APDR News in Brief 24 November 2024

Infoblox IDs malicious DNS threat actors: Hijacking domains using a ‘Sitting Ducks attack’ remain an under-recognised topic in the cybersecurity community. Few threat researchers are familiar with this attack vector and knowledge is scarce. However, the prevalence of these attacks and the risk to organisations are significant. Following its initial publication on Sitting Ducks, Infoblox Threat Intel delved deeper into this topic. The result is a new, eye-opening report estimating that over one million registered domains could be vulnerable daily. The report also explores the widespread use of the attack and how multiple actors leverage it to strengthen their malicious campaigns. During a Sitting Ducks attack, the malicious actor gains full control of the domain by taking over its DNS configurations. Cybercriminals have used this vector since 2018 to hijack tens of thousands of domain names. Victim domains include well-known brands, non-profits, and government entities. Infoblox Threat Intel crafted a monitoring initiative after the initial paper on Sitting Ducks attacks was published in July 2024. The results are very sobering, as 800,000 vulnerable domains were identified, and about 70,000 of those were later identified as hijacked. Vacant Viper is one of the earliest known threat actors to exploit ‘Sitting Ducks’ and has hijacked an estimated 2,500 domains each year since December 2019. This actor uses hijacked domains to augment its malicious traffic distribution system (TDS) called 404TDS with the intention to run malicious spam operations, deliver porn, establish remote access trojan (RAT) C2s, and drop malware such as DarkGate and AsyncRAT. Vacant Viper does not hijack domains for a specific brand connection but instead for a set of domain resources that have high reputations and will not be blocked by security vendors. The newly published report lists examples of attack chains showing redirection techniques used both by the 404TDS and its affiliates, including how Vacant Viper uses hijacked domains in the 404TDS. Palo Alto Networks honours leading JAPAC partners: Palo Alto Networks announced the recipients of its JAPAC Partner Awards at the Palo Alto Networks Executive Kick-Off (PEKO). These annual awards recognise the remarkable contributions, vision, and leadership of our partners in the Asia Pacific and Japan region, who play a critical role in advancing security resilience for organisations facing ever-evolving cyber threats across the region. Janet Docherty, Director of Channel Sales & Alliances ANZ, Palo Alto Networks, said, “Our partners are instrumental in safeguarding organisations across JAPAC. As cyber threats grow more complex and widespread, the commitment of our partners empowers us to extend our reach and help more organisations strengthen their defences. We’re immensely proud to celebrate their achievements and contributions to our mission.” The 2024 JAPAC Partner Award winners are: JAPAC Precision AI Innovator of the Year – CyberCX (ANZ); JAPAC Strategic Win of the Year: Security Operations – ACPL Systems (India); Network Security – PT NTT Indonesia (ASEAN); Prisma SASE – TeamWave, Inc. (Korea); Prisma Cloud – KPMG Assurance and Consulting Services (India); JAPAC Cybersecurity for Good Award – Net One Systems Co. Ltd. (Japan); JAPAC Cybersecurity Frontier Award – Exclusive Networks Singapore Pte. Ltd. (ASEAN); JAPAC Platformization Excellence Award – NTT Communications (Japan); JAPAC Market Expansion Champion Award – ECCOM Network Systems Co. Ltd (Greater China); JAPAC Cyberforce Champion Award – IIJ Global Solutions Inc. (Japan); JAPAC Global Alliance Innovator Award – NTT DATA, Inc. (APAC); JAPAC Distributor Excellence Award – TECHMATRIX CORPORATION (Japan). Elbit Systems wins deal with European country for defence systems: Elbit Systems announced that it was awarded contracts worth a total amount of approximately $335 million, to supply defence systems to a European country. The contracts include the supply of PULS (Precise and Universal Launching Systems) rocket launchers and rockets, as well as Hermes 900 Unmanned Aircraft Systems (UAS) equipped with advanced payloads. The contracts will be performed over a period of three years and six months. Elbit Systems’ PULS provides a comprehensive and cost-effective solution capable of launching unguided rockets, precision-guided munitions, and missiles with various ranges. The PULS launcher is fully adaptable to existing wheeled and tracked platforms, enabling significant reductions in maintenance and training costs. The Hermes 900 multi-role MALE UAS is Elbit Systems’ largest unmanned aerial vehicle, designed to perform a wide range of missions, including area dominance and persistent intelligence, surveillance, target acquisition and reconnaissance (ISTAR) across land and maritime domains. Since its first order of in 2011, the Hermes 900 has been selected by over 20 customers worldwide. Airbus delivers first of up