Sponsored by Spectra Group
————————————————————————
3 Aug 23. Pentagon CIO pushes defense agencies to tap $9bn cloud contract.
The Pentagon’s top technology official instructed defense agencies, military services and other offices to prioritize a $9 billion cloud computing arrangement, including when cutting deals concerning the nation’s most sensitive data.
Defense Department Chief Information Officer John Sherman in a memo made public Aug. 2 said a number of existing cloud services will transition to the Joint Warfighting Cloud Capability, or JWCC, upon expiration. New agreements made for secret and top-secret classifications should adopt JWCC, as well, he said.
“The JWCC contract vehicle provides the DoD an unprecedented ability to directly acquire commercial capabilities and services at three classification levels … and from strategic and operational headquarters to the tactical edge,” the memo states.
“The JWCC is not a cloud management or hosting environment,” it continues, “but rather a key vehicle in the department’s technology arsenal for the acquisition of services for current and future DoD component managed and controlled cloud environments.”
The Pentagon in December tapped Amazon, Google, Microsoft and Oracle for its landmark JWCC. The contract is considered the follow-up to the failed $10 billion Joint Enterprise Defense Infrastructure venture. JEDI, as it was known, was scuttled in 2021 after allegations of political interference and lengthy litigation.
The four companies are competing for JWCC jobs spanning unclassified, secret and top-secret designations, and are guaranteed only $100,000. Each won work in March in an initial round of awards worth millions of dollars, officials said at the time.
Sherman’s directions for JWCC usage include exceptions for the National Reconnaissance Office, National Geospatial-Intelligence Agency, Defense Intelligence Agency and the National Security Agency. They rely on the intelligence community’s Commercial Cloud Enterprise, or C2E, which was awarded in 2020. It features the same vendors as JWCC, plus IBM.
Sherman last year described getting JWCC up and running as “among my very top priorities.” (Source: C4ISR & Networks)
03 Aug 23. CIO Signs 2023-2027 DoD Cyber Workforce Strategy Implementation Plan. The Department of Defense (DoD) Chief Information Officer (CIO) Hon. John Sherman released the 2023-2027 Cyber Workforce (CWF) Strategy Implementation Plan today.
The CWF Workforce Strategy Implementation Plan will assist the Department in advancing talent management initiatives aimed at fostering an agile, flexible, and responsive cyber workforce. This Implementation Plan sets the foundation for how the Department will successfully execute the 22 objectives and 38 initiatives aligned with the 4 overarching goals in the CWF Strategy.
“Our goal is to ensure we are not only finding and hiring a diverse group of highly skilled cyber professionals but also develop the tools, resources, and partnerships required to continue growing these individuals,” said Patrick Johnson, Director, Workforce Innovation Directorate.
To realize the success of these goals and objectives, the activities outlined within must be measurable and monitored with continuous feedback. DoD components will continue to build and improve action planning efforts to achieve the goals and objectives in the CWF Strategy.
“Maintaining a highly skilled cyber workforce is vital to protecting our Nation against global cyber threats,” Sherman said. “This Implementation Plan covers how the Department will take progressive measures to cultivate a workforce that is flexible and responsive in an ever-changing cyber domain.”
Together, the CWF Strategy and Implementation Plan will enable the Department to recruit, develop, and retain the most capable and dominant cyber workforce in the world.
To read the CWF Strategy Implementation Plan, visit:
https://dodcio.defense.gov/Cyber-Workforce/CWS.aspx(Source: U.S. DoD)
03 Aug 23. TLS APT29 will continue to abuse legitimate services to target government sector in ongoing espionage operations. On 2 August, Microsoft disclosed an investigation into the Russian advanced persistent threat (APT) group ‘APT29′, and its use of Microsoft Teams chat to phish organisations. APT29 abused a compromised but legitimate Microsoft domain and sent tech support lures via Teams chats to targeted organisations, requesting multifactor authentication (MFA) tokens. These tokens were then used by APT29 to obtain unauthorised access to victims’ accounts. The campaign focused on fewer than 40 unique organisations within the government, NGOs, IT services, technology, manufacturing and media sectors, indicating that this was a highly targeted operation, likely for cyber espionage purposes. APT29 is linked to Russia’s Foreign Intelligence Service (SVR), often engaging in destructive and espionage-focused attacks against the US and other Western government entities to pursue the Kremlin’s strategic interests. This incident comes shortly after reports that APT29 is abusing other legitimate services to infect Eastern European diplomatic agencies with a new backdoor (see Sibylline Cyber Daily Analytical Update – 31 July 2023). Therefore, it is highly likely that APT29 will continue to target government and associated sectors in espionage operations, as tensions between Russia and the West persist. (Source: Sibylline)
03 Aug 23. Russian IADS Redux Part-6: Fundament-alists. Part 6 of Armada’s ongoing series on Russia’s strategic integrated air defence system examined its identification friend or foe apparatus. This article looks at the IADS’ command and control capabilities.
Like many of the Command and Control (C2) processes used by the Russian military, the C2 capabilities of Russia’s strategic Integrated Air Defence System (IADS) are being overhauled. Roger McDermott, an expert on the Russian military at the Jamestown Foundation thinktank in Washington DC, has highlighted several new C2 systems entering service. These systems include the Fundament-M system which networks air defence sensors and effectors, providing battle management. Mr. McDermott notes that, as of 2020, Fundament-M had been deployed in Russia’s Central Military District (CMD). The CMD covers a huge part of central Russia stretching from the Arctic to Russia’s borders with Kazakhstan and Mongolia. Before the system’s introduction, the CMD was devoid of an automated air defence C2 system, unlike Russia’s other military districts.
Russian Aerospace Force units in the CMD, including ground-based air defence assets, are deployed under the command of the Central Military District’s 14th Air Force and Air Defence Army. This unit has two headquarters, one in Novosibirsk and the other in Samara, both in the southern part of the CMD. These facilities may each have responsibility for the eastern and western segments of the CMD’s vast airspace. Having two operational-level HQs provides redundancy should one be unserviceable or be destroyed during hostilities. These HQs are in turn connected to subordinate Aviation Guidance Points (AGPs). AGPs command the tactical battle directing the kinetic and electronic engagements of targets flagged by the operational headquarters.
Fundament-M consolidates imagery from ground-based air surveillance radars deployed within the Military District (MD). By consolidating this imagery, Fundament-M develops the Recognised Air Picture (RAP) of the military district’s airspace and air approaches. Open sources say that Fundament-M supplements this RAP with imagery from civilian air traffic control radars in the military district. Once threats are identified, the system can be used to task effectors. These effectors include Surface-to-Air Missile (SAM), Anti-Aircraft Artillery (AAA), fighters or electronic warfare assets.
Linking Outwards
Mr McDermott’s article says that Fundament-M links outwards to army and navy C2 systems used wholly or partially for air defence. For example, Fundament-M links downwards into the Barnaul-T C2 system Russia’s land forces use for tactical, deployed ground-based air defence command and control. Barnaul-T is used with medium-range, medium-altitude SAM systems like the 9K330 Tor (NATO reporting name SA-15 Gauntlet). Long-range, high-altitude SAM batteries like the S-400 (NATO reporting name SA-21 Growler) use the Polyana-D4M1 C2 system. Russian ground-based air defence assets deployed with the Russian Aerospace Force probably both use Barnaul-T and Polyana-D4M1 for similar purposes. It remains unknown what C2 system is used by the aerospace force’s fighter controllers to vector fighters towards their targets.
Military Districts
Incarnations of Fundament-M are being rolled out across Russia’s Northern, Eastern, Southern and Western Military Districts. These disparate systems most likely send their operational-level RAPs upwards to the armed forces’ National Defence Management Centre (NDMC). Based in Moscow, the MDMC provides strategic/operational control of Russia’s armed forces. Consolidating the RAP at this level would ease the strategic-level air defence of Russia in wartime.
Cyber Vulnerabilities
The advent of Fundament-M greatly improves air defence C2 at the operational level, and potentially at the strategic level too. Through networking these disparate systems deployed across the country’s military districts, commanders can build strategic, as well as operational level, RAPs. Usefully, networking Fundament-M outwards to subordinate, tactical air defence C2 systems will improve the management of engagements. However, one major potential vulnerability of a digitised C2 system like Fundament-M could be cyberattack. Although Russian engineers will have worked hard to ensure that the networks Fundament-M depends on are robust, inevitably weakly defended entry points could exist which could be exploited to insert malicious code. (Source: Armada)
03 Aug 23. TLS – EAB Steps Forward. Initial deliveries of the US Army’s Terrestrial Layer System – Echelons Above Brigade equipment could be made to the army’s Multi-Domain Task Forces.
US Army plans to enhance operational-level electronic and cyberwarfare are moving ahead with deliveries of prototype TLS – EAB systems in the offing.
Lockheed Martin will build a prototype Terrestrial Layer System – Echelons Above Brigade (TLS – EAB) ensemble for the US Army’s Intelligence, Electronic Warfare and Sensors Programme Executive Office (PEO IEWS). The PEO IEWS issues requirements and procures electronic warfare capabilities on behalf of the US Army, and is based at Aberdeen Proving Ground, Maryland.
A press release from the PEO IEWS announcing the news said this phase of the overall TLS EAB acquisition, known as Phase 2, is worth $36.7m. Phase 1 covered technical reviews of the capabilities offered in response to the TLS – EAB requirement providing opportunities for soldiers to give feedback. The press release continued that Phase 2 should last 21 months. This phase will see representative equipment “tested in a relevant environment.”
The TLS – EAB effort will deliver multi-function EW and cyberwarfare capabilities to support land manoeuvre and joint forces to divisions and corps. Put simply, the TLS – EAB will provide EW and cyberwarfare at the operational level.
Timelines
A statement provided to Armada by the PEO IEWS said that an operational demonstration of TLS – EAB prototype systems will be performed by a US Army unit in 2025. The operational demonstration will be preceded by several events dubbed ‘touch points.’ These events will give soldiers the chance to evaluate the TLS – EAB architecture and provide feedback. Deliveries of production systems will then follow, possibly that same year.
While the TLS – EAB system is expected to be used in a static fashion, it will be vehicle-mounted, although the PEO IEWS statement said the exact choice of vehicle is yet to be decided. “However, the criterion for the platform is a vehicle that is common to most operational units.” The Steyr/Oshkosh Family of Medium Tactical Vehicles “is being considered as the TLS – EAB prototype platform.”
As Armada has previously reported, the TLS – EAB ensemble is likely to include two vehicles: One will carry a Signals Intelligence (SIGINT) and electronic attack system. These systems will likely detect and engage threats using frequencies of circa 30 megahertz up to 18 gigahertz. The second vehicle will carry a defensive electronic attack system. This apparatus will help safeguard friendly communications networks and radios from hostile electronic/cyberattack. This latter vehicle will perform cyber/electronic attack to pre-empt hostile actions but will not collect SIGINT.
CONOPs
The first recipients of production TLS – EAB systems could be the army’s Multi-Domain Task Forces (MDTFs). The MDTF concept forms the bedrock of the force’s strategy to defeat anti-access/area-denial postures with units earmarked for Europe and the Asia-Pacific.
According to a US Congressional Research Service document MDTFs will have strategic fires, air defence and brigade support battalions. An Intelligence, Information, Cyber, Electronic Warfare and Space (I2CEWS) battalion will support these. The I2CEWS includes two military intelligence companies, a signals company, an extended range sensing and effects company, and an information defence company. It is reasonable to assume that the TLS – EAB will support all these elements. The system will perform electronic/cyberattack on their behalf and on behalf of MDTF kinetic formations.
Initially deploying the TLS – EAB with the Multi-Domain Task Forces is both a sensible and prudent move. Given difficult relations between the US, and the People’s Republic of China and Russia, Europe and the Asia-Pacific are potential flashpoints. Ensuring that advanced electronic and cyberwarfare capabilities can support the army’s manoeuvre force should the unthinkable happen is paramount. (Source: Armada)
03 Aug 23. Getting Past the Propaganda. Iranian military EW cadres watch their screens during a military exercise in 2021. Iranian propaganda frequently mentions supposed state-of-the-art Iranian electronic warfare capabilities, and the armed forces’ readiness for combat in the electromagnetic spectrum.
A new book casts much-needed light on the electronic and cyberwarfare postures of the armed forces of the Islamic Republic of Iran.
It is no secret that we are big fans of the Lightning Press at Armada. The publishing house produces some of the best overviews of foreign militaries available in the public domain. In the past, we have had Norm Wade, the press’ owner and author, as a guest on our Radioflash! podcast. In late 2022, Mr. Wade’s book on the military of the Democratic People’s Republic of Korea (DPRK) revealed how the DPRK’s Korean People’s Army uses Electronic Warfare (EW) to support its manoeuvre force.
You can image our excitement when Mr. Wade’s latest addition to Lightning Press’ OPFOR Smartbook series reached us. Published in June OPFOR Smartbook-4: Iran and the Middle East looks, in part, at the Islamic Republic of Iran’s military. Getting reliable and detailed information on the Iranian armed forces is difficult. Nonetheless, Mr. Wade’s book provides one of the most comprehensive assessments of Iran’s military, and some useful indications of her electronic and cyberwarfare postures.
Cyberwarfare
The Iranian regime routinely uses cyberwarfare at the strategic level to “influence the (Iranian) population’s ideological and cultural exposure,” writes Mr. Wade. Cyberwarfare is also used internationally to harass and intimidate opponents of the regime based abroad, and to promote the Iranian regime’s official narratives. In November 2021, Armada reported on Iranian cyberoperations against her US and Saudi Arabian strategic rivals. As the article states, cyberoperations are also a favoured way for the Iranian government to perform espionage and intelligence-gathering.
What is less clear is the extent to which the Iranian military would employ cyberwarfare at operational and tactical levels. We reported in 2019 that US Cyber Command may have attacked elements of Iran’s Integrated Air Defence System. These attacks may have followed Iran’s shootdown of a US Navy Northrop Grumman RQ-4A Global Hawk uninhabited aerial vehicle on 20th June 2019. Assuming this attack did take place, it would be surprising the Iranian military did not try to beef up the cyber defences of its military networks.
The book does reveal that the Islamic Revolutionary Guard Corps (IRGC) is responsible for offensive military cyberoperations. Iran has two groups of forces: The IRGC arose out of the 1979 Iranian Revolution and is responsible for defending Iran’s regime and Islamic theocracy. Iran’s other military, the Artesh, is more conventional, primarily focused on protecting the country from external threats. As one can image, the respective missions of the two services can overlap. Both the Artesh and IRGC possess full panoplies of sea, land and air forces. Mr. Wade reveals that the IRGC possesses a dedicated Electronic Warfare and Cyber Defence Organisation. Offensive cyber operations are also the responsibility of the country’s Cyber Defence Command.
Electronic Warfare
Strategic-level electronic warfare in Iran, specifically Signals Intelligence (SIGINT) collection, is the responsibility of the Ministry of Intelligence and Security writes Mr. Wade. He adds that one of the stated military modernisation goals of Iran is to improve the country’s electronic warfare posture. EW modernisation is one of the country’s goals outlined in its current five-year military plan. Beyond this, we have little additional information on how the Iranian armed forces organise and deploy their EW capabilities. We know little of Iranian EW doctrine nor exactly what electronic warfare systems are used. This is not a failing on the author’s part. One effects of Russia’s ongoing war in Ukraine is the ability to collect information from the theatre of operations on how the former’s armed forces are fighting in the electronic spectrum.
