Cyberconflict and warfare

Microsoft takes down massive Lumma malware network

Microsoft has dismantled a major cybercrime operation centred around the Lumma Stealer malware, which had infected over 394,000 Windows devices globally.

In partnership with global law enforcement and industry partners, Microsoft seized more than 1,300 domains linked to the malware.

The malware was known for stealing sensitive data such as login credentials, bank details and cryptocurrency information, making it a go-to tool for cybercriminals since 2022.

The takedown followed a court order from a US federal court and included help from the US Department of Justice, Europol, and Japan’s cybercrime unit.

Microsoft’s Digital Crimes Unit also received assistance from firms like Cloudflare and Bitsight to disrupt the infrastructure that supported Lumma’s Malware-as-a-Service network.

The operation is being hailed as a significant win against a sophisticated threat that had evolved to target Windows and Mac users. Security experts urge users to adopt strong cyber hygiene, including antivirus software, two-factor authentication, and password managers.

Microsoft’s action is part of a broader effort to tackle infostealers, which have fuelled a surge in data breaches and identity theft worldwide.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!

China creates AI to detect real nuclear warheads

Chinese scientists have created the world’s first AI-based system capable of identifying real nuclear warheads from decoys, marking a significant step in arms control verification.

The breakthrough, developed by the China Institute of Atomic Energy (CIAE), could strengthen Beijing’s hand in stalled disarmament talks, although it also raises difficult questions about AI’s growing role in managing weapons of mass destruction.

The technology builds on a long-standing US–China proposal but faced key obstacles: how to train AI using sensitive nuclear data, gain military approval without risking secret leaks, and persuade sceptical nations like the US to move past Cold War-era inspection methods.

So far, only the AI training has been completed, with the rest of the process still pending international acceptance.

The AI system uses deep learning and cryptographic protocols to analyse scrambled radiation signals from warheads behind a polythene wall, ensuring the weapons’ internal designs remain hidden.

The machine can verify a warhead’s chain-reaction potential without accessing classified details. According to CIAE, repeated randomised tests reduce the chance of deception to nearly zero.

While both China and the US have pledged not to let AI control nuclear launch decisions, the new system underlines AI’s expanding role in national defence.

Beijing insists the AI can be jointly trained and sealed before use to ensure transparency, but sceptics remain wary of trust, backdoor access and growing militarisation of AI.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!

NATO weighs inclusion of cybersecurity in new 5% defense spending target

NATO is discussing proposals to broaden the scope of defence-related expenditures to help member states meet a proposed spending target of 5% of GDP. According to Bloomberg, the target includes 3.5% for traditional defence spending and 1.5% for related activities.

The 1.5% portion may include cybersecurity, protection of critical infrastructure, border and coastal security, space-related initiatives, and the work of non-defence intelligence agencies. Some member states are also advocating for the inclusion of counter-terrorism efforts and dual-use infrastructure, pending agreement among the alliance.

The proposals are currently under negotiation and are expected to be discussed further by NATO’s policy and planning committee. These discussions will inform a framework to be considered at the alliance’s summit in June.

A final decision on the classification of eligible expenditures has not yet been made, according to the reports, and remains subject to consensus among member states. NATO has not responded publicly to inquiries regarding the ongoing negotiations.

The 5% figure was originally proposed by former US President Donald Trump and was initially viewed as an ambitious benchmark. Recent reporting suggests, however, that a growing number of member states now recognise the need for increased defence investments. As of April, 23 out of 32 NATO members had met the current 2% defence spending guideline, with all expected to do so by the summer.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!

UK to establish cyber and electromagnetic command to enhance warfare capabilities

The United Kingdom has announced plans to establish a new military formation, the Cyber and Electromagnetic Command, aimed at strengthening its digital and electronic warfare capabilities. The new command will fall under Strategic Command, which already oversees the Ministry of Defence’s offensive and defensive cyber operations and works in coordination with the National Cyber Force.

According to the Ministry of Defence, the formation will be responsible for leading defensive cyber operations, coordinating offensive cyber capabilities, and integrating electromagnetic warfare expertise across the Armed Forces. Rather than creating entirely new capabilities, