KongTuke is now being reported using Microsoft Teams chats to reach employees directly, pose as IT support, and talk them into running a PowerShell command that installs ModeloRAT.

Cyber Security News reported the Teams-based campaign on May 12, 2026, and BleepingComputer reported on May 14 that the same activity can produce persistent access in as little as five minutes.

The Attack

The reported Teams campaign begins with contact from a fake or hijacked Teams account. The attacker presents as internal IT or help desk support. That matters because the instruction that follows would look absurd in most contexts: open PowerShell, paste a command, and run it.

In a Teams support chat, especially during an apparent device issue, that same instruction can look like a diagnostic step.

Cyber Security News reported that the command drops a ZIP archive into the user’s AppData path, extracts it locally, and launches the malware from a directory named WPy64-31401. That directory name is consistent with the WinPython packaging seen in earlier ModeloRAT reporting.

Microsoft’s February analysis of CrashFix described the same larger pattern: native Windows utilities, obfuscated PowerShell, WinPython, and a Python RAT running through pythonw.exe so the user does not see a console window.

The RAT beacons over HTTP, performs reconnaissance, and establishes persistence through a Run registry key. Microsoft also observed a follow-on chain creating a scheduled task named SoftwareProtection that executed a Python payload every five minutes.

The Teams variant reportedly adds resilience by using both a Run key and a randomly named scheduled task. That gives the operator two chances to survive cleanup. Remove the obvious startup entry and the scheduled task may still bring the implant back.

According to cybersecuritynews.com,

Since the malware relies on a portable Python environment to execute, tracking unusual instances of pythonw.exe running from user-writable paths like AppData can help surface suspicious activity early.

Regularly reviewing new scheduled task registrations and registry run key changes can help catch persistence attempts before they quietly take hold.

The Actors

KongTuke has been tracked as a malicious traffic distribution system that uses compromised websites, redirects, and social engineering lures to deliver malware.

Red Canary lists KongTuke under aliases including Chaya_002, LandUpdate808, and TAG-124, and describes the group’s tradecraft as heavily tied to compromised WordPress sites and changing lure chains.

Huntress reported in January 2026 that KongTuke was using a malicious Chrome extension called NexShield, a near-clone of uBlock Origin Lite, to trigger a fake “CrashFix” flow.

That campaign intentionally broke the victim’s browser experience, then told the victim to run a command to “fix” it. The payload was ModeloRAT, a Python remote access trojan reserved for domain-joined systems.

The new Teams activity keeps the same basic infection idea but changes the point of contact. Instead of waiting for a user to hit a poisoned web lure, the actor moves into the workplace chat channel and starts a support conversation.

Conclusion

KongTuke’s move into Teams is a practical shift. They’re taking a lure that already worked in browsers and moving it closer to the employee’s daily workflow. That removes friction and also makes the attack feel less like a web scam and more like an internal support task.

Most companies still think about physical attacks as an outside problem.

Meaning that when we think about who is going to be breaking into our building to steal intellectual property, bug the corporate board room or gain access to the servers, its somehow, in most people’s mind, a guy in a black hoodie or balaclava sneaking in.

But now ask yourself this question, if given the choice, would you rather sneak around a building in he middle of the night trying to bypass an unknown number of sensors and alarms, or simply walk through the building holding a coffee and a smile ?

This is why, for a large number of organizations, your biggest risk will always be insider threats, or perceived insider threats.

Two Kinds of Risk

Most organizations fall into one of two broad physical risk categories.

The first category is the business that sells merchandise.

Jewelry stores, electronics shops, laptop resellers and other merchandise-heavy businesses have a very specific problem. They hold goods that can be grabbed, moved, fenced, resold, stripped, or converted into cash quickly.

Their physical risk is often direct theft. The attacker does not need deep access to sensitive records or internal systems. They need proximity to the product, speed, and a way out.

For those businesses, smash-and-grab attacks still, and likely will always be the norm, and what these organizations should be actively working to prevent.

That said, daytime retail attacks have become more common and more aggressive. Flash-mob style thefts changed the assumptions for businesses that used to think the worst-case physical attack would happen after closing.

A group can enter during normal hours, overwhelm staff, take what they came for, and leave before a good guy with a gun arrives. This is a big reason why understanding your threats time on target is incredibly important.

The second category is the organization that does not really sell merchandise.

Pension companies, banks, insurance firms and similar organizations usually do not have display cases full of goods. Yes, they have laptops, phones, network gear, but nobody is breaking into google headquarters to steal laptops, their real exposure is access.

Access to things like: documents, credentials, conversations and intellectual property.

For these companies, the attacker is trying to collect information, plant a device, photograph documents, obtain a credential etc, and this will likely represent the bulk of organizations that will hire physical pentesters.

And most of these businesses rely, or have setup a variation of front heavy security to protect all of the above, which usually means an expectation of catastrophic failure.

Why It Always Boils Down to Insider Threats

For this conversation, we’re ignoring the merchandise businesses. However, do keep in mind that merchandise-based businesses do have real insider threats that happen every single day.

The former employee, the disgruntled janitor, the person who needs a few extra bucks who used to work for you or currently still does, any of these people can turn on you, knowingly or unknowingly.

So insider threats on merchandise-based businesses are a real thing. However, we are going to be focusing on who is likely to employ the vast majority of physical pen testers, and that’s the other category.

A physical attacker does not need to start as an insider to become an insider threat.

They only need to get past the point where people stop questioning their presence, eg front heavy security’s often single point of security barrier.

Most people, when they think of a bad guy, they think of somebody who’s going to break in in the middle of the night wearing a balaclava or a black hoodie. The problem is that companies and organizations that deal with espionage, pension companies and the like, the ones that we’re discussing, it is far easier and far more effective to break in during the day when all of the alarms and cameras are off because you can sweet-talk your way past a person, past a guard, past a secretary. You cannot do that with an alarm or a camera.

But understand that regardless of whether it was somebody who jumped through a window or cloned a badge or broke in from the outside, or if it was somebody who was already inside, a legitimate insider threat, both of these things are going to converge to an insider threat or a perceived insider threat where everybody around you, everybody around the attacker, assumes that the attacker, either a real employee who’s turned or an actual person who’s not supposed to be there, is legitimately there, and therefore it devolves into an insider threat.

And this is where one of the biggest oversights of all physical security comes into play, and I have seen this more times than I can count, and that is even companies that hire physical pen testers to come in and pen test the building, it’s almost always the same playbook.

Try to sneak into the building and then try to gain access to some secure location, but as I just mentioned, regardless as to how the threat gets inside, it will become an insider threat. Most physical pentesters will tell you, that once you have a foothold into the building, the game is over, they have won.

And this is the big issue.

But Did You Test It?

One of the first questions in security should always be, did you test it?

Not, did you buy it. Not, did the vendor promise it works, but did you test it?

This is where a lot of companies get exposed. They will talk confidently about cameras, access control, visitor management, etc, but when you ask when they last tested a physical insider threat scenario, the answer is usually silence.

Most organizations have never done it. They are relying on their front heavy security, their parameter barriers to protect them while not considering that anyone who bypasses these barriers will likely have complete access to everything.

I can already hear SOC members, facility managers, and security guards saying things like, ah, but our server room is always locked, or you need an access control badge to get onto any other floor. And it’s like, yes, you do, but also understand that privilege escalation, whether it’s through cyber or physical, is not a difficult task. It can rely on patience, but it’s not very difficult.

Understand that part of front-heavy security says that any person who’s gotten beyond the security choke points or perimeter barriers is authorized to be here.

That’s the assumption. How else did you get this far into the building? And so when people are using under-door tools or lockpicking or pulling card readers off the wall, etc., but they’re inside the building during daylight hours, 99 times out of 100, people assume they must be authorized to be here and they don’t care.

And that’s one of the biggest problems. And that’s one of the reasons why front-heavy security is so dangerous.

Ask Yourself This Question

Assume that there is one person inside your building who is not supposed to be there during daylight hours. Would normal employees be able to spot them if they were acting normal, dressed appropriately, and maybe even had something that looked like a real functioning badge?

Now ask yourself the question, what areas and things do normal employees have access to within your building? This is what our insider also has access to.

Would they have access to conference rooms? Would they have access to unlocked laptops? Do employees leave badges laying around on their desks? Could they get into the server or archive rooms? What could they get access to?

And now, the big question. You, who is reading this blog, are likely to be very security-minded. That’s why you’re reading this blog.

So assume that you are the insider threat. Assume that you have already gotten inside your own building, inside the organization that you work at. What could you do?

Because you already have all the knowledge. You already know all the vulnerabilities, the ins and outs of the building. You know when Sally from accounting leaves doors cracked open, or you know where the keys are to the server rack or other things.

All of this information are things that actual physical attackers will discover over time. So if you were the actual insider threat, how much damage could you do, and would the security barriers that are currently in place stop you?

Conclusion

The purpose of this article is not to shame people who’ve never done an insider threat scenario or even a physical pen test. It’s to illustrate the point that for a large majority of companies and organizations out there, your biggest threat are going to be insiders.

And most people, most companies, most organizations have never even considered this, let alone actually tested it. And regardless as to what security vendors or your facility manager or your SOC say, until you have tested something, you have absolutely no idea how things will go.

Training Resources:

For individuals looking for a hands on training that includes all of the above topics, Covert Access Team (covertaccessteam.com) provides training courses focused on physical penetration testing, lockpicking, bypassing techniques, social engineering and other essential skills.

• Covert Access Training - 5 day hands on course designed to train individuals and groups to become Covert Entry Specialists

• Physical Audit Training - 2 day course on how to setup and run a physical security audit

• Elicitation Toolbox Course - 2 day course of that primarily focuses on elicitation and social engineering as critical aspects of Black Teaming

• Strategic Operations for Lone Operators - Advanced course for those who are interested in learning how to become a one man infiltration team.