to 82 H145Ms to Germany: Less than a year after the contract was signed, Airbus Helicopters has delivered the first of up to 82 H145Ms ordered by Germany at its Donauwörth site. The Bundeswehr (German Armed Forces) have named their new H145Ms “Leichter Kampfhubschrauber” (light combat helicopter), or LKH for short. The helicopter’s missions include training, reconnaissance, special forces operations and light attack. This first helicopter is dedicated to training operations and will be used at the German Army’s Bückeburg base. The first delivery of an H145M LKH in the light attack role to the German customer is scheduled for 2025, as contracted. The training of the Bundeswehr’s pilots started already in August this year. In December 2023, the Bundeswehr and Airbus Helicopters signed a contract for the purchase of up to 82 multi-role H145M helicopters (62 firm orders plus 20 options), the largest order ever placed for the H145M and consequently the largest for the HForce weapon management system. The contract also includes seven years of support and services, ensuring optimal entry into service and support. The German Army will receive 57 helicopters, while the Luftwaffe’s special forces will receive five. The H145M is a multi-role military helicopter that provides a broad range of mission capabilities. Within minutes, the helicopter can be reconfigured from a light attack role with axial ballistic and guided weapons and a state-of-the-art self-protection system into a special operations version with fast rappelling equipment. The comprehensive mission packages include hoisting and external cargo capabilities. HENSOLDT demonstrates successful overall system integration in “Timber Express”: Sensor solutions provider HENSOLDT has once again demonstrated its technological capabilities as part of the multinational ‘Timber Express 2024’ exercise. The OPTARION mission support system successfully integrated NH90 and TIGER helicopters in a secure data link network and connected them to modern command and information systems. “Seamless connectivity and the secure exchange of situational information between different weapon systems are crucial for today’s hybrid operations on the battlefield,” explains Alex Irmscher, programme manager for ground stations at HENSOLDT. “Thanks to our EUA solutions, it was possible to integrate the aircraft into the Bundeswehr’s digital command network without having to modify the weapon system.” The centrepiece of the demonstration was the transmission of real-time data between the helicopters and other platforms along the ‘sensor-to-effector’ chain. A special feature was the connection of the platforms to the “SitaWare HQ” battle management system and the real-time integration into Link-16, the standardised tactical data link network used by NATO and partner nations. This networking helps the armed forces to create a unified situation picture and improve decision-making in complex scenarios. A core aspect of the OPTARION mission support system is its ability to increase the operational efficiency and deployment flexibility of the armed forces. In an increasingly network-centric warfare, it enables the linking of different platforms and systems via secure data links, creating a common and dynamic situation picture. This network-centric operations capability not only improves real-time decision-making, but also ensures a high level of interoperability. This makes OPTARION a key component for modern combat operations and provides the armed forces with the technological basis for successfully operating in complex and rapidly changing threat scenarios. GE Aerospace receives KC-135 data contract: GE Aerospace was awarded a production contract for Integrated Data Acquisition Recorder (IDAR) systems for the United States Air Force (USAF) fleet of 396 KC-135 aircraft. GE Aerospace will begin deliveries to the USAF in 2026 and will continue through 2031. Under the contract, GE Aerospace will upgrade the existing IDAR and incorporate advanced components with new growth capabilities, including cybersecurity and potential data encryption features which will extend the life of the USAF KC-135 fleet. The Integrated Data Acquisition Recorder can simultaneously acquire, process, analyse, and store critical aircraft data such as structural, engine, maintenance, mission, and system health information, while providing crash survivable flight data recording functionality. The IDAR has been instrumental in supporting the USAF Aircraft Structural Integrity Programs (ASIP) and Military Flight Operations Quality Assurance (MFOQA) programs. Gripen E excels at CRUZEX: In its global debut at a multinational exercise, Gripen E exceeded expectations, making a powerful first impression. Nearly two years after being introduced into active service with the Brazilian Air Force (FAB), the F-39E Gripen concluded its participation in CRUZEX 2024, confirming FAB’s projections. “Expectations were surpassed, especially regarding availability. We