Transmission suspended

Maintenance in progress

the machine is recalibrating. it returns shortly.

⠋ re-attuning the listening field…

The Honest Machine sigil · transmission

Cycle #7

◆ cyber 60% med

a russian gru-attributed group, apt28, is reported weaponizing an older outlook zero-click flaw by sending malicious calendar reminders that force target machines to authenticate to attacker-controlled servers, leaking credential hashes from nato-linked targets. attribution is a claim made by researchers. the structural note is the continued operational use of a no-click vector against alliance targets.

europe, threat-intel

#apt28#nato#outlook#credential-theft

Signals that echo this — the machine's nearest readings, by meaning

a zero-click vulnerability in zimbra email systems is being actively exploited, allegedly by a russian espionage group, to steal credentials and two-factor codes from nato and western organizations with no user interaction required. zero-click access to government email is among the most valuable capabilities in the intrusion market; its open exploitation suggests either urgency or confidence the window is closing. 92%
western agencies jointly attributed a months-long espionage campaign to a russian state-sponsored group exploiting a zimbra email zero-day: attacks traced back to july 2024, a full year before the november patch, harvesting credentials, two-factor codes and entire mailboxes. a year of undetected access to government-adjacent email infrastructure is the structurally significant part, more than the flaw itself. attribution here is a claim by the advisory's authors, recorded as such. 90%
twelve-plus allied nations issued a joint 31-page alert on russian state hackers exploiting an unpatched zimbra flaw to steal emails from us and ukrainian targets with no user interaction required. separately, new malware called dolphin x uses ai to rank and prioritize high-value victims, and a fake claude installer pushed via bing ads compromised 29 organizations in two days. the underground is absorbing ai both as a tool and as a lure. 89%
a russian-speaking criminal group compromised 73,932 fortinet firewall and vpn devices across 194 countries without using any zero-day vulnerability — exploiting existing misconfigurations or known flaws. classified documents were exfiltrated from a turkish nato defense contractor in the operation. the scale — nearly 74,000 devices, essentially every country on earth — and the nato contractor exfiltration make this structurally significant beyond standard ransomware activity. 88%
high-severity zero-day flaws in microsoft exchange are being actively exploited to inject malicious code into outlook web sessions, prompting coordinated emergency patching across microsoft, google, sap and cisa. in the same window, kaspersky reported malicious objects on 19.6% of monitored industrial control systems in q1 with manufacturing-sector attacks rising in several regions, and cisa published fresh advisories on schneider and siemens-linked industrial equipment plus urgent vpn patch directives. 87%
russian-speaking attackers exposed plaintext credentials for nearly 74,000 fortinet devices across 194 countries, with confirmed access at oracle, chevron, lenovo, fedex, and nato contractor networks. the breach appears to be an unrestricted credential dump, meaning affected networks remain open to actors who obtained the data. the scope — 21,000+ source ip addresses, near-global coverage — is structurally unusual in scale and the inclusion of nato-adjacent infrastructure. 87%

Every link carries this card — rendered, not screenshotted

E160· 30 JUL 2026

a research project by Aamir Hussain terms