrory’s teeth.
To sell this theory, the state employed famed forensic dentist Richard Souviron, a star prosecution witness in the recent and sensational trial of serial killer Ted Bundy. Although Souviron initially said he couldn’t definitively link the two marks on Julie’s arm to McCrory’s teeth, at trial he was unequivocal that they matched.
Skin, with its malleability, is a terrible medium for accurately recording any injury.
Bite-mark analysis is based on a two-pronged foundation. First, that the shape and arrangement of our teeth are unique, like DNA, and second, that skin is a suitable substrate for recording this uniqueness. As it turns out, there’s no science backing either assertion. In fact, research into the discipline has routinely found the opposite — that human dentition is not unique and that skin, with its malleability, is a terrible medium for accurately recording any injury. This makes bite-mark analysis a random and entirely speculative practice.
Still, after taking center stage at the Bundy trial, bite-mark analysis took off in the 1980s and ’90s and, despite not having any basis in actual science, made its way into courtrooms around the country, turning forensic dentists like Souviron into newsmaking, swashbuckling crime fighters.
In the years that followed, however, bite-mark analysis was increasingly called into question and ultimately exposed as junk science, a subjective pattern-matching practice that has led to dozens of wrongful convictions. At least four of those, including McCrory’s, are cases in which Souviron served as the prosecution’s expert.
In 2019, Souviron recanted his testimony in McCrory’s case, providing an affidavit to Fabricant and Loudon-Brown, who presented it at a 2021 evidentiary hearing in Andalusia. “As a forensic odontologist I no longer believe the individualized teeth marks comparison testimony I offered in his case was reliable or proper,” Souviron wrote. “I no longer believe, as I did at the time of trial, that there is a valid scientific basis for concluding that the injury found on the skin of the victim in this case, assuming that the injury is in fact teeth marks, could be ‘matched’ or otherwise connected to a specific individual, such as Mr. McCrory.”
Despite the fact that their key witness had disavowed the evidence they used to send McCrory to prison for life, prosecutors fought to preserve their conviction. At the 2021 hearing, they insisted that McCrory was guilty, based on the same evidence they presented at trial. They recast the supposed bite mark as “teeth marks,” implying that, while bite-mark analysis may be discredited, the study of “teeth marks” is a separate and valid discipline. Even if Souviron had not testified for the state, they argued, jurors could have looked at photos of the marks on Julie’s body and the dental molds taken from McCrory and decided for themselves that McCrory inflicted the wounds.
Covington County Circuit Court Judge Lex Short, who presided over the hearing, agreed with the prosecutor. So did the Alabama Court of Criminal Appeals, which upheld his ruling in favor of the state. But Huffaker did not.
Huffaker took exception to the notion that analyzing “teeth marks” is somehow separate from bite-mark analysis. It is clear, he wrote, “that bitemark identification is based on analysis of individual teeth markings.”
But “most importantly, the state court unreasonably determined that, even without Dr. Souviron’s expert testimony, a reasonable jury could compare the bitemark evidence with McCrory’s dentition themselves and find that it belonged to McCrory,” Huffaker wrote. “This finding blinks reality in light of the evidence presented by McCrory at the postconviction evidentiary hearing.” In a footnote, he added that “if an expert could not testify about bitemark identification because it is junk science, a jury should not have been allowed to consider it either.”
McCrory is not the only person who is still fighting for his freedom decades after being convicted based on discredited junk science. Last year, Chris Duncan was declared innocent nearly 30 years after being sent to Louisiana’s death row based on bogus bite-mark evidence. He was released one day before Thanksgiving. In his case, a video showed the state’s supposed bite-mark expert manufacturing the evidence that was used to convict Duncan.
As in McCrory’s case, Louisiana prosecutors have nevertheless continued to insist their case against Duncan is solid. And as in McCrory’s case, this has not gone over well with some judges. Earlier this year, Louisiana Supreme Court Chief Judge John Weimer wrote that bite-mark evidence “should be discarded and no longer have a place in the realm of forensic science.”
“Long ago, some who were thought to have the best and brightest minds of that time endorsed ‘trial by water’ as a means of determining a person’s guilt or innocence. We now look back at those practices as asinine and absurd, since those who fell victim to those practices often did not survive, regardless of whether they were found guilty or innocent,” Weimer wrote. “Thankfully, as scientific knowledge evolved, there was a realization that these practices had no basis whatsoever in logic, reason, or the search for truth, and the practices were discarded.”
As the holidays approach, McCrory’s family remains hopeful that he will soon walk out of prison. His son Chad, who is now in his 40s, has attended a dozen parole hearings with the hope of one day seeing his father released.
Grissett, McCrory’s former lawyer, reached out to Chad to share his hope that McCrory will finally come home. While memories have faded in the tight-knit community of Andalusia, many people remember McCrory’s case, he said.
“Everybody sees this was junk science,” Grissett said. “You don’t have to be a scientist to understand that.”
It’s “sad that it’s taken this long,” Grissett said. It haunts him that “somebody’s still out there who murdered this lady. And I’m afraid that they’re not gonna look into that.”
Source: The Intercept · 2026-10-28
An overview of the activities of selected APT groups investigated and analyzed by ESET Research in Q2 2026 and Q3 2026
Source: WeLiveSecurity (ESET) · 2026-10-28

ICE’s Homeland Security Investigations is engaged in far-reaching spying against left-wing activists that rivals the FBI and CIA crackdowns on the Civil Rights and anti-war movements.
Source: WIRED Security · 2026-10-28


In July, not long before President Donald Trump delivered a primetime address questioning the legitimacy of American elections, the pioneering conservative election lawyer Cleta Mitchell and about two dozen of her associates logged onto a private video briefing with the White House.
Mitchell, who holds no formal position in the Trump administration, had been pivotal to Trump’s bid to challenge his loss in 2020, spearheading efforts to prove his claims of fraud and reverse his defeat in court.
After Joe Biden took office, when others abandoned the fight or scoffed as Trump clung to conspiracy theories, Mitchell doubled down, founding a grassroots organization devoted to rewriting election laws and rules to be more restrictive. Members of her group, the Election Integrity Network, were named to vital election-related positions in swing states and, later, in the second Trump administration.
The pre-speech briefing was an acknowledgment of just how consequential Mitchell and her organization had become. The White House had held similar sessions for key political players, such as governors, members of Congress and major press outlets.
ProPublica’s reporters are on the lookout for what’s going right and what isn’t. We’re monitoring voter suppression and interference, election observers and poll watchers, extremism tied to the election, and ICE activity at the polls. Have you seen something?
At the appointed time, the screen filled with the faces of EIN leaders and supporters, some sitting in front of digital backgrounds with the group’s logo on them. Mitchell shushed those who’d forgotten to mute and introduced John Solomon, an ally of hers who was helping prepare the speech.
Mitchell and her network hardly needed the run-through, though: Much of the speech was a compendium of allegations and conspiracy theories they had originated or spread.
Her lieutenants were thrilled to hear that the president would assert there were more than 275,000 noncitizens on state voter rolls — a since-debunked claim based on work led by one of her proteges, who occupied a top post at the Department of Homeland Security.
The speech would end with an exhortation for Congress to pass the SAVE America Act, a bill requiring voters to provide documentary proof of citizenship to register, which Mitchell had helped draft.
To Seth Keshel, an EIN adviser on the call, none of it was surprising — Mitchell was in and out of the White House all the time. He’d joined her for one such meeting.
“She’s got an open door with the president,” he said.

