Day: October 30, 2026

  • Syrian hacker who served Assad regime gets 42 months in US prison

    A Syrian man who prosecutors say was a central figure in a hacking operation run from former President Bashar Assad’s inner circle was sentenced Thursday to 42 months in federal prison.

    Ahmad Umar Agha, 42, carried out the conspiracy from as early as Aug. 24, 2011, until Jan. 31, 2024, according to the Justice Department. The operation was organized and led by members of Assad’s circle, including the commander of Syria’s General Intelligence Directorate.

    Agha hacked approximately 47 media entities, businesses, nongovernmental organizations and U.S. and allied government bodies, prosecutors said. The motives included punishing news organizations for reporting on Syrian government atrocities during the Arab Spring and the civil war that followed, spreading fear and confusion among the regime’s opponents, collecting intelligence and trying to persuade members of the U.S. military to refuse their orders.

    “Agha deployed his hacking skills in the service of Assad’s regime to silence reporting on the regime’s atrocities, intimidate its opponents, and incite U.S. servicemembers to refuse their orders,” said Assistant Attorney General for National Security John A. Eisenberg.

    The most damaging intrusion came April 23, 2013. Prosecutors said Agha accessed the Twitter account belonging to the Associated Press to post a false claim that President Barack Obama had been injured in two explosions at the White House. The post triggered a flash crash, briefly erasing $136 billion in value from the stock market. 

    In another intrusion, Agha, who used the hacker handle, “Th3 Pr0,” compromised the company hosting the U.S. Marine Corps’ recruitment website and redirected about 3,500 visitors to an image urging Marines to refuse their orders and fight alongside the Syrian Army. On two occasions, he stole usernames and passwords for White House staff email accounts in attempts to take control of the White House’s social media accounts. In one instance he succeeded, prosecutors said.

    The costs to victims were significant. One company that works with online publishers lost about $35,000 a day for roughly six months. A global nongovernmental organization spent about $250,000 on new network monitoring products, retrained more than 800 staff members and suffered $480,000 in total losses.

    “This case emphasizes the grave threat posed by cyber criminals and especially those serving regimes hostile to the United States,” said First Assistant U.S. Attorney Theophani K. Stamos for the Eastern District of Virginia.

    Agha and coconspirator Firas Dardar were first charged by criminal complaint June 12, 2014, and indicted May 17, 2018. Dardar remains a fugitive. He was also charged in 2015 in a separate conspiracy alongside Peter Romar, a Syrian national then living in Germany, that involved computer intrusion, extortion, money laundering and violations of the Syrian Sanctions Regulations. Romar was extradited from Germany and pleaded guilty in 2016.

    Assad’s regime collapsed in December 2024, and the former president fled the country.

    Source: CyberScoop · 2026-10-30

  • Syrian Electronic Army hacker gets prison time for attacks on Western targets

    Syrian Electronic Army hacker gets prison time for attacks on Western targets

    Ahmad Umar Agha, known online as “Th3Pr0,” was sentenced Thursday in federal court in Virginia to 42 months behind bars for his role in a conspiracy that was organized by former Syrian President Bashar al-Assad’s closest advisers.

    Source: The Record · 2026-10-30

  • Defanging Laws and Bringing Home Billions: How Trump Has Rewritten the Corruption Rulebook At Home and Abroad

    Defanging Laws and Bringing Home Billions: How Trump Has Rewritten the Corruption Rulebook At Home and Abroad

    During his first term in office, U.S. President Donald J. Trump drew criticism for profiting from events held at Trump-branded golf courses and housing foreign delegations at his pricey Washington hotel. 

    But upon his return, he has blown past all precedents on personal enrichment while also overseeing the systematic unraveling of American anti-corruption laws, institutions, and norms. 

    While many of these moves have been enforced by the U.S. government’s executive branch, the Republican-led Congress has done little to stop the slide — and, in some cases, has even encouraged it.

    So when U.S. voters head to the polls on November 3 for midterm elections, it is not just control of the House of Representatives and the Senate that is at stake, but the future of efforts to contain corruption at home and abroad. 

    On the eve of the election, OCCRP spoke to experts to take stock of the state of U.S. corruption — and the fight against it —  today, whether Democrats have a plan to reverse course, and what the repercussions of Trump’s actions have been at home and abroad. 

    The White House did not respond to requests to comment in time for publication.

    How has the U.S. approach to fighting corruption at home changed under Trump?

    Since returning to the White House in January 2025, Trump has taken a wrecking ball to anti-corruption programs and policies that have long been a source of bipartisan consensus. 

    One of the president’s first moves involved the mass firing of 17 inspectors general — non-partisan officials whose job it is to investigate misconduct, waste, fraud, and abuse across different government agencies and report back to Congress. 

    At least 22 inspectors general were removed during Trump’s first 18 months, and as of a week before the midterm elections, 27 posts remained vacant.  

    The administration didn’t provide a reason for their firing or notify Congress at the time, which a federal judge later ruled was unlawful.

    The administration has also paused and weakened several key pieces of anti-corruption legislation, including a landmark 2021 law that sought to combat the flow of illicit finance through the U.S. by requiring companies to report their ultimate beneficial owners, known as UBOs.

    Known as the Corporate Transparency Act, the law was meant to prevent criminals and kleptocrats from secretly stashing their wealth behind anonymous shell companies. 

    But this past August, the Treasury Department issued a new rule that dropped the disclosure requirement for U.S. companies and individuals, calling it a “burdensome reporting requirement.”

    (This week, more than 20 U.S. states sued the administration over the rollback, arguing that laws passed by Congress can’t be undone by rulemaking.)

    Erica Hanichak, co-director of the FACT Coalition, which advocates for rules to combat financial crime, describes the curtailing of the law as one of the ways the U.S. has “undeniably stepped back its fight against dirty money” over the past two years.  

    The consequences are far-reaching — and run contrary to the goals of law enforcement and other national security officials, she said. 

    When UBO information is kept secret, it makes it “harder for law enforcement and intelligence officials to follow the proceeds of financial crime, thereby handing a major win to cartels, U.S. adversaries, corrupt politicians, and fraudsters.” 

    In one recent example, the U.S. watchdog on federal spending noted that the lack of such data is hampering the ability to detect fraud in government contracting, leaving “hundreds of billions of federal dollars” vulnerable to “beneficial ownership-related fraud risks.”

    Last year, the Justice Department prosecuted 11 people tied to a Russian transnational criminal organization that exploited the weak ownership reporting requirements to fraudulently bill the Medicare system, stealing almost $1 billion. 

    The Trump administration has also watered down the Foreign Corrupt Practices Act (FCPA), a 1977 law that makes it illegal for American businesses to bribe foreign officials, and which has also allowed the U.S. government to prosecute and fine foreign companies engaging in bribery if they list their stocks or debt instruments in U.S. financial markets. 

    Arguing that the restriction put U.S. companies at a competitive disadvantage, the administration initially paused enforcement of the law and then later published new guidelines that called for focusing on cases that undermine U.S. interests.

    According to Richard Nephew, a scholar at Columbia University’s School of International and Public Affairs, the real danger goes beyond what he notes has been a significant decrease in fines and convictions. 

    More worrying, he has written, is what “the overall picture signals about whether the United States takes bribery seriously, and how that signal changes the risk calculus for companies deciding whether to comply.”

    He pointed to Trump’s own embrace of controversial gifts while in office — the most notable of which has been a $400 million jet from Qatar set to serve as Air Force One.

    “When the President of the United States is accepting a gold bar as a gift, it is reasonable to ask whether similar gifts given to other foreign heads of state will be seen as grounds for investigations, much less prosecutions,” Nephew wrote in the law and policy journal Just Security. 

    What about U.S. anti-corruption efforts abroad? 

    Dating back to the 1960s, successive U.S. administrations have pioneered transparency, good governance, and programs to combat corruption around the world, even if their implementation was uneven and imperfect. But the Trump administration has actively retreated from efforts to curb graft abroad in ways both big and small. 

    For instance, it quickly dismantled the U.S. Agency for International Development (USAID), one of the main instruments for funding anti-corruption efforts overseas, and froze the disbursement of foreign funding.

    (OCCRP formerly received grants from USAID, and became a plaintiff in a lawsuit against the Trump administration for illegally terminating funding that had been allocated by Congress.)

    The State Department’s Office of the Coordinator on Global Anti-Corruption — a post created in 2021 to integrate anti-corruption efforts with Washington’s foreign policy goals — was also eliminated soon after Trump took office, as was the Task Force KleptoCapture, a unit created by the Justice Department in 2022 to go after sanctions evaders, especially Russian oligarchs. The Justice Department said the latter was part of a policy realignment to focus on fighting cartels. 

    The administration has also stepped away from smaller but symbolic efforts to stamp out corruption overseas, such as no longer including information about corruption in the State Department’s annual country reports on human rights. (The State Department did not respond to requests to comment). 

    And then there’s the controversial use of the Magnitsky Act, which was passed in 2012 to allow the U.S. government to sanction foreigners who engage in corruption or human rights abuses.

    The president shocked anti-corruption crusaders last year when he used the Magnitsky Act to sanction a Brazilian Supreme Court justice who oversaw the trial of  Brazil’s former president Jair Bolsonaro, a Trump ally later convicted of plotting a coup after losing the 2022 election.

