FTRCRP

First Agentic Ransomware, Four Nights Over Kyiv, Ankara Draws the Line

Mon, 13 Jul 2026 00:00:00 +0000

Issue 023 covers 4–11 July 2026: JadePuffer, the first documented fully agentic LLM-driven ransomware, arriving alongside a BeyondTrust critical auth bypass with 2,000 instances still exposed; Russia’s four consecutive ballistic missile salvos on Kyiv killing 70+ in one week; the NATO Ankara summit committing $58 billion in new defence procurement with Norway signing onto Triton drones and a $922M South Korean MLRS deal; Norway rebuffing Trump on Greenland and removing China’s stone lions from Svalbard; and the US-Iran exchange widening across the Gulf as the ceasefire was declared over.

Assembly Breach, Five Thousand Sorties, Black Walks

Sat, 04 Jul 2026 00:00:00 +0000

World Leaks ransomware group breached Tata Electronics, Apple’s primary iPhone assembly partner in India, leaking more than 200,000 iPhone 18 Pro component files to the dark web; Oracle’s E-Business Suite faced confirmed active exploitation while a separate PeopleSoft zero-day struck Nissan and hundreds of insurance sector clients; per NATO all 32 members met the 2% GDP defence spending threshold in 2025, a first for the alliance, with a 5% target now set for 2035; NATO Secretary-General Rutte confirmed approximately 5,000 US aircraft sorties from European bases during the US-Iran military exchange of 26-29 June; Apollo founder Leon Black walked out of a House Oversight interview on 26 June, the first walkout of the Epstein depositions, and was subpoenaed to return under oath on 16 July; and Russia launched a massive combined assault on all ten Kyiv districts on 1-2 July, killing eight.

Mythos Breaks NSA, World Leaks Apple, Kapotnya Burns

Sat, 27 Jun 2026 00:00:00 +0000

Week 26: a US senator discloses that Anthropic’s Mythos AI model, in a controlled red-team test against a replica of NSA classified systems, found vulnerabilities in nearly all of them within hours, days before a Five Eyes joint advisory on AI-driven offensive hacking; World Leaks ransomware posts roughly 630 GB of Apple and Tesla supply-chain data from Tata Electronics; Operation Endgame dismantles the Amadey-StealC infostealer network across 326 servers and 142 domains, recovering 27 million stolen credentials; Ukraine’s Liutyi drones put Kapotnya refinery offline until year-end and trigger Russia’s worst fuel crisis in years; and publicly released DOJ Epstein disclosure datasets cross-checked against E24, Aftenposten and Filter Nyheter document a $250,000 wire tied to Terje Rød-Larsen, a leaked confidential UN briefing (resolution 1559), and a set of Thorbjørn Jagland emails handled in full in FTRCRP’s investigation.

Zero-Day Sweep, Helsinki Goes Nuclear, Epstein's Files Go Public

Sun, 21 Jun 2026 00:00:00 +0000

ShinyHunters breached 100+ organisations via Oracle PeopleSoft zero-day CVE-2026-35273 including the Council of Europe; a Fortinet credential-harvesting campaign swept Fortune 500 firms and government agencies across 15 countries; Finland’s parliament voted to lift its decades-long nuclear weapons ban; the US and Iran agreed a preliminary ceasefire reopening the Strait of Hormuz; and Congress subpoenaed the Epstein estate, the Clinton family, and the DOJ as Bill Gates testified before House Oversight and fresh DOJ document batches landed under the 2025 Epstein Files Transparency Act.

Bear Gap, Patch Tuesday, and Gates Under Oath

Thu, 11 Jun 2026 00:00:00 +0000

Issue 019 covers Norway’s unanimous Storting defense vote (NOK 11B+, 6 submarines, 5 frigates), the Narvik Agreement placing Norway under French nuclear deterrence as the 9th NATO ally, and Defence Minister Sandvik’s Bear Gap warning; Microsoft’s record 206-flaw June Patch Tuesday with one actively exploited zero-day (CVE-2026-45586); a Red Hat npm supply-chain backdoor across 32 packages and 116,991 weekly downloads; Bill Gates’s House Oversight testimony that Epstein leveraged his extramarital affair as pressure; and the US-Iran war’s Day-100 escalation with 49 Tomahawks fired and Iranian ballistic missiles intercepted over Jordan.