No one besides Trump himself has done more than Mitchell, 76, to turn the mundane processes of how ballots are cast and counted in American elections into mortal combat.
Since Trump returned to the White House, Mitchell and her acolytes have been deeply entwined in his unprecedented bid to assert federal control over voting, an effort that has increasingly defined his second term.
Friends and enemies alike credit her with providing much of the administration’s election road map. The White House has turned to those close to her to enact the plan, appointing her associates to help lead the hunt for noncitizens on voter rolls and to reinvestigate 2020 voting irregularities.
“She has the president’s ear,” Steve Bannon, Trump’s former chief strategist and a close ally of Mitchell’s, said in a July interview. “A lot of the momentum things we’ve seen over the last six months or so come directly from Cleta’s involvement.”
To understand how Mitchell became the hand behind this transformational push, ProPublica traced her obsession with politics and elections back to its roots.
From the start, those who knew her told us, she stood out for her willingness to embrace options others wouldn’t and to do whatever it took to win.
Her relentlessness and long-term strategic vision have enabled her to outflank or outlast not only her liberal opponents, but her conservative rivals.
Much of Mitchell’s influence derives from years of groundwork she’s done to put a foundation under the so-called election-integrity movement, once dismissed as a collection of oddballs and fringe actors.
Beyond building the EIN and raising millions of dollars to fund its activities, she’s helped direct tens of millions more to like-minded policy shops, researchers, law firms and advocacy groups.
The net effect has been to make an agreed-upon set of beliefs about elections — that the 2020 presidential vote was stolen, that U.S. voting systems are rigged, that there’s rampant voting by noncitizens — a core part of conservatism.
Rick Wilson, a former Republican strategist who collaborated with Mitchell before Trump’s election and now heads the anti-Trump Lincoln Project, said she had been crucial in building the institutional infrastructure that has sustained Trump’s “big lie.”
“What she found in Trump was less of a client and more of a movement,” he said.
Mitchell declined multiple requests to speak with ProPublica for this article but occasionally answered emails. “Hahahaha!!!” she wrote in response to one email asking for an interview. To another, she replied: “You’re my opponent. … You’re never going to write in any objective, non-judgmental way about the election integrity movement.”
She responded in writing to about a quarter of our detailed questions, disputing that her efforts were designed to undermine elections or upend their results.
“Nothing that we do is designed or intended to ‘sway’ any election outcomes,” she wrote. “What we focus on is making sure the election process is accurate, transparent, and honest. The ONLY steps I’ve urged the Administration to take are those that will give the voters — ALL voters — confidence that the outcomes are correct.”
A White House spokesperson didn’t answer specific questions about Mitchell, saying she has no official role in election policy but is an effective private advocate.
To tell Mitchell’s story, ProPublica interviewed more than 35 people who have worked with her or know her personally, including participants in her network, Republican election lawyers, current and former Trump administration officials, family members and friends. Many, especially conservatives who’ve fallen out with her, spoke on the condition of anonymity because they feared retribution.
We examined thousands of emails related to her work obtained from public records requests and sources, as well as court filings and an oral history she gave in 2007.
We also reviewed hundreds of hours of recordings of her network’s organizing calls spanning a four-year period, many of which were shared exclusively with ProPublica, as well as numerous speeches she’s given at private events for conservatives.
On a call earlier this year, she emphasized that Democrats “only win when they cheat” and that people who resist EIN’s agenda are “opposed to honest elections” and “depraved.”
As much as Mitchell has been able to achieve with Trump in the White House, several people we spoke with noted she hasn’t been able to push important parts of her agenda over the finish line.
Her signature legislation — the SAVE Act and its successor, the SAVE America Act — have been blocked by moderate Republicans in the Senate. Election changes she’d hoped the president could push through before the midterms, such as compelling states to turn over confidential voter information to the Justice Department, have been blocked by the courts. And Trump’s mid-July address on elections drew shrugs even from some conservative media.
Critics, including some inside the election-integrity movement, told ProPublica they are worried that Mitchell’s growing frustration is prompting her to press Trump and his allies toward ever more extreme actions. Her lifelong pattern, ProPublica’s reporting shows, has been to escalate conflicts into winner-take-all battles — a pattern playing out now as she tries to shape the midterms.
Hours after Trump’s speech, Mitchell appeared on Bannon’s “War Room” podcast, sounding openly exasperated at the dismissive coverage, her lips pressed into a thin line.
Bannon suggested the evidence of election fraud cited by the president justified declaring a national emergency, which he argued would enable Trump to immediately force states to implement parts of the SAVE America Act.
Mitchell went even further, one-upping the right-wing provocateur. Trump needn’t bother with this step, she said, which would inevitably be met with court challenges. He already had authority under a law empowering the government to protect critical infrastructure to unilaterally enforce the bill’s requirements, she insisted.
“We’ve got the blueprint. We’ll help,” she said. “We just need someone in authority to say, ‘Let’s do it.’”

Mitchell’s fascination with politics and voting began at an early age.
One of her first memories, she would recount in the 2007 oral history, was begging her mother “please not to go vote” until she got home from school and could accompany her. Later, she recalled, “I would study all the voter guides and tell my mother who I thought she ought to vote for.”
Mitchell grew up poor in Oklahoma City, the third of six children born to Jack Deatherage and Modean Lane. She’s often credited her mother, a secretary, for pushing her relentlessly to excel. About her father, she’s said much less, telling The Wall Street Journal only that he was “kind of a no-account.”
According to court records, their home life was highly volatile. Her mother initiated divorce proceedings at least five times, citing her father’s chronic unemployment, drinking, cruelty and violence. The couple split up for good in 1962, when Cleta was 11.
She hid the family’s struggles behind a peppy disposition, piling up accolades at school. At 15, she was runner-up in the Oklahoma City Junior Miss pageant. (Asked about these events, Mitchell replied: “I am peppy. I was also named Miss Congeniality in that pageant.”)
At the University of Oklahoma, which she attended on a journalism scholarship, Cleta was known as a “good girl, sorority girl, untouched by the sexual revolution,” one contemporary said.
Before long, she found a seemingly perfect consort: Duane Draper, who’d been the university’s student body president. While friends believed their shared interest in politics brought them together, they had another bond: He, too, had grown up with an abusive father.
“They were mirror images,” said Conrad Draper, Duane’s brother. “They both felt powerless in their childhood, so in their adulthood they constantly pursued power.”
They married in 1971, when Cleta was a junior. When she ran to be student body president, he served as her unofficial campaign manager.
She lost, a setback she blamed mostly on misogyny. Still, she emerged as ambitious as ever. She spearheaded voter drives to defeat Republicans, worked to expand students’ access to voting and helped launch the Oklahoma chapter of the National Women’s Political Caucus. She served as a delegate at the 1972 Democratic National Convention.
As soon as she graduated from law school, Cleta ran for a seat in the Oklahoma House of Representatives, taking on an incumbent Republican. She knocked on every door in her district, prospecting for votes at bowling alleys, beauty shops and high school football games. When she won, Duane had the campaigning shoes she’d worn to near-shreds bronzed.
At 26, she joined a Legislature that was literally smoke-filled (it hadn’t banned cigars) and full of men uneasy at the arrival of “this young, pretty, opinionated blond,” she said in the oral history. She was undaunted, swiftly moving up the ranks by cultivating wealthy donors and building a fundraising machine.
Less than two years later, when Cal Hobson, a small-town mayor contemplating a House run, asked whose backing he should seek, he was sent to Cleta. She had only one question when he sought her endorsement, he recalled: Did he back the Equal Rights Amendment, the proposed constitutional change to guarantee women the same legal rights as men? Hobson said yes and became her ally in the Legislature, watching as she made “some friends and a lot of enemies.”
With Democrats in control of the Oklahoma House, she exploited a battle between candidates for speaker to win a top post on the powerful Appropriations and Budget Committee, then became its chair.
Once in leadership, she backed a slate of liberal initiatives, from expanding open records laws to creating training centers to help divorced women improve their career prospects.
But her idealism coexisted with a ruthless pragmatism, said David Walters, who came up in Democratic politics in the same era and would eventually become the state’s governor. He remembered his shock when she promised him she’d oppose a powerful state development official in a battle over a new building on the University of Oklahoma campus, then switched sides behind the scenes.
“It was quite remarkable,” Walters said. “This was an example of Cleta saying one thing publicly and doing in private something entirely different.”
In 1982, with her political fortunes on the rise, Cleta’s marriage to Duane ended. The filings offered little explanation, citing only “incompatibility,” but those close to her knew Duane had come out as gay. The heartbreak was “devastating,” Hobson said.
Duane left Oklahoma for Boston, where he became a gay-rights activist. He died of AIDS in 1991.
After the divorce, Cleta did what she’d always done: She “put her nose to the grindstone,” Hobson said, “writing the budget and getting her way at the Capitol.”
She found a new partner in Dale Mitchell, a former college baseball player, registered Republican and bank executive. In 1984, when they married, they agreed that Dale would change his party affiliation if Cleta would take his last name.
Later that year, Time magazine named the newly minted Cleta Mitchell as one of a group of star Democratic state legislators, all female, who might one day “set their sights on a higher prize: the presidency itself.” About a year after they got married, they welcomed a baby girl.
Then, over two years, their life collapsed.
Her political fortunes waned after the ERA, her signature issue, failed to pass in Oklahoma and nationally. Her main political patron, the speaker of the House, had become entangled in a voting-fraud scandal, costing her her position in leadership. She chose not to defend her House seat, then two years later ran for lieutenant governor. When she lost, she found herself out of office completely.
Dale’s troubles dwarfed hers. When oil prices sank, his overleveraged bank collapsed and federal regulators shut it down. He was banned from the banking industry and later convicted on multiple counts of bank fraud, for which he was put on five years’ probation and ordered to pay $3 million in restitution. The crisis ruined them financially.
Cleta emerged from the ordeal infuriated by what she viewed as federal government’s overreach in prosecuting her husband, whom she has defended as “the most honest person I’ve ever known.”
Once out of Democratic politics, Mitchell gravitated toward conservatives, who were gaining ground in much of the country. She explained the shift as a way to realign her politics to match her personal philosophy of self-sufficiency (and no government handouts). Others say she saw a route back to power and took it.
Hobson, who rose to lead Oklahoma’s senate, was gobsmacked by her transformation.
“No one,” he said, “has changed more politically in my lifetime than Cleta Deatherage Mitchell.”

Starting in the early 1990s, Mitchell embarked upon a three-and-a-half decade climb up the conservative power ladder.
She and Dale moved to Washington, D.C., so she could help lead a mostly Republican campaign for congressional term limits. Though ultimately unsuccessful, the fight endeared Mitchell, brought in as the token Democrat, to the conservative elite. She switched her party affiliation in 1996 and, within the next few years, had recovered enough financially to buy a home in an upscale gated community and a luxury vacation getaway in the U.S. Virgin Islands.
After the 2000 election, as George W. Bush fought to hold onto a narrow lead over Al Gore in Florida, Mitchell became one of the Bush campaign’s high-profile media surrogates and defenders. In TV appearances, she argued that Democrats’ demands for recounts were an attempt to manipulate the election system.
She emerged determined to focus more of her legal practice on countering what she saw as an assault by progressive groups on election integrity. If “Republicans don’t commit themselves to learning and practicing the art of political war,” she wrote in a Wall Street Journal column, “there may not be much of a GOP to kick around anymore in the future.”
Over the next eight years, she became a go-to election lawyer for Republican politicians and a partner at a powerful D.C. law firm. Later, when the Tea Party emerged, Mitchell embraced hard-right candidates and causes that some other GOP attorneys would not.
She jokingly described herself as the “consigliere to the vast right-wing conspiracy” — a title others found increasingly on the mark.
As an attorney, Mitchell didn’t particularly shine in the courtroom, those who worked with her said, but she was a masterful and aggressive backroom negotiator and strategist.
No longer a candidate herself, she was free not to be “Miss Congeniality,” she acknowledged in a mentorship speech to conservative women titled “It’s Better to Be Respected Than Liked.” She won over allies with Southern warmth but could be a dangerous enemy if crossed. She’d do anything — within the law — to win, a dynamic one fellow election lawyer called “part of her brand.” (Mitchell didn’t respond to the questions about these assessments.)
Mitchell was one of the first Republican lawyers to support Trump’s presidential ambitions.
Starting in 2011, she defended him against a Federal Election Commission complaint that a website floating a possible Trump run constituted an undeclared candidacy.
Michael Cohen, Trump’s fixer, who helped launch the exploratory bid, said Mitchell had come recommended as the most aggressive lawyer in the field and first met the future president when she came to Trump Tower to discuss the case. Cohen said Trump subsequently retained Mitchell several more times.
“Each matter was resolved to our benefit, something both Trump and I appreciated,” Cohen said in a brief phone interview. When ProPublica asked what the other matters were, Cohen responded, “I can’t disclose those,” then hung up.
When Trump ran for real in 2016, Mitchell transferred her support to him once he’d knocked out her longtime client Marco Rubio. Some of her allies were shocked she’d back an insurgent candidate who often chafed at constitutional limits on executive power and violated conservative principles she’d long espoused.
During Trump’s first term, Reuters reported, Mitchell teamed with other prominent GOP lawyers on efforts to tighten election laws and rules, focusing on those related to mail-in voting and voter ID. Mitchell helped steer millions of dollars into these initiatives, as well as backing lawsuits against Democratic-leaning cities and counties aimed at compelling them to purge voters from their rolls.
In the run-up to the 2020 election, Mitchell was among the first GOP lawyers to urge the Trump campaign to develop plans to dispute the contest’s results, focusing on six to eight battleground states.
Mitchell’s subsequent role in helping Trump try to challenge his loss has been much chronicled in news articles and examined in multiple investigations. Over time, experts said, it’s become clear she helped originate several of the most aggressive actions taken by the president and his allies.

“She had her finger in just about every pie the select committee looked at,” said Marc Harris, senior investigative counsel to the House congressional committee that investigated the Jan. 6, 2021, attack on the capitol.
Mitchell led litigation on the president’s behalf in Georgia, accumulating 1,800 pages of election fraud allegations. She maintains events moved too fast for this material to be properly evaluated by a judge. “President Trump NEVER got his day in court in GA,” she wrote in response to ProPublica’s questions.
These claims figured prominently in the infamous phone call on which she joined Trump as he pressed Georgia Secretary of State Brad Raffensperger to “find” him enough votes to overcome Biden’s slim margin in the state.
As Trump poured on the pressure, Mitchell fed him details of election irregularities from her case and demanded that Raffensperger share his findings from investigations into them.
Mitchell insisted to ProPublica they merely wanted to provide Raffensperger with evidence, not to push him “to take any official action to ‘overturn the election.’”
In the call, Trump made clear what he wanted.
“All we have to do, Cleta, is find 11,000-plus votes,” he said.
Mitchell also played a largely overlooked role in launching Trump’s final and most extreme gambit, the so-called fake electors strategy.
She recruited her longtime friend, law professor John Eastman, to prepare a memo outlining a constitutional framework under which Republican legislators in swing states where Trump had lost could appoint alternate electors who’d support him.
In her emailed responses to ProPublica, Mitchell called the idea an outgrowth of work she’d done early that year advising the American Legislative Exchange Council about steps state lawmakers could take to help Trump in a contested election.
“A movement is stirring,” Mitchell wrote to Eastman in an email two days after the election released by the House Jan. 6 Committee. “But needs constitutional support.”
Ultimately, what congressional investigators came to call the “Trump-Eastman scheme” culminated with a plan for Vice President Mike Pence to certify the fake electors’ votes, flipping the Electoral College in Trump’s favor. But Pence rejected the idea, becoming the target of enraged Trump supporters when they stormed the Capitol on Jan. 6.
Experts said Mitchell helped set the day’s events in motion though she was not at the riot.
“She worked closely with John Eastman in developing and seeking to implement dubious legal strategies to overturn the election result,” Harris said. “She encouraged the selection of fake electors.”
Mitchell denied any responsibility for Eastman’s work or what ensued.
“I was completely uninvolved in the Jan 6 rally at the Capitol,” she wrote in response to ProPublica’s questions. “I had nothing to do with the issues and advice from Dr. Eastman to the President, the Vice-President, or anyone else involved in that. None whatsoever.”
In an email responding to ProPublica’s questions, Eastman acknowledged Mitchell had solicited the memo but disputed his strategy was aimed at upending the election.
The California Supreme Court disbarred Eastman for his actions.
Mitchell resigned from her law firm after the Raffensperger call sparked backlash, blaming her exit on pressure from anti-Trump groups.
But unlike many who’d fought alongside her, Mitchell wasn’t dispirited once Biden entered the White House. She was just getting started.

In 2022, behind the closed doors of hotel ballrooms and conference suites, Mitchell appealed to crowds of conservatives in seven swing states, asking them to help her overhaul U.S. elections.
“Welcome, fellow deplorables!” she said to open the proceedings in Michigan, after a welcome video from Trump urging the crowd to get behind her. “As an old Southern Baptist, I like evangelizing. So, this is your Bible!”
Brandishing the 20-page manual provided to each participant, Mitchell implored attendees to master the arcane rules of American elections, work the polls and cozy up to — or, better yet, serve on — local election boards.
The tour was part of the nationwide launch of the Election Integrity Network. In the aftermath of losing the fight over 2020, Mitchell decided she needed an army — a popular movement large and loud enough to tear down what she saw as an election system dominated by Democrats.
“My sole focus has been for the last year and a half, how we as conservatives could build an infrastructure to do hand-to-hand combat with the Left, starting at the local level,” she said on a September 2022 EIN organizing call.
The network served as the centerpiece, providing the boots on the ground, but Mitchell also created an ecosystem to support it, spreading money to allied researchers, law firms and policy shops.
A ProPublica analysis of data from the Campaign Legal Center, a government watchdog nonprofit, shows that between 2021 and 2025, Mitchell helped put more than $70 million into this work. According to tax filings, at least $11 million of that total came from nonprofits she oversaw. Tens of millions more came from the Bradley Foundation, where she served on the board, and the Conservative Partnership Institute, a Trump-aligned think tank where she was a senior legal fellow.
Roughly 30 conservative election-integrity nonprofits were started after 2020. Well over half have received money from Mitchell or have close ties with her, the data shows.
“She occupies a unique position,” connecting donors, activists and political leaders, said Brendan Fischer, the Campaign Legal Center’s director of strategic investigations. She’s leveraged this spot, he said, “to turn election denial from a fringe position into an organized national movement.”
In assembling the EIN, Mitchell built chapters from scratch in some states; in others, she absorbed long-standing groups that did similar work.
Much of the network’s organizing takes place on the regular video calls held by each state chapter and about half a dozen national working groups, which focus on subjects such as reshaping voter rolls and scrutinizing voting machines.
In reviewing hundreds of hours of these meetings, ProPublica found a mixture of mind-numbing technical discussions, wild speculation and hyperpartisan vitriol.
On a July 2025 call to honor Eastman, he urged network leaders to assault the Left as the Romans attacked the ancient city of Carthage. “They will never stop until not only are they defeated, but the land from which they came is salted over so they can’t grow up again,” he said.
Mitchell disputed that EIN was partisan. “I defy you to show me hyperpartisan vitriol on any EIN related call,” she wrote to ProPublica. “That is not what we do. Mind-numbing technical discussions, yes.”
Local calls often fixate on micro-efforts aimed at a single county or election office. Members — who sometimes call themselves “election believers,” a counter to the “election denier” label used by critics — discuss lobbying particular politicians or combing voting records for evidence of fraud. If, as often happens, they find no widespread problems, the meetings serve as echo chambers in which supporters are urged to keep the faith and see conspiracies behind small bureaucratic mistakes.
Current and former members said being in the network made them feel like part of a special strike force saving America. Mitchell’s charm could be irresistible.
“It’s like she’s the sun and you’re the sunflower,” a former EIN leader said, speaking on the condition of anonymity for fear of retaliation. But Mitchell’s wrath could be volcanic if members disagreed with her or explored working with other election-integrity groups.
“Vindictive is not a strong enough word,” the former EIN leader said. “She treats you like a heretic.”
(Mitchell didn’t respond to these observations.)
Mitchell joins rank-and-file calls every month or so, on which she’s praised effusively and given titles like “the world’s leading expert on election integrity” and “our patron saint.” She also chairs a Friday morning leadership meeting that draws high-profile guests like Lisa Nelson, the head of the American Legislative Exchange Council, state election officials and luminaries from conservative think tanks. “It’s a who’s-who of who matters in the movement,” the former member said.
Since Trump retook the White House, officials from his administration have occasionally attended, discussing how they can coordinate with the network’s activists.
In summer 2025, a DHS official joined a network call to discuss an effort to persuade states to use an agency tool to search their voter rolls for noncitizens. Many states had resisted, uneasy about sharing confidential data with the federal government. The official wanted network members to encourage state and local officials to cooperate.
“This is your team,” an EIN leader said. “These are the people that are going to do the work in the states that you need to make this magic happen.”
Early on, many EIN branches weren’t particularly effective and several had notable stumbles. A then-participant in North Carolina’s chapter accompanied a group that unsuccessfully tried to force its way into a voting office. The chapter’s leader was accused of following election workers in his car and other disruptive behavior. (He denied his actions were problematic.)
But by 2023, the network started getting significant wins.
Mitchell and EIN were instrumental in spurring Republican states to pull out of a program to cross-check voter rolls for duplicate registrations. Mitchell claimed the program aided Democrats by requiring states to encourage unregistered residents to sign up to vote.
EIN members also helped persuade numerous states to pass laws banning “Zuckerbucks” — private donations from Meta CEO Mark Zuckerberg and others aimed at bolstering underfunded local election offices. Mitchell had claimed the donations helped Democratic turnout, paying for things like Spanish translators in election offices.
EIN continued to grow, expanding from seven chapters in 2022 to at least 26 today.
In Georgia, the network came close to realizing the goals Mitchell sketched out when she first pitched the group.
EIN members secretly pushed a rule through the State Election Board allowing local officials to delay certifying the state’s vote count — a step experts warned could enable them to dispute a Trump loss in the upcoming 2024 election. (Mitchell disputed that the rule change was aimed at this.)
A court struck down the rule, but that didn’t stop a group aligned with Mitchell from mounting an ad campaign urging election officials nationwide not to certify results they didn’t like.
As her state-level plans advanced, Mitchell readied an even bigger swing, one aimed at changing elections across the country and setting the agenda for a second Trump administration.

In January 2024, Mitchell met with a small group of Republican lawyers and election-integrity leaders to discuss how best to prevent fraud in the November presidential election.
Those gathered in the Arizona hotel room were especially worried about noncitizen voting, though numerous audits, studies and analyses — even those by Republican groups and states — show it is vanishingly rare.
Arizona had passed a law compelling residents to provide proof of citizenship when they registered, rather than just swearing they were citizens under penalty of perjury, as is typical in most states.
Mitchell suddenly had an inspiration, she later recounted in a private speech to Virginia’s EIN chapter: She’d lead a push for a similar federal law. “I didn’t think of this,” she told those at the event. “God made me do this.”
When Mitchell returned from Arizona, she was, indeed, a woman on a mission. She convened her closest congressional allies, Sen. Mike Lee of Utah and Rep. Chip Roy of Texas. Their staffers met with her to help draft the Safeguard American Voter Eligibility Act.
The bill set a high bar for proving citizenship, demanding that would-be voters produce documents like certified birth certificates and passports that many Americans don’t have. It also required states to use the DHS’ databases to purge noncitizens from their voter rolls.
The ideas in the measure would presage some of the second Trump administration’s most norm-breaking actions. “When we look back to the original SAVE Act in 2024 to the administration’s actions today, the through line is clear,” said Michael McNulty, a director for the watchdog nonprofit Issue One.
Mitchell knew the initial version of the act wouldn’t pass. When it was introduced in May 2024, Democrats controlled the Senate and the White House.
Rather, people in the election-integrity world said, she saw the measure as a strategic opportunity — both to cement her position atop the movement and to reignite the fervor for voting restrictions among the Trump faithful. For years, she’d fought behind the scenes for Trump’s ear on election issues, vying with more moderate Republican election experts as well as fringe activists.
To make sure her rivals had no choice but to support the SAVE Act, she brought on a backer too powerful to ignore: Stephen Miller, senior adviser to Trump in his first term and architect of his immigration policy. (Miller didn’t respond to questions about his relationship to Mitchell or the SAVE Act.)
Mitchell denied Miller had a hand in the measure. “Stephen is someone I greatly admire but we never worked together on the SAVE Act,” she wrote to ProPublica.

But Roy, the bill’s House sponsor, said in a podcast interview that Miller helped draft it. Mitchell sought to dovetail her election agenda with Miller’s immigration agenda, those who’ve worked with them said. They stood side by side at an event at the Capitol to launch the bill, warning that Democrats were letting people into the country illegally in part to swing elections.
In a coup for Mitchell — anointed the Mother of the SAVE Act — pretty much every significant player in the election-integrity space joined the Only Citizens Vote Coalition, a group she launched to back the bill.
Mitchell directed more than $6 million to groups that bought ads, put out research and took other actions supporting SAVE, tax filings show. Some $800,000 went to the nonprofit arm of the conservative media organization The Federalist, which provided glowing coverage of the legislation.
Sean Davis, The Federalist’s CEO, didn’t answer questions about whether the donation affected coverage. “Cleta Mitchell is a saint,” he said in an email.
The measure sailed through the House in July 2024, then predictably died in the Senate. The bill had drawn fire from voting advocacy groups, which said the measure could disenfranchise millions of eligible voters, particularly women, the poor and minorities, all critical Democratic voting blocs.
Mitchell hardly missed a beat. That same month, she led a panel at an American Legislative Exchange Council conference that approved model legislation similar to the SAVE Act for conservative lawmakers to introduce in states across the country. Twelve states have since passed laws that strongly resembled SAVE and 23 have changed their voting procedures to reflect aspects of it.
That November, Trump won back the presidency and Republicans secured majorities in both chambers of Congress.
Mitchell saw the chance not only to pass an even tougher federal version of SAVE — a “SAVE Act on steroids” as she called it in a November organizing call — but to make even more far-reaching changes to American elections.
“This is a once-in-a-generation opportunity,” she told attendees on the call. “I don’t want us to miss this.”

Two months after Trump took the oath of office, America got its first glimpse of how he planned to overhaul the nation’s election system.
His March 25, 2025, executive order — titled Preserving and Protecting the Integrity of American Elections — looked a lot like the SAVE Act. It required voters to prove their citizenship when they registered, mirroring the types of identification listed in the bill.
It also expanded on the notion of using DHS data to verify voters’ eligibility, saying that all of the federal government’s relevant troves of sensitive information should be made available for this use. Further, it directed the Justice Department to prioritize the prosecution of election crimes and noncitizen voting.
Mitchell was close to a pair of White House lawyers involved in drafting the order and was among a small group of outside attorneys who provided suggestions for it, according to several people who helped write it.
The order was the first in a string of behind-the-scenes victories that have not only allowed Mitchell to shape the Trump administration’s election blueprint, but have given her substantial influence over who’s been chosen to carry it out.
At least 25 administration appointees have close ties to Mitchell, ProPublica’s reporting shows, with several holding key posts directly related to elections.
“She’s had a lot to do with even White House hires in this regard,” Bannon said. (The White House denied Mitchell had swayed its hiring decisions.)
Heather Honey, a senior counselor to Homeland Security Secretary Markwayne Mullin, has a portfolio that touches on almost everything the administration does on elections. She’s figured centrally in the government’s efforts to find and prosecute noncitizen voters.
Before joining DHS, Honey was a Mitchell protege and led EIN’s Pennsylvania chapter. A high-ranking federal official knowledgeable about the hiring process told ProPublica that the agency hired Honey over more experienced candidates. Her “sole qualification was who she worked with,” the former official said. “She worked with Cleta.”
A DHS spokesperson called this “false,” saying Honey had been recommended by senior government leaders for her election expertise.
Mitchell also has had a hand in shaping the administration’s reinvestigation of fraud allegations involving the 2020 election, beginning with the FBI’s seizure of election records from Fulton County, Georgia.
As ProPublica has reported, the affidavit justifying the raid included material compiled by an EIN-affiliated researcher and cited network participants as witnesses.
When the case bogged down as the prosecutor overseeing it began to doubt its strength, Mitchell was among those who recommended a replacement: Dan Bishop, a former North Carolina congressman whom she’s praised on social media and supported with campaign donations.
At a May meeting, a Georgia EIN leader said Bishop was tapped “thanks in large part to Cleta Mitchell,” an account echoed by an administration official familiar with the matter.
A Justice Department spokesperson said the agency “has no knowledge of any role Cleta Mitchell played” in Bishop’s appointment.
Mitchell told ProPublica she didn’t believe she’d affected this decision. “I was very worried about the direction of the case earlier this year and made known my displeasure quite strongly,” she said. “The decision to appoint Dan was made by the President and I applaud it, but I cannot claim credit for that brilliant idea.”
Soon after stepping in, Bishop tried to subpoena personal information for thousands of Fulton County poll workers, a move the county and election experts denounced as politically motivated intimidation. A court quashed the subpoena. Bishop has appealed.
As she’d envisioned in her call with EIN members just after the 2024 election, Mitchell has gotten the president to sink enormous political capital into passing even tougher versions of the bill, now known as the SAVE America Act.
The 2026 measure would require voters nationwide to present photo ID to vote and compel states to turn over their voter rolls to DHS, which would scour them for noncitizens. Trump has repeatedly called the measure his top legislative priority, threatening not to sign other bills until it passes.
Lee, the Utah senator who sponsored the bill, said Mitchell was central to the updated version, especially the strict voter ID provisions. Trump, he added, gave it the new name.
Former officials and people in the election-integrity movement told ProPublica that Mitchell has had to overcome naysayers within the administration, including White House Chief of Staff Susie Wiles.
On an EIN call in early 2025, Mitchell complained that Wiles had responded frostily to plans she offered for the incoming administration, “saying, ‘Thank you, I’ll take a look as soon as I come up for air.’”
At the time, Mitchell said she’d wanted to reply that wouldn’t happen for four years. When ProPublica followed up about the incident, she wrote: “Susie is remarkable and a great chief of staff. She doesn’t have time to read all the things that people like me send her.”
Mitchell has surmounted these obstacles, in part, by continuing to build out her array of alliances.
By the middle of this year, when the White House brought on Solomon — a longtime Mitchell supporter who vetted material for Trump’s prime-time elections address — it was clear she had found another way in. (A White House spokesperson said that Solomon, who also runs a conservative news site, interacted with Mitchell as a journalist would speak to a subject-matter expert.)
A former administration official who said he’d tried to stymie Mitchell acknowledged she’d won out. “The White House listens to her,” he said.
Mitchell had told her EIN disciples not to worry after Wiles’ brush off. She had more cards to play, she assured them.
“I always know if plan A doesn’t work, I have a plan B,” she said. “If plan B doesn’t work, I have a plan C. And so forth.”

By the time the first mail-in ballots of the midterms were cast in September, Mitchell had shaped and staffed the Trump administration’s election efforts to an astonishing extent. And yet, the knockout blow had eluded her.
Courts had blocked large parts of Trump’s executive orders. The hunt for noncitizen voters and the reinvestigation of 2020 voting irregularities had produced little of consequence, despite the considerable resources poured into them.
Mitchell’s critics and even her allies, including some in the election-integrity movement, say frustration has prompted her to push for more drastic steps.
During the summer, she mounted an escalating pressure campaign to save the SAVE America Act, mobilizing EIN members to badger recalcitrant senators, according to recordings of EIN meetings. She also worked with the bill’s Senate sponsor and Trump to kill the filibuster, a pathway known as the nuclear option, to get the bill over the line, but was blocked by a handful of moderate Republicans.
Mitchell has taken a similarly all-or-nothing approach in pressing states to pass laws modeled on the SAVE America Act, sometimes with similarly self-defeating results.
Earlier this year, she waded into a battle over an Ohio bill despite being warned that the governor would veto the tougher version she preferred. The final bill contained the provision Mitchell sought. The governor promptly vetoed it.
Former Ohio Secretary of State Ken Blackwell, an election-integrity movement leader who’s worked with Mitchell for decades, said Mitchell sometimes runs the risk of making elections less secure by torpedoing practical solutions.
“It was her way or the highway,” he said. “We need to focus on getting concrete wins.”
(Mitchell didn’t respond to Blackwell’s broader criticism but called the more moderate election measure he’s backed in Ohio “not nearly as good as it should be.”)
As the midterms near, she has become increasingly vocal — in media appearances, online and with her network members — in calling for the president to exert unprecedented powers to sway the vote.
“Even if she fails, she always finds another point of attack,” said Max Flugrath, a director at the voting advocacy group Fair Fight. “She’s relentless.”
On the Oct. 6 episode of “War Room,” Mitchell angrily pounded home that several agencies, particularly the Commerce Department, could intervene “today” to shore up purported vulnerabilities in voting machines. She repeated the word “today” seven times during the appearance, like a drumbeat.
Some of those who’ve known Mitchell the longest say her urgency has crescendoed as, at 76, she’s confronted the possibility that this administration is her last chance to realize her goals.
“In her mind, in her timeline, it’s existential,” the former network leader said. “She’s got to do it all, and she’s got to do it now. … The election integrity movement, c’est moi.”
Source: ProPublica · 2026-10-28

An unreleased Anthropic AI model found security flaws in Chrome, Safari, Android, Windows, and Linux and chained them into working proof-of-concept exploits, the company said in its latest report.
The exploits were built in the lab after the model was prompted, not seen in any real attack, and Anthropic reported every flaw to the vendor first, so all of them are already patched. One proof of
Source: The Hacker News · 2026-10-28

In September 2026, the SOCRadar Threat Research Unit (STRU) discovered an exposed staging server holding the live workspace of an operator tied to the n0n ransomware group. The open directory exposed the operation’s full September workflow: breach and exfiltration tooling, original locker source code, extortion infrastructure, and an AI coding agent environment backed by more than $7,000 in paid LLM API usage.
The findings implicate at least 23 organizations across 14 countries, including a US sports retailer, a cloud provider, a teachers’ union, a Venezuelan ISP, an Argentine ministry and a pharmaceutical subsidiary. No vulnerability exploitation was identified: every documented compromise relied on weak or stolen credentials. Where n0n does not encrypt, it destroys data and backups after exfiltration.
This post summarizes the research. The full technical analysis, including locker internals, per-victim case studies and the complete operator toolkit, is available in the whitepaper, Automating Extortion: Inside an AI-Assisted n0n Ransomware Operation.
Key Takeaways
n0n is a data-exfiltration and destructive-extortion actor tracked by SOCRadar since September 2026. The group insists on the exact spelling of its name, “two lowercase n letters with a zero between them,” uses the slogan “n0n | no js | no mercy” across its Tor and clearnet portals, and appends the .n0n extension to encrypted files.

The operation has scaled quickly. On October 12, 2026, the group added 38 maritime, port and logistics organizations across 18 countries to its Dark Web leak site in a single batch. Maritime security research linked at least 21 of them to customers of South Korean maritime software provider CyberLogitec, though CyberLogitec has not confirmed an incident and the supply-chain connection remains unverified. None of the 38 listings was marked as settled after the October 19 deadline, and all were published.
STRU found a Python HTTP file server on 185.157.161[.]148:8877 (AS42675, Sweden) exposing the operator’s working directory in two snapshots on September 25 and 26, 2026. The files map a segmented setup: an agent box hosting the AI coding agent and C2 panel, a “raas” node running the leak site backend and per-victim Bitcoin wallet generation, a “monster” server where all stolen data lands, and a VPN-bound seedbox that distributes leak torrents.

n0n’s tracked operations ran from September 17 to October 22, 2026. Across three publication rounds and the ChiBiTek listing on October 11, the group exposed 15 of the 23 organizations identified in the workspace, typically leaking data four days after public disclosure.

Every case follows the same lifecycle, with the main impact shifting between exfiltration, encryption, destruction and network disruption depending on the target.

The locker is a lightweight AES-256-CBC encryptor with Windows, Linux and PowerShell variants, plus an OpenSSL stage for firewall appliances. Most destructive steps live in external wrapper scripts. Each build uses a single hardcoded key, and one key is likely shared across two victims, so a decryptor for one could unlock the other.

Demands range from 0.5 BTC to 33 BTC per victim, and up to $28M per organization in the October port wave. Each victim gets a unique Bitcoin address, and opening a negotiation room requires a 10% upfront payment. A check of all 55 collected addresses showed zero transactions as of October 16, 2026. To raise pressure, n0n contacts victims’ clients, MSPs, unions and the media, and in one case emailed PayPal’s security team over a breach at its contact-center provider.


The operator uses opencode, an open-source AI coding agent, configured with 154 model entries across seven providers, including “uncensored” and “abliterated” models with safety training removed and a self-hosted model. The agent wrote and debugged hundreds of attack scripts, and gateway spending passed $7,216 by October 22, 2026. The evidence points to a human-directed operation supported by AI; no fully autonomous attack system was observed.


Of the 23 organizations identified in the workspace, 15 were published on the leak site, 4 were compromised but not published, and 4 saw access attempts with no outcome shown. Victims span 15 sectors, and all demands are financial.
STRU assesses with medium confidence that the server is a private workspace for a single operator or small team, while the group’s broader framework, tooling and master wallet control indicate a multi-operator operation. The corpus provides no definitive geographic or national attribution.
| Tactic | Technique | Procedure |
|---|---|---|
| Reconnaissance | T1595.001 – Active Scanning: Scanning IP Blocks | RDP batch scans and a ranked list of 305 FortiGate SSL-VPN appliances |
| Initial Access | T1078 – Valid Accounts | Weak or default RDP/WinRM administrator credentials; firewall-manager admin accounts |
| Initial Access | T1078.004 – Valid Accounts: Cloud Accounts | Exposed long-lived AWS IAM access keys |
| Initial Access | T1133 – External Remote Services | Internet-facing FortiGate SSL-VPN, RDP and WinRM |
| Execution | T1059.001 – Command and Scripting Interpreter: PowerShell | Strike, exfiltration and implant scripts pasted into RDP sessions |
| Execution | T1053.005 – Scheduled Task/Job: Scheduled Task | Locker and audit runs as SYSTEM tasks every 5-10 minutes |
| Execution | T1651 – Cloud Administration Command | AWS SSM commands, hosting-panel recipes and Zabbix script execution |
| Persistence | T1053.005 – Scheduled Task/Job: Scheduled Task | AfricaSync, FinSoftSync*, SvcSync, NetAssist |
| Persistence | T1547.001 – Boot or Logon Autostart: Registry Run Keys | n0nNote opens the ransom note at every logon |
| Persistence | T1136.001 – Create Account: Local Account | Hidden administrators svc_upd, svc_reg, svc<slug> |
| Persistence | T1098.004 – Account Manipulation: SSH Authorized Keys | Operator keys installed via VNC console on cloud clones; root@3090-AI on FMC appliances |
| Defense Evasion | T1562.001 – Impair Defenses: Disable or Modify Tools | Symantec Endpoint Protection stopped and disabled |
| Defense Evasion | T1564.002 – Hide Artifacts: Hidden Users | SpecialAccounts\UserList value 0 for the cover accounts |
| Defense Evasion | T1070.004 – Indicator Removal: File Deletion | Toolkit overwritten three times and deleted; launchers self-delete |
| Credential Access | T1110.004 – Brute Force: Credential Stuffing | FortiGate /remote/logincheck credential stuffing via residential proxies (APBSID=n0n) |
| Credential Access | T1110.002 – Brute Force: Password Cracking | Offline cracking of stolen SaaS user hashes and encrypted 7z archives |
| Credential Access | T1555.003 – Credentials from Password Stores: Web Browsers | Chrome/Edge stores decrypted, including Chrome’s app-bound key |
| Credential Access | T1539 – Steal Web Session Cookie | Live administrator Chrome profiles copied and driven over DevTools |
| Credential Access | T1111 – Multi-Factor Authentication Interception | Billing-panel MFA codes read from the staff mailbox |
| Credential Access | T1003.003 – OS Credential Dumping: NTDS | NTDS.dit copy from a shadow copy (scripted) |
| Discovery | T1046 – Network Service Discovery | Internal sweeps of 445/3389/5985/1433 |
| Discovery | T1580 – Cloud Infrastructure Discovery | EC2/ECS/SSM mapping and hosting-panel VM inventories |
| Discovery | T1619 – Cloud Storage Object Discovery | S3 bucket listing and prefix census |
| Lateral Movement | T1021.001 – Remote Services: Remote Desktop Protocol | Headless xfreerdp sessions driven by key injection and OCR |
| Lateral Movement | T1021.006 – Remote Services: Windows Remote Management | pywinrm strikes, triage and browser theft |
| Collection | T1530 – Data from Cloud Storage | S3 bulk pulls with per-bucket byte caps |
| Collection | T1114.002 – Email Collection: Remote Email Collection | Full IMAP dump of a provider staff mailbox |
| Collection | T1115 – Clipboard Data | RDP results returned through the clipboard |
| Collection | T1113 – Screen Capture | Remote screen captured and read with OCR to drive logons |
| Command and Control | T1071.001 – Application Layer Protocol: Web Protocols | HTTPS implant C2 (c2srv.py) and the kserver panel |
| Command and Control | T1001 – Data Obfuscation | Status beacon disguised as card-payment JSON to /x/i |
| Command and Control | T1572 – Protocol Tunneling | SSH -D SOCKS tunnels over Tor |
| Command and Control | T1090.003 – Proxy: Multi-hop Proxy | Tor, SSH pivots, gost exits on compromised hosts, residential proxies |
| Exfiltration | T1041 – Exfiltration Over C2 Channel | Zip-base64 POSTs to /c2/…/out (8 GiB budget) |
| Exfiltration | T1567.002 – Exfiltration Over Web Service: to Cloud Storage | Uploads to a public file-hosting service |
| Impact | T1486 – Data Encrypted for Impact | n0n locker (Windows/Linux) and the OpenSSL stage on FMC appliances |
| Impact | T1485 – Data Destruction | S3 mass deletion; a provider’s servers and backups removed |
| Impact | T1490 – Inhibit System Recovery | Shadow copies deleted; free space wiped |
| Impact | T1489 – Service Stop | MSSQL, MySQL and IIS stopped before encryption |
| Impact | T1565.001 – Data Manipulation: Stored Data Manipulation | Firewall rules flipped to BLOCK in the FMC configuration database |
Whitepaper
Automating Extortion: Inside an AI-Assisted n0n Ransomware Operation
Get the full technical analysis, including locker internals, per-victim case studies and the complete operator toolkit.
| Type | Indicator | Context |
|---|---|---|
| IPv4 | 185.157.161[.]148 | Agent box – kserver C2 – /x/i beacon |
| IPv4 | 185.157.161[.]93 | ntpsync[.]io origin – PHP payloads |
| IPv4 | 81.161.239[.]10 | “monster” – loot vault – implant C2 – payloads (:8455) |
| IPv4 | 188.214.135[.]130 | “raas” – leak backend – payloads (:8898, :8899) |
| IPv4 | 198.13.158[.]143 | SSH pivot over Tor – SOCKS hop to victim SaaS tenants |
| IPv4 | 45.132.114[.]241 | Operator scrub-list IP |
| IPv4:port | 217.18.55[.]185:11434 | Self-hosted LLM |
| Domain | ntpsync[.]io | Beacon cover domain |
| Domain | n0n-cases[.]net | Extortion mail sender |
| notice@n0n-cases[.]net | Extortion mail sender address | |
| Domain | n0n[.]to | Leak site (clearnet, inactive) |
| Domain | uberip[.]com | Actor mail domain |
| Domain | nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad[.]onion | Onion leak site (Tor) |
| File / Path | *.n0n, *.n0n.tmp, n0n_READ_ME.txt, C:\Users\Public\n0n\ | Encrypted files – note – staging dir |
| Registry | HKLM\Software\Microsoft\Windows\CurrentVersion\Run : n0nNote | Ransom note at logon |
| Account | svc_upd (“Software Update”) – svc_reg (“Registry Service”) – svc<slug> | Hidden admins |
| SHA-1 | dc82e9c22c4a06c6bc03701fce2b55f4f490c651 | nenc.exe |
| SHA-256 | d1fd3a8ac4ada74b8ccbcdf5134797acff401b7fb50e16549b337781dfe1a486 | nenc.cpp – Windows locker v1 |
| SHA-256 | 340172627cdf40927784956be784bd2b3f5d1584cb79cf31064f387bbe9acb28 | nenc2.cpp – Windows locker v2 |
| SHA-256 | 886b3608d05069d314fa6300404de6627f96b13a95c5633f6c91dfc2a545ac87 | nenc2l.cpp – Linux locker |
For the full IOC list, consult the SOCRadar platform.
n0n is a data-exfiltration and destructive-extortion ransomware group active since September 2026. It encrypts files with the .n0n extension, destroys data and backups where it does not encrypt, and runs a Tor leak site with keyed negotiation rooms. As of October 19, 2026, it listed 93 victims with total demands of $283.7M.
Every documented n0n intrusion relied on weak or compromised credentials, and no exploit payloads or CVE references were found in the operator’s files. Entry points include credential stuffing against FortiGate SSL-VPN portals through residential proxies, weak RDP/WinRM credentials, exposed AWS IAM keys and reused hosting provider sessions.
The operator uses the opencode AI coding agent, configured with 154 model entries across seven providers, including uncensored, abliterated and self-hosted models. The agent produced and debugged hundreds of attack scripts, with gateway spending above $7,216. The evidence shows a human-directed operation supported by AI; no fully autonomous attack system was observed.
Each n0n build uses a single hardcoded AES-256 key with no per-victim derivation, and one key is likely reused across two victims, which creates recovery opportunities for affected organizations. Because the operator also deletes shadow copies, wipes free space and removes provider-hosted backups, offline or immutable backups remain the only reliable recovery path.

Source: SOCRadar · 2026-10-28