    (The conviction prevented Bolsonaro from running for office, leading his son Flavio to take up the family mantle and narrowly lose a presidential runoff election this past Sunday. Facing a money laundering investigation in Brazil, Flavio fled the country for the U.S.)

    “Global Magnitsky was a huge win when it passed … and the human rights community and the anti-corruption community celebrated,” said Gary Kalman, director of Transparency International U.S. 

    “Never in our wildest imagination would we have dreamed that a president of the United States would use the Global Magnitsky Act to go after a judge in another country for enforcing anti-corruption laws.”

    What about Trump and his family? Have they engaged in corrupt behavior?

    U.S. presidents have historically stepped away from their personal business interests to avoid conflicts of interest, or even the perception of a conflict.

    Yet Trump’s latest annual financial disclosure — which runs 927 pages long and covers his first year back in office — shows a significant increase in his income while president. Last month, Forbes estimated he was $2.7 billion richer than when he won the 2024 election.

    The source of this wealth comes from cryptocurrency enterprises, Trump-owned resorts and real estate, his social media platform Truth Social, and a range of other business ventures, many of which are rife with potential conflicts of interest.

    “I don’t think that there’s any president who has so brazenly used their office to create a web of foreign entanglements that enriches himself, his family, and some of his closest advisors and their families,” said Matthew Dallek, a historian specializing on presidential politics at George Washington University.

    The examples to choose from are numerous. For instance, the collective Trump fortunes soared earlier this year when an investment firm reportedly connected to the United Arab Emirates’ ruling family bought nearly half of a Trump family-connected cryptocurrency company. 

    A company backed by Trump’s sons has also sought to sell drone interceptors to Gulf countries while they were under attack by Iran following a war started by their father. 

    Trump and other officials’ frequent visits to the president’s properties, meanwhile, generate advertising and revenue for those businesses — and open up avenues through which others can use their wallets to try to curry favor with the president.  

    Taken together, experts have described it as an unprecedented level of political profiteering that raises the risk of the president putting his business interests ahead of those of the country.

    It’s also a problem that won’t be easy to fix. 

    Trump’s second term has exposed just how much the U.S. presidential system depends on “an adherence to norms and a set of expectations and values…rather than strict rules and laws preventing a president from corrupt actions,” Dallek said. 

    In previous comments to the press, a White House spokesperson has stated that “neither the president nor his family has ever engaged — or will ever engage — in conflicts of interest.” When asked about his lucrative year following the release of his financial disclosures this June, Trump attributed the profits to the stock market “going up” and said he never spoke to the people who manage his money.

    “We are experiencing what happens when you have an individual who dismisses ethical norms,” said Kalman of Transparency International. “People are now trying to figure out how you close these kinds of gaps in our ethics rules at the highest levels of our government.”

    One avenue, he said, is to secure the roles of state actors that could provide a counterweight to the Justice Department, whose independence has been called into question as it has pursued investigations against the president’s opponents and dropped cases involving allies. 

    “I think there’s a lot of district attorneys and law enforcement officials that are concerned about what they’re seeing as the weaponization of the Justice Department,” said Kalman. “If the U.S. Justice Department gets taken over by the executive, you have what we have now, which is a lack of accountability or unwillingness to enforce any of the violations that we’ve seen happen.”

    The Justice Department did not respond to requests to comment.  

    Democrats are trying to take back Congress. What is their plan if they succeed? 

    Polls show voters cite corruption as a major concern, and Democrats have pledged to investigate corruption if they regain control of one or both chambers of Congress.

    Should they win back at least the House of Representatives, they would be in a position to legislate and hold oversight hearings. They’ve already signaled plans to spotlight the business entanglements of the Trump family and friends, and say they won’t be shy about using their power to subpoena witnesses.

    “We can bring in members of the Cabinet and ask them questions and perhaps see if there’s any way we can get rid of some of them,” Rep. Dina Titus, a Nevada Democrat on the House Foreign Affairs Committee, told OCCRP. Her panel will “look at some of this corruption that’s going on around the rest of the world involving the administration and some of their buddies and relatives,” she added. 

    Much of what Democrats will be able to do hinges on the size of their victory, and some of their plans have yet to be spelled out in detail. 

    “Democrats are running on corruption, but they’re not running on a specific platform of how they’re going to reform or fix the system or address many of Trump’s egregious acts,” said Dallek, the historian. 

    In a recent interview with the TV outlet MS Now, New York Democrat Hakeem Jeffries, the current House minority leader, outlined plans for the first 100 days of the next Congress that included empowering two committees to look into corruption.  

    He has said the Judiciary Committee and the House Oversight Committee would be tasked with accountability and looking into the Trump family business entanglements.

    “We’re going to follow the facts, apply the law, be guided by the Constitution and then let the chips fall where they may,” he said. 