• Counter Elicitation - 2 day course on how to recognize and prevent elicitation attempts, and safegaurd your secrets.

• Cyber Bootcamp for Black Teams - 2 day course designed explicitly for physical penetration testers who need vital cyber skills to add to their toolbox.

• Private Instruction - Focused learning & training based on your needs .

So the other week we ran another iteration of the CAT course, which was fantastic. Not only did we have a great group of students, but as the instructor, its always fun to see how they go about the final day or so infiltrating live buildings to test everything that they have learned.

However, I wanted to write up a post specifically about a piece of gear that has come out of Norway recently from John-André Bjørkhaug, which some of you may already know for his physical & cyber pentesting talks.

What some of you may not know is that John actually creates a lot of really awesome, and custom equipment for physical pentesters that he has only recently begun selling to the public.

John gave the CAT students access to some of his previously restricted equipment, and now that it is finally ok to talk about … I wanted to talk about it.

Most people are aware that some ID cards can be cloned with things like flippers, Icopys and Proxmarks, but that is abusing vulnerabilities on the front end of the access control system, while there is in fact a more glaring vulnerability on the backend.

Effectively, you can think of card readers, for the most part, as having two communications protocols, one for the front end and one for the back end.

The front end (in blue) is between the card and reader and this is where you might try to clone a card with things like a flipper.

The back end (in green) is between the reader and controller, which is a totally different protocol, and almost always setup to be vulnerable to a man in the middle attack, specifically by using a very outdated protocol called Wiegand.

Think of it like this, front end comms may or may not be encrypted sufficiently, but the back end comms is almost always unencrypted.

This means, that placing a device that can both capture and replay that back end communication can open doors, even if the front end is so secure no device could duplicate a card.

Enter the ESPkey (challenge coin for scale), which is a postage stamp sized device that sits behind the card reader to intercept and replay valid ID cards to the controller and thus opening the door.

Now arguably, there should be an alert if someone pulls a card reader off the wall to install one of these devices … and there very often is a tamper switch, though whether its actually wired up, monitored and acted upon is a different issue.

However, this is why I love John’s trainer, because it comes equipped with active tamper switches and runs the Wiegand protocol on the back end, which is what you will abuse with the ESPkey.

John’s RFIDemon Ultra allows you practice bypassing optical tampers switches, install ESPkeys and then bypass the card to readers front end communication entirely.

When asking Chatgbt about how common Wiegand is globally today you see about 90% of facilities.

One thing that all you auditors and pentesters should realize is that telling a company or organization to simply use unclonable cards does not necessarily fix the PACS vulnerability issue, it only resolves one of its components.

The reader’s John makes each serve a purpose for different training needs, from decrypting encrypted sector data, bypassing tamper switches and installing ESPkeys to simply cloning cards.

And for anyone who likes mechanically bypassing PACS systems, John’s hooks are arguably some of the best I have used … and yes I do use them on real engagements all the time, with my personal favorite being “Big John”, as they incredibly thin (0.8 mm), but made from solid steel which makes them very strong.

So, a huge thank you to John for all the gear he makes and the time he puts into each piece of equipment.

Training Resources:

For individuals looking for a hands on training that includes all of the above topics, Covert Access Team (covertaccessteam.com) provides training courses focused on physical penetration testing, lockpicking, bypassing techniques, social engineering and other essential skills.

• Covert Access Training - 5 day hands on course designed to train individuals and groups to become Covert Entry Specialists

• Physical Audit Training - 2 day course on how to setup and run a physical security audit

• Elicitation Toolbox Course - 2 day course of that primarily focuses on elicitation and social engineering as critical aspects of Black Teaming

• Strategic Operations for Lone Operators - Advanced course for those who are interested in learning how to become a one man infiltration team.

• Counter Elicitation - 2 day course on how to recognize and prevent elicitation attempts, and safegaurd your secrets.

• Cyber Bootcamp for Black Teams - 2 day course designed explicitly for physical penetration testers who need vital cyber skills to add to their toolbox.

• Private Instruction - Focused learning & training based on your needs .

Federal prosecutors say a Chinese aerospace engineer spent years posing as trusted U.S. researchers to obtain restricted aerospace software and source code from NASA, the U.S. military, universities, and private defense firms.

Song Wu, an engineer at China’s state-owned Aviation Industry Corporation of China, allegedly used fake email accounts to impersonate people inside the American research community and request software tied to aerospace engineering and computational fluid dynamics.

He was indicted in September 2024 on wire fraud and identity theft charges. He remains at large.

The Case

According to the Department of Justice, Song’s campaign ran from January 2017 through December 2021. Prosecutors allege he created email accounts impersonating U.S.-based researchers and engineers, then used those accounts to request specialized software and source code used in aerospace engineering and computational fluid dynamics.

Targets included personnel at NASA, the U.S. Air Force, Navy, Army, the Federal Aviation Administration, major research universities in Georgia, Michigan, Massachusetts, Pennsylvania, Indiana, and Ohio, and private aerospace companies.

Prosecutors said the tools could support industrial and military applications, including advanced tactical missile development, aerodynamic design, and weapons performance assessment. The FBI’s wanted notice says the software was restricted or proprietary and used for aerospace engineering and computational fluid dynamics.

NASA’s Cyber Crimes Division received a report that someone had created a Gmail account claiming to be an established aerospace professor who frequently collaborated with NASA. The account was asking colleagues for access to export-controlled software and source code.

NASA OIG said investigators found the impersonator had targeted dozens of U.S. professors, researchers, and engineers. In some instances, the scheme worked, and victims unknowingly violated export control laws by sharing sensitive material.

Keep in mind that China is always attempting to steal this type of info and so these styles of attacks should come as no surprise. This article I previously wrote about is about how one Chinese agent was able to steal the blueprints for the F-22, C-130 Spector and more.

The Actors

Song Wu is a Chinese national, born June 12, 1985, according to the FBI. The Bureau lists him under the alias Shuimusheng Wu and identifies his occupation as engineer.

At the time of the alleged campaign, Song worked for Aviation Industry Corporation of China, known as AVIC. The Department of Justice describes AVIC as a Beijing-headquartered, Chinese state-owned aerospace and defense conglomerate that manufactures civilian and military aircraft and is one of the largest defense contractors in the world.

For anyone who may have read my post about the “Man Huntin’ Project”, and looking to flex their OSINT, Humit & Sigint muscles for a profit, as of the time of this article Song does not have a bounty :(

The Attack

Song allegedly built email accounts that looked like they belonged to real people in the aerospace and engineering community. Prosecutors say the messages appeared to come from colleagues, associates, friends, or other trusted figures. The ask was direct, send the source code, make the software available, provide a copy.

NASA OIG said Song and unidentified co-conspirators conducted extensive research on targets before contacting them. They posed as real friends and colleagues who needed software copies or source code that could be used to rebuild or modify applications.

The method worked because the environment was built for collaboration. NASA researchers, university faculty, defense engineers, and aerospace specialists regularly exchange technical material with people they know. The weakness was not only the inbox. It was the informal trust path around controlled technical data.

NASA OIG identified basic tells after the fact. Song allegedly made repeated requests for the same software and failed to justify why he needed it. Those are small indicators, but they are enough when the material is export-controlled and the request arrives through a consumer email account claiming to represent a known researcher.

Conclusion

Whether its China’s thousand talent program, traditional spy craft or just outright theft, this sort of espionage is so common that it should be on everyone’s radar.

When people ask, why does this happen, lets simply look at the F-35 blueprints that were stolen by a different Chinese spy, also using the “trusted method of infiltration” and according to Lockheed Martin, the project took decades to develop and cost around 2 TRILLION dollars, all of which China got to skip by stealing the blueprints.

So when people tell you why would countries like China do this … well there is your answer, and if you think this isn’t happening every day, than I have to say I think that your naive.

I suppose that its going to be a regular occurance that AI will be used for both good and evil moving forward.

Varonis says its researchers obtained access to Bluekit, arguably one of the most sophisticated AI based phishing as a service platforms on the market today.

Varonis doesn’t say exactly how they actually got access to the platform, instead simply stating that,

“To see how that held up in practice, we obtained access to Bluekit and reviewed the kit from the inside.”

That said, from what they have reported, this may be one of the most dangerous phishing as a service providers yet.

The Platform

The Bluekit dashboard showing the main operator panel. Source varonis

Older phishing kits were often modular by necessity. One seller provided a credential page. Another handled domains. Another sold SMS or email delivery. Another handled Telegram bots, proxy logic, or post-compromise dashboards. Operators had to stitch those pieces together, keep infrastructure alive, avoid basic analysis, and move fast before domains were burned.

Bluekit pulls that into one control plane.

Varonis found a dashboard covering site creation, domain setup, captured logs, delivery tooling, and campaign support features. Telegram is wired in as the default exfiltration channel. Operators can buy or connect domains inside the same interface they use to manage phishing pages and victim logs.

Some of the templates Bluekit supports. Source varonis

The template set is broad enough to cover common account takeover paths. Varonis reviewed templates for

• cloud

• email

• developer

• social

• retail

• crypto services: including iCloud, Apple ID, Gmail, Outlook, Hotmail, Yahoo, ProtonMail, GitHub, Twitter, Zoho, Zara, and Ledger.

BleepingComputer and SecurityWeek both reported the same general template spread after Varonis published its findings.

The templates map directly to account takeover. Email enables BEC. Cloud accounts expose documents and collaboration. Developer platforms expose repositories, secrets, and pipelines. Crypto and retail accounts support theft and fraud. Bluekit is not built around one lure. It is built around access.