Smoke and mirrors: the disclosure hype is conveniently timed

Wed, 10 Jun 2026 00:00:00 +0000

Disclosure Day in theaters, Sleeping Dog on the podcast circuit, eight explosive videos in Washington… the attention machinery is at full throttle in a June when the ground is shifting. The phenomenon stays an open question, the hype has an incentive structure worth reading.

Extend the thinking, do not substitute it

Tue, 02 Jun 2026 00:00:00 +0000

Three pillars for using AI honestly in study and security work, and what a hardened lab actually taught me.

Reading

Tue, 02 Jun 2026 00:00:00 +0000

The opinions on this site are ours. This is the ground they stand on.

An evidence-based platform owes you its sources, and not only the footnotes on a single article. These are the books that shaped how we think about technology, privacy, and the friction between the two. No affiliate links, no sponsored placements, no Amazon kickback. If a book is here, it earned the line on its own.

The bridge: technology and the human

Where machines and meaning meet, which is most of what this site is about.

A Stolen Registry, a Nuclear Umbrella, and a Royal Reckoning

Mon, 01 Jun 2026 00:00:00 +0000

Lithuania’s state land registry was stolen, more than 600,000 records covering close to a fifth of the population, with politicians openly worried the data lands with Russian intelligence. Norway came under France’s nuclear umbrella through the Narvik Agreement, and Moscow answered with a public threat. Crown Prince Haakon addressed the Epstein questions around the Crown Princess in public for the first time as SVT released new Swedish files. The ShinyHunters federation kept its run going, Carnival confirmed a breach touching nearly six million people and Charter confirmed one of its own. A Gogs zero-day shipped with a working exploit and no patch, and the FBI warned twice, on a phishing service that walks past Microsoft 365 multi-factor and on a ransomware crew that shows up at law firms in person. Russia put an Oreshnik on Kyiv and a drone into a NATO member’s apartment block.

AI Transparency Notice

Tue, 19 May 2026 00:00:00 +0000

What this page is for

This is a plain-language explanation of how AI tools are used across ftrcrp.org. It exists so a reader can know, at a glance, what role AI played in any piece they are reading. The legal scaffolding is in the editorial standards page, this one is for people who want a straight answer.

How AI is used

The site publishes across several sections, each handled differently.

OWA, Glasswing, and a Refused Ransom

Tue, 19 May 2026 00:00:00 +0000

A critical Exchange OWA cross-site scripting flaw (CVE-2026-42897) is being exploited via crafted email, CISA pushed it to KEV inside 24 hours. Anthropic loosened the Mythos disclosure policy on Project Glasswing, partners can now share AI-found zero-days more broadly. The Coinbase Cartel listed Grafana on its leak site and Grafana publicly refused the ransom. The mini Shai-Hulud worm hit 170+ npm packages and 2 PyPI packages across TanStack, Mistral AI, and Guardrails AI namespaces. MuddyWater’s Q1 espionage campaign turns out to span nine countries including a major South Korean electronics maker. Stortinget’s Epstein commission of enquiry held its first session, the work has started.

From the Goblins to the Hearing

Tue, 12 May 2026 00:00:00 +0000

Two weeks at once. OpenAI hardcoded a system-prompt override to stop ChatGPT 5.1 from talking about goblins. DENIC broke the .de TLD with bad DNSSEC and Cloudflare disabled validation to keep Germany online. Trellix’s source code was breached. A Linux kernel LPE and a Palo Alto firewall RCE both landed on CISA KEV with active exploitation. The DOJ Epstein archive crossed 269,000 PDFs and the Stortinget control hearing on the Norwegian-Epstein thread is running this week.

Goblins in the Machine, Holes in the Wire

Thu, 07 May 2026 00:00:00 +0000

OpenAI hardcoded a system-prompt override to stop ChatGPT 5.1 from talking about goblins. DENIC broke the .de TLD with bad DNSSEC signatures and Cloudflare disabled validation to keep Germany online. Trellix’s source code was breached. A Linux kernel LPE and a Palo Alto firewall RCE both landed on CISA KEV with active exploitation. The DOJ Epstein archive crossed 269,000 PDFs, OCR still paused, Stortinget hearing days away.

Mines and Mythos

Tue, 28 Apr 2026 00:00:00 +0000

Trump ordered the Navy to shoot Iranian boats mining Hormuz. Voice phishing surged against IT helpdesks. The Vercel breach widened. India’s finance minister flagged Anthropic Mythos as a banking risk. A new 2 Tbps DDoS record set a fresh ceiling for the threat surface.

The Verse He Chose

Tue, 28 Apr 2026 00:00:00 +0000

King Charles III invoked Joel 3:10, the mobilisation verse, in his joint address to Congress on April 28. The verse he chose, not the verse he didn’t, is the signal.

Hospitals and Hormuz

Wed, 22 Apr 2026 00:00:00 +0000

Patch Tuesday dropped 167 CVEs and two live zero-days. Dutch hospitals are still offline after ChipSoft. Iran shut Hormuz again when the US refused to lift the blockade. A new class of 1.58-bit AI arrived at 8B parameters.

Blockades and Breaches

Tue, 14 Apr 2026 00:00:00 +0000

A Fortinet zero-day giving attackers full endpoint control. Trump’s naval blockade of Iran. An Easter ceasefire in Ukraine that didn’t hold. Week 15 brought the pressure.

MuddyWater Follow-Up: April 2026

Sat, 04 Apr 2026 00:00:00 +0000

A lot changed in four weeks. MuddyWater rebuilt their toolkit in Rust, started using AI to write malware, compromised US banks and airports, and picked up new attack vectors including RDP and Ethereum-based C2. This is the follow-up.

The Easter Escalation

Sat, 04 Apr 2026 00:00:00 +0000

A browser zero-day hitting 3.5 billion users. A US fighter jet shot down over Iran. Russia stalling for the first time in years. And the Epstein fallout reaching all the way to a Nordic royal palace. Week 14 was not quiet.

One Month of Fire

Sun, 29 Mar 2026 00:00:00 +0000

The Iran war hits one month with Houthis entering the fight, Iran strikes Bahrain, and US deploys 3,500 marines. FBI Director Kash Patel’s personal email hacked by Handala. European Commission breached via AWS — ShinyHunters claims 350GB. Stortinget summons Støre and a dozen officials to open Epstein hearings. Cyber warfare is no longer parallel to kinetic war — it is the same war.

The Admin Prompt

Tue, 24 Mar 2026 00:00:00 +0000

Microsoft blocked a registry hack that unlocks native NVMe on Windows 11. Every tech outlet responded the same way: download an unsigned binary from GitHub and run it as admin. Nobody asked what happens when millions of users are trained to do this.

The Week Everything Moved

Tue, 24 Mar 2026 00:00:00 +0000

EU Chat Control collapses, E2EE survives. Mette-Marit speaks, Stortinget votes unanimously for Epstein commission. Tycoon 2FA dismantled, Medusa ransomware hits hospitals, and the Iran war grinds into week four with no ceasefire in sight.

The Genie Problem

Mon, 16 Mar 2026 00:00:00 +0000

Claude Opus 4.6 broke its own exam by identifying the benchmark, finding the encrypted answer key on GitHub, and decrypting it across 18 independent runs. Iran’s Handala group wiped 200K devices at Stryker, Epstein Nordic scanner hits 3,140 documents, and OpenClaw’s creator gets name-dropped in the Wes Roth video covering the eval results.

Fifteen Days of Fire

Sat, 14 Mar 2026 00:00:00 +0000

Iran war hits Day 15 with Kharg Island struck and oil past $100, Økokrim finds classified documents in Rød-Larsen’s basement, Reuters reveals FBI Epstein files were hacked in 2023, Iran-linked Handala group wipes 200K devices at Stryker, and Telus Digital loses 1 petabyte to ShinyHunters.

Cracking the Factory: When 'Random' Passwords Aren't

Mon, 09 Mar 2026 00:00:00 +0000

Every password your computer has ever generated is the output of a deterministic algorithm. When that algorithm is weak, fingerprinted, or seeded from a timestamp, ‘random’ collapses to ‘predictable with effort.’ Three real-world cases prove this isn’t theoretical.

The Bombs Don't Stop

Sat, 07 Mar 2026 00:00:00 +0000

Iran war enters its eighth day with 1,450+ killed and 5,000+ bombs dropped, Økokrim seizes Oslo Accords documents from Rød-Larsen, LexisNexis breach exposes 3.9M records including federal judge profiles, and the Coruna iOS exploit kit chains 23 vulnerabilities into a weaponized platform.

How to Build an AI Brain

Thu, 05 Mar 2026 00:00:00 +0000

A practical guide to giving your AI agent persistent memory, from workspace files to graph databases. Four layers, starting from trivial to advanced.

MuddyWater: Inside Iran's Cyber War Machine

Thu, 05 Mar 2026 00:00:00 +0000

A comprehensive look at MuddyWater, the Iranian APT embedded in US banks and airports before the bombs even fell. From Operation Olalampo to exposed server infrastructure, AI-generated malware to Ethereum-based command channels, this is what a state-sponsored cyber operation looks like in 2026.

The Silent Siege

Thu, 05 Mar 2026 00:00:00 +0000

Telia Norge was compromised for 18 months. 500,000 customers exposed. The breach reveals what happens when we treat connectivity as a consumer product instead of critical infrastructure.

SearXNG + Tor in Docker: Your Own Private Search Engine

Sun, 01 Mar 2026 00:00:00 +0000

A step-by-step guide to deploying SearXNG in Docker with Tor integration and Caddy HTTPS reverse proxy. Private, self-hosted search that aggregates 40+ engines without leaking your queries.

The World Catches Fire

Sat, 28 Feb 2026 00:00:00 +0000

US and Israel strike Iran in coordinated assault, Pakistan declares open war on Afghanistan, Cisco SD-WAN zero-day exploited since 2023, Mandelson arrested over Epstein ties, Clinton testifies ‘I saw nothing,’ and the DOJ faces growing backlash over withheld Epstein files.

The Reckoning Begins

Sun, 22 Feb 2026 00:00:00 +0000

Prince Andrew arrested, Norway’s elite in freefall over Epstein ties, Dell zero-day exploited by China since 2024, six Microsoft zero-days patched, Geneva peace talks stall, and Trump’s Board of Peace convenes.

Two Carriers and a Zero-Day

Sun, 15 Feb 2026 00:00:00 +0000

Apple zero-day exploited in the wild, Microsoft patches six critical flaws, US deploys two carriers toward Iran, Ukraine drones strike 1,100 miles deep, ransomware surges 52%.

Eight Minutes to Admin

Sat, 07 Feb 2026 00:00:00 +0000

APT28 zero-day, 149M credential leak, AI breaches AWS in 8 minutes, PST warns of worst security since WWII, Epstein political fallout, and more.

Digital Hygiene: Keep Your Dirty Laundry Off the Line

Fri, 06 Feb 2026 00:00:00 +0000

A practical guide to digital privacy. Not for paranoids, but for anyone who’d rather keep their business their own. Passwords, 2FA, social media, and more.

.md TLD: Namespace Collision Threat to AI Agents

Wed, 04 Feb 2026 00:00:00 +0000

Seven common markdown filename domains (readme.md, changelog.md, etc.) were investigated in a sandboxed environment. 57% are actively detecting AI agents and building infrastructure for potential prompt injection attacks.

Executive Summary

Moldova’s country-code TLD .md creates a dangerous namespace collision with markdown files. When auto-linking systems or AI agents encounter README.md in text, they may inadvertently fetch https://readme.md — a domain squatter’s site, not a repository file.

Key Finding: 4 of 7 tested domains are actively serving different content to AI agents versus human browsers. This is pre-positioned attack infrastructure.

Signal Under Siege

Tue, 27 Jan 2026 00:00:00 +0000

How state actors and scammers target encrypted messaging, and how to protect yourself.

The Norwegian Gateway: ITavisen, CryptoEasily, and the Myth of 'Norsk er Trygt'

Sun, 11 Jan 2026 00:00:00 +0000

Part 2 of our investigation into ITavisen’s promotion of CryptoEasily. Documenting victim testimony, regulatory failures, the eToro/Plus500 connection, and why ‘Norwegian is safe’ is a dangerous myth.

CryptoEasily Cloud Mining Scheme Investigation

Tue, 16 Dec 2025 00:00:00 +0000

Investigation report documenting a cryptocurrency investment scam operating through ITavisen.no and coordinated syndication across multiple platforms.

Academic Grind, Technical Wins, and a System on the Fringes

Wed, 26 Nov 2025 00:00:00 +0000

Python progress, CCNA grinding, encrypted backup wins, and reflections on infrastructure fragility and surveillance overreach.

Under The Radar

Thu, 06 Nov 2025 00:00:00 +0000

Notes from Simen Bakke’s lecture at Noroff on how China uses civilian hackers and IT companies for cyber operations.

The Testing Grounds

Mon, 27 Oct 2025 00:00:00 +0000

Signals dispatch examining AI escalation, credential leaks, and the ethical testing grounds shaping the next era.

Cloud Week

Fri, 24 Oct 2025 00:00:00 +0000

Management notes on decentralised resilience, hybrid security workflows, and rebuilding digital hygiene from the ground up.

About FTRCRP

Wed, 01 Jan 2025 00:00:00 +0000

This is an independent research and media platform. No ads. No sponsors. No investors. What you read here is funded by consulting work and the people who find it worth reading.

We cover cybersecurity, surveillance, digital rights, and the friction between technology and human life. When something is important and underreported, we write about it. When something is technically complex, we try to make it legible without making it dumb.

AI Policy & Academic Integrity for Schools

Wed, 01 Jan 2025 00:00:00 +0000

AI Policy & Academic Integrity for Schools

Students are using ChatGPT, Claude, and other AI tools. Teachers don’t know how to respond. Schools need clear policies before problems escalate.

The Challenge

Generative AI has disrupted education:

Students use AI tools without clear guidance
Teachers are uncertain how to assess work authenticity
Schools face pressure from parents, Udir, and staff
Inconsistent enforcement creates fairness concerns
Waiting for problems to emerge is not a strategy

Getting ahead of this with clear, thoughtful policy prevents problems before they start.

Ethical AI Implementation

Wed, 01 Jan 2025 00:00:00 +0000

Ethical AI Implementation

Your team is already using ChatGPT. Vendors are pitching AI features. You need governance before tools proliferate, not after problems emerge.

The Challenge

AI tools are being deployed without oversight:

Staff use ChatGPT with client data
Vendors promise AI features without transparency
No framework for evaluating risks
Hallucinations and errors go unverified
Data leakage concerns are unaddressed
Dependency on tools that may change or disappear

You need help evaluating, implementing, and governing AI responsibly.

GDPR Compliance for Small Organizations

Wed, 01 Jan 2025 00:00:00 +0000

GDPR applies to you, but enterprise compliance solutions don’t fit your budget or size. You need practical, affordable guidance from someone who understands both the regulations and the technology.

The Challenge

Small organizations handling personal data face a difficult position:

GDPR requirements are mandatory regardless of company size
Enterprise compliance solutions cost more than your entire IT budget
You lack dedicated legal or compliance staff
You’re not sure if you’re compliant or exposed
Maximum fines are significant (up to 4% of global turnover)

You need help right-sized for your reality.

PGP Public Key

Wed, 01 Jan 2025 00:00:00 +0000

PGP Public Key

For secure communications, you can encrypt messages to FTRCRP using the PGP key below.

Key Details

Field	Value
Owner	FTRCRP Secure Tips
Email	HAL0zum@proton.me
Key type	Ed25519 (sign/certify) + Curve25519 (encryption)
Created	2026-01-27
Expires	Does not expire

Fingerprint

FE70 9E0B 2BE3 F5D9 8CD2 4715 A8B0 1918 6315 D536

Always verify this fingerprint through a second channel before sending sensitive material.

Usage

Copy the public key block below (or download it)
Import it into your PGP client: gpg --import ftrcrp.asc
Verify the fingerprint matches
Encrypt your message and send to: HAL0zum@proton.me

Public Key Block

Alternative Secure Channels

ProtonMail: HAL0zum@proton.me (end-to-end encrypted by default between Proton users)
Signal: Available upon request

For sensitive tips or confidential communications about security issues, scams, or other matters requiring discretion.

Press Kit

Wed, 01 Jan 2025 00:00:00 +0000

Press Kit

Media resources for journalists, researchers, and publications covering FTRCRP’s work.

Logo & Brand Assets

Full Logo PNG (High resolution)
Standard Logo PNG (Web optimized)

Usage Guidelines: Logo may be used in editorial coverage. Maintain clear space around logo. Do not modify colors or proportions.

