emergency response Archives

Winsage

October 1, 2026

I got hands-on with Panasonic’s new TOUGHBOOKs, and they’re becoming the AI hub for police cars, military drones, and emergency responders

Panasonic's TOUGHBOOK lineup is celebrating its 30th anniversary, with a focus on evolving from rugged devices to intelligent edge computers. The TOUGHBOOK 33 and G3 models feature Intel's latest Core Ultra processors with AI capabilities, enabling local data processing and reducing reliance on cloud connectivity. The TOUGHBOOK 34 has a 12.4-inch display for in-vehicle use, while the G3 is compact with a 10.1-inch display for fieldwork. Both devices support unmanned systems and fleet intelligence applications, allowing for real-time data retrieval and management. The modular xPAK ecosystem enables users to adapt hardware configurations based on specific needs. Connectivity upgrades include 5G support and enhanced Wi-Fi and Bluetooth capabilities. The devices are designed for use in military, emergency response, and utility sectors, emphasizing their role as secure, connected, and AI-capable tools for critical missions.

Winsage

September 23, 2026

PAYLOAD ransomware hijacks Windows Group Policy in encryption-less attacks

A sophisticated PAYLOAD ransomware attack targeted an unnamed manufacturing organization in the Middle East, exploiting vulnerabilities in Microsoft Active Directory Group Policy. The attackers accessed the network through a compromised domain account via FortiGate SSL VPN on April 11, escalated privileges to domain administrator by April 13, and created a malicious Group Policy Object (GPO) named "PAYLOAD." This GPO was linked at the root of the domain, allowing it to affect nearly all domain-joined Windows workstations. The attackers distributed ransom notes, altered desktop images, displayed ransom messages at login, and disabled local administrator accounts. A second GPO, "win Firewall Off," was deployed to disable Windows Firewall across all profiles. The malicious policies activated on April 14 after systems were rebooted, causing widespread disruption. The attackers also exfiltrated data from file servers and published it on the dark web, while Kaspersky found no evidence of Windows file encryption or active malware processes. Recommendations for organizations include monitoring GPO creation, checking for unexpected changes, implementing multi-factor authentication for VPN access, and protecting privileged accounts.

Winsage

September 22, 2026

PAYLOAD ransomware hijacks Windows Group Policy in encryption-less attacks

A sophisticated PAYLOAD ransomware attack targeted a manufacturing organization in the Middle East, exploiting vulnerabilities in Microsoft Active Directory Group Policy. The attackers gained initial access on April 11 by compromising a domain account through the company's FortiGate SSL VPN. By April 13, they escalated privileges to a domain administrator and created a malicious Group Policy Object (GPO) named “PAYLOAD,” which was linked at the root of the domain. This GPO allowed them to distribute a ransom note, change desktop images, display a ransom message during login, and disable the local administrator account. A secondary GPO, “win Firewall Off,” was used to disable Windows Firewall across all profiles. The malicious changes activated on April 14 after system reboots, causing widespread disruption. The attackers also exfiltrated sensitive data, which was later released on the dark web. Kaspersky's investigation found no evidence of file encryption or active malware processes, indicating the attack was contained within Active Directory. Recommendations for organizations include monitoring GPO modifications, implementing multi-factor authentication for VPN access, and safeguarding privileged accounts.

AppWizard

June 9, 2026

PlanetPlay and UNICEF collaborate to support children through a PC games collection

PlanetPlay has partnered with UNICEF to support global children's causes through game-based fundraisers and awareness campaigns. The first project, the PlayForEveryChild PC Games Collection, will launch in October and will be available exclusively on PlanetPlay's games marketplace, with 100% of profits directed to UNICEF. The funds will enhance children's access to education, healthcare, climate resilience programs, and emergency response efforts. PlanetPlay is inviting game studios and publishers to contribute titles to the Collection by June 30.

TrendTechie

May 12, 2026

Трёхмерная реконструкция аварий на трассе А-7: Патерна, Пикассент и Торрент

The operation "Exit" in Valencia province led to three simultaneous accidents on the A-7 highway, causing over six kilometers of traffic congestion. Accident analysts utilize three-dimensional documentation, including digital photogrammetry and laser scanning (LiDAR), to accurately capture collision points and vehicle trajectories. This data helps determine liability and structural deficiencies. The 3D models created allow for the calculation of impact speeds and simulation of vehicle interactions. Additionally, these technologies enable predictive simulations to test modifications for traffic management and improve safety measures, ultimately aiming to reduce accident rates on busy corridors.