    Congressional Republicans, for their part, have prominently used their oversight powers to investigate people named in or associated with the Epstein files, including Commerce Secretary Howard Lutnick. The committee has also investigated tax breaks given to politically opposed non-profit organizations, while their anti-corruption agenda has largely been focused on reversing the “Censorship Industrial Complex,” a term used to describe those they say are suppressing right-wing viewpoints online under the pretense of limiting disinformation. 

    Hanichak, from the FACT Coalition, called on the next Congress — regardless of who holds the reins after Tuesday — to “strengthen guardrails to prevent public officials from profiting from power.”

    “We are what we tolerate: in most cases, the recent reticence of both Republicans and Democrats to denounce corruption by colleagues in their own parties has bred public distrust about the sincerity of reform,” she said. 

    “We need more transparency and accountability — in elections, in our financial system, in government contracts and services — to restore faith that democracy can deliver for ordinary people.”

    Source: OCCRP · 2026-10-30

  • Fake GitHub Repo Tricks AI Agents Into Installing SolanaCry Malware

    A fake GitHub repository tricks AI coding agents into installing SolanaCry malware, giving attackers remote access to developers’ Windows PCs through NetSupport.

    Source: HackRead · 2026-10-30

  • Undead Software Projects Continue to Raise Security Risks

    Undead Software Projects Continue to Raise Security Risks

    A security firm patched a decade-old app to prevent the takeover of millions of machines, highlighting that abandoned domains remain a boon to attackers.

    Source: Dark Reading · 2026-10-30

  • Five Questions About Trump’s ‘America First’ Approach to Fighting Corruption

    Five Questions About Trump’s ‘America First’ Approach to Fighting Corruption

    Shortly after taking office in early 2025, the administration of U.S. President Donald Trump paused the enforcement of the Foreign Corrupt Practices Act (FCPA), the nearly 50-year-old law that prohibits American citizens or companies from bribing foreign officials for business.

    When the FCPA was resumed six months later, the U.S. Department of Justice was ordered to narrow its focus to limit “undue burdens” on American companies operating outside the country. That action was in line with the Trump administration’s “America First” unilateral approach to foreign policy, which has seen the U.S. withdraw from dozens of international organizations on the grounds that they are inefficient and not in line with the country’s priorities. 

    Lorenzo Crippa, a lecturer at the University of Strathclyde who quantitatively studies how recorded instances of corruption affect financial flows, discusses the repercussions of these changes and worrying trends that have emerged under the new U.S. approach to global anti-corruption enforcement.

    The U.S. has changed the way it applies the Foreign Corrupt Practices Act, and last month it was announced it will officially withdraw from GRECO, the Council of Europe’s anti-corruption body. U.S. officials reportedly said the government would instead use unilateral tools like sanctions and visa restrictions to fight corruption, which they described as more effective. Based on your research, do you think the rejection of collaborative global standards in favor of mechanisms a country controls itself can be more effective?

    I would say hardly so. In the anti-corruption space, likely the opposite is true. It’s just enough to look at history: the U.S. adopted the FCPA (Foreign Corrupt Practices Act) in 1977, and for 20 years, the law was basically silent until a global regime on anti-corruption was passed at the OECD (Organisation for Economic Co-operation and Development) with the OECD Anti-Bribery Convention. 

    The law was on the books, but it was effectively not enforced, because the fear was that enforcing the law would disadvantage American companies at a time when German competitors and French competitors could even deduct bribes from tax statements.

    That all changed with the OECD Anti-Bribery Convention. At the end of the ‘90s, that’s the moment we see enforcement of the FCPA, effectively for the first time.

    The same could be said when we think of other areas of governance, more generally. There’s research in political science and international relations that clearly shows that coordination among countries is the most effective way to address global issues, rather than unilateral actions. So, I’m at the very least skeptical that that could be the case.

    In unrelated research of mine with some co-authors, we looked at the effect of American sanctions on financial markets, and we find that they can actually backfire for American firms that are connected to the sanctioned entities. So there’s even evidence that a multilateral solution could probably be more desirable.

    You co-authored an article in Foreign Affairs this year on how Washington may now be weaponizing anti-corruption law. Many critics of the U.S. say that its laws were hardly neutral before, and often applied for geopolitical or economic leverage, or even amounted to a form of imperialism. How would you respond to that line of argument?

    Certainly it’s true that the FCPA had been enforced in the past also for geopolitical reasons. I’m sympathetic to these claims. What has changed is that the approach of the Trump administration seems to be one where American firms get a free pass, and non-American firms would be subject to harsher enforcement. Or at least the expectation seems to be this one. And if that’s the case, this is a significant change from the past.

    If we compare it from the past situation, [despite] the fact that non-U.S. firms might have been significantly charged under the FCPA, American firms were still subject to this policy to a full extent. Whereas here, what we’re observing is the possibility of a double standard. That could genuinely be concerning, because that would be outright weaponization.

