Sponsored by Spectra Group
———————————————————————————————————————–
16 Sep 24. Asia-Pacific: Newly revealed operation points to espionage risks from Chinese state-backed groups. On 14 September, the cybersecurity company Cybereason reported on an ongoing Chinese state-sponsored cyber espionage campaign targeting the academic, government and manufacturing sectors in India, Japan and Taiwan. The campaign is associated with a Chinese state-sponsored group called ‘Earth Kasha’, which is likely related to another state-sponsored group, ‘APT10’. This assessment is based on similarities in their tactics, techniques and procedures (TTPs). Earth Kasha reportedly first gained access to targeted systems in 2022 via software vulnerabilities and spear phishing messages, highlighting the group’s ability to maintain a prolonged presence on compromised systems. Additionally, the threat actors deploy a new backdoor to maintain persistence and to conduct post-exploitation activities, including collecting sensitive system data. Chinese state-sponsored groups routinely conduct cyber espionage operations against perceived adversaries to bolster their economic and security posture. We assess that Earth Kasha will likely attempt to move laterally within compromised networks in follow-on attacks, heightening espionage risks for various sectors. (Source: Sibylline)
18 Sep 24. L3Harris Technologies (NYSE:LHX) has met a key spectrum dominance milestone by initiating production of its Viper Shield™ all-digital electronic warfare (EW) suite for F-16 fighter jets. The company will be providing the advanced capability to F-16 fleets in six countries.
“Equipping aircrews and commanders with situational awareness about the electronic landscape gives them the ability to identify, locate and counter threats at the speed of relevance,” said Ed Zoiss, President, Space and Airborne Systems, L3Harris. “We are proud of the Viper Shield technology our engineers developed and the fact that it serves as the only advanced electronic warfare solution that is funded and in active production for international F-16 partners. The system’s small 3U form factor enables installation in multiple F-16 block configurations.”
L3Harris is actively engaged in discussions with other U.S. allies and partner nations to deliver its advanced EW capabilities. The Viper Shield system provides two installation options for existing or upgraded F-16 configurations: integrated within the aircraft or as an external pod with the same EW system hardware. This flexible approach uses software-defined technology to enhance the offensive and defensive capabilities of F-16 Block 70/72 aircraft. By design, Viper Shield is engineered to allow for future capability upgrades, ensuring it can counter evolving threats. (Source: ASD Network)
19 Sept 24. US-Taiwan: Botnet takedown points to elevated security risks from Chinese state-sponsored groups. On 18 September, the cyber security company Lumen reported that the Chinese state-sponsored group ‘Flax Typhoon’ developed a multi-tiered botnet (‘Raptor Train’) to target Taiwan and the US; it has been in use since at least 2020. Flax Typhoon exploited several software vulnerabilities to infiltrate Internet-of-Things (IoT) devices to create Raptor Train; this was until US security agencies dismantled the botnet in mid-September. Raptor Train comprised around 260,000 devices before takedown, highlighting the scale and sophistication of this operation. The botnet’s first tier primarily included IoT devices, while the second and third tier operated the command-and-control (C2) infrastructure. Notably, Flax Typhoon deployed the ‘Nosedive’ payload on some tier-one devices to obtain disruptive capabilities for potential future attacks. However, reports indicated no disruptive activity. (Source: Sibylline)
16 Sept 24. Weather Forecasts. An artist’s rendering of the UK’s forthcoming Skynet-6A military communications satellite. The MOD has commissioned work to ensure that the ground infrastructure supporting this satellite is resistant to rain fade.
The United Kingdom is moving ever closer to the introduction of its Skynet-6A military communications satellite with ongoing propagation surveys to support the new spacecraft.
Several British military communications satellites support the UK’s armed forces and the country’s Ministry of Defence (MOD). These spacecraft include Skynet-4C which carries X-band (7.9-8.4 gigahertz/GHz uplink/7.25-7.75GHz downlink) and Ultra High Frequency (UHF: 305-315 Megahertz/MHz uplink/250-260MHz downlink) traffic. Skynet-4C is supplemented by three additional satellites in the Skynet-4 constellation: Skynet-E/F carry C-band (5.925-6.425GHz uplink/3.7-4.2GHz downlink) traffic in addition to X-band and UHF links. The Skynet-5 constellation, which superseded Skynet-4, comprises four satellites (Skynet-5A/B/C/D) all handling X-band and UHF traffic. The Skynet-5 constellation also carries Ku-band (14GHz uplink/10.9-12.75GHz downlink) traffic.
Skynet-6A
Airbus received a contract from the MOD to provide the next member of the Skynet family, Skynet-6A, in 2020 with the satellite scheduled for launch in 2025. Alongside the new satellite, the contract covers extensive improvements to the ground infrastructure the Skynet constellations depend on. A key element of introducing Skynet-6A into service is ensuring that existing SATCOM ground stations can support the satellite. This work includes ensuring that rain fade disruption to the satellite’s Ka-band (26.5-40GHz uplink/18-20GHz downlink) provision is minimised.
Rain fade is a phenomenon that can affect radio signals above frequencies of circa eleven gigahertz. Rain, snow, sleet, ice and other physical contaminants in Earth’s atmosphere can absorb some of the energy of radio transmissions at these frequencies and above. This absorption can cause potential losses in signal power. The phenomena occurs because some precipitation particles are a similar size to these frequencies’ wavelengths. It is imperative that Skynet-6A ground infrastructure is managed in such a way as to reduce rain fade disruption. Anyone familiar with Britain’s weather will know that rain is a regular occurrence.
Rain Fade
In late August, Atheras Analytics won a contract to provide Ka-band propagation analysis to the UK MOD to help the ministry manage the ground stations that will support Skynet-6A. According to a press release the company will use software to analyse existing ground station sites to ascertain the extent rain fade may cause problems there. The outcome of this analysis will let the ministry plan how it can ensure continued links between ground stations and the satellites at times when rain fade may be a significant problem.
The press release continued that the company is using its Design Tool which employs a proprietary artificial intelligence-based Outage Prediction Algorithm (OPA). The OPA is applied to historic rainfall measurements at the ground stations’ location to help determine historic link availability at these sites. Through the analysis of the ground stations’ locations, and their susceptibility to rain fade, ground network design can be optimised to maximise network and service availability.
John Yates, Atheras Analytics’ managing director, told Armada that “(t)he next-generation Skynet 6 satellites will incorporate a Ka-band capability which has not existed in previous Skynet generations.” He added that this survey work commenced in July and will conclude in October. “The initial work is to assess the suitability of the existing gateway locations for supporting the planned Ka-band services. If there is any question or uncertainty about the suitability of the existing sites, the MOD has an option to extend the work to assess the suitability of other additional sites.”
Mr. Yates observed that the SATCOM sector “has entered a phase of major change in the delivery of consumer and enterprise broadband using high/very high throughput satellites … which can deliver data rates of the order of between 500 gigabits-per-second and one terabit-per-second.” One solution to these high data throughput demands is to use Ka-band frequencies despite rain fade susceptibility. Mr. Yates says that ground station architectures can be managed in such a way so that if one station is affected by rain fade, uplink and downlink services are automatically transferred to another ground station unaffected by the weather. In a country with a climate as wet as the UK managing rain fade to ensure smooth SATCOM is paramount. (Source: Armada)
17 Sept 24. MUOS Earns its Wings. Communications and networking for US Army airborne forces has taken a step forward following trials of a new architecture that could reduce the hardware burden for airborne forces.
The US Army revealed in late July that the 11th Airborne Division of the 2nd Airborne Infantry Brigade Combat Team (AIBCT) is the first formation in the army to deploy a push-to-talk air-to-air/air-to-ground Enroute Mission Command (EMC) capability. This network was established using L3Harris AN/PRC-158 Very/Ultra High Frequency (V/UHF: 30 megahertz/MHz to 2.5 gigahertz/GHz) multi-channel radios. In a written statement shared with Armada L3Harris described the radio as being the “backbone of this network.”
Links and waveforms supported by the AN/PRC-158 include the Single Channel Ground and Airborne Radio System, better known as SINCGARS. The SINCGARS waveform uses Very High Frequency (VHF) transmissions of 30 megahertz/MHz and 87.975MHz. Also carried by the AN/PRC-158 is the Warrior Robust Enhanced Networking (WREN) waveform. WREN uses VHF and UHF (Ultra High Frequency: 300MHz to three gigahertz) transmissions. Offering bandwidths of between 50 kilohertz to ten megahertz, WREN gives position location information and handles voice traffic, according to the US Army. The waveform is provided in two configurations: WREN TSM enables point-to-point communications at ranges of up to five kilometres (3.1 miles). WREN-NB is a narrowband waveform for use in electromagnetically contested and congested environments. Both waveforms carry traffic across the Integrated Tactical Network discussed in more detail below.
KEN and DAN
The US Army article announcing the news stated that, until now, EMC had needed Key Leader Enroute Node (KEN) and Dependent Airborne Node (DAN) teams to facilitate these communications. The article continued that KEN and DAN teams would be drawn from signals formations outside the army’s AIBCTs. Signallers would need to be accommodated on aircraft supporting the mission, potentially sacrificing space for additional airborne forces and their kit. KEN nodes provide broadband backhaul data and intra-aircraft voice and data communications. These nodes also provide secure video teleconferencing and air-to-air/air-to-ground task force and combatant commander communications. DAN nodes are employed by subordinate commanders for inflight communications to connect with superiors who are using the KEN node.
The adoption of the AN/PRC-158 for these tasks removes the need for KEN and DAN nodes to support the AIBCTs during Joint Forcible Entry Operations (JFEO). The radios connect with standard Satellite Communications (SATCOM) systems used by US Air Force Boeing C-17A Globemaster-III airlifters. C-17As form a key part of the JFEO airborne capability. For example, AN/PRC-158 radios can use the Mobile User Objective System (MUOS) satellite constellation. The MUOS constellation provides UHF (240MHz to 270MHz) narrowband SATCOM. Open sources say that MUOS facilitates voice and data communications at speeds of up to 384 kilobits-per-second. Communications with the MUOS constellation is via the Wideband Code Division Multiple Access (WCDMA) waveform carried by the AN/PRC-158.
The US Army report stated that the AN/PRC-158 radios used the force’s Integrated Tactical Network (ITN) during the EMC experiments. The ITN is a deployable network handling non-classified traffic using military radios and civilian devices, latter including smartphones and tablets. Moving non-classified traffic onto the ITN frees space on other tactical communications networks for secure traffic. As it handles unclassified traffic, ITN can connect US Army units with allied forces during coalition operations.
The new Enroute Mission Command capability was tested during a series of JFEO exercises held recently in Alaska, California and Hawaii over the Pacific Ocean. The architecture was also trialled during a JFEO exercise which commenced in Alaska and finished in Thailand. The adoption of the AN/PRC-158 to support the EMC represents a qualitative enhancement compared to the erstwhile KEN and DAN nodes. Using these transceivers with the army’s ITN shows how this innovative network is finding additional uses beyond the land environment. (Source: Armada)
18 Sept 24. September Radio Roundup. Viasat developed the Secure Wearable Hub to equip dismounted troops with a particular emphasis on special forces soldiers. The system could become available for procurement by the end of the year.
Viasat Unveils SWH
In late July Viasat announced the introduction of its Secure Wireless Hub (SWH). A company press release revealed that the SWH is a wearable, tactical gateway for use by dismounted troops. The Secure Wireless Hub has been developed as part of a “multi-phase effort” involving the US Special Operations Command. This effort is identifying and developing advanced communications for mobile ground forces. One of the capabilities offered by the SWH is a secure virtual private network “allowing the use of multiple transports and waveforms across a range of devices to provide resilient connectivity and safely share critical battlefield information” the press release noted. The Secure Wireless Hub lets users connect with cellular and wi-fi/bluetooth services. Viasat told Armada in a written statement that the SWH is “a modular system that was designed specifically to integrate Type-1 encryption handheld tactical radios and connects to non-Type-1 MANET (Mobile Ad Hoc Networking) and other IP (Internet Protocol) based radios.” The company said that “a single management app on an end user device easily configures peripheral devices.” Moreover, “LTE (Long Term Evolution) and wi-fi/bluetooth modules that can be added, or removed, based on the user’s needs.” Regarding ongoing developments “the SWH was designed to meet the needs of special operations forces and is currently being evaluated by both conventional and unconventional units.” The Secure Wireless Hub “is completing a series of user evaluations and is currently being targeted for procurement availability by the end of the calendar year.”
More T Node details
In Armada’s August Military Communications Newsletter we included an article on a new transportable fifth-generation cellular communications node equipping the US Air Force called T Node. This capability has been developed by two companies; SEMPRE and Instant Connect. Instant Connect has provided us with some additional details regarding its contribution to T Node. In a written statement, the company said it is providing an Internet Protocol (IP) platform notably mobile and desktop software applications providing “interoperable push-to-talk” communications over SEMPRE’s network. The software also provides “seamless integration with other voice systems like radios and PBXs (Private Branch Exchanges) with everything running over the 5G network.” Instant Connect’s IP platform “links warfighters, commanders and base operations in a single integrated, transportable voice environment allowing users of radios, smart phones, tablets, computers, and other devices to communicate and achieve the mission.” In addition, Instant Connect’s software “provides a voice overlay to the popular ATAK (Android Team Awareness Kit). This lets users leverage ATAK and voice communications simultaneously from the same interface, without having to switch screens or use other devices.” Communications/transmission security protocols offered by the IP platform include FIPS 140-2 and AES-256. (Source: Armada)
18 Sept 24. Thales partners with Dstl and defence SMEs Catalyst and DCE to create a new hybrid testing environment for crewed and uncrewed platforms.
- Thales, in collaboration with synthetic environment creators, Catalyst, and robotics and automation experts, Digital Concepts Engineering (DCE), are under contract from the Defence Science and Technology Laboratory (Dstl), for the research and development of open interfaces and architectures between GVA compliant crewed and uncrewed platforms.
- A new, hybrid, test and experimentation environment (‘digital twin’) is being developed that will allow operators and researchers to plan and test new concepts, systems and architectures in both virtual and physical domains.
- The first use (both live and virtual) of the digital twin system is planned for early 2025, operating air and ground uncrewed systems from a GVA crewed platform in a Recce-FIND role. This will also incorporate artificial intelligence and Thales’ DigitalCrew, aiming to improve effective use of unscrewed systems and reduce the burden of key decision makers on the battlefield, leading the way in bridging the gap between crewed and uncrewed systems.
- The digital twin environment aims to enable integration of virtual and live systems from dispersed locations, better enabling early system of systems integration and testing at system and sub-system level (e.g. Hardware in the Loop).
Thales in the UK, under contract from Dstl, is leading the way with crewed-uncrewed integration, developing a system of systems digital twin environment for experimentation on the operation of Land Robotics and Autonomous Systems (RAS). Research is ongoing for the project entitled, ‘Land Robotics and Autonomous Systems Ecosystem of Digital Twin Development and Experimentation’ (Land RAS EDT), and the consortium of Thales, Catalyst and DCE are making great progress towards final live trials and demonstrations which are scheduled for early 2025.
Land RAS EDT is a hybrid ecosystem, allowing operators and researchers to utilise a common architecture and interface to plan and experiment in both the virtual and physical domain. The platform enables the operation of virtual and physical systems through one interface, which allows for endless experimentation opportunities. The development of Land RAS EDT will initially be designed to enable the exploration of RAS in the beyond visual line of sight (BVLOS) reconnaissance role. It will also provide a platform for better understanding the contribution of RAS to the Army’s intent to fight by recce-strike at all levels.
Ultimately, the aim of the programme is to enable early experimentation in the virtual domain and allow for more effective multi-domain integration through the evolution and extension of existing open architectures and research in the combination of crewed and uncrewed systems. This will reduce the risks, costs and timescales associated with the introduction of new systems and concepts into the armed forces through embracing spiral development. For this project, the facility will incorporate Thales’ DigitalCrew and other AI enablers to better understand system effectiveness of such platforms and the benefits that they provide through a reduction of cognitive burden on the operator.
Catalyst has deep expertise in electronic architecture, synthetic environment modelling, simulation and experimentation. This expertise has been used to create a synthetic environment and digital twins of all physical platforms. DCE specialise in open architectures, developing technologies for robotic and autonomous systems, and is extending its Marionette control system for command and control (C2) of the project’s uncrewed ground vehicles. Thales, Catalyst and DCE are working to develop a system designed to include various crewed and uncrewed vehicles for multi-domain experimentation and testing.
Land RAS EDT consists of a physical mobile crewed platform, running a generic vehicle architecture (GVA) equipped with in service and next generation Thales optronics sensors. Through the use of mission planning software, the mobile crewed platform (or any accredited user on the network) can control and view the movement of the uncrewed, autonomous vehicles. All systems and vehicles have a “digital twin” in the virtual world. Thales and partners’ open architecture experience will allow Land RAS EDT to inform both new and existing programmes, improving efficiencies for defence procurement and, subsequently, reducing the cost and time of physical trials. Furthermore, Thales offers a platform, sensor, and software agnostic approach to integration, boosting the cost efficiencies associated with the research programme and final experimentation system.
“Robotic and Autonomous Systems are transforming warfare, but are rapidly evolving. The open and modular architectures developed in this project should better enable the Army to rapidly adapt and integrate emerging RAS technologies with in service platforms such as Ajax at the pace of relevance. This, together with the use of digital twin environments, should provide a critical enabler to reduce risks, costs and timescales associated with integration and spiral development of RAS capability into the force.” – Guy Powell, Principal Advisor – Land Autonomy, Dstl
The world of uncrewed vehicles is rapidly evolving with many systems moving away from traditional, crewed fleets. Land RAS EDT enables the customer and end users to build on the vast open architecture experience of Thales and its partners, Catalyst and DCE, to extend exploration into autonomous systems and robotics. By incorporating artificial intelligence and Thales’ DigitalCrew, Land RAS EDT reduces the burden on key decision makers on the battlefield, leading the way in bridging the gap between crewed and uncrewed systems. Thales’ DigitalCrew will be deployed on UGVs, UAVs and command vehicles to autonomously detect and classify objects of interest. This information will be shared with the wider network to create a Common Operating Picture (COP).
“In recent times, the growing significance of autonomy and artificial intelligence has become increasingly apparent, reshaping the landscape of security strategies worldwide. This important research partnership between Dstl, Thales and multiple SMEs will advance the UKs understanding of Digital Twins and open architectures and explore how crewed, optionally crewed and uncrewed systems can co-exist in complex, multi-domain architectures.” Stephen McCann, Managing Director, Thales in the UK.
28 Aug 24. CRFS, a leading innovator in radio frequency (RF) technology, won the Army Technology Excellence Awards 2024. The award celebrates groundbreaking achievements and innovations in the defense industry, recognizing companies that have made significant technological advancements and set new standards.
CRFS won the award thanks to the innovative design and exceptional RF performance of its RFeye Node 100-18 LW sensor: a breakthrough in UAV sensing technology.
A NATO member requested that CRFS design this product to enable effective signal management and signals intelligence operations in a conflict zone. The end user already used the TRL-9 RFeye Node 100-18, which delivers transformative capability through its advanced RF performance. However, this sensor was not designed with smaller unmanned system integration in mind, so CRFS rapidly designed the same capability into a much-reduced form factor with no loss of performance.
“On receiving this urgent requirement, our engineering team worked hard to develop a sensor that not only meets the rigorous demands of our military customer but also excels in the harshest environmental conditions. The company’s ability to quickly deliver this hugely valuable tool for modern military forces in record time is very impressive,” said Matt Hunt, VP of Global Sales.