Scant information is available in this regard vis-à-vis the Iranian military. For example, no data appears to have reached the public domain on the use of EW by Iranian proxies during Yemen’s long civil war. Almost no public information on how Iranian proxies in Syria and Lebanon such as Hamas have used EW seems to exist. Where information on Iranian EW is publicly available, it often seems confined to blusterous propaganda reports. These reports gush about Iranian EW exercises or newly-introduced kit will devastated Iran’s rivals. Hardly material for rigorous analysis.
With Ukraine aflame and tensions running high with the People’s Republic of China, it is easy to forget that Iran still poses a clear and present threat to the strategic interests of the US and her allies. These threats are underscored by Tehran’s support of insurgents operating in Iraq, Syria and Lebanon, and her deep opposition to Israel. Iran’s ability to threaten closure of the Persian Gulf, a maritime choke point through which up to 30 percent of the world’s oil consumption flows through daily according to the Strauss Centre thinktank at the University of Texas, is a major cause of concern. Fortunately, the Lightning Press’ latest work helps us makes sense of Iran’s armed force, its current practices and the direction of travel for their electronic and cyberwarfare postures. (Source: Armada)
03 Aug 23. August Spectrum SitRep. Plans are afoot to enhance the Praetorian Defensive Aids Subsystem (DASS) equipping the Eurofighter Typhoon combat aircraft. These improvements will include new software and hardware, and a closer synergy between the DASS and new radars destined to equip the aircraft.
Armada’s monthly round-up of all the latest electronic warfare news in the product, programme and operational domains.
New Shields for Praetorian
Leonardo announced in mid-July a new package of upgrades for the Praetorian Defensive Aids Subsystem (DASS) equipping the Eurofighter Typhoon series of combat aircraft. The company announced the news via a press release on behalf of EuroDASS. EuroDASS is a consortium comprising ELT Group, Indra and Hensoldt, as well as Leonardo, which share responsibility for Praetorian. The press release said that one of the aims of the upgrade is to enhance the DASS’s ability to work with new radars the aircraft is receiving. Typhoons are due to be equipped with Leonardo’s ECRS Mk.2 and Hensoldt’s ECRS Mk.1 X-band (8.5 gigahertz/GHz to 10.68GHz) fire control radars. Typhoons flown by Germany and Spain will receive the ECRS Mk.1 with the Royal Air Force receiving the ECRS Mk.2, according to reports. The press release said the DASS upgrade will deliver “a digital receiver capability, which will allow Typhoon to better recognise modern and complex targets and their modes of operation, enabling it to deploy the appropriate countermeasures.” The radio frequency waveband Praetorian works in is expected to be extended, although the frequencies this will encompass have not been revealed. The DASS’ signal processing capabilities will also be enhanced, the press release continued. Of particular interest is the convergence of Praetorian with the ECRS Mk.2 to enable the latter to perform electronic attack, as well as conventional radar functions. Phil Liddiard, Leonardo’s vice president for combat air and EuroDASS’ consortium programme lead told Armada that hardware improvements to Praetorian include “(a)n additional digital receiver capability, which will allow Typhoon to better recognise modern and complex targets and their modes of operation, enabling it to deploy the appropriate countermeasures.” Writ large, the upgrade work is part of the Typhoon’s proposed P4E enhancement. The four nations in the Eurofighter consortium (Germany, Italy, Spain and the United Kingdom) are expected to agree to move ahead with P4E in 2025 says Mr. Lilliard. Assuming P4E goes ahead, Leonardo added that these DASS enhancements could be retrofitted to existing Typhoons. The improved DASS will also be available for export customers.
RFeye for Aerostar
In late June, CRFS announced that its RFeye spectrum monitoring technology is now available onboard Aeronautics’ Aerostar Uninhabited Aerial Vehicle (UAV). Reports stated that RFeye will be used for the detection and location of signals of interest across frequencies of ten megahertz to 18 gigahertz. Reports continued that RFeye has already been integrated onto an Aerostar UAV for a European client. Details of the client have not been made public. CRFS told Armada in a written statement that Aeronautics is now offering RFeye as part of a larger intelligence, surveillance and reconnaissance package for the UAV. This package will be offered to existing and future Aerostar customers. CRFS’ statement continued that very little modification of the RFeye was needed to install the system onboard the UAV: “We carefully worked through mechanicals, power, data and the positioning of the measurement antennas relative to any antennas on the airframe,” the statement continued. The aircraft, complete with its RFeye payload, has already been delivered and is in service, CRFS’ statement concluded.
Outfoxing the Jammers
Northrop Grumman revealed in late June that it had conducted a successful flight test of the company’s Embedded Global Positioning System/Inertial Navigation System, according to a company press release. Known as EGI-M, it was the first time that the system’s architecture had flown equipped with an M-Code receiver. M-Code is the encrypted US Global Positioning System (GPS) Position, Navigation and Timing (PNT) signal. The EGI-M has been developed for aircraft to allow them to fly in areas where GPS PNT signals maybe jammed. The press release continued that EGI-M being considered by the US Department of Defence (DOD) for several aircraft. These platforms include US Navy Northrop Grumman E-2D Hawkeye airborne early warning and control planes. Another candidate named by the company is the US Air Force’s Lockheed Martin F-22A Raptor fighter. Northrop Grumman told Armada in a written statement that the recent flight test “helps demonstrate … EGI-M design performance in an environment more representative of end-user characteristics.” Although demurring from providing details on the expected dates for the EGI-M’s introduction, the statement continued that “Northrop Grumman’s EGI-M production delivery schedule meets the current timeline for DOD platform integration.”