How It Works

The target details view with session state and browser-storage dumps. Source varonis

Bluekit appears to be designed around the modern phishing workflow, not the old “steal password, redirect victim, hope it works” model.

The operator starts inside the dashboard. From there, the kit supports domain selection, mode selection, and template selection. Once the site is live, the operator can configure how the phishing page behaves, including login-detection actions, redirects, anti-analysis checks, spoofing options, device filters, proxy settings, and session-handling behavior.

Optional site-level controls for redirects, spoofing, and anti-analysis checks. Source varonis

Varonis says Bluekit tracked session state, stored repeated dumps of cookies and local storage, and kept a live view of what the target saw after login. That means the panel is not limited to collecting a username and password. It is built to surface authenticated session material after the victim interacts with the lure.

In an AiTM attack, the attacker positions infrastructure between the victim and the legitimate service, relays the login process, and attempts to capture credentials, MFA interaction, and session cookies. Microsoft has described AiTM campaigns as attacks that intercept authentication between the user and a legitimate service to capture the session cookie after MFA is completed.

Once an attacker has a usable session token, the password and MFA prompt are no longer the whole fight. The attacker is trying to inherit the session the user already authenticated. That is why traditional MFA can fail against this class of phishing. The user may complete MFA successfully, but the attacker’s infrastructure is positioned to capture the session material created by that successful login.

Bluekit’s live session view and browser-storage dumps show the direction of travel. The kit is not just harvesting credentials. It is trying to package account takeover into a managed operator view.

The AI Layer

A prompt-and-response view from the AI Assistant test. Source varonis

Bluekit’s AI Assistant is the feature that gives the kit its headline value, but the reporting suggests it is still rough.

Inside the Bluekit panel, Varonis saw multiple model options, including an abliterated

• Llama default

• GPT-4.1

• Claude Sonnet 4

• Gemini

• DeepSeek variants.

Varonis was only able to test the default abliterated Llama model. The commercial model options appeared in the interface but required additional configuration that Varonis did not have.

The model selector inside Bluekit’s AI Assistant. Source varonis

Varonis tested the AI Assistant with an executive phishing scenario involving Microsoft 365 MFA re-verification, a branded QR code, email delivery, and a credential-harvesting page.

The following is a video demo by varonis,

The result was a campaign skeleton, not a finished attack. Basically, this AI will help you outline everything but still requires humans to polish things up before the attack.

The Actors

No public reporting has identified a named developer, group, country, or criminal crew behind Bluekit.

Varonis refers to a developer shipping new features and templates quickly, but does not attribute the kit to a known actor. SecurityWeek also reported that Bluekit had not yet been seen in a live campaign at the time of Varonis’ publication.

Prevalence

There is no public evidence that Bluekit is currently widespread.

Varonis says the kit had been on its radar for a while and that researchers initially hoped to catch it in a live campaign. Instead, the release cadence became the story. The developer kept adding features and templates fast enough that tracking the kit’s evolution became relevant on its own.

That puts Bluekit in the watchlist category, not the epidemic category.

SecurityWeek reported in April 2026 that phishing-kit activity increased after disruption of Tycoon 2FA, with Barracuda detections across several kits rising from roughly 20 million to more than 23 million, while Tycoon lost ground to other platforms including Mamba and EvilProxy.

Conclusion

While Bluekit isn’t dominating the phishing attack platforms yet, I do believe that AI based, or assisted, attack platforms will soon become a dominate method for all manner of cyber attack and defense.

With how rapid AI has grown up in the last five years, it will be very interesting to see where things stand going forward into the next five.

Suppose I tasked you with exfiltrating extremely sensitive information out of a government office, take a moment and think about how you would do it.

Some of you might consider downloading the data onto a USB and walking it out Ed Snowden style. Others of you might consider printing off the documents and leaving with physical paper copies.

But how would you go about it …?

Allow me to introduce you to one of the oldest schools of spying and by extension exfiltrating data via KIMs or Keep In Memory … its nothing more than practice memorization, and on that note, I will introduce you to Ana Belen Montes.

By day, Montes was a respected DIA (Defense Intelligence Agency) analyst. By night, she was working for Cuban intelligence. She entered DIA in 1985 already recruited, rose into the Cuba portfolio, and became one of the U.S. government’s senior analysts on Cuban military affairs.

Federal sources and DIA training material say she operated for more than 16 years before her arrest on September 21, 2001.

Montes’ Recruitment

Montes was recruited before she ever entered DIA. In 1984, while working a clerical job at the Department of Justice, she was outspoken about U.S. policy in Central America. Cuban officials assessed her as sympathetic.

The FBI later described the sequence plainly, she met with them, agreed to help Cuba, and then applied to DIA because that would give her useful access. By the time she started there in 1985, she was already a recruited agent.

This type of recruitment still happens to this day and it is arguably one of the most difficult parts of weeding out spies, China for example has used the 1000 talent program for years to facilitate the theft and espionage of everything they can get access to.

Prosecutors later alleged Marta Rita Velazquez, a former U.S. government employee and SAIS classmate of Montes, introduced Montes to a Cuban intelligence officer in New York in December 1984, helped facilitate her recruitment, and accompanied her on a clandestine trip to Cuba in 1985 for training.

Those charges against Velazquez were allegations, not a conviction, but Montes herself pleaded guilty in 2002 to conspiracy to commit espionage for Cuba.

Inside DIA, Montes became valuable because she was legitimate. She had access. She had standing. She had subject-matter authority. CDSE describes her as a senior DIA analyst for Cuban matters, holding TS/SCI access, with authorized exposure to highly sensitive counterintelligence information.

She also passed a DIA polygraph. Security officials knew she had strong foreign policy views and had concerns about her access, but there was no hard proof she was passing classified information. The polygraph gave false comfort.

The Exfiltration

According to the FBI and CDSE, Montes avoided removing documents from work, electronically or physically. She memorized classified details, went home, typed them onto her laptop, transferred the material to encrypted disks, then delivered those disks to Cuban handlers after receiving tasking by coded shortwave radio.

Montes worked around all typical methods of data extraction checking by making her own memory the transfer medium.

Cuban intelligence handled her like an access platform. They trained her in clandestine communications, coded contact, package passing, and emergency procedures. CDSE says Cuban intelligence also taught her how to beat a polygraph, though whether that specific technique worked is unknown. What is known is that she passed one in 1994, after years of spying.

She received instructions through shortwave radio numbers broadcasts, used coded systems, and met handlers in person. The FBI later built the case through physical surveillance, electronic surveillance, and covert searches.

Investigators wanted to identify her handler before arresting her, but after 9/11 Montes was about to be assigned work related to U.S. war plans. The FBI and DIA moved before she could access and pass that material.

Montes acknowledged revealing the identities of four American undercover intelligence officers working in Cuba. AP reported that prosecutors also said she disclosed secrets so sensitive they could not be described publicly, including information tied to U.S. surveillance of Cuban weapons.

She was sentenced to 25 years in prison. She was released in January 2023 after serving more than 20 years.

Detecting a Montes Today

Could you spot her today?

Most SOCs have methods and tools to detect data exfiltration, unauthorized access, etc, but in cases like this, nothing unauthorized was accessed, nothing was copied and nothing was printed that didn’t need to be.

The company or organization that you work for almost assuredly has sensitive information that would devastate the them if leaked or compromised.

Montes isn’t just relying on memorizing documents, she is relying on the trusted method of infiltration, which is something every organization should be aware of, and have a strategy for combating.

Conclusion

One of the reasons why Montes was able to spy for nearly two decades is because methods like this are not only affective but incredibly difficult to spot.

So I ask again, could the systems and protections that you currently have in place, at your own organization, catch the Ana Montes who may currently be working inside your agency ?

Remember, its not enough to say, hypothetically I could if … Ask if the current tools, procedures and systems you have in place today would actually catch her.

Training Resources:

For individuals looking for a hands on training that includes all of the above topics, Covert Access Team (covertaccessteam.com) provides training courses focused on physical penetration testing, lockpicking, bypassing techniques, social engineering and other essential skills.

• Covert Access Training - 5 day hands on course designed to train individuals and groups to become Covert Entry Specialists

• Physical Audit Training - 2 day course on how to setup and run a physical security audit

• Elicitation Toolbox Course - 2 day course of that primarily focuses on elicitation and social engineering as critical aspects of Black Teaming

• Strategic Operations for Lone Operators - Advanced course for those who are interested in learning how to become a one man infiltration team.

• Counter Elicitation - 2 day course on how to recognize and prevent elicitation attempts, and safegaurd your secrets.

• Cyber Bootcamp for Black Teams - 2 day course designed explicitly for physical penetration testers who need vital cyber skills to add to their toolbox.

• Private Instruction - Focused learning & training based on your needs .

Toronto Police say three men used mobile SMS blasters across the Greater Toronto Area, forcing phones onto fake cell networks and pushing fraud texts directly into victims’ inboxes.

Police say tens of thousands of phones connected to the rogue devices. They also recorded more than 13 million network disruptions, including disruptions that could interfere with access to 911. Toronto Police called it the first known SMS blaster case in Canada.

The Case

The investigation, called Project Lighthouse, began in November 2025 after a cybersecurity partner alerted police to a mobile SMS blaster operating in downtown Toronto.

The device was not fixed to a building. Police say it was mobile. That matters.

A rogue tower sitting in one place is a problem. A rogue tower moving through the city is a roaming attack platform. It can pass through dense residential blocks, commercial zones, transit corridors, and event areas, hit thousands of devices, then disappear back into traffic.