The RFeye Node 100-18 LW’s low Size, Weight, and Power (SWaP) enhances UAV mission endurance, enabling extended electronic warfare and ISR missions. It contains an upgraded GNSS chipset supporting multiple bands to help maintain operational effectiveness in GNSS-disrupted environments. Also, its advanced RF performance means it can monitor a wide range of signal types, including low-power, low probability of intercept (LPI), and low probability of detection (LD) signals.
One key design feature, particularly important for unmanned systems with limited bandwidth at range, is the sensor’s in-built edge processing, which reduces the burden of backhauling data, allowing it to deliver clear and accurate RF data for spectrum intelligence.
“The fact that the RFeye Node 100-18 LW weighs less than 2kg, along with its superior phase noise, channel re-tune time, noise figure, and spurious-free dynamic range, underscores its advanced design and engineering. Although it’s an ideal solution for small to large UAV platforms, the sensor can be integrated into any unmanned platform—a UGV or a USV,” said Tina Ross, Global Awards Manager.
CRFS’ achievement in winning the Innovation Award at the 2024 Army Technology Excellence Awards demonstrates the company’s commitment to pushing the boundaries of RF technology and delivering cutting-edge solutions that meet the evolving needs of NATO members.
17 Sept 24. Mattermost extends Microsoft Teams and Microsoft 365 platform to accelerate mission-critical workflows in defense, government, and vital services.
The generally available Mattermost for Microsoft Teams integration empowers critical infrastructure organizations to integrate people, processes, and technology across the organization, accelerating operational efficiency and bolstering cyber resilience.
Mattermost, the leading secure, self-hosted collaboration platform for critical infrastructure, today announced the availability of Mattermost for Microsoft Teams, a flexible interoperability framework to flow information and communications across enterprise-wide Microsoft 365 users and technical and operational organizations in Mattermost.
For national security, public safety, and critical infrastructure organizations, Mattermost supplements “Enterprise IT” systems such as Microsoft Teams with “Mission IT” workflows vital to cyber resilience, including out-of-band incident response, ChatOps in segregated networks, Red Team and penetration testing workflows, and emergency communications.
Microsoft Teams and the entire Microsoft 365 suite are essential tools for communication and collaboration for many enterprise organizations. However, technical operators need integrated tool chains to surface mission-critical information, solve problems, and protect their digital landscape. Without access to these tools, data can leak into insecure channels, and workflows become impossible to standardize.
With Mattermost and Teams, technical operators gain access to webhooks, slash commands, custom plugins, and workflow orchestration — all without being disconnected from the broader organization. Users log in where they do their best work, but can still communicate with each other.
The benefits of implementing Mattermost for Microsoft Teams include:
- Maximize your Microsoft investment for technical and operating teams: Combine Mattermost’s out-of-band incident response, emergency communications, and security operation workflows with Microsoft Teams’ collaboration tools to maintain enterprise-wide communication, while securely flowing messages from Teams into Mattermost, optimizing overall collaboration efficiency.
- Accelerate situation awareness in mission-critical environments: Ensure critical information flows seamlessly when you configure integration between Microsoft Teams and Mattermost, enabling faster response times and improved decision-making in mission-critical environments.
- Interoperate while meeting advanced and custom security and compliance needs for critical infrastructure: Enable mission-critical environments in Mattermost to securely ingest and transform data from external sources through continuous monitoring, filtering, and alerting.
Mattermost for Microsoft Teams is available now as part of the latest Mattermost platform release, which includes additional investments in the platform’s scalability, reliability, and security for mission-critical work. These enhancements include the introduction of a reliability dashboard, metrics plugin, health check plugin, and improved load testing tools that allow Mattermost customers to scale their environments with up to 100,000 active users.
“This latest iteration of Mattermost represents the next stage in our commitment to building a scalable, resilient collaboration platform for the teams that manage the world’s most essential infrastructure, says Chen Lim, VP of Product at Mattermost, “By enabling Mattermost customers to scale their workspace, connect to business-critical tools like Microsoft Teams, and improve their own visibility into the health and security of their Mattermost environments, we’re helping them achieve more effective workflows now and in the future.”
The Mattermost team continues to develop and extend cross-platform interoperability with feedback from the Mattermost user community. Existing Mattermost customers can contact their account teams to request to join the joint-development program for this new framework.
To learn more about the latest version of Mattermost for Microsoft Teams, please visit mattermost.com/solutions/mattermost-for-microsoft-teams/
About Mattermost
Mattermost is the leading collaboration platform for mission-critical work. We serve national security, government, and critical infrastructure enterprises, from the U.S. Department of Defense, to global tech giants, to utilities, banks, and other vital services. We accelerate out-of-band incident response, DevSecOps workflow, mission operations, and self-sovereign collaboration to bolster the focus, adaptability, and resilience of the world’s most important organizations.
Our enterprise software and single-tenant SaaS platforms are built to meet the custom needs of rigorous and complex environments while offering a secure and unrivaled collaboration experience across web, desktop, and mobile with channel-based messaging, file sharing, audio calling and screen share, with integrated tooling, workflow automation and AI assistance.