(Source: Armada)
01 Aug 23. RTX Connects New Platforms to Serve As Battlefield Nodes.
- Round two of Northern Edge sees communications networks expanded to additional coalition partners during Indo-Pacific multinational exercise
RTX (NYSE:RTX) demonstrated advanced AI-enabled communications systems to rapidly distribute data to coalition partners during the second round of the U.S. Indo-Pacific Command’s Northern Edge 2023 exercise series at Kadena Air Base in Okinawa, Japan.
Collins Aerospace, an RTX business, expanded upon the airborne, platform-agnostic data hotspot that the company debuted during the first Northern Edge exercise in Alaska earlier this year. Leveraging the company’s cross domain solution, advanced AI-enabled communications, and intelligent gateway technology, Collins connected partners from The Five Eyes alliance and others to the data network, expanding joint force capabilities during the demonstration.
“This was a critical demonstration to prove our solutions can facilitate and enable connectivity for a large and growing joint force network,” said Elaine Bitonti, vice president, Connected Battlespace & Emerging Capabilities for Collins Aerospace. “It’s important to understand that the joint fires data our systems processed and distributed came from a large network of platforms that weren’t originally designed to connect and share data like this,” Bitonti said. “Not only did our gateway and cross domain solution connect those platforms, they also automated the distribution of that data to the right partner at the right security level.”
RTX’s Raytheon business unit contributed to accelerating decision-making timelines, with an integrated team demonstrating how AI-enabled machine-to-machine communications rapidly delivered threat awareness data from the U.S. Space Force’s Unified Data Library to multiple aircraft, demonstrating how they can be used as connectivity nodes on the battlefield.
“Our automated communications powered by AI securely provided mission data to a number of platforms including C17s, C-130s and the KC-135 in a realistic combat scenario,” said Conn Doherty, vice president of Battle Management Command & Control & Autonomy Solutions at Collins Aerospace. “Northern Edge TAC-2 has been a vital proving ground to demonstrate how enabling JADC2 technologies can strengthen the Joint Force and its allies and partners’ readiness to fight and win.”
RTX’s suite of technologies is flexible, allowing integration into a variety of platforms. The company’s focus on open systems architecture development aims to support the evolving needs of the customer and the battlefield and its technologies enable synchronized operational capabilities available in every domain. Expanded connectivity to U.S. Air Force Mobility Command assets was facilitated through an ongoing Cooperative Research and Development Agreement between Collins Aerospace and the Utah Air National Guard. The agreement is focused on extending the utility and survivability of the KC-135 by expanding the role the KC-135 can play on the battlefield as an airborne refueling and connectivity node. (Source: ASD Network)
02 Aug 23. Europe: Cyber espionage campaign targeting industrial control systems poses heightened risk to national security, critical infrastructure. Cyber security company Kaspersky issued a report on 31 July outlining Chinese advanced persistent threat (APT) group ‘APT31’, which is targeting air-gapped industrial control systems (ICS). Air-gapped systems are those which are isolated from enterprise networks and public internet; they are typically used to ensure the security of critical operations. The cyber attacks began in April 2022, and have targeted critical infrastructure in Eastern Europe to remotely access ICS systems. They have also stolen sensitive data while simultaneously installing second-stage malware to evade detection and establish successful infections in air-gapped systems. To install the specialised malware and steal data from the industrial control system, APT31 used infected USB drives to propagate the infection – a tactic recently used by other Chinese state-sponsored threat actors seeking to infect healthcare organisations in Europe (see Sibylline Cyber Daily Analytical Update – 26 June 2023). APT31 has implemented a wide variety of tactics, techniques, and procedures (TTPs) to conduct the campaign. This indicates that the group meticulously planned the operation and adjusted its methods to ensure persistence and evade detection. Industrial control systems are attractive targets for state-sponsored actors, as they play a vital role in national security and valuable, sensitive corporate-sector projects. This long-term operation underscores the increased targeting of critical national infrastructure, and the threat of such infections for national security. (Source: Sibylline)
02 Aug 23. Viasat Launches Black ICE Software Defined Radio Platform. New family of innovative, high-performance modem solutions enable the integration of commercial off-the-shelf as well as custom waveforms for low SWaP, secure beyond line-of-sight data communications.
Viasat Inc. (NASDAQ: VSAT), a global communications company, today announced the launch of its Black ICE Software Defined Radio (SDR) family of modem solutions. The Black ICE SDR modem solutions enable the integration of commercial off-the-shelf and custom waveforms, allowing secure data transmission for mission-critical operations.
With the increasing use of uncrewed Intelligence, Surveillance and Reconnaissance (ISR) operations, combatant commands require a reliable, flexible, secure, low size, weight and power (SWaP) solution that provides consistent communications coverage to support their missions.
The Black ICE SDR product line enables a host of new innovative capabilities via the proven and reliable ELERA L-band and Global Xpress Ka-band networks, augmenting U.S. Government resources for land, sea and air communications worldwide.