Police say the blasters impersonated legitimate cellular infrastructure. Nearby phones connected to them. Once connected, victims received fraudulent text messages that appeared to come from trusted organizations, including banks, Canada Post, 407 ETR, and parking authorities. The links led to phishing pages built to steal credentials, payment data, or identity information.

According to Toronto Police, the disruptions could last from seconds to several minutes. During those windows, affected devices could have trouble connecting to legitimate cellular towers, including for emergency calls.

The Actors

Dafeng Lin, 27, of Hamilton, was arrested on March 31, 2026. Police charged him with offences including mischief, mischief endangering life, personation with intent to gain advantage, use of a computer system with intent to commit an offence, fraud under $5,000, possession of property obtained by crime, and possession of instruments to be used to commit forgery.

Junmin Shi, 25, of Markham, was also arrested on March 31. Police charged him with offences including mischief to data, mischief endangering life, personation with intent to gain advantage, fraudulently intercepting a computer system function, use of a computer system with intent to commit an offence, and possession of instruments to be used to commit forgery.

Weitong Hu, 21, of Markham, turned himself in on April 21. Police charged him with conspiracy to commit an indictable offence, intercepting private communication, trafficking identity information, possessing identity documents, unauthorized possession of credit card data, and personation with intent to gain advantage.

In total, police say the three men face 44 charges.

Tradecraft

SMS blasters sit in the same family as IMSI catchers, StingRays, and cell-site simulators. The names get used differently, but the principle is close enough: the attacker brings fake cellular infrastructure into range and tricks phones into talking to it.

StingRays became known through law enforcement and intelligence use. IMSI catchers were built to identify devices, locate phones, and map handsets in a target area. SMS blasters take that same radio deception and turn it toward mass fraud.

The device pretends to be a legitimate cell tower. Nearby phones connect because they are designed to attach to the strongest or most available network. In many cases, the attacker forces the handset down to weaker network behavior, often 2G, where protections are thinner. Once the phone is attached, the blaster can push scam texts directly to the device, bypassing normal carrier filtering.

That is why the method is dangerous. The victim does not install malware. They do not join a bad Wi-Fi network. The attack happens through the cellular layer the phone already trusts.

For users, detection is imperfect. Warning signs include a sudden drop from 5G or LTE to 2G or “E,” emergency-only service, strange loss of signal, failed calls, or scam texts arriving right after a service glitch. None of that proves a rogue tower is nearby, but it is enough to treat the message as hostile.

Conclusion

This type of attack vector isn’t new, but it was the first time the Canadian police had seen this used in this way.

Unfortunately, these devices are not difficult to create or use, but typically criminals who have the cyber abilities to do so often find that they have other professional opportunities that would usually keep them from turning to crime.

One of the things that concerns me the most about the use of these attacks is the inability for citizens to utilize emergency services by effectively taking thousands of phones offline.

Stay safe out there.

Apologies for being away for about a week, but I was up in Copenhagen teaching a new group all the ins and outs of covert entry.

Wanted to say thank you to everyone who was there, you were a great group to work with, and I really enjoyed watching how you all worked through the final day infiltration.

For anyone who wasn’t there, despite telling the client site not to inform their staff about the engagement, they seemed to have let the word slip to all employees, which made the student’s job much more difficult.

But despite the fact that the entire office was on high alert, the students still managed to not only infiltration the building and accomplish all the flags, they came up with some really clever methods of infiltration and I will let them tell you about sometime … if they choose to.

Keep up the training, and let me know the next time you use Bob to gain persistence inside a target building

Training Resources:

For individuals looking for a hands on training that includes all of the above topics, Covert Access Team (covertaccessteam.com) provides training courses focused on physical penetration testing, lockpicking, bypassing techniques, social engineering and other essential skills.

• Covert Access Training - 5 day hands on course designed to train individuals and groups to become Covert Entry Specialists

• Physical Audit Training - 2 day course on how to setup and run a physical security audit

• Elicitation Toolbox Course - 2 day course of that primarily focuses on elicitation and social engineering as critical aspects of Black Teaming

• Strategic Operations for Lone Operators - Advanced course for those who are interested in learning how to become a one man infiltration team.

• Counter Elicitation - 2 day course on how to recognize and prevent elicitation attempts, and safegaurd your secrets.

• Cyber Bootcamp for Black Teams - 2 day course designed explicitly for physical penetration testers who need vital cyber skills to add to their toolbox.

• Private Instruction - Focused learning & training based on your needs .

He has also trained as a locksmith and developed expertise in covert access and physical penetration testing. Alex designs and manufactures the FIT’D secure door bypass units and brings a practical, cross-domain approach to real-world security assessments.

You can find Alex at:

https://www.linkedin.com/in/alex-j-cole/

https://assured.redsec.uk/

https://redsec.uk/

https://assured.redsec.uk/FITD1/

When running a physical pentest, a lot of your time, probably around half, is going to be dedicated to various forms of recon. Given that, and the fact that you will likely never be given as much time on an engagement as you’d like, you always want to optimize what you’re up to.

This means both collecting specific intelligence and accomplishing tasks based upon that intelligence as quickly and effectively as possible.

At every phase of recon, you should know what information you are trying to get, why you need it, and what you can actually accomplish with it.

For example, suppose you’re doing long range recon on a target from a hotel room. Exactly what information will be enough for you to move onto short range recon?

This post is going to hopefully help black teams best optimize their recon time both in what info they are looking for, and what they can actually do during each phase.

The information comes directly from CAT’s Recon Playbook.

The phases of recon

Recon should generally move through four phases: OSINT, long range, short range, and embedded.

That order matters because proximity creates risk. The closer you get, the easier it is to be noticed, remembered, challenged, or forced into bad decisions.

Each phase should do two things. First, it should answer a defined set of questions. Second, it should let you accomplish practical work that reduces friction later.

It should be noted that while engagements have many overlaps in approaches, recon types, vulnerabilities, etc not all targets will allocate each type of recon. Further, each target building will have different requirements, info to gather and tasks to accomplish, but this post should give you an excellent template to use for all engagements.

Here is another hypothetical for you; suppose you are the team lead and you have outlined that during long range recon you need the following info:

• Employee Dress Code

• Employee arrival & exit times

• Most used entrances / exits

• Employee badges and lanyards

However, after an entire day, your team reports back that they have only managed to get the employee dress code. Do you move onto short range recon with the info you’ve gotten, or do you allocate another day for long range recon?

Read more

On April 17, an Iranian official told Reuters that commercial ships could use the waterway, but only with approval from the Islamic Revolutionary Guard Corps and in coordination with Iran’s ports authority.

A day later, Indian ships were reporting gunfire during transit, including one crew broadcast now circulating publicly in which mariners can be heard telling Iranian forces they had already been cleared.

Who Controls What

There has been a back and fourth involving the strait as to who is actually in control of what, but on April 17th, the IRGC started publishing this broadcast in the area to all ships.

Unfortunately, relying on the Iranians to manage the strait hasn’t seemed to go well for commercial vessels, as even those that have complied with the IRGC have later come under their fire. Whether this is intentional or out of incompetence is yet unclear.

After the above distress call, it was reported that two additional Indian flagged ships were attacked while crossing the strait, prompting India to summon Iran’s ambassador and register “deep concern.”

Indian reporting identified the vessels as Sanmar Herald and Jag Arnav. Another Indian tanker, Desh Garima, appears to have completed transit.

At the same time as all of this is ongoing, the Pentagon has released footage of the US Navy opening fire on an Iranian-flagged cargo ship who ignored warnings to turn around over a six hour period

The Strait

Hormuz is small, but it moves a huge share of the world’s seaborne energy. Reuters reported in February that more than 20 million barrels per day of crude, condensate, and fuels moved through the strait on average last year.

Qatar sends almost all of its LNG through it, and roughly a third of global fertilizer trade, including sulphur and ammonia, also passes through the corridor.

The IEA says about 80% of oil and oil products moving through Hormuz in 2025 was headed to Asia. On LNG, almost 90% of the volumes exported through the strait went to Asian markets, while Europe’s share was just over 10%.

The big weak point for Europe is jet fuel. Europe had been getting nearly 75% of its jet fuel imports, about 375,000 barrels per day, from the Gulf before the current disruption.

As those flows tightened, Europe started pulling record replacement volumes from the United States and Nigeria.

Britain’s Turn at Playing Navy

Britain started this crisis trying to stay out of it. Keir Starmer said London would not be dragged into the Iran war and would not support the U.S. blockade of Hormuz. Days later, the same government was talking up a naval mission to protect shipping and restore freedom of navigation. That would have sounded more convincing if the Royal Navy still had the weight to carry the line.

Reuters reported that Britain’s permanent warship presence in the Middle East had already ended when HMS Lancaster was decommissioned in Bahrain in December 2025, and the only destroyer sent to the region, HMS Dragon, made it as far as the Mediterranean before having to be sent for maintenance due to mechanical problems.

Europe’s Reaction Is Very European

Europe has decided to carve a fresh canal through Turkey and start charging ships like a discount Suez. The idea is to spend around 20 billion euros over the next decade or so to build an artificial route connecting the Black Sea and the Sea of Marmara, similar to the Suez Canal.

Europe is moving closer to creating a Suez Canal-style maritime corridor as Turkey advances the £20 billion Istanbul Canal, a project designed to establish a toll-based shipping route linking the Black Sea and the Sea of Marmara and reshaping global trade flows.

According to the Business Insider,

“Under the United Nations Convention on the Law of the Sea (UNCLOS), ships have the right of “transit passage” through straits used for international navigation.

Countries bordering such straits cannot demand payment for passage, though limited service-related charges are permitted.

Egypt and Panama, however, levy tolls because the Suez Canal and Panama Canal are man-made waterways.