brought seven aircraft as planned and almost every day we had all seven fighters available on the flight line. The Composite Air Operations (COMAO) missions involved four F-39E Gripens in the morning, along with another smaller mission in the afternoon with two more aircraft,” explained Lieutenant Colonel Ramon Lincoln Santos Fórneas, commander of the 1st Air Defence Group (1º GDA). Whether acting as an Allied or an Opposing Force, the integration and performance of the systems were exceptional, showcasing the F-39E Gripen’s capabilities as a modern weapons platform. The fighter’s interaction with other aircraft in the same formation also went smoothly, providing air superiority and protection for transport and attack aircraft formations during the Composite Air Operations (COMAO), which involved dozens of aircraft flying simultaneously in the same airspace. Textron Aviation delivers multi-mission Beechcraft King Air 360CHW: Textron Aviation announced the Peruvian Air Force has received the first of two aeromedical evacuation-equipped Beechcraft King Air 360CHW special missions aircraft. “The King Air 360CHW delivered to the Peruvian Air Force for aeromedical evacuation (MEDEVAC) can also execute troop and cargo transport, command and control and many other missions,” said Bob Gibbs, vice president, Special Mission Sales. “From the coast and the highlands to the Amazon rainforest of Peru, the versatile King Air is well suited to operate in diverse, austere and remote locations.” Delivery of a second aeromedical evacuation-equipped King Air 360CHW is expected in 2025. When government, military and commercial customers want airborne solutions for critical missions, they turn to Textron Aviation. The company’s aviation solutions provide the high performance and flight characteristics required to address the unique challenges of special missions operations. With unparalleled quality, versatility and low operating costs, Textron Aviation products are ideal for air ambulance; intelligence, surveillance and reconnaissance (ISR); utility transport; aerial survey; flight inspection; training and a number of other special operations. Austria begins modernisation of its C2 capability with Systematic Defence: Systematic Defence is proud to announce the signing of a significant contract with the Austrian Armed Forces for the delivery of its world-leading command and control software, SitaWare Headquarters and SitaWare Frontline. This contract marks an important expansion of the SitaWare user community, with Austria becoming the latest nation to adopt the proven C4ISR solution to enhance its operational command and tactical capabilities. Following a public tender process, the Austrian Federal Army selected SitaWare Headquarters for its advanced command-and-control (C2) capabilities, including its ability to deliver seamless interoperability and information sharing across military units and coalition partners. In tandem, SitaWare Frontline will provide Austrian forces with a robust mounted solution, enhancing communication and situational awareness at the tactical edge. This marks a key component in the Austrian Armed Forces efforts to modernise its C2 infrastructure and ensure efficient communication from headquarters to the frontline. SitaWare Headquarters, already used by over 50 countries worldwide, is renowned for its ability to enhance collaborative planning, provide comprehensive situational awareness, and improve decision-making processes at all levels of command. The addition of Austria to the SitaWare user family also strengthens the international network of militaries benefiting from its force-multiplying capabilities. Earlier this year NATO also procured SitaWare for its land forces, with SitaWare Headquarters becoming the Future Land C2 capability under the project DEMETER. The interoperability with NATO, especially the compliance with NATO’s Future Mission Networking (FMN) concept, was key criteria for the selection of SitaWare. In line with this growing partnership, Systematic Defence is also opening a new office in Vienna, Austria, further strengthening the company’s commitment to customers within the DACH region. Next-gen electronic warfare system for Eurofighter Typhoon: The EuroDASS consortium, the industrial partnership responsible for the Eurofighter Typhoon’s ‘Praetorian’ defensive suite, has unveiled details on the next generation of Typhoon sensing and jamming capabilities following the completion of concepting work and technology flight trials. EuroDASS partners Leonardo, ELT Group, Indra and Hensoldt, drawing on Europe’s sovereign electronic warfare expertise, are working with systems integrator BAE Systems to develop the system in support of its Typhoon Next Generation initiative. The next-generation electronic warfare system will future-proof Typhoon against new and emerging threats through to 2060 and beyond, providing improved situational awareness and increased survivability. Key features will include advanced