20 Mar 25. Spectra Group train Armed Forces of the Philippines (AFP) to use Troposcatter MTTS. Spectra Group (UK) Ltd, a specialist provider of secure voice, data and satellite communications systems, has been supporting the Armed Forces of the Philippines (AFP) to enhance their strategic communications expertise, particularly by maximising the capabilities and hence benefits of using Comtech’s Troposcatter Modular Transportable Transmission System (MTTS). Spectra Group acquired the global distribution rights for Comtech’s Troposcatter Family of Systems (less USA, Canada and Mexico which is retained by Comtech) in 2024 and late last year Spectra Group also announced opening their Australia office to better support the Asia region. Tropospheric scatter is a communications capability that uses the Troposphere (up to about 13km altitude) to provide high bandwidth communications. It is satellite independent and works in a GPS/GNSS denied environment, so is suitable for use in a Peer-on-Peer conflict/Multi Domain Integration. Troposcatter inherently has very low latency and can provide huge bandwidth, potentially enabling analysis and manipulation of large data, which combined with its low operating cost makes it suitable for strategic down to tactical headquarters. Troposcatter MTTS is the most flexible, rapidly deployable, modular transit case troposcatter system available for when the operational situation demands high power, typically 500W. Key benefits for the AFP include rapid deployability, exceptional mobility and robust performance in challenging environments, enabling critical voice, data, and video communications in situations where traditional infrastructure is unavailable. Throughout March, Spectra Group has been providing a comprehensive familiarisation and training package to the AFP to ensure that they are not only able to unlock the full capability of their MTTS Troposcatter systems but also embed indigenous knowledge and expertise to maintain the capability for the future.
Shaun Barry, Business Development Manager at Spectra Group said: “We have been working hard over the last couple of years to develop opportunities in the Asia region and this training programme is a good example where we are directly supporting our customers to not only get the best from their equipment now but also sustain that capability into the future. The region is extremely geographically complex which presents multiple strategic communication challenges for security forces and Spectra Group has have a number of superb systems including Troposcatter, SlingShot and soon GENSS that provide the perfect solution to these challenges.”
19 Mar 25. Thales reveals new vehicular version of SquadNet radio. Thales UK has released a vehicular version of its SquadNet dismounted soldier radio called the Vehicle Mounted SquadNet Radio (VMSR), for which it has an unspecified NATO member launch customer.
Speaking at the product launch on 12 March at SAE Media’s Future Soldier Technology Conference in London, Ciaran McCloskey, product line manager, tactical products for Thales UK, said that the radio provides seamless integration of secure voice and data between dismounted troops and the vehicle platform. Like the handheld (HH) version of the radio, which measures 20×10×6 cm and weighs 250 g, the VMSR operates in the 431–470 MHz and 865–880 MHz frequency bands and has an output power of 250 mW. A mobile ad hoc network (MANET) radio, it utilises a standard waveform with automatic 3-hop networking, providing simultaneous voice and data services. It also runs the same waveforms as the HH SquadNet including low probability of detection, anti-jam frequency hopping, multipole voice mode (four simultaneous voice nets), full duplex, and dual voice net. McCloskey said that the VMSR form factor has been specifically designed to enable fitting in as wide a range of vehicles as possible, both traditional military platforms and commercial vehicles. It can be dashboard, bulkhead, or seatback mounted. (Source: Janes)
19 Mar 25. Ulefone Armor 28 Ultra Series Unveiled with Dimensity 9300+, Pioneering AI Thermal Imaging.
Ulefone launched the performance powerhouse Armor 28 Ultra Series. Dimensity 9300+ global debut, 16GB+ 1TB massive storage. its Thermal Version features next-gen AI-powered thermal imaging.
Ulefone celebrates its 10th anniversary with the launch of the Armor 28 Ultra series, a lineup of rugged smartphones designed to deliver unparalleled performance and innovation. The series includes the standard
Armor 28 Ultra and the exclusive Armor 28 Ultra Thermal Version, which introduces next-generation AIpowered thermal imaging capabilities. Both models are powered by the groundbreaking Dimensity 9300+ chipset, feature AMOLED dual-screen technology, a Sony IMX989 1-inch main camera, 1TB storage, and Wi-Fi 7 support. With an Antutu score exceeding 2.3 m, these devices set a new benchmark for rugged smartphones.
Exclusive Next-Gen Thermal Imaging in Armor 28 Ultra Thermal Version
The Armor 28 Ultra Thermal Version offers professional-grade thermal imaging empowered by AI. It features a next-gen ThermoVue T2 thermal sensor, enhanced by SharpenAI and FusionAI technologies, which reduce image processing time by 50%. With an ultra-high thermal sensitivity of <40mk and a professionalgrade accuracy of ±2%, the device achieves a super thermal resolution of 640 x 512, delivering exceptional image quality and detail. The ThermoVue Pro app introduces new image modes and features. This makes the Thermal Version ideal for professionals in fields such as construction, engineering, and emergency response.