Tech Optimizer

March 13, 2026

Zombie ZIP vulnerability lets compressed malware leisurely stroll past 95% of antivirus apps — security suites are blissfully unaware of security issue

The Zombie ZIP exploit is a vulnerability that allows malware to bypass most antivirus solutions by misleading them about the nature of ZIP file contents. It takes advantage of the ZIP file structure, presenting itself as uncompressed data while hiding compressed information. This vulnerability can be easily implemented in Python with minimal code. The Computer Emergency Response Team (CERT) has issued advisory VU#976247, and the vulnerability is listed as CVE-2026-0866. Systems administrators are advised to be vigilant regarding ZIP files on their networks.

Tech Optimizer

November 5, 2025

Hackers Are Using Linux Malware to Invisibly Bypass Windows Security

Hackers are refining tactics to evade detection by EDR systems and antivirus software, with a notable strategy being the use of Linux malware to infiltrate Windows systems. Investigations by Bitdefender and CERT-GE revealed a campaign by the Russian hacker group Curly COMrades, which exploits the Hyper-V virtualization platform on Windows 10 to create covert access channels. They utilize Alpine Linux for lightweight virtual machines that are difficult to detect, requiring only 120 MB of disk space and 256 MB of RAM. The attackers maintain persistent access using tools like Resocks and Stunnel, starting their activities in early July 2024 by activating Hyper-V on compromised systems and deploying misleading virtual machines labeled “WSL.” They introduced custom malware, CurlyShell and CurlCat, for communication and remote access. This trend of using Linux malware against Windows systems is growing, as seen in recent Qilin ransomware attacks documented by Trend Micro.

Winsage

November 4, 2025

Russian hackers abuse Hyper-V to hide malware in Linux VMs

The Russian hacker group Curly COMrades has been using Microsoft Hyper-V to bypass endpoint detection and response (EDR) solutions by creating a concealed Alpine Linux-based virtual machine for running malware. They have deployed proprietary tools, CurlyShell and CurlCat, within this virtual environment to maintain operational stealth and secure communication. Active since mid-2024, the group targets government and judicial entities in Georgia and energy companies in Moldova. In early July, they gained remote access to two machines, activated Hyper-V, and disabled its management interface to deploy a minimalistic virtual machine that hosted their malware. This tactic allowed them to evade traditional host-based EDR detections. The virtual machine was configured to use the Default Switch network adapter, making malicious traffic appear to originate from the legitimate host's IP address. CurlyShell executes commands and maintains persistence, while CurlCat facilitates covert traffic tunneling. The group also utilized PowerShell scripts for persistence and pivoting to remote systems, including injecting Kerberos tickets into LSASS and creating local accounts via Group Policy. Bitdefender advises organizations to monitor for abnormal Hyper-V activation, LSASS access, and suspicious PowerShell scripts.

Winsage

November 4, 2025

Russian spies pack custom malware into hidden VMs on Windows

Bitdefender's senior security researcher, Victor Vrabie, reported that the Russian cyber group Curly COMrades is using Microsoft's Hyper-V hypervisor to conduct sophisticated attacks on compromised Windows machines. They create a concealed Alpine Linux-based virtual machine (VM) that bypasses traditional endpoint security, allowing prolonged access for espionage and malware deployment. This VM is lightweight, requiring only 120MB of disk space and 256MB of memory, and hosts a reverse shell called CurlyShell and a reverse proxy named CurlCat. The group's operations have targeted judicial and governmental institutions in Georgia and an energy company in Moldova. Their current campaign, starting in July, involved activating Hyper-V and downloading the VM with custom malware. The VM uses the Default Switch network adaptor, making malicious traffic appear to originate from the legitimate host's IP address. CurlyShell maintains root-level persistence and communicates with a command-and-control server over HTTPS, while CurlCat manages an SSH reverse proxy tunnel disguised as standard HTTP traffic. Additionally, two PowerShell scripts linked to the group enable remote authentication and establish persistent access across domain-joined machines. Vrabie highlighted the evolving tactics of cybercriminals to bypass endpoint detection and response (EDR) systems, emphasizing the need for a multi-layered security strategy.

AppWizard

October 10, 2025

Four months after its second delay, Cities Skylines 2’s big bridges DLC finally has a new date, and a lot to prove

Cities Skylines 2 has a 'mixed' rating of 53% on Steam two years after its launch. The Bridges and Ports expansion, which has faced two delays, is set to release on October 29, priced at .99/£16.99. This DLC will enhance water-based construction with new features such as customizable harbors, new coastal maps, and facilities like ore yards and passenger terminals. It will introduce 20 variants of drawbridges and lift bridges for improved connectivity and new transportation options like ferries. The expansion includes over 100 new assets, including lighthouses and leisure piers. Performance issues and traffic patterns remain concerns, and the asset editor is still pending release. A bundle option with the 'Cold Wave Channel' radio station will be available for .89/£18.89. Players are encouraged to discuss their expectations for the DLC online.