Mattermost is developed on an open core platform vetted by the world’s leading security organizations, and co-built with over 4,000 open source project contributors who’ve provided over 30,000 code improvements towards our shared vision of accelerating the world’s mission-critical work. For more information visit mattermost.com.
16 Sept 24. USAF clears Viper EW suite for live flight tests. US Air Force (USAF) programme leaders have given the green light to begin live flight tests of Northrop Grumman’s AN/ALQ-257 Integrated Viper Electronic Warfare Suite (IVEWS), after the system cleared service-led pre-flight system testing and integration efforts.
The pre-flight test and integration process, conducted at the air service’s Joint Preflight Integration of Munitions and Electronic Sensors (J-PRIMES) facility at Eglin Air Force Base in Florida, consisted of the IVEWS being “subjected to accurate representations of complex radio frequency (RF) spectrum threats”, according to USAF programme officials.
The system’s completion of the pre-flight evaluation and system integration process at J-PRIMES was “the culmination of three years of extensive US government IVEWS system-level testing”, said USAF Colonel Michael Rigoni, director of F-16 International Electronic Warfare Systems.
“I am optimistic the upcoming operational assessment flight-test events will yield positive results and look forward to seeing this important capability continue to mature,” Col Rigoni said in an August service statement.
First operational flights of IVEWS-equipped F-16s had been slated for the end of the first quarter of fiscal year (FY) 2024. Despite the recent completion of the J-PRIMES process, it remains unclear when those live flight tests will take place.
Prior to the J-PRIMES process, the IVEWS underwent system evaluation during several Integration Demonstrations and Applications Lab (IDAL) events culminating in Laboratory Intelligent Validated Emulator (LIVE) closed-loop testing at Hill Air Force Base at the end of 2023. The system also underwent initial live flight tests aboard a F-16 surrogate aircraft during the air service’s ‘Northern Lightening’ military exercise in 2021, according to the USAF statement. (Source: Janes)
16 Sept 24. Kromek’s D5 RIID selected by the UK Ministry of Defence. Kromek, the designer and manufacturer of radiological and biological detectors, based in Sedgefield, Co. Durham, has won a £2m contract from the UK Ministry of Defence (MOD) for its D5 RIID and associated accessories.
The D5 RIID is a small, light, wearable Radioisotope Identification Device (RIID) with an expansive radioisotope library, an ultra low false alarm rate and a networked capability to allow for reachback to a command centre. It can be hand-held, body-worn or mounted on an uncrewed platform and remotely operated, and has exceptional endurance.
The UK MOD contract also includes the external Alpha Beta probe, which attaches to the D5 RIID and allows the device to also detect Alpha and Beta radiation. This makes the D5 RIID the most versatile detector of its size.
The D5 RIID combines small form factor with powerful radiometric performance and enhanced sensitivity at a medium resolution of less than 4% for accurate adjudication. Fast to start and identifies within seconds, the high sensitivity of the device means that any source, even very low activity sources, can be accurately detected, with very low false alarm rates. You will have data you can rely on to make those important decisions.
Commenting on the win, Craig Duff, Kromek’s Commercial Director (Nuclear), said “This major order from the UK MoD is a national endorsement of the groundbreaking capability of the D5 RIID. Coming so soon after the recent DIMS [Detection, Identification and Monitoring Equipment Uplift] contract award on the UK’s National Resilience Framework from Merseyside Fire and Rescue Services, this reflects a growing confidence in the capability of Kromek’s suite of radiation detection products.”
Arnab Basu, CEO of Kromek, said: “We are delighted to have won this important contract from the UK MOD, which is a significant strategic customer for Kromek. That it was awarded after a rigorous tender process provides excellent endorsement of the strength of our solution. It is also great validation to receive this key order for our Alpha Beta probe so soon after its launch at the end of last year. With the Alpha Beta probe upgrade, our D5 RIID is one of the most versatile handheld radiation detectors available today. We are looking forward to delivering this contract and supporting UK national defence efforts and to continuing to strengthen our relationship with this important customer.”
Kromek will be displaying the D5 RIID alongside its other hand-held and static radiation detectors at the Emergency Services Show at the NEC in Birmingham on 18-19 September (Stand H154) and also at the International Security Expo at London Olympia on 24-25 September (Counter Threat Pavilion).
13 Sept 24. Cyber Update Key points.
- A cyber operation targeting Taiwan’s military sector points to the elevated espionage risks stemming from a new Chinese-speaking group, ‘TIDRONE’ (see Sibylline Cyber Daily Analytical Update – 9 September 2024 and our Technical analysis below).
- A new remote access trojan (RAT) is targeting the Colombian financial sector, underscoring the increased financial risks stemming from the cyber criminal group ‘BlindEagle’ (see Sibylline Cyber Daily Analytical Update – 10 September 2024).
- The exploitation of vulnerable network edge devices highlights the elevated security risks stemming from the ‘Quad7’ botnet (see Sibylline Cyber Daily Analytical Update – 11 September 2024 and our Technical analysis below).
- A new cyber operation manipulating search engine results will elevate the financial and reputational risks from Chinese cyber criminal groups (see Sibylline Cyber Daily Analytical Update – 12 September 2024).