    Like I said, I’m sympathetic with these critics of the FCPA but it did manage to get some massive cases of corruption brought to justice — even of American firms. I think the largest fine in FCPA history is Goldman Sachs. It was certainly far from ideal, but probably closest to the best that was realistically adoptable as an anti-corruption policy. So its reshaping under the Trump administration is, to me, concerning.

    What are your specific concerns? What could be the broader effects on corruption around the globe if they don’t target U.S. firms and selectively target non-U.S. firms?

    When Trump initially halted enforcement of the FCPA in 2025, I was initially puzzled. The FCPA has been used as a tool of foreign policy as well, so getting rid of this or pausing it altogether, was puzzling to me.

    But when the period of pause was over and enforcement resumed, under new revised guidelines, what seems to be the case is that it’s going to be enforced primarily with the purpose of defending American foreign interests. At the moment we just have a handful of new cases after this change in enforcement, which makes it a little bit difficult as of now to understand if that’s really the direction that this is going.

    What my co-authors and I found was that at the very least markets seem to have priced in that expectation. We found that the moment the FCPA was suspended, firms that had been targets of FCPA actions in the past significantly experienced a boost in their stock price, which reflects the idea that probably investors expected a lax enforcement environment coming, for the rest of the Trump administration at least. That essentially means putting a bonus on the possibility of corrupt activity. It’s a very robust change that we observe from the moment enforcement was made laxer.

    In the past decades, we got used to the idea that corruption was bad for business, that investors would prefer a cleaner firm. These results, at least in this historical moment, seem to indicate the opposite: That these market actors would be willing to bet on more corruption. This is somewhat of a step change when it comes to corporate governance and good governance of business. Then again, this gain in stock price was concentrated on American firms. Non-American firms saw no improvement to their valuation, which seems to reflect this idea that there’s going to be weaponization going forward.

    With those same co-authors, you published another paper this year studying the effects of the OECD Anti-Bribery Convention, finding that the drop in bribery by companies who comply with the convention was basically offset by an increase in bribery from non-signatory competitors. What can we conclude from this? Is it casting doubt on whether the OECD convention or any “supply side” treaty targeting bribers can work?

    That’s a tricky question, because that paper clearly shows two faces of the same coin. On the one hand, it shows that these treaties are working because they generate strong incentives for those outside the treaty to make the most out of the advantage that they can get. That shows firms covered by the treaty that cannot bribe with impunity. The other face of the coin, that this is offset by corruption from firms outside the treaty, is really concerning. It means that something should be done.

    We had a meeting with the OECD working group on bribery about this when we were disseminating the results of our findings. I think they’re very aware of this problem. My main takeaway from this is that the solution is [an] expansion of these treaties. As long as there are double standards, as long as there are firms outside of the treaty who can bribe with impunity, the risk of this leakage (that’s what we call it where corruption sort of leaks to the group of firms outside of the treaty) becomes larger.

    Historically, the way this has been solved was by trying to expand participation to the treaty. 
In the ‘90s, that meant having France, Germany, and Japan in the treaty. Right now, probably that means trying to expand to China, Singapore, Taiwan — jurisdictions with firms that are very heavily involved in business, but who can bribe with impunity. I understand that calling for more multilateralism these days seems idealistic, but really that’s the only way that we can ensure that these supply side treaties can work in a sense. 

    My research doesn’t do much on this, but existing research of others does show that in the past a strategy has been to use domestic anti-corruption needs of countries. When the OECD Anti-Bribery Convention was signed, the U.S., who was heavily pushing for this treaty, managed to sort of exploit the fact that European countries were facing their own domestic corruption scandals. In Italy, for example, the Mani pulite [“clean hands”] scandal was a big thing in the ‘90s, and that was a significant reason why the U.S. managed to put pressure on this treaty to exist. So if treaty members were able to exploit the fact that, domestically in other parts of the world, there might be a need for more anti-corruption reforms, this could be one lever to try and extend participation. 

    I wouldn’t be certain that these [multilateral treaties] are the ideal solutions, but of the ones that have been tried, they seem to have been quite effective. At least in the shape that they used to have, with a multilateral agreement, and within that agreement, the United States playing a significant role in enforcement, for the good and bad that that was. This role as a global sheriff, in a sense, has managed to reduce corruption and bring large cases of bribery to justice. Now, whether that is the ideal solution, I’m not sure. There certainly is evidence that this was working, and jeopardizing that with the recent moves of the Trump administration makes me somewhat worried.

    Could the U.S. look to resume its role as “global sheriff” if U.S. President Donald Trump’s Republican Party suffers the kind of losses currently being predicted in polling for next week’s U.S. midterm elections?