complex threat characterisation, Digital Radio Frequency Memory (DRFM) capabilities and the provision of interfaces for an external, high-powered electronic attack pod for Suppression of Enemy Air Defence (SEAD) missions; a key NATO requirement. Wideband Active Electronically Scanned Array (AESA) Electronic Counter-Measures (ECM) will be provided with increased power for self-protection. The new system will be a form-fit retrofit option for Typhoon’s in-service Defensive Aids Sub-System (DASS), named Praetorian after the elite Roman bodyguard corps. It will have no impact on the outer mould line of Typhoon and impose no restrictions on the current flight envelope. This minimises aircraft clearance and ensures ease of integration for new build aircraft as well as retro-fit to existing platforms. Typhoon will be more capable, more survivable, and more available, meeting the operational needs of air forces across Europe and the Middle East for decades to come. Saab and DSTA deepen partnership: Saab and Singapore’s Defence Science and Technology Agency (DSTA) have signed an expanded Memorandum of Understanding (MoU) to deepen collaboration on the exploration of underwater technologies. The agreement was signed 20 November at the Sweden – Singapore Royal Business Forum in connection with the first Swedish state visit to Singapore. The expanded MoU builds upon a previous agreement signed in 2023, which focused on long-term supportability, people development, and smart technologies. With the updated scope, DSTA and Saab will jointly explore cutting-edge underwater solutions aimed at building and safeguarding capabilities for enhanced maritime security and resilience. The parties will conduct joint studies of operational concepts and emerging technologies. “This expanded MoU builds upon the fruitful cooperation between Saab and DSTA in the naval domain and reflects our shared commitment to underwater technology innovation. Together, we will leverage our expertise to strengthen maritime security,” said Anders Carp, Saab’s Deputy CEO. GE Aerospace demonstrates hybrid electric propulsion system: GE Aerospace successfully demonstrated a hybrid electric propulsion system rated at one megawatt as part of a $5.1 million research and development contract from the U.S. Army Combat Capabilities Development Command (DEVCOM) Army Research Laboratory (ARL). Under the Applied Research Collaborative Systematic Turboshaft Electrification Project (ARC-STEP) contract, GE Aerospace conducted research, development, testing, and evaluation of a megawatt (MW) class electrified powerplant that further identified and matured technologies applicable to future Army air vehicle propulsion as well as military electrified ground vehicles. The successful demonstration involved a CT7 turboshaft engine combined with GE Aerospace-produced electric machine and power electronics. Throughout testing – which was conducted at the GE Aerospace Research Center in Niskayuna, New York – subject matter experts from both the U.S. Army and GE Aerospace investigated and integrated technologies that enable lightweight, efficient, reliable, and safe hybrid-electric propulsion systems. The impact of hybrid electric propulsion on the efficiency and effectiveness of various platform types was also examined. KONGSBERG signs deal for NASAMS and NOMADS: Kongsberg Defence & Aerospace (‘KONGSBERG’) has signed a contract with the government of the Netherlands for the delivery of NASAMS and NOMADS air defence systems. The contract is valued at about NOK 12 billion. The contract was signed on November 21. It followed the announcement by KONGSBERG on October 14, when the Dutch government filed a recommendation to Parliament, outlining its intention to acquire the new systems as part of the CITADEL programme, a comprehensive integrated air and missile defence programme. LINK “By selecting NASAMS and NOMADS the Netherlands will enhance its air defence capabilities with an integrated system that covers short- and medium range threats. The Netherlands continues to be a strong and integral member of the larger NASAMS user community, and we are pleased to welcome the country as the first international NOMADS user,” said Eirik Lie, President of Kongsberg Defence & Aerospace. The Netherlands first acquired the NASAMS system in 2006. The new acquisitions will improve and expand the country’s ground-based air defence capabilities. The CITADEL solution also includes the National Manoeuvre Air Defence System, NOMADS – a highly mobile air defence configuration with short range missiles tailored to protection of land forces in a dynamic and contested land warfare environment. NOMADS is fully integrated with NASAMS and other NATO systems, enabling autonomous and networked operations with multiple vehicles. Deliveries will commence in 2028. For Editorial Inquiries Contact: Editor Kym Bergmann at [email protected] For Advertising Inquiries Contact: Group Sales Director Simon Hadfield at [email protected]