Black ICE SDRs are designed to meet high-demand requirements of military users by offering security, flexibility, low form factor and high-performance terminals. The solutions support Xilinx and Intel Field Programmable Gate Array (FPGA) architectures in both L-band and Ka-band, as well as OpenAMIP for antenna management. Additionally, it enables a reduction in SWaP for L-band LAISR user terminals, further supporting customers’ BLOS communications requirements for open architecture, security, low form factor terminals and high performance.
Leveraging the resilient, secure, and easy-to-use ELERA L-band network, Black ICE SDR allows for flexible waveform integration and provides low SWaP solutions that meet challenging user terminal form factor and performance requirements for beyond line of sight (BLOS) communications on crewed and uncrewed platforms, as well as expeditionary Command and Control (C2) operations.
For Ka-band customers, Black ICE can be integrated into standard Global Xpress Ka-band terminals via G-MODMAN II and Open Platform (OP) modem manager technology to enable the addition of a special waveform service. Through the special waveform service, U.S. Government Global Xpress customers will be able to access alternative waveforms to satisfy specific high-demanding mission requirements, such as high data rate and resiliency necessary in congested and contested environments.
More complex waveforms and enhancements are in development and will enter commercial service later in 2023 to offer new features and provide customers more flexibility in addressing evolving mission requirements. Additionally, Black ICE will enable the addition of future enhanced special waveform features so that the service can utilize the capabilities of Viasat’s next-generation satellites.
Matt Wissler, Chief Technology Officer at Viasat Government Systems, said, “With the increasing use of beyond line-of-sight communications as part of ISR and C2 missions, U.S. Government customers require a high-performance solution that maximizes platform range and reduces signatures for land, sea and air. The Black ICE SDR platform provides customers with solutions that enable flexible waveform integration and allow them to securely transmit large volumes of data while meeting the SWaP requirements of these platforms.
“We are excited to offer our Black ICE family of modem solutions to our U.S. Government customers. This innovative capability enhances our current service offerings and enables us to prepare new mission-specific solutions that will leverage the capabilities of our next-generation satellites while delivering additional value to the end user,” Wissler added.
For more information on the Black ICE SDR solutions, please visit https://www.inmarsatgov.com/capabilities/black-ice-sdr/.
01 Aug 23. US military targets deepfakes, misinformation with AI-powered tool. The U.S. military is testing an artificial intelligence tool that can trawl social media and other open-source information and spot misleading content, such as bots or deepfakes, to better inform commanders of the region they are operating in.
The program, dubbed Data Robot, was part of the Cyber Quest trials held throughout July at Fort Gordon in Georgia. It was previously put through its paces during the Pacific Sentry exercise in Hawaii, officials said.
“We want to give the commanders the right information at the right time so we can impact the enemy. That’s the goal,” Army Col. Brett Riddle, director of the Cyber Battle Lab, told reporters at a Cyber Quest briefing July 28. “And I think Data Robot did show us that we can start to progress forward with that.”
Quickly discerning fact from fiction is critical for forces in the field. And the task is increasingly complex as misinformation floods the likes of Twitter and Facebook and world powers wage online influence campaigns, some more overt than others. A manipulated video surfaced last year in which a poorly edited Ukrainian President Volodymyr Zelenskyy called on his soldiers to lay down their arms and surrender to Russia, for example. It was quickly debunked.
The U.S. is now beefing up its information warfare capabilities, a persuasive combination of data awareness and deception aimed at gaining an advantage before, during and after battles. Cyber Quest is organized each year to examine up-and-coming technologies and inform future investments.
“It’s our opportunity to take cutting-edge, newly delivered products from industry, put them into the hands of soldiers and determine if they’re going to work in the field, in the dirt, in the rain, in Georgia, in the hot, humid weather,” Army Maj. Gen. Paul Stanton, the commander of the Army cyber center of excellence, said. “We need opportunities like Cyber Quest to work directly alongside our industry and scientific partners so they can make the modifications to existing protocols so that they’ll meet our needs.”
The Data Robot tool required about 90 days’ worth of data to reference before effectively identifying messages pushed by bots, according to Stanton. Pattern recognition and other insights are derived from extensive training regimens.
“Was anyone using artificial intelligence and machine learning? The simple answer is yes,” Stanton said of Cyber Quest. “Social media in the Indo-Pacific doesn’t look like social media in the United States.”
Data Robot could eventually fold into the Command Post Computing Environment to provide snapshots of information, though it will require some troubleshooting, officials said.
The environment consolidates various programs and data streams into a common pane maintained by soldiers. It also provides a software and hardware framework upon which future applications can be built.