Natural routes such as the Bosphorus and the Strait of Hormuz generally cannot impose transit fees.

Turkey’s proposal to build an artificial canal parallel to the Bosphorus would allow Ankara to introduce structured tolls without breaching international law.”

Basically the idea is simply this

Conclusion

So what is going on in the Strait these days is honestly anyone’s guess, but it has made for some very entertaining reading.

I get asked why use the term black team instead of red team … and, well, this post will hopefully answer that question.

Let’s start off by addressing that in the security industry, we basically already have too many colors to play with. For those who don’t believe me, what follows describes a potentially real situation:

You are a white hat hacker who has been contracted to work with a group of grey hat hackers for a simulated purple team engagement during a black box network pentest.

So then, why did I add another color to the list? By the end of the article I hope you will understand why.

BIG DISCLAIMER

I have had the privilege to work besides some extremely talented physical red teamers throughout my career, and this article in no way is saying that everyone on a red team doesn’t know physical pentesting, far from it. This article (and the term black team) is more for an industry standardization and I hope that is clear throughout this article.

What a Red Team Usually Is

Red teaming effectively means the simulated bad guys, and on paper, that’s exactly right, but now lets look at industry.

Look for “red team” job listings and you will come up with a very specific skill set … cyber

Having glanced over a dozen or so “red team” job listings while making this post, they were all the same.

Asking AI to describe how to get onto a red team, and you get something like:

In general, this isn’t a problem because the overwhelming majority of red teams are running some form of cyber pentesting, so it makes sense to require these skills.

But that brings me to the very first major distinction, which is that the skills to hack a website are not the same to crack a safe.

Skills Are Not Interchangeable

Being able to pop a web application does not mean you can work a door, or even a person. Knowing how to deauth Wi-Fi does not mean you can crawl up the side of a building. These are simply different disciplines. They overlap in mindset, not in execution.

A lot of firms still sell them as if they are interchangeable. This makes sense because sales are often told to say yes to any client request. The client asks for a physical intrusion. Someone looks around the room, finds the cyber pentester, and asks a version of the same stupid question: you hack websites, right, so can you break into the bank?

Unfortunately for the client, the answer to that question, is that the hacker, and indeed the salesman could likely break into the bank successfully. That’s not because either are trained or incredibly skilled at covert intrusion, but because the bank’s physical security, like many organizations, is terrible.

If you want to understand the state of many organizations’ physical security, think of it this way,

Most untrained, or minimally trained, people can breach most buildings and gain access to sensitive or even critical areas. If we said the same thing about cyber security, everyone would freak out.

Your cyber security is so bad that someone with a few hours of hack the box training can take over your network and do anything they want … yep, its pretty bad.

You Cannot Test What You Do Not Recognize

The next problem is even simpler. If the team does not know what a physical vulnerability looks like, they will not test it.

A web app hacker might walk past a euro cylinder sticking too far out of a door and not even register it as a weakness. They may not see a badly fitted strike plate, a misaligned latch, a reader mounted in a stupid place, a reception process that can be manipulated, or an access control system that still runs Wiegand on the back end.

Nobody in cyber knows every path in, just like nobody in physical knows every bypass route … that’s not the point here. Its that if someone who only knows the basics, then they will only test the basics.

Lets put this a different way. If the only thing you know in cyber is how to exploit an IDOR, then IDOR is what you will look for. That is what you will test. That is what will end up in the report. And that is the ONLY thing that will be in the report.

If the only thing you know in physical is how to use a Flipper or tailgate, then badge cloning and tailgating is what you will test, and it will be the only thing tested.

Everything else gets missed.

In a cyber pentest, you don’t stop until all objectives are achieved and all potential vulnerabilities checked.

But in a physical pentest, all too often, the engagement stops as soon as a single objective is accomplished and no further vulnerabilities are checked.

Why Clients Get Confused

Client: “We already hired a red team this year.”

You: “What was the scope of the project?”

Client: “Network and wifi pentesting.”

The problem is the label does too much work. “Red team” sounds comprehensive. Buyers hear it and assume somebody tested the whole attack surface.

In reality, most engagements are still roughly ninety-five percent cyber and five percent physical, if physical appears at all.

So the client locks down their network security and assumes they are safe and covered, when in reality anyone off the street could likely walk in and do anything they wanted. Which of course includes cyber based hacking.

Yes, It Really Is That Bad

One of the most common objections in physical pentesting is some version of this:

We already know you can get inside, so why should we pay you to prove it?

That is the same logic as saying:

We already know you can get into our servers through the internet, so why test them?

Nobody serious says that in cyber, but its an all too common statement in physical.

The reason most untrained or minimally trained people can breach buildings and gain access to sensitive areas is because the buildings security is just that bad.

Now realize that your job is not to get inside, it’s to help secure them.

On a cyber pentest, you will check as many potential vulnerabilities as possible, which you can only do if you know what they are and how to test them.

The same thing holds for physical pentesting. You need to study all possible vulnerabilities and at least know how to recognize and test them.

Why We Use Black Team Instead of Red Team

We use black team because the client should not have to guess whether the people showing up are cyber experts who occasionally tailgate, or physical experts who live in this space.

Black team says the focus is physical. It tells the buyer the engagement is built around the real-world attack surface of places, people, procedures, and protective systems. It tells them the report will not stop at “we cloned a badge” because cloning a badge is not a methodology, it’s one move.

A physical engagement can and should be just as thorough and robust as their cyber counterpart. And just as importantly, it should add the same level of value to the client after completion.

When a cyber pentest concludes, everyone understands how it helped the client’s security, but if on a physical pentest all you do is tailgate into the building, what value have you brought them?

The naming also fixes expectations internally. It stops firms from quietly pushing undertrained cyber staff into physical jobs because the paperwork says “red team” and everyone hopes for the best. That protects the client, and it protects the team.

For the same reason why if you hire a cyber pentester, you don’t want 95% of their job to be web design. You want them to be a dedicated cyber pentesting team. For this same reason, you want the team you hire, ideally, to be a dedicated black team.

Conclusion

The market uses red team to mean offensive cyber almost by default, and the evidence is right there in the hiring language and certification ecosystem.

That is fine, as long as people stop pretending the label automatically covers physical tradecraft.

It does not.

Physical intrusion work deserves its own lane, its own standards, and its own name. Black team tells the client that physical security is being treated as a discipline in its own right, not as a side quest for whoever on the cyber team happened to say yes.

This is going to be an article for all you OSINTers out there who want a potentially lucrative hobby that also helps bring justice to the world.

Most people are aware of things like the FBI Most Wanted, and some people may even know that such organizations sometimes offer rewards for the capture of these people … But not many people apparently know that sometimes law enforcement will offer rewards (sometime very large rewards) for information about only the location of such wanted people … and thats where this article is going to be discussing.

Now before we really get into this, for obvious reasons I must state,

This article and topic are for lawful investigations only. Use legal OSINT and investigation techniques with the goals to assist law enforcement.

Also, while I will focus on rewards, due note that helping to catch criminals or even helping to locate and save a missing person can be their own reward, but thats obviously an individual motivator

Read the Reward Language Like a Contract

On the FBI most wanted page for example, you can find all kinds of criminals from: kidnappers, terrorists or just fugitives, but for our purposes we are interested in those cases that have both active rewards & where the agencies are only interested in location information, not arrest.

Looking at the two cases above we can see that while both offer rewards, one gives you a payout only if the person is arrested, while the other only requires location information.

Due note that the rewards can range from a few thousand to … a bit more

The Europe’s Most Wanted side makes this problem even more obvious. On Joseph Johannes Leijdekkers’ page, the reward is for the decisive tip leading to his arrest, and the page says the reward will be paid several days after his arrest. This is obviously not what we are looking for.

So the first step is simple, only begin your search for people who have both rewards & require only location based information.

No Reward Is Guaranteed

Next comes one of the biggest things to keep in mind before you commit to these searches, and that is even if you locate the person, there is still no guarantee of payment. Thats right kids, sometimes the government can be liars … better you learn that life lesson now.

Further, make sure you read the wanted poster like a contract, because if it says payment “up to” a certain amount, does not mean the entire amount.

It may tie payment to a specific result. It may leave room for agency discretion, joint rewards with competing tipsters, internal validation standards, or disputes over what actually caused the outcome.

Where to Look First

The FBI is usually the easiest place to start because the wanted pages are structured and readable.

Its wanted index lets you browse major buckets, including Terrorism, Kidnappings/Missing Persons, and Seeking Information.

The Terrorism section itself also separates entries such as “Most Wanted Terrorists” and “Seeking Information - Terrorism,” which is worth paying attention to before you even open the poster.

INTERPOL works differently. It is not a global arrest squad, and it says that openly. Some Red Notices are public, most are not, and the public is told not to approach wanted persons and to report information to local or national police, or through the notice channel where available. That makes INTERPOL useful as a source of targets and identifiers, but not as a place where you should imagine some direct freelance role in the apprehension side.

Europe’s Most Wanted sits somewhere in between. It is public-facing, built to receive information, and explicit that dangerous subjects should not be approached. But many of its rewards are still tied to arrest, not just location.

That means it is useful for lead development, but not always ideal if your goal is specifically to focus on “location-only” reward language.

Given that, I would suggest starting with the FBI :D

The Play-by-Play

Obviously we all have our own method for OSINT, and I am not going to tell you what tools or methods to follow, but I do want to give a general overview and some things to consider if you decide to take up a search.

1. Start with the notice, not the hunt

Open the FBI, INTERPOL, or Europe’s Most Wanted site and pick a case. Read the poster first. Do not start searching blind.