- The continuation of phishing operations targeting software developers will sustain elevated espionage risks stemming from the North Korean state-sponsored group ‘Lazarus.’
Technical analysis of weekly stories
A new Chinese-speaking group (TIDRONE) is targeting military-related industries in Taiwan in an ongoing cyber espionage operation. Although TIDRONE started targeting Taiwanese organisations in March, it is suspected that the group likely infiltrated targeted organisations via the software supply chain at an earlier stage. TIDRONE typically uses enterprise resource planning (ERP) systems and remote desktop software to deploy malware (including ‘CXCLNT’ and ‘CLNTEND’) on compromised systems. This enables the group to collect sensitive information, escalate privileges and evade security mechanisms. Notably, the infected organisations use the same ERP vendor, suggesting that TIDRONE has possibly infiltrated victims via supply chain attacks. The group has used several versions of malware loaders throughout this operation, with the latest variant merging two payloads into a single encrypted payload. This highlights the rapid evolution of TIDRONE’s tactics, techniques and procedures (TTPs), as well as its sophistication (due to the new loader’s anti-detection capabilities). The payload code enables CXCLNT and CLNTEND to be deployed in various file formats, further pointing to the actor’s sophistication and adaptability. Additionally, the payloads are stored in the system’s memory as an additional detection evasion mechanism.
The Quad7 botnet is exploiting software vulnerabilities to obtain access to global network edge devices in an ongoing cyber operation. The botnet comprises five device clusters, and includes compromised internet-facing ports for multiple small office/home office (SOHO) devices, virtual private network (VPN) appliances and wireless routers. Although the full scope of this campaign is unclear at present, actors are exploiting Quad7 to conduct brute force attacks on Microsoft365 accounts, as well as internet-exposed services such as VPNs, telnet and secure shell (SSH) protocols. Notably, Quad7 adopted the KCP protocol to communicate with actor-controlled infrastructure to achieve better latency and stealth due to the protocol’s encryption mechanisms. This is indicative of the adaptability of Quad7’s TTPs, as well as its gravitation towards more sophisticated tools. Additionally, the threat actors used a new backdoor (‘UPDTAE’) to control infected devices remotely while avoiding detection from internet scans. We assess there is a realistic possibility that Quad7 is currently in a testing phase due to the increasing number of infected devices in each cluster and the threat actors’ use of new TTPs.
Some non-exhaustive recommendations to mitigate against these threats include:
- Monitor devices and networks for suspicious activity.
- Add available Indicators-of-Compromise (IoCs) to your organisation’s security detection systems to detect potentially malicious samples on the network.
- Adopt behaviour-based end-point detection and response (EDR) solutions, prioritising the detection of the initial stages of a compromise.
- Ensure adequate security monitoring and detection capabilities, particularly for all external-facing services, devices and ports.
- Conduct cyber hygiene awareness courses for users, enabling them to recognise and report phishing and other types of social engineering.
- Employ complex passwords for edge devices and staff accounts to mitigate against brute force and other password-focused cyber attacks.
Our cyber word(s) of the week: Brute force attack. (Source: Sibylline)
13 Sep 24. Global: Phishing operations will sustain espionage risks from North Korean state-sponsored groups. On 10 September, the software company ReversingLabs disclosed that the North Korean state-sponsored group ‘Lazarus’ is targeting software developers in an ongoing cyber campaign. Lazarus sends phishing messages to potential victims on the platform LinkedIn, impersonating staff from a financial institution. The actors then trick victims into clicking on a malicious link purporting to be a coding skills test for a job interview. Notably, the actors create urgency to ensure that the malware is executed by stating that the test can only be completed within a limited timeframe. Malicious code subsequently deploys various backdoor and information-stealing malware, likely to collect sensitive data and maintain prolonged presence on compromised systems. This operation is likely a continuation of a previous Lazarus campaign which has targeted software developers since August 2023. We assess that this campaign sustains espionage risks for global developers. (Source: Sibylline)
13 Sept 24. DOD Hosts International Exchange on Shaping Cybersecurity Workforce.
A senior Defense Department official hosted government officials, academics and entrepreneurs from Indonesia for a discussion on how the Pentagon is aligning its cyber workforce strategy to meet the demands of a rapidly evolving domain.
Patrick Johnson, director of the DOD Chief Information Officer’s Workforce Innovation Directorate, provided an in-depth overview of the Pentagon’s cyber workforce framework and vision for recruiting and retaining top talent to meet the demands of the future.
The exchange was held as part of the State Department’s International Visitor Leadership Program, or IVLP, which aims to develop lasting relationships between emerging foreign leaders and their counterparts in the United States. Next week, representatives from DOD CIO will host a group from Japan who are in the U.S. to discuss ways to enhance cybersecurity in Japan.
“In the cyber arena, the human being is the weapon system,” Johnson said, underscoring the critical importance of securing the global networks that permeate daily life in both the public and private sectors.
He said the nation’s defenders must increasingly account for both the kinetic and nonkinetic effects that shape the modern battlefield. He noted, for example, that a nefarious cyber actor could single-handedly take down the world’s most advanced fighter aircraft without firing a single shot.