“There was a lot of promising work done here at Cyber Quest,” Riddle said. “When we look at information advantage and trying to produce those visual overlays for commanders, it can be done.” (Source: Defense News)
01 Aug 23. US: Military entities, government contractors remain key targets in cyber espionage operations. On 29 July, reports by the New York Times indicated that the US government was mitigating risks from two different cyber security incidents: one involving Chinese threat actors, and another related to a malicious insider. The first incident occurred in May 2023 when Chinese advanced persistent threat (APT) group as ‘Volt Typhoon’ targeted US military systems in Guam. The US government now suspects the intrusion was more widespread than initially believed. Malware associated with ‘Volt Typhoon’ was implanted within several networks controlling the communications, power and water systems that supply US military bases both within the US and overseas. This underscores the threat posed by the group to US national security, through targeting specific systems that could impact the military’s ability to respond to incidents, particularly in the scenario of China’s military operations against Taiwan. The second major incident reportedly occurred when an engineer from a base in Tennessee took home military-grade radio equipment and obtained unauthorised access to radio communications technology used by the Air Education and Training Command (AETC). The individual’s intended purpose has not been disclosed. Nonetheless, the incident highlights the persistent insider risk posed to businesses, especially for those engaged in government contracts pertaining to national security. (Source: Sibylline)
01 Aug 23. Successful Completion of Sea Trials for the Israeli Navy’s New EW Counter Measure Dispensing System by Elbit Systems. The new Counter Measure Dispensing System (DESEAVER MK-4) is the fourth generation to be installed by Elbit Systems onboard the Israeli Navy’s vessels.
The Israeli Navy and Elbit Systems have successfully completed a series of sea trials for the DESEAVER MK-4 Counter Measure Dispensing System (CMDS) onboard Israeli Navy vessels.
The trials tested the capability of the new maritime Electronic Warfare (EW) system to effectively respond to complex missile attack scenarios, including launching decoy rounds from several launchers against multiple concurrent threats.
The DESEAVER MK 4 is the fourth generation of EW dispensing systems to bring to a full effect the soft kill anti-missile defense capabilities as part of Elbit Systems’ Integrated Electronic Warfare Suite (IEWS).
Elbit Systems ISTAR and EW’s IEWS is operational across the Israeli Navy and additional international Naval Forces.
The DESEAVER MK 4 system provides perimeter protection against concurrent multiple missile threats from multiple directions. The system is comprised of several trainable and stabilized launchers that are capable of rapid and accurate placing and launching of decoys selected by the anti-missile algorithms. The system employs a range of passive and active decoys.
Similar to its predecessors, the fourth generation of the DESEAVER system is fully integrated with other ship combat systems.
Oren Sabag, General Manager of Elbit Systems ISTAR & EW: “We are proud of our ongoing cooperation with and support of the Israeli Navy. The successful completion of these trials provides further proof of the reliability of our technology and the advanced protection capabilities they provide against new and evolving threats.”
28 Jul 23. Kenya: Pro-Russian hacktivists will continue to target government services in politically-motivated campaigns. Kenyan authorities temporarily shut down government e-visa services following a distributed-denial-of-service (DDoS) attack on their network on 27 July. The affected platform, e-Citizen, is responsible for government services and houses citizens’ sensitive personal data for passports, identity cards and more. The pro-Russian hacktivist group ‘Anonymous Sudan’ claimed responsibility for the attack, stating that it was retaliation for alleged Kenyan interference in Sudan’s internal affairs. Anonymous Sudan is an active threat actor, which regularly conducts religious and/or geopolitically-motivated attacks. For example, in response to the West’s support for Ukraine, it has often targeted Western entities in DDoS campaigns. While the attack disrupted key digital services for travel, officials stated that airlines should continue to board passengers, and the authorities will issue necessary visas upon arrival at entry ports. It is unclear how long the disruption will last as the authorities work to restore the services. (Source: Sibylline)
28 Jul 23. Cyber Update.
Executive summary
- This week, threat actors were observed using open-source software and crowd-sourced coding databases and tools to compromise vendors and target specific customers (see Sibylline Cyber Daily Analytical Update – 24 July 2023).
- The Norwegian government suffered a cyber attack after threat actors exploited a zero-day vulnerability in a third-party vendor. The supply chain compromise affected 12 ministerial departments (see Sibylline Cyber Daily Analytical Update – 25 July 2023).
- Another supply chain compromise affected software vendor JumpCloud and a select group of their customers. However, due to an operational security failure by the advanced persistent threat (APT) group, the attack has been attributed to North Korean APT group ‘UNC4899’ (aka ‘Labyrinth Chollima’) (see Sibylline Cyber Daily Analytical Update – 26 July 2023). North Korean threat actors are increasingly compromising vendors to target specific customers downstream, which is likely to continue in the long term.
- New malware (‘Decoy Dog’) rapidly changed its attack infrastructure following the publication of in-depth analysis into the technical processes of the malware. This underscores the active development the malware is undertaking in order to sustain operations and prevent effective counter-measures (see Sibylline Cyber Daily Analytical Update – 27 July 2023).
- Kenyan visa services were hit by a distributed-denial-of-service (DDoS) attack by pro-Russian hacktivist ‘Anonymous Sudan.’
What you may have missed
The US Cybersecurity and Infrastructure Security Agency (CISA) and security technology company Axis Communications released an advisory regarding a vulnerability (CVE-2023-21406) in their network door controller that could allow arbitrary code execution. The vulnerability is related to the Open Supervised Device Protocol (OSDP), an access control communications standard that is assumed to be secure. The vulnerability can be exploited by a threat actor with physical access to the control reader, often positioned at the entry point of a secured facility, to open doors and tamper with access logs to disguise entry. Additionally, an actor could exploit the vulnerability to execute code on the internal access controller from outside a facility to obtain access to the internal network. This underscores the threat this vulnerability could pose to both the physical and cyber security of various organisations. This vulnerability highlights the intersection of physical and cyber risk and the subsequent impact both can pose to a business’s overall security.