Go straight to the reward language, the ask, and the identifiers. Note that the reward is only necessary if thats what you’re interested in. If you want to simply do a good deed, help save a missing person, or whatever your motivation is, you can look for anyone on the wanted / missing person lists (lawfully and legally of course).

2. Screen the case before you waste time

You want notices asking for information leading to location, whereabouts, etc.

Be careful with notices that say:

• information leading to arrest

• information leading to conviction

If the reward depends on arrest or conviction, your OSINT alone likely will not qualify even if you find the person.

Also note that some of the cases are decades old, and as such you may have little hope of finding the person, especially if they have lived their entire life in some tiny third world village and only came to the first world to commit terrorism then immediately ran home. Tiny third world villages can be extremely difficult to penetrate via the internet

3. Build a clean target sheet

Pull out:

• full name

• aliases

• date of birth

• place of birth

• nationality

• languages

• physical traits

• associates

• last known locations

• photos

• etc

Note that on many cases there is a lot of useful info on the pages about the target, including potential locations, what they may look like today, etc

4. Work outward from the official details

Start with the easiest pivots:

• aliases

• family

• associates

• old cities

• schools

• jobs

• businesses

• social accounts

• old media coverage

The goal is not to “solve” the case in one jump. The goal is to shrink the subject’s world. Basically use your very best OSINT techniques here to start tracking

5. Narrow location in layers

Move from broad to specific.

Country first. Then city. Then neighborhood. Then contact network. Then routine.

Remember that your tip needs to be so specific and exact that someone looking at your report can literally find this person with no other details.

Also realize that the people who may be reading your report may, or may not, be the brightest bulbs in the box … so write your report accordingly

6. Corroborate before you tip

One clue is not enough.

You want multiple points lining up:

• same alias

• same face

• same associates

• same region

• recent timestamps

• matching background details

A useful lead is specific and current. Also realize that while a good lead goes cold fast, people are creatures of habit. So while you likely will not be able to say exactly where a person will be at 4pm thats not really the goal here. You simply need to give LE enough intel to locate the person.

7. Do not cross into hands-on activity

This is really important as most of the people on these lists are dangerous, and people who know that they are wanted can act extremely violently if confronted or threatened … even if they think they’re threatened, so play it safe and stay home.

Your role is to develop information, not make the arrest.

8. Submit a tight package

Send the tip through the official channel.

Include:

• the official notice

• why you think it is the same person

• where you think they are

• what evidence supports that

• dates, usernames, screenshots, links, and image comparisons

Keep fact separate from inference.

9. Stop there

Once the tip is in, you’re done.

At this point, ALL of your work is finished and your only further action is to watch your email or phone for any updates. Note that sometimes these updates can take … well lets just say a while, as LE can be extremely busy and they get A LOT of tips on any given day.

Be patient and realize that your work is finished.

Other Organizations To Search

Realize that most law enforcement organizations, local and international have similar programs, though not all offer rewards, so obviously if this is something that is of interest to you, don’t stop with just the ones I listed above. Check your countries LE and investigative organizations and see whats out there. That said, here are some useful links (though in my opinion I would start with the FBI)

• INTERPOL Help us find
  https://www.interpol.int/What-you-can-do/Help-us-find

• INTERPOL Red Notices
  https://www.interpol.int/How-we-work/Notices/Red-Notices/View-Red-Notices

• Europe's Most Wanted
  https://eumostwanted.eu/

• FBI Most Wanted
  https://www.fbi.gov/wanted

• FBI Fugitives
  https://www.fbi.gov/wanted/fugitives

• FBI Terrorism
  https://www.fbi.gov/wanted/terrorism

• FBI Seeking Information
  https://www.fbi.gov/wanted/seeking-information

• U.S. Marshals
  https://www.usmarshals.gov/what-we-do/fugitive-investigations/15-most-wanted-fugitive

• U.S. DOJ Wanted Fugitives hub (link to links)
  https://www.justice.gov/action-center/identify-our-most-wanted-fugitives

• DEA

  https://www.dea.gov/fugitives

• ICE Most Wanted
  https://www.ice.gov/most-wanted

• Global Criminal Justice Rewards Program - Current Reward Offers
  https://2021-2025.state.gov/global-criminal-justice-rewards-program/current-reward-offers/

• UK National Crime Agency Most Wanted
  https://www.nationalcrimeagency.gov.uk/most-wanted

• Dutch Police - Nationale Opsporingslijst
  https://www.politie.nl/gezocht/nationale-opsporingslijst

• Germany BKA wanted pages (English examples vary by case PDF)

  https://www.bka.de/

• Australian Federal Police - Crime Stoppers
  https://www.afp.gov.au/about-us/contact-us/crime-stoppers

• NSW Police Rewards
  https://www.police.nsw.gov.au/can_you_help_us/rewards

• New Zealand Police online options
  https://www.police.govt.nz/advice-services/all-online-options

• Canada CBSA Border Watch Line
  https://www.cbsa-asfc.gc.ca/security-securite/bwl-lsf-eng.html

Conclusion

While this sort of work obviously isn’t for everyone, it is something that I realized most people aren’t aware of.

If you are the kind of person who is into OSINT and potentially want a new hobby, this is something that may be up your ally. While there is obviously a financial incentive with this type of work, it certainly isn’t the only motivator.

Bringing criminals to justice or even locating and saving a missing person are certainly their own reward.

A man got onto the airfield at Shannon Airport, climbed onto a parked U.S. Air Force C-130, and started hitting the aircraft in broad daylight.

Local reporting said he reached the aircraft on a remote taxiway, got up onto the wing, and struck the wing and fuselage with what was described as a hatchet or similar tool before responders pulled him off and arrested him.

The Operation

The breach happened at about 9:45 a.m. at Shannon Airport in County Clare. According to local reporting, airport staff spotted a person inside a restricted area near a parked U.S. Air Force C-130 Hercules on a remote taxiway.

Airport police, Shannon Airport fire and rescue, Garda units, and Irish Defence Forces personnel all responded. Additional armed Garda personnel were also reported at the scene. Shannon suspended operations at about 9:50 a.m. and resumed them at 10:15 a.m.

The extent of the aircraft damage is less cleanly established. Local reporting said the damage was “extensive,” but that description appears to come from unnamed sources, not a formal U.S. Air Force damage assessment released on the record.

The Actors

Irish police did not initially name the suspect. Court reporting later identified him as Daithí O’Corrain, 47, of Blarney Street, Cork City. He appeared before Limerick District Court charged with criminal damage to the C-130 Hercules, criminal damage to a perimeter fence, and trespass at a taxiway. He was refused bail and remanded in custody. On the reporting available so far, police and court coverage have not publicly laid out a full motive statement from O’Corrain.

Similar Breaches, Same Pattern

This is not a one-off. It fits a pattern that I have been writing about for a while, people with no elite training, no advanced kit, and no serious tradecraft getting onto airfields and reaching aircraft anyway. The common thread is not sophistication, it is weak perimeter control, bad response, complacency, and the fact that large airfields create dead ground and assumptions that people stop challenging.

We covered that in the Avalon Airport case in Australia. A 17-year-old got through a hole in the perimeter fence, used a high-visibility vest and tool belt to look like he belonged there, and reached a Jetstar aircraft carrying a loaded shotgun before crew and passengers stopped him.

The Brize Norton breach in June 2025 was even more embarrassing for the people responsible for protecting military aircraft. Palestine Action activists entered the RAF base, reached two Voyager aircraft, and damaged them with paint and crowbars after moving across the site on electric scooters.

The Andrews case was even worse because it stripped away any illusion that only activist cells or politically motivated groups do this. In 2021, a civilian with no credentials was waved through a gate at Joint Base Andrews, wandered around for hours, slipped past another access point, and boarded a C-40 used by senior U.S. officials. The detail everybody remembers is that he was reportedly wearing a hat that looked like Mickey Mouse ears.

Shannon sits cleanly inside that same line of failure. A lone man got through the perimeter, reached a parked U.S. military C-130, climbed onto it, and began striking the aircraft with a handheld tool.

In every one of these cases, there was no James Bond level of infiltration. No high tech gadgets or state level actors breaching security, it was simply untrained idiots with a will to commit crime and the courage to follow through with it.

Conclusion

For any readers of this blog, instances like this one shouldn’t be a surprise and the fact that untrained, low skill attacks worked to infiltrate, what should be, high security facilities or areas is almost expected.

So the next time someone tells you that “this area is high security”, make sure that you respond with, “Ya, but did you test it?”

Training Resources:

For individuals looking for a hands on training that includes all of the above topics, Covert Access Team (covertaccessteam.com) provides training courses focused on physical penetration testing, lockpicking, bypassing techniques, social engineering and other essential skills.

• Covert Access Training - 5 day hands on course designed to train individuals and groups to become Covert Entry Specialists

• Physical Audit Training - 2 day course on how to setup and run a physical security audit

• Elicitation Toolbox Course - 2 day course of that primarily focuses on elicitation and social engineering as critical aspects of Black Teaming

• Strategic Operations for Lone Operators - Advanced course for those who are interested in learning how to become a one man infiltration team.

• Counter Elicitation - 2 day course on how to recognize and prevent elicitation attempts, and safegaurd your secrets.

• Cyber Bootcamp for Black Teams - 2 day course designed explicitly for physical penetration testers who need vital cyber skills to add to their toolbox.

• Private Instruction - Focused learning & training based on your needs .

Its been a long time since I have watched the movie “Gone in 60 Seconds” but this story is effectively taken directly from it. Apparently 400 high end vehicles, worth around $40 million were stolen out of Michigan.

Prosecutors say eight men in southeast Michigan ran a scheme that moved stolen cars from local pickup points into shipping containers, then sent those containers by freight or rail to port cities for export overseas. The case started with Dearborn police and grew into a multi-agency federal investigation.