In 2023, DOD published its strategy to align the department’s efforts to identify, recruit, develop and retain a data-literate and technology-adept cyber workforce to ensure the U.S. maintains its warfighting edge.
The department has also laid out its framework to shape the cyber workforce through personnel qualification, academic outreach and professional development; and it has implemented the Cyber Excepted Service, which taps into enhanced recruitment and retention authorities.
But the challenges presented by the rapidly changing cyber domain are not unique to DOD, as this week’s discussion highlighted.
The exchange provided an opportunity for the participants to discuss shared challenges that span the public and private sectors in both the U.S. and Indonesia.
The participants discussed common bureaucratic hurdles in in both countries that challenge public sector recruiters, who often battle lengthy hiring processes and higher salaries offered by private employers.
They also discussed the changing metrics used to gauge candidate qualifications for cyber jobs.
Al Akbar Rahmadillah, founder of Sobat Cyber Indonesia, highlighted the imperative to tap into practical qualifications gained through informal, hands-on training.
That sentiment is not unique to Indonesia’s private sector. Johnson said DOD is increasingly looking to leverage performance-based qualifications, rather than formal education.
Participants also mentioned the impact of competition stemming from Indonesia’s large population of young professionals has on recruiting cyber talent.
That back-and-forth exchange is precisely the level of dialogue the IVLP is designed to foster.
Since 1940, the IVLP has hosted more than 225,000 participants for exchanges focused on topics ranging from young people and women’s leadership to promoting cybersecurity and combatting transnational crime.
Alfian Linux, chief executive officer of Xtend Indonesia, a private sector technology firm, said his experience participating has been invaluable.
“Everyone knows that the giant companies and the technology before has come from the United States.,” he said, adding that he hopes the IVLP discussions will open doors for Indonesian firms to work effectively alongside U.S. firms.
But Johnson, who has hosted an IVLP cohort from Iraq as part of the program, said the U.S. also benefits immensely from the exchange.
“In the cyber domain, the talent shortage is global,” he said, adding that every country has information technology infrastructure that must be defended.
Johnson said it is incumbent on countries to learn from one another to overcome pressing challenges.
“I think we need to take it seriously take that opportunity to talk to smart people from outside our own little sphere,” he said. “The world has a lot to offer.” (Source: U.S. DoD)
13 Sept 24. Land Forces 2024: L3Harris to establish Australian radio support facility. L3Harris Technologies is set to open its first regional support centre (RSC) outside the United States as it gears up to provide maintenance, repair, and overhaul (MRO) services for tactical communication devices in operation by Australian, international, and US forces across the Indo-Pacific.
Speaking to Janes on 12 September at the Land Forces 2024 exhibition in Melbourne, Australia, company executives confirmed the RSC will be located at the company’s existing Integration and Sustainment Centre at Pinkenba near Brisbane airport in the first quarter of 2025.
Initially, the RSC will support Australian and New Zealand defence forces, negating any requirement to ship unserviceable radios back to L3Harris’s facility in Rochester, New York, where MRO traditionally takes place.
Instead, radios will be shipped directly to the Brisbane facility for repair, reducing the amount of time it takes to fix and return a radio from six months to just one month, the company said.
According to L3Harris Australia’s managing director Andrew Rushbrook, the company is also looking to expand the RSC’s remit to include MRO of L3Harris radios used by international customers across the wider Indo-Pacific region. These include Japan, Mongolia, the Philippines, and Taiwan, he said.
A third phase will also see the RSC providing MRO services for US forces deployed across the Indo-Pacific. In August L3Harris conducted a ‘fly-in/fly-out proof of principle’ with the US Marine Corps (USMC) to repair four of the USMC AN/PRC-117G manpack radios.
The Marine Rotational Force-Darwin at Robertson Barracks, Northern Territory, took part in the proof of principle to confirm “advantages of in-region equipment repairs”, according to the USMC. (Source: Janes)
————————————————————————————————————————
Spectra Group (UK) Ltd
Spectra Group (UK) Ltd, internationally renowned award-winning information security and communications specialist with a proven record of accomplishment.
Spectra is a dynamic, agile and security-accredited organisation that offers secure Hosted and Managed Solutions and Cyber Advisory Services with a track record of delivering on time, to spec and on budget.
With over 15 years of experience in delivering solutions for governments around the globe, elite militaries and private enterprises of all sizes, Spectra’s platinum and gold-level partnerships with third-party vendors ensure the supply of best value leading-edge technology.
Spectra was awarded the prestigious Queen’s Award for Enterprise (Innovation) in 2019 for SlingShot.
In November 2017, Spectra Group (UK) Ltd announced its listing as a Top 100 Government SME Supplier by the UK Crown Commercial Services.
Spectra’s CEO, Simon Davies, was awarded 2017 Businessman of the Year by Battlespace magazine.
Founded in 2002, the Company is based in Hereford, UK and holds ISO 9001:2015, ISO 27001:2013 and Cyber Essentials Plus accreditation.
————————————————————————————————————————-