18 Mar 25. ALQ-167 Angry Kitten electronic warfare pod in testing on C-130s. The US Air National Guard Air Force Reserve Command Test Center (AATC) is testing the ALQ-167 Angry Kitten electronic warfare (EW) pod aboard Lockheed Martin C-130 Hercules transport aircraft, the centre announced on 12 March. Angry Kitten has completed testing aboard the F-16, its primary platform. The pod was developed by the Georgia Tech Research Institute as a simulated threat emitter pod, such that F-16s with Angry Kitten aboard could simulate potential enemy systems without modifications to their internal systems. Angry Kitten’s software proved easy to update, leading the US Air Force to modify it for use as a combat-capable jamming pod.
“We had minimal hopes for what we could do for larger body aircraft, but it’s showing that we actually have good effects,” Chris Culver, an EW engineer attached to the project, said in the announcement.
Testing aboard the C-130 involved real-time updates, such that operators onboard the aircraft could hone jamming techniques during flight; tests aboard the F-16 entailed such modifications on the ground following flights, the announcement noted. The Angry Kitten pod was mounted to an AS-7 Special Airborne Mission Installation & Response (SABIR) retractable arm attached to the C-130’s left paratrooper door, which was lowered below the aircraft for operation.
“They are making changes real time to the techniques and pushing updates to the pod, seeing the change in real time,” Culver said. (Source: Janes)
18 Mar 25. Smiths Detection, a global leader in threat detection and security Screening, has signed an agreement with Deepnoid, a Korean specialised AI software company led by CEO Choi Woo-Sik, to test AI integration within its security screening systems. Deepnoid’s AI technology will undergo rigorous testing with Smiths Detection’s HI-SCAN 6040-2is carry-on baggage X-ray scanner, with future trials exploring its potential in Computed Tomography (CT) screening to increase detection speed, precision and efficiency.
This collaboration supports Smiths Detection’s responsible open architecture, ensuring third-party AI solutions work seamlessly within its technology while maintaining the highest security standards. It is part of the Ada Initiative, Smiths Detection’s structured process for onboarding suppliers to ensure their hardware, software, and algorithms integrate flawlessly. By introducing AI-driven tools, this partnership strengthens threat detection while keeping security infrastructure adaptable to future risks.
Cymoril Metivier, Global Digital Portfolio Director, Smiths Detection, commented: “We are excited to collaborate with Deepnoid as we explore new advancements in security screening. Advancing threat detection has been a key focus for Smiths Detection for years, with our iCMORE AI-driven algorithm suite using advanced object recognition to accurately detect prohibited items, weapons, lithium batteries and other dangerous goods. Driving responsible open architecture strengthens these capabilities, enabling greater flexibility to integrate new technologies. This partnership reinforces our commitment to high-performance security solutions that stay ahead of evolving threats.”
Sunghoon Eom, Country Manager – Korea, Smiths Detection Asia-Pacific Pte Ltd, commented: “We are honoured to partner with Deepnoid to advance AI-driven security screening solutions. This collaboration strengthens our regional ties and enables us to better respond to the specific AI demands of the local market. By combining expertise, we can deliver more sophisticated and effective security solutions, benefiting both Korea and the wider global market.”
Jae-Ik Cho, Executive Vice President, Deepnoid, stated: “This collaboration is a significant milestone for Deepnoid as we aim to become a game-changer in the security AI market. We will leverage our partnership with Smiths Detection to position ourselves as a leading provider of innovative AI technology in the global security screening industry.”
Deepnoid continues to expand its global footprint, developing AI solutions for healthcare and security. This partnership accelerates AI-powered security screening, ensuring faster, smarter, and more precise threat detection.
By ensuring seamless interoperability between cutting-edge hardware, software, and AI-driven solutions, Smiths Detection continues to set the standard in global threat detection, safeguarding people and critical infrastructure worldwide.
Through our open architecture approach, we create tailored third-party integrations, and with iCMORE, our in-house engineered suite of AI-driven threat detection solutions, we redefine security operations. Seamlessly integrated with our X-ray screening systems, iCMORE enhances detection accuracy for prohibited items, currency, weapons, lithium batteries, and other dangerous goods. By reducing operator workload, streamlining workflows, and cutting false alarms, it empowers security teams to make faster, more confident decisions. Designed to scale and evolve, iCMORE ensures that security operations stay ahead of emerging threats.
14 Mar 25. EDA Conducts 1st CBRN Live Agent Training. The European Defence Agency (EDA) has conducted its first-ever chemical, biological, radiological, and nuclear (CBRN) live agent training for specialised defence units.
Hosted at the CBRN Test and Training Centre in Zemianske Kostolany, Slovakia, the training took place from 2 to 7 March 2025, with participants from eight EU Member States facing scenarios on qualified and forensic CBRN sampling.
As part of efforts to increase the safety of European armed forces and the wider population, EDA is also committed to strengthening CBRN defence through advanced threat detection projects, such as the ‘Chemical, Biological, Radiological, Nuclear Surveillance as a Service’ (CBRN SaaS).