    There’s a group of senators led by Elizabeth Warren who are trying to propose a bill called the FCPA Reinforcement Act. The idea is to extend the statute of limitations of the FCPA so that it could effectively be protected by future political decisions to halt enforcement again. This specific bill is very unlikely to pass — it’s mostly like a signalling device. 


    But under a flip [of congressional power in next week’s elections]  … that’s a hypothetical. [but] Mmy expectation would be that it would counteract the negative effect that we saw on stock market movements at least. By protecting the FCPA from political swings it should reinforce the idea that enforcement is going to happen, and that good anti-corruption governance is the expectation, and that companies and investors shouldn’t deviate from that. So at the very least, I would expect it should reassure markets of that and prevent investors from betting on corruption. I’m not sure this would do much to change this idea of enforcing the FCPA more strongly on non-American companies. I’m not sure that would be something that the bill itself could address. But at the very least, it should remove part of the problem. 

    Source: OCCRP · 2026-10-30

  • WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours

    WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours

    Threat actors have been observed attempting to exploit a high-severity security flaw in WordPress Core shortly after patches were released.

    The vulnerability, which does not have a CVE identifier, relates to a case of remote code execution impacting WordPress Core versions 4.7 through 7.1.3. It carries a CVSS score of 8.1 on the CVSS scoring system. Patches for the flaw were released on October

    Source: The Hacker News · 2026-10-30

  • Egyptian court orders closure of news site Mada Masr and fines editor Lina Attalah, sparking international outcry

    Egyptian court orders closure of news site Mada Masr and fines editor Lina Attalah, sparking international outcry

    A Cairo court on Tuesday ordered the closure of news outlet Mada Masr and convicted its editor-in-chief Lina Attalah of managing an unlicensed website. The ruling sparked outrage among press freedom advocates, who warned it marked a significant escalation in ongoing attacks against independent media in Egypt. 

    Attalah was briefly detained and ordered to pay the maximum penalty of 3 million Egyptian pounds, equivalent to more than $50,000, according to Mada Masr. Upon her release, Attalah learned a one-year prison sentence was issued against her in absentia in 2024 on separate charges of publishing false news and operating an unlicensed website. Her lawyers challenged the ruling, and a retrial is scheduled for Nov. 11, Mada Masr reported.

    “If Egypt can put in custody one of its most respected editors and shut down her newsroom, no independent journalist in the country is safe,” Sara Qudah, regional director of the Committee to Protect Journalists, said in a public statement.

    https://www.icij.org/news/2026/10/bought-off-corrupt-argentine-president-attacks-icij-member-hugo-alconada-mon/

    PRESS FREEDOM ‘Bought-off, corrupt’: Argentine president attacks ICIJ member Hugo Alconada Mon Oct 27, 2026

    https://www.icij.org/news/2026/10/tunisian-court-dismisses-case-to-dissolve-publisher-of-icij-partner-inkyfada/

    PRESS FREEDOM Tunisian court dismisses case to dissolve publisher of ICIJ partner Inkyfada Oct 09, 2026

    https://www.icij.org/news/2026/09/icij-journalist-micah-reddy-freed-after-4-days-in-secretive-djibouti-custody/

    PRESS FREEDOM ICIJ journalist Micah Reddy freed after 4 days in secretive Djibouti custody Sep 22, 2026

    Recommended reading PRESS FREEDOM ‘Bought-off, corrupt’: Argentine president attacks ICIJ member Hugo Alconada Mon Oct 27, 2026 PRESS FREEDOM Tunisian court dismisses case to dissolve publisher of ICIJ partner Inkyfada Oct 09, 2026 PRESS FREEDOM ICIJ journalist Micah Reddy freed after 4 days in secretive Djibouti custody Sep 22, 2026

    Source: ICIJ · 2026-10-30

  • The Flashpoint Threat Intelligence Brief: Middle East

    The Flashpoint Threat Intelligence Brief: Middle East

    Blog

    The Flashpoint Threat Intelligence Brief: Middle East

    Flashpoint’s weekly analysis tracks shifting kinetic and cyber threat radiuses, geopolitical disruptions, and provides critical operational forecasts for the ongoing Middle East conflict.

    Default Author Image
    October 30, 2026

    Following Operation Epic Fury, regional kinetic operations have transitioned into direct, persistent threats against commercial shipping, energy infrastructure, and critical supply chains.

    The Flashpoint Threat Intelligence Brief: Middle East cuts through headline noise to deliver tactical, ground-level intelligence for government agencies, corporate security leads, and global logistics teams—turning Flashpoint’s primary source intelligence into proactive risk mitigation.

    Here are the updates from this week that your security operations team should be tracking.