Phrase of the week
This week’s cyber phrase of the week is: Zero-day vulnerability
Definition: A flaw or bug in software or technology that is unknown to the vendor or developer, which can allow a threat actor access into a system or network. A zero-day vulnerability is classified as a zero-day if it is actively exploited and/or does not have an official patch readily available. ‘Bug bounty’ programmes are a popular means of defence, which pay ethical hackers to find vulnerabilities in technology prior to malicious threat actors, so patches can be developed.
Example: See Sibylline Cyber Daily Analytical Update – 25 July 2023: ’the Norwegian government revealed that it had suffered a cyber attack via a zero-day vulnerability (CVE-2023-35078). The attack reportedly affected the operations of 12 governmental departments. The zero-day vulnerability originated in a third-party information and communications technology (ICT) vendor.’
Global weekly analysis
On 26 July, a Chinese delegation arrived in North Korea for Victory Day celebrations to mark the 70th anniversary of the Korean War armistice. This shortly followed the arrival of a Russian delegation to North Korea, signalling the resumption of in-person diplomacy by Pyongyang (see Sibylline Daily Analytical Update – 26 July 2023). The revival of in-person diplomatic relations between the three countries indicates the growing likelihood that this informal alliance may pose long-term cyber security threats to the West. Diplomatic co-operation is likely to apply to cyber activity, increasing the possibility of collaborative cyber operations against Western entities or dispersing stolen sensitive strategic information between the three countries. As ties with the West continue to deteriorate for China, North Korea and Russia, the strengthening of this tri-lateral relationship will likely pose elevated security risks to government and diplomatic entities in the West. (Source: Sibylline)
28 Jul 23. Keel laid for the first Polish SIGINT ship at Remontowa shipyard. Saab and Remontowa Shipbuilding join forces to build signal intelligence vessels for the Polish Navy.
The keel laying ceremony for the inaugural Polish signals intelligence ship, a joint project between Saab and Remontowa Shipbuilding S.A., commenced yesterday in Gdansk, Poland.
This event signifies the collaborative effort to construct two advanced SIGINT ships to bolster the Polish Navy’s intelligence capabilities across the maritime domain. The project, initiated in late 2022, has garnered enthusiasm from key stakeholders, including Saab, the Polish Armament Agency, the Polish Navy, and Remontowa Holding.
The construction project, contracted to Saab, a defence and security solutions provider, includes designing and producing two SIGINT ships with integrated advanced mission systems. These vessels are set to change how intelligence data is acquired and processed across naval operations.
Mats Wicksell, Senior Vice President and head of Saab’s business area Kockums expressed his appreciation for the collaborative efforts on this crucial project. “Naval intelligence ship systems are advanced platforms that must be highly reliable and available.
The keel laying ceremony today is an important milestone in the shipbuilding process, and we appreciate the cooperation with our Polish customer, the Armament Agency, the Polish Navy and our partner in this project Remontowa Holding.”
The partnership with Remontowa Shipbuilding S.A., which has a reputation in shipbuilding and repair services, has ensured that the project remains firmly grounded in Poland. The steel-cutting ceremony, held on April 27, 2023, initiated the physical construction of the first ship.
In a step towards enhancing the nation’s naval intelligence capabilities, the Polish Navy has been anticipating the delivery of these advanced SIGINT ships. With the ever-evolving nature of modern maritime threats, these vessels will enhance situational awareness and data analysis, helping safeguard Poland’s interests in the region and beyond.
Once operational, the SIGINT ships will be instrumental in conducting intelligence, surveillance, reconnaissance, and electronic warfare missions. Their ability to gather and process intelligence data from various sources will bolster the Polish Navy’s ability to maintain maritime security and respond effectively to emerging threats.
This keel-laying ceremony marks a step forward in the joint venture between Saab and Remontowa Shipbuilding S.A., underscoring Poland’s commitment to strengthening its naval capabilities and fostering valuable partnerships in the defence industry.
This week, Saab also secured an order from Poland for two Saab 340 airborne early warning aircraft equipped with advanced Erieye radar, further solidifying Saab’s partnership with Poland’s Ministry of National Defence. (Source: naval-technology.com)
————————————————————————-
Spectra Group Plc
Spectra Group (UK) Ltd, internationally renowned award-winning information security and communications specialist with a proven record of accomplishment.
Spectra is a dynamic, agile and security-accredited organisation that offers secure Hosted and Managed Solutions and Cyber Advisory Services with a track record of delivering on time, to spec and on budget.
With over 15 years of experience in delivering solutions for governments around the globe, elite militaries and private enterprises of all sizes, Spectra’s platinum and gold-level partnerships with third-party vendors ensure the supply of best value leading-edge technology.
Spectra was awarded the prestigious Queen’s Award for Enterprise (Innovation) in 2019 for SlingShot.
In November 2017, Spectra Group (UK) Ltd announced its listing as a Top 100 Government SME Supplier by the UK Crown Commercial Services.
Spectra’s CEO, Simon Davies, was awarded 2017 Businessman of the Year by Battlespace magazine.
Founded in 2002, the Company is based in Hereford, UK and holds ISO 9001:2015, ISO 27001:2013 and Cyber Essentials Plus accreditation.
————————————————————————-