The training in Slovakia was not a simulation. Real radioactive materials, such as Caesium-137, and highly toxic chemical warfare agents, including VX and Sarin, were used in accordance with the highest safety standards. Every step and every procedure had to be executed in full CBRN protective gear. This hands-on experience strengthened specialists’ ability to detect, contain, and neutralise threats.
An eight-member evaluation team, comprising experienced CBRN defence personnel from five Member States and led by EDA, assessed the course in real time, enabling the immediate identification of lessons learned for future projects.
Bridging civil-military gaps
Training defence specialists under real CBRN conditions also helps bridge gaps between civilian and military sectors. In a crisis, coordination is key, and expertise and resources must be deployed without delay. Strengthening Europe’s preparedness contributes to a faster, more effective response framework that protects both soldiers and civilians. “A soldier’s gear isn’t always a rifle. Sometimes, it’s a gas mask, gloves, and a protective suit,” said EDA Project Officer for CBRN Friedrich Aflenzer.
EDA’s broader role
Founded in 2004, the Agency helps foster defence cooperation across Europe. It serves as the central hub for EU countries aiming to develop their defence capabilities together. EDA’s activities span from harmonising requirements and developing operational capabilities to research, technology, innovation, training, and supporting Common Security and Defence Policy operations. The agency also works closely with the European defence industry to strengthen Europe’s technological and industrial base. (Source: ASD Network)
14 Mar 14. Cyber Update Key points.
* The adoption of the ‘Qilin’ Ransomware-as-a-Service (RaaS) by the North Korean state-sponsored actor ‘Moonstone Sleet’ will sustain elevated financial risks for global organisations (see Sibylline Cyber Daily Analytical Update – 10 March 2025).
* A stealthy operation has elevated the cyber espionage risks stemming from the suspected Indian advanced persistent threat (APT) group ‘SideWinder’ for the global maritime, logistics and nuclear sectors (see Sibylline Cyber Daily Analytical Update – 11 March 2025 and our Technical analysis below).
* A cryptocurrency-theft operation by the North Korean state-sponsored group ‘Lazarus’ will sustain long-term financial risks for global entities (see Sibylline Cyber Daily Analytical Update – 12 March 2025 and our Technical analysis below).
* A breach at an electricity utility company in Massachusetts (US) highlights the long-term security risks facing CNI sectors stemming from the Chinese state-sponsored group ‘Volt Typhoon.’
* US critical national infrastructure (CNI) will face heightened financial and disruption risks stemming from the RaaS group ‘Medusa.’
Technical analysis of weekly stories
The suspected Indian advanced persistent threat (APT) group SideWinder has targeted the maritime, logistics and nuclear sectors across Africa, Asia and Europe in cyber espionage operations since H2 2024. The group uses spear phishing emails to trick potential victims into opening a malicious .DOCX attachment. The emails purport to provide information on governmental decisions and/or diplomatic issues pertaining to nuclear power plants, maritime infrastructure and port authorities to enhance legitimacy and bolster infection rates. The attachment downloads an additional file containing malicious JavaScript code using a remote template injection technique; it then exploits a known software vulnerability (CVE-2017-11882) to execute the code, initiating a multi-stage malware execution process. The JavaScript loads a downloader module to collect information on installed security protections, highlighting SideWinder’s detection-evasion capabilities. If no security mechanisms are detected, the group deploys a first-stage malware loader (‘Backdoor Loader’) that subsequently installs information-stealing malware (‘StealerBot’) to exfiltrate sensitive information from compromised systems. If SideWinder’s tools are discovered on an infected system, the group will deploy modified versions of the malware within hours; this highlights the persistence and sophistication of SideWinder’s techniques.
The North Korean state-sponsored group Lazarus is exploiting a legitimate open-source software repository to conduct a cryptocurrency-theft operation. The group advertises malicious software packages on the repository, using typo-squatting techniques to enable the files to appear legitimate; this tricks developers into downloading the malicious packages, allowing Lazarus to infiltrate targeted systems. The group uses several techniques to obfuscate the malicious code contained in the packages, showcasing the group’s detection-evasion capabilities. The code collects sensitive information from compromised systems (including login credentials) and exfiltrates cryptocurrency assets, before transferring stolen data to command-and-control (C2) infrastructure. It also deploys a backdoor (‘InvisibleFerret’) and additional malware (‘BeaverTail’) to achieve prolonged persistence on compromised systems and to execute additional commands remotely. Additionally, the group has created GitHub pages for several of the malicious packages to feign legitimacy, underscoring Lazarus’ continued exploitation of legitimate platforms in malicious operations.
Non-exhaustive recommendations to mitigate against these threats include:
* Monitor devices and networks for suspicious activity
* Add available Indicators-of-Compromise (IoCs) to your organisation’s security detection systems to detect potentially malicious samples on the network; configure firewalls to block outbound communications to malicious IP addresses associated with any known malware
* Adopt behaviour-based end-point detection and response (EDR) solutions, prioritising the detection of the initial stages of a compromise
* Conduct cyber hygiene awareness courses for users, enabling them to recognise and report phishing and other types of social engineering
Our cyber word(s) of the week: Remote template injection technique
(Source: Sibylline)