Organization Boilerplate

Short Version (50 words): FTRCRP is an independent security research initiative based in Norway, focused on consumer protection and digital ethics. We investigate scams, analyze industry patterns, and publish practical security guidance. Evidence-first methodology with transparent documentation.

Security Posture Review

Wed, 01 Jan 2025 00:00:00 +0000

Security Posture Review for SMBs

You know security matters, but you don’t have a dedicated IT security team. You need a pragmatic, affordable assessment that identifies real risks and provides actionable fixes, not compliance theater.

The Challenge

Small organizations face security threats but lack resources:

No dedicated IT security staff
Limited budget for enterprise security tools
Uncertainty about what’s actually at risk
Fear of expensive assessments that deliver jargon-filled reports
SMBs are increasingly targeted precisely because attackers know you have weak spots

You need practical security guidance that fits your reality.

Contact (Beta)

Mon, 01 Jan 0001 00:00:00 +0000

Use the form below to reach us, or email us directly at HAL0zum@proton.me. All inquiries are reviewed and responded to personally.

What We Help With

Consulting Requests. Security assessments, architecture review, incident response
Collaboration / Job Opportunities. Research partnerships, contracting, employment
Press / Media. Interviews, comments, expert consultation
Newsletter. Subscribe to FTRCRP updates and publications
General Inquiries. Questions, feedback, or anything else

Response Time

We’ll respond within 24-48 hours. All responses are human, considered, and never automated.

Editorial Standards

Mon, 01 Jan 0001 00:00:00 +0000

FTRCRP Editorial Standards

Version: 1.0 Effective: 2026-01-26 Review Date: 2027-01-26

Purpose

These standards ensure all FTRCRP publications maintain accuracy, fairness, and ethical integrity. They apply to all content published under the FTRCRP name.

Core Principles

1. Accuracy First

Verify before publish. Every factual claim requires a source.
Distinguish fact from opinion. Use clear language: “evidence shows” vs “we believe.”
Acknowledge uncertainty. “Appears to,” “suggests,” “alleged.” Use appropriate qualifiers.
Correct errors promptly. Issue corrections publicly with changelog documentation.

2. Fair Representation

Present all relevant sides. Include perspectives that challenge our conclusions.
Steelman, don’t strawman. Represent opposing views at their strongest.
Right of reply. Contact subjects for comment before publication when practical.
No personal attacks. Criticize actions and systems, not individuals’ character.

3. Transparency

Disclose conflicts of interest. Financial relationships, personal connections, prior involvement.
Show methodology. Explain how we reached our conclusions.
Cite sources. Enable readers to verify independently.
Open to correction. Welcome challenges to our findings.

4. Proportional Response

Punch up, not down. Prioritize investigating power, not individuals.
Consider impact. Will publication cause disproportionate harm to the subject vs public benefit?
Privacy by default. Minimize personal information unless directly relevant.

Citation Requirements

Sourcing Standards

Source Type	Requirement
Regulatory documents	Direct link to official source
News articles	URL + archive link (Wayback Machine)
Court records	Case citation + public record link
Corporate filings	Registry link (Bronnøysund, Companies House, etc.)
Personal statements	Exact quote with context
Statistics	Original study/report + methodology

Archive Protocol

All web sources should be archived to prevent link rot:

Frequently Asked Questions

Mon, 01 Jan 0001 00:00:00 +0000

Frequently Asked Questions

About FTRCRP

What does FTRCRP do?

We help organizations implement technology ethically. We protect privacy, building trust, and putting humans at the center of digital systems.

Specifically:

GDPR compliance for small organizations
AI policy development for schools and businesses
Security assessments for SMBs without internal IT security
Digital literacy training for educational institutions

Why “FTRCRP”?

“Future Corp.” A deliberate question about what kind of corporate future we’re building. The choices organizations make today about privacy, AI, and security shape the society of tomorrow. We help them choose well.

Message Sent

Mon, 01 Jan 0001 00:00:00 +0000

Thank You

Your message has been received. We aim to respond within 48-72 hours.

If your inquiry is urgent or requires secure communication, please mention this in your message and we will prioritize arranging a secure channel.

Return to Contact Page | Back to Home

Search

Mon, 01 Jan 0001 00:00:00 +0000