Federal authorities have publicly said the investigation recovered more than 350 stolen vehicles.

The Operation

According to the indictment unsealed on September 4, 2025, the conspiracy ran from July 2023 through August 2025. Prosecutors say the group received stolen vehicles at one of four commercial or industrial lots, loaded multiple vehicles into shipping containers, and arranged onward movement to port cities by freight or rail.

As I have mentioned previously, one of the easiest ways that smugglers use to get illicit goods in and out of countries are through ports, simply because of the high volume and low inspection rate. In Europe for instance,

OECD and Europol are clear that trying to “inspect everything” would gridlock ports, yet the current equilibrium leaves inspection rates around 1–2% in many contexts.

FOX 2 Detroit, citing Dearborn police Cpl. Daniel Bartok, reported that many of the vehicles were shipped to the Middle East, including Iraq and Dubai.

The official Justice Department release is more restrained on destination, saying only that the containers were shipped overseas from port cities if not interdicted. Taken together, the picture is straightforward, local theft, staging at lots, containerization, domestic transport, then export.

The Actors

The Justice Department identified the defendants as

• Haydar Al Haydari, 41, of Garden City

• Karar Alnakash, 43, of Detroit

• Abbas Al Othman, 42, of Dearborn Heights

• Mohammed Al Hilo, 36, of Detroit

• Moustapha Al Fetlawi, 46, of Dearborn Heights

• Terrill Davis, 33, of Detroit

• David Roshinsky Williams, 32, of Harper Woods

• Mohammed Al Abboodi, 35, of Detroit.

All were charged with conspiracy to transport stolen vehicles, and each also faces one or more counts of transportation of a stolen vehicle.

The charging documents released publicly do not spell out the full division of labor in detail, but the structure is obvious enough. Someone had to source vehicles, someone had to receive and hold them, someone had to pack containers, and someone had to push those containers into legitimate transport channels without drawing immediate scrutiny.

Tactics and Tradecraft

First its important to understand time on target, and unfortunately for general theft, that time is incredibly limited.

So when attempting to protect merchandise, and yes cars are in this category, understand that the amount of time thieves need to actually be around the car can be seconds to minutes depending on the car make and model due to vulnerabilities differences.

The above is a simple relay attack, often used on high end cars, that relies on one attacker having an antenna near the car keys and the other attacker have a receiver / transmitter near the car. The idea is simply to trick the car into thinking the keys / owner are standing next to the car, and thus allowing the car to open and drive off.

Of course, like all things, there are many different vulnerabilities for different cars, some mechanical, some technological, and some simple human error but all have vulnerabilities.

Stealing high end cars from lots implies your standard security suite: fences, alarms, cameras, etc. However, its obvious that these didn’t actually prevent the thieves from either getting access, nor getting away with the cars.

And while i have my suspicions on how the bad guys eventually got caught, I will leave it to you to formulate your own opinions on how the police pulled it off.

Conclusion

This is an example of an intelligent, well planned out criminal enterprise that was thankfully taken down by law enforcement. However, as security personnel, and security conscious people, we can learn from them on how to better secure our clients and ourselves.

Training Resources:

For individuals looking for a hands on training that includes all of the above topics, Covert Access Team (covertaccessteam.com) provides training courses focused on physical penetration testing, lockpicking, bypassing techniques, social engineering and other essential skills.

• Covert Access Training - 5 day hands on course designed to train individuals and groups to become Covert Entry Specialists

• Physical Audit Training - 2 day course on how to setup and run a physical security audit

• Elicitation Toolbox Course - 2 day course of that primarily focuses on elicitation and social engineering as critical aspects of Black Teaming

• Strategic Operations for Lone Operators - Advanced course for those who are interested in learning how to become a one man infiltration team.

• Counter Elicitation - 2 day course on how to recognize and prevent elicitation attempts, and safegaurd your secrets.

• Cyber Bootcamp for Black Teams - 2 day course designed explicitly for physical penetration testers who need vital cyber skills to add to their toolbox.

• Private Instruction - Focused learning & training based on your needs .

An attack on infrastructure feeding the Transalpine Pipeline in Italy briefly threatened fuel supplies across southern Germany and showed, again, how little force it can take to jam a major European energy artery.

Italian police are investigating damage to a transmission pylon near Udine that disrupted operations tied to the TAL crude route in late March.

MiRO, one of Germany’s largest refineries, said it received no crude through TAL for three days and had to run on stored stock. Reuters reported the disruption put gasoline, diesel, and jet fuel supplies in southern Germany at risk.

TAL carries crude from the Adriatic terminal at Trieste through Austria into Germany. That makes this more than a local Italian infrastructure incident. A strike on a support asset in northeast Italy was enough to put pressure on refinery operations deeper inside Central Europe.

The Attack

According to Reuters, the damage happened on March 25 near Udine. The affected asset was a Terna transmission pylon, not a refinery, terminal, or obvious pipeline control point. Repairs were completed four days later, but the interruption was still enough to cut off crude deliveries to MiRO for roughly three days through March 30.

TAL pushed back on reports of confirmed third-party action against its own facilities, but Italian police opened an investigation after media reports raised possible sabotage.

This type of attack is what we see over and over again; find the weakest point along the supply chain and attack there. As I have written about many times, removing power from a city or location is rarely done at the power plant, but instead, attackers will target substations, pylons or anywhere that security is weakest.

MiRO was able to stay online by burning through stored crude only underlines the point that attacks like this have an extremely limited buffer before everything shuts off. To put this into perspective

Based on MiRO’s published crude tank capacity and its reported 310,000 barrel-per-day throughput, the refinery appears to have enough on-site crude storage for roughly two weeks at full runs, at least on paper.

The real buffer is probably smaller. Tank capacity is not the same as usable emergency reserve, especially at a refinery running dozens of crude grades through a fixed process slate. Germany’s national emergency oil stocks sit behind that, but those are state reserves, not barrels waiting inside MiRO’s fence.

Put a different way, this simple attack was able to disrupt supply for 3 days, and if we assume a 14 day reserve (before hitting Germany’s national strategic reserve) this attack was able to use up ~21% of their reserve.

The Actors

Right now, the actors are unknown.

Reuters reported that Italian police are investigating the incident, that Terna said the damage was caused by unknown parties, and that TAL denied confirmed third-party action against its own infrastructure. That leaves a serious infrastructure attack under investigation, but no public attribution and no public claim of responsibility.

Why pylon damage disrupted the pipeline

TAL depends on electrically powered pumping infrastructure to push crude from Trieste across the Alps and into Central Europe. Reuters reported that damage to a transmission pylon near Udine temporarily disrupted TAL operations in March, even though the public reporting did not indicate the pipeline itself was physically hit.

That relationship is straightforward. A long-distance crude pipeline is not a passive tube. It needs pumping stations to maintain pressure and keep flow moving. TAL’s own material says the system uses pump stations and that parts of the line are tied directly into the power system, including energy infrastructure built around the flow of crude through the route. If power feeding those operations is interrupted, throughput can drop or stop even when the steel line remains intact.

As I have harped on many times, everything is downstream of electricity, even things like water, gas an oil. If you cut off electricity, everything else will fail and thats exactly why its so important to protect it.

Also realize that this is the exact type of attack / incident that took out power to the entire Iberian Peninsula last year, a single, seemingly tiny point of failure has a cascading effect on everything downstream.

Conclusion

These styles of attacks are things that have become trends across Europe, and the West and are something that will likely continue into the future.

From Berlin, Heathrow, Iberian Peninsula, Fort Bragg, only to name a few recent incidents, these attacks are not slowing down, but they continue to show just how fragile infrastructure is and how with the removal of a single piece, everything can come tumbling down.

Training Resources:

For individuals looking for a hands on training that includes all of the above topics, Covert Access Team (covertaccessteam.com) provides training courses focused on physical penetration testing, lockpicking, bypassing techniques, social engineering and other essential skills.

• Covert Access Training - 5 day hands on course designed to train individuals and groups to become Covert Entry Specialists

• Physical Audit Training - 2 day course on how to setup and run a physical security audit

• Elicitation Toolbox Course - 2 day course of that primarily focuses on elicitation and social engineering as critical aspects of Black Teaming

• Strategic Operations for Lone Operators - Advanced course for those who are interested in learning how to become a one man infiltration team.

• Counter Elicitation - 2 day course on how to recognize and prevent elicitation attempts, and safegaurd your secrets.

• Cyber Bootcamp for Black Teams - 2 day course designed explicitly for physical penetration testers who need vital cyber skills to add to their toolbox.

• Private Instruction - Focused learning & training based on your needs .

A Dunwoody records dispute has produced allegations that Flock Safety personnel may have accessed live camera feeds tied to sensitive locations, including spaces reportedly used by children.

Flock Safety is an Atlanta-based public safety technology company that sells automated license plate readers, camera systems, and related surveillance tools to police agencies, neighborhoods, and businesses.

I want to make a point that, the claims described in this article remain disputed and unproven based on the public record currently available.

The allegation comes out of a real records fight in Dunwoody over audit logs, access controls, and who allegedly entered the city’s Flock environment.

Note that the public material currently available does not support stating the allegations are established fact.

Dunwoody officials publicly questioned Flock’s contract, access practices, and policy terms in early 2026. The city’s own security review also identified concerns around non-police logins, audit oversight, and misuse-detection controls.

Separately, a local records-based analysis claimed that audit logs appeared to show Flock employees accessing feeds associated with locations including a pool, library, and gymnastics area.

The Case

The core allegation appears to come from Dunwoody resident Jason Hunyar, who published an April 8, 2026 post claiming records obtained through open-records requests purported to show Flock employees allegedly opening feeds tied to several locations at the Marcus Jewish Community Center and other sites in Dunwoody. Hunyar claimed the logs allegedly reflected access by named Flock employees.

According to Jason,

Flocks ‘audits’ only show when a person initiated a liveview camera. They do not show the duration of the liveview, or when it ended. This is a fundamental issue with the auditing of the system, and thus we do not know when someone stops looking at a camera. All of the claims below come with that caveat.

Hunyar claimed that, in his view, the audit records were incomplete and that he believed they indicated repeated access by Flock employees.

CAT has not independently reviewed the complete underlying log set, and these claims remain disputed.

The following video clip discusses the allegations surrounding the dispute and should not be treated as independent proof of the underlying claims.

Dunwoody’s March 23, 2026 IT security assessment identified “Non-PD direct logins” as a risk item and also flagged concerns involving audit-log review, supervisory oversight, and misuse-detection documentation. That city document does not prove Hunyar’s interpretation of any specific access event. It does, however, verify that Dunwoody itself was already examining access and audit-control issues inside the Flock environment.

In December 2025, 404 Media reported that dozens of Flock Condor PTZ camera feeds were exposed to the open internet, allegedly allowing unauthorized viewing of live streams, archived footage, and certain administrative functions. That incident does not prove the Dunwoody allegation, but it does indicate that Flock’s video-access controls were already under public scrutiny before the Dunwoody records fight intensified.

Flock’s offical FAQ, states that company personnel do not access or monitor customer footage in the manner alleged here.

The company states, “Nobody from Flock Safety is accessing or monitoring your footage,” and separately states, “Flock will not share, sell, or access your data.” On the same page, Flock also says it does not access or monitor footage without an explicit request from the customer, while noting that its team has software in place to measure camera performance and image capture quality.

Conclusion

While this is a serious accusation, based on the public record currently available, it remains disputed and unproven.

A hacker using the name “FlamingChina” claims to have pulled more than 10 petabytes of data out of China’s National Supercomputing Center in Tianjin, a state-run high performance computing hub that supports thousands of research, industrial, and government users.

Multiple outlets reporting on the leak say the claim is still unverified, but analysts who reviewed sample files told CNN the material looks consistent with the kind of work run through the facility.

The Operation

Reporting around the case points to the National Supercomputing Center in Tianjin, often shortened to NSCC-TJ, as the likely source of the stolen material. Official descriptions of the center say it serves roughly 6,000 clients across China, including research institutes, businesses, and government agencies. That client base helps explain why the leaked samples reportedly cut across aviation, weapons work, scientific modeling, and other technically different but compute-heavy disciplines.

The seller posted the data for sale on February 6, 2026, according to reporting cited by TechRadar and Security Affairs. Limited samples were allegedly offered for smaller amounts, while full access was marketed for hundreds of thousands of dollars in cryptocurrency. Analysts cited in that reporting said the samples included schematics and renderings tied to aircraft, missiles, bombs, and other high-end research outputs.

A supercomputing center brings together computing workloads, stored data, and research outputs from multiple users in one environment.

If that environment is compromised, the exposure may extend beyond final documents to include simulation files, draft models, test results, and other working material. In practice, that can provide a more detailed view of a program’s development than polished public or internal summaries alone.

The Actors

Very little is firmly established about FlamingChina beyond the handle itself. Public reporting does not identify a known crew, a leadership structure, or a confirmed state sponsor. Right now, “FlamingChina” is best understood as the name attached to the sale and leak operation, not a fully attributed threat actor with a proven history. Multiple reports describe it as either a single hacker or a small group, which is another way of saying nobody credible has pinned down the real size of the operation yet.

The first public trace appears to be in early February 2026. Reporting says an account calling itself FlamingChina posted sample material from the alleged Tianjin haul on an anonymous Telegram channel on February 6. SpyCloud’s February cybercrime roundup says the same leak was offered for sale on February 4 on a BreachForums successor by a user named airborneshark1, and adds that the actor releasing the data appeared to run the FlamingChina Telegram channel as well. That does not prove FlamingChina is an established group with multiple operators, but it does suggest the persona was active across at least two distribution channels, a forum sales post and a Telegram leak channel.

On manpower, there is no reliable public number. No outlet I found gives a confirmed member count, and no threat-intelligence reporting in the public domain ties the name to a known roster, affiliate network, or broader criminal ecosystem.

Location is also unresolved. The target was in Tianjin, but that says nothing about where the operator sat. The infrastructure discussed in reporting, Telegram, crypto payment, breach-market sales, and a claimed botnet-assisted exfiltration route, points to a remote actor with access to standard cybercrime channels, not to a physically proximate penetration team.

Conclusion

If the leak is real, this was not just theft of stored data. It was access to a national-level research and simulation backend that appears to have pooled work from defense, aerospace, science, and government clients in one place.

That is the kind of compromise that lets an adversary map programs, dependencies, timelines, and weak points across sectors at once.

People talk about cameras, access control, reinforced doors, alarms, glazing, fences, fog systems, analytics, and AI. All of that matters, but only up to a point. In the end, physical security still comes down to one thing: can armed forces get to the problem in time and actually stop it.

Now I know some of you may disagree with me about guns, but realize that if the criminals know that nobody with one is going to try and stop them, than you regularly see scenes like this

Now obviously the police response time was faster than the criminals could rob the store and get away … but it simply didn’t matter because the police decided not to get involved, and therefore, all the security features this store had put in place were irrelevant.

When it comes to armed security, that might be you, a private security team, or the police. Remember that security barriers can buy you time, but that time should be a countdown until armed police arrive to stop and arrest the bad guys. But again, if the police refuse to get involved than, as I mentioned in this video, you ultimately don’t have any security.

That said, and because many countries do not allow for citizens to be armed, or defend themselves, a eager little meat missile can also be very useful at deterring crime

The Numbers

Start with the United Kingdom, because one of the most common lines pushed in online arguments is that domestic burglary there is “basically always solved.” The specific claim you flagged, that roughly 92 percent of home invasions are solved in the UK, does not survive contact with official data.

For the year ending March 2025, the government said the charge rate for residential burglary was 4.7 percent, and the charge rate for home burglary was 5.5 percent.

In the same release, the government said 69.6 percent of burglary offences were closed with no suspect identified. That is not a 92 percent solve rate. It is the opposite story.

By Contrast, lets pivot over to the NYPD’s official clearance reporting for Q2 2025 showed a citywide burglary clearance rate of 38.3 percent for complaints made in that quarter. Using the broader accounting method that includes older complaints cleared during the quarter, the figure was 52.5 percent.

That said, even on the friendlier metric, nearly half of burglary complaints were not cleared. On the tighter same-quarter measure, well over sixty percent were not. The New York City Council’s own review of 2024 NYPD data put average citywide burglary clearance at 33 percent for complaints made and cleared in the same quarter, or 43 percent using the broader all-complaints-cleared measure. Different methodologies move the number around, but none of them describe a system that reliably catches burglars.

When you are assessing security recommendations for clients, these are numbers that you certainly want to keep in mind an research.

The Delay

Police response time matters because it gives you the minimum delay budget your site has to create.

If your realistic police arrival time is seven minutes, then your perimeter, doors, windows, internal compartmentation, safe room, and alarm chain need to keep the intruder from reaching people or target assets for at least that long.

That said, I strongly encourage everyone to know what the police response time is for your area, for example, here is the NYPD’s.

London’s published police performance data says forces aim to answer 90 percent of 999 calls within ten seconds. The Met’s own FOI material shows an immediate-grade target response time of 15 minutes. That target matters because it is the clock a burglary victim is really designing against, not the fantasy number.

All of that said, delaying bad guys is only useful under the assumption that there is a finish line for delaying them, meaning that eventually when the timer runs out, good guys with guns will show up to stop them … But as we have seen, this sadly isn’t always the case, and unfortunately, is some cities and areas, this is becoming the norm.

The Failure Point

In the end, this often isn’t the fault of the police themselves, as they are always given directives on how to handle various situations and crime.

While this fact is incredibly frustrating, to see police officers standing by watching crime happen, remember that they aren’t the ones who decide policy, they are simply enforcing the policy, but you should ALWAYS know what the policy is in the areas that you and your clients are operating in, because it can make a huge difference.

Conclusion

I highly encourage everyone from the security expert, to the client to understand these numbers and what they mean for your security requirements.

My recommendation is to always give an extra 25 - 50% on security delaying for police response time. So if the average police response time for a burglary is 10 min in your area, i recommend a minimum delay of 12 - 15 min, because remember, thats the average and on busy nights it may be much longer.

Also know the criminal outcomes in your areas, if very few crimes are ever solved in your area, this is information that is invaluable to you because it means that there is an almost guarantee that the people who broke into your office / home / etc will not be caught.

Stay safe out there

Training Resources:

For individuals looking for a hands on training that includes all of the above topics, Covert Access Team (covertaccessteam.com) provides training courses focused on physical penetration testing, lockpicking, bypassing techniques, social engineering and other essential skills.

• Covert Access Training - 5 day hands on course designed to train individuals and groups to become Covert Entry Specialists

• Physical Audit Training - 2 day course on how to setup and run a physical security audit

• Elicitation Toolbox Course - 2 day course of that primarily focuses on elicitation and social engineering as critical aspects of Black Teaming

• Strategic Operations for Lone Operators - Advanced course for those who are interested in learning how to become a one man infiltration team.

• Counter Elicitation - 2 day course on how to recognize and prevent elicitation attempts, and safegaurd your secrets.

• Cyber Bootcamp for Black Teams - 2 day course designed explicitly for physical penetration testers who need vital cyber skills to add to their toolbox.

• Private Instruction - Focused learning & training based on your needs .