    Operational SITREP: Executive Summary

    Between October 23 and October 29, Ansarallah (the Houthi movement) continued its campaign against Saudi aviation, military, and energy infrastructure. Houthi military spokesperson Yahya Saree claimed ballistic missile and drone strikes on King Khalid International Airport, Saudi Aramco facilities in Yanbu, crude oil pumping stations, and the Ras Tanura refinery. On October 27, the group also claimed to have struck Saudi Arabia’s Ministry of Defense headquarters in Riyadh and military transport aircraft at Abha airport along with King Khalid Air Base. Saudi authorities have not confirmed damage at several of these sites.

    Saudi-led coalition forces reported intercepting missiles and drones targeting Riyadh, Khamis Mushait, the Eastern Province, and other areas, including 10 ballistic missiles directed toward southern Saudi Arabia on October 25. King Khalid International Airport resumed international flights that day, although Ansarallah warned airlines that the airport remained a military target. Coalition air strikes continued in northern Yemen, with the Sanaa-based Health Ministry reporting eight fatalities following a strike on workers’ housing in Hamdan.

    Houthi ground operations also intensified around Taiz and Lahj, with reported advances along the Jabal Sabr front and an assault on Al-Maqatira Castle. On October 29, Yemeni government forces reported that Ansarallah fired two ballistic missiles at Aden International Airport, extending the threat to another major aviation facility.

    The United States ordered nonessential staff and families to depart its embassy in Riyadh and consulates in Jeddah and Dhahran following statements by Islamic Revolutionary Guard Corps (IRGC) officials identifying American diplomats as legitimate targets. Similar precautionary measures were reported at US missions elsewhere in the Middle East. US officials also cited intelligence indicating potential Iranian assassination planning against American diplomatic and government personnel.

    Iran continued operations against Kurdish opposition groups in Iraq, with the IRGC conducting a drone strike on a Komala facility near Erbil on October 24. Maritime incidents persisted near the Strait of Hormuz, including a UKMTO report of a vessel on fire north of Khasab, Oman on October 29. The IRGC Navy separately claimed to have electronically seized and landed a US drone west of the strait, although that claim remains unverified.

    In the cyber domain, researchers from TrendAI, Citizen Lab, and Confiant identified additional surveillance activity involving Israeli advertising technology firm Discover-Tech. The company reportedly bid on advertising traffic associated with Starlink users in more than 100 countries, enabling potential identification and geolocation of individuals in conflict-affected regions. Google and Comcast subsequently removed the firm from their advertising platforms.

    Kinetic & Maritime Risk

    The resumption of international flights at King Khalid International Airport does not eliminate the risk of further disruption. Ansarallah has continued to designate the airport as a military target, while missile interceptions have created additional hazards for surrounding communities. In Khamis Mushait and Ahad Rafidah, falling debris injured two people and damaged residential buildings and vehicles. Similar debris was reported across parts of western Saudi Arabia, including areas around Jeddah, Taif, and Rabigh.

    In Yemen, Houthi advances along the Jabal Sabr front have brought fighting closer to government-held positions overlooking Taiz, including areas near Taiz University. The expanding offensive threatens access routes around a city where the UN has warned that approximately 800,000 people urgently need humanitarian assistance. Continued operations in Lahj and attacks toward Aden add further uncertainty for transport and government facilities in southern Yemen.

    Western-linked personnel and facilities face increased exposure following Iranian threats against American diplomats. The US drawdown extends beyond Saudi Arabia, with similar precautionary measures reported at diplomatic missions in the UAE, Lebanon, Qatar, Jordan, Bahrain, and Kuwait. Iranian allegations that US aircraft are operating from Gulf states could also increase the risk of Tehran identifying host-nation military facilities as potential targets in a renewed confrontation.

    At sea, the reported incidents near Khasab and Iraq’s Al-Faw port highlight risks across both the Strait of Hormuz approaches and the northern Gulf. The reporting identifies 113 maritime attacks in and around the Strait of Hormuz since February 28, underscoring the sustained exposure of commercial vessels operating through the region.

    Cyber and Hybrid Risk

    The latest Discover-Tech findings raise particular concerns about the information exposed through real-time advertising auctions. Researchers found that the firm could use advertising bid requests to identify and geolocate Starlink users, with activity concentrated in countries affected by conflict or political instability. This creates potential surveillance exposure for personnel relying on satellite internet services in areas where other communications infrastructure may be limited or disrupted.

    The research also builds on earlier findings connecting Discover-Tech to the delivery of Candiru spyware through online advertisements. Although advertising-based tracking does not itself establish that a device was compromised, the ability to identify and locate specific users could support subsequent targeting. Google and Comcast’s removal of Discover-Tech from their advertising platforms represents a response to the reported activity.

    Separately, the IRGC Navy’s claimed electronic takeover of a US drone near the Strait of Hormuz remains unverified. If substantiated, the incident would indicate an electronic warfare capability relevant to unmanned aircraft operating near Iranian-controlled waters. Iran’s announcement of arrests involving alleged US- and Israel-linked intelligence cells also reflects its continued focus on identifying suspected foreign intelligence activity, although the alleged affiliations have not been independently established.

    Recommended Risk Posture and Protective Controls

    Organizations with personnel, facilities, or operations exposed to the conflict should maintain heightened awareness of physical security, travel, maritime, and surveillance risks.

    Cyber Defense

    • Limit advertising-based tracking: Organizations with personnel using Starlink or other satellite internet services in conflict zones should review network- and browser-level ad blocking, restrict advertising identifiers on managed devices, and assess exposure of location and device data through advertising systems.
    • Review counterintelligence exposure: Organizations with personnel or partners traveling to Iran should limit the sensitive information carried on devices, review communications practices, and reinforce check-in procedures in light of recent arrests of alleged foreign-linked cells.

    Physical and Operational Defense

    • Strengthen protections for US-linked personnel: Organizations supporting diplomatic missions or employing current and former US government officials should review travel, residence, and event security in response to reported Iranian threats.
    • Reassess Saudi Arabia travel and facility plans: Confirm flight status before travel, review shelter procedures, and account for the risks associated with missile interception debris, particularly in Riyadh, Jeddah, Dhahran, and southern Saudi Arabia.
    • Maintain heightened maritime security: Shipping operators should monitor UKMTO advisories, review transit risks near Khasab and Al-Faw, and reinforce crew readiness for fires and other onboard emergencies.
    • Review exposure near Erbil: Organizations operating in Iraq’s Kurdistan region should assess proximity to Iranian Kurdish opposition facilities and update shelter and personnel-accountability procedures following repeated IRGC strikes.

    Strategic Outlook: Operational Forecast

    Over the next 48–72 hours, Houthi forces are likely to sustain missile and drone attacks against Saudi aviation, energy, and military infrastructure while continuing operations around Taiz, Lahj, and Aden. The resumption of international flights at King Khalid International Airport does not eliminate the threat of renewed disruption, particularly given Ansarallah’s continued designation of the airport as a target. Saudi-led coalition strikes in northern Yemen are also likely to continue.

    The US diplomatic drawdown reflects heightened concern about threats to American personnel, while reported planning for additional US strikes against Iran introduces uncertainty ahead of the November 3 midterm elections. Iranian Foreign Minister Abbas Araghchi’s statements about continued diplomatic contacts suggest negotiations remain possible, although no breakthrough has been reported.

    Maritime incidents near the Strait of Hormuz and northern Gulf are likely to persist, with additional uncertainty surrounding the IRGC’s claims of electronic warfare operations against US aircraft. Iranian strikes against Kurdish opposition positions near Erbil may also continue, alongside further counterintelligence arrests and public accusations of foreign involvement.

    In the cyber domain, the latest Discover-Tech findings may prompt additional scrutiny of advertising-based surveillance and the exposure of satellite internet users in conflict-affected regions.

    Enhance Threat Intelligence Using Flashpoint

    As the conflict continues to affect military operations, commercial shipping, regional infrastructure, and digital communications, security teams need timely intelligence to assess emerging risks and protect their organizations.

    Flashpoint combines primary-source monitoring, open-source intelligence, and geospatial analysis to help organizations identify developing threats, assess operational exposure, and make informed security decisions.

    Request a demo to learn how Flashpoint supports physical security intelligence, threat monitoring, and operational risk assessment.

    Frequently Asked Questions (FAQs)

    What is the Flashpoint Physical Threat Intelligence Brief?

    The Flashpoint Physical Threat Intelligence Brief: Middle East is a recurring threat intelligence update that translates raw primary-source open-source intelligence (OSINT) and geospatial data into actionable physical security analysis. It focuses on kinetic conflict developments, standoff weapon capabilities, maritime corridor security, and critical infrastructure risks across the Middle East.

    How does Flashpoint gather physical security intelligence for the Middle East?

    Flashpoint Physical Security Intelligence (PSI) gathers data by combining global open-source intelligence (OSINT), geolocated social media signals, satellite imagery, and primary-source threat monitoring. The platform uses AI-driven natural language processing and geospatial mapping to track kinetic developments, weapon strike radiuses, and physical security threats in real time.

    See Flashpoint in Action

    Source: Flashpoint · 2026-10-30

  • SS7 and Diameter Attacks: How Signaling Flaws Expose Your Phone

    Flaws in SS7 and Diameter signaling protocols can allow attackers to track phone locations, intercept calls and SMS verification codes, and impersonate subscribers without compromising their devices. Cape explains how these attacks exploit trust between networks and how its security-focused mobile service helps defend against them. […]

    Source: BleepingComputer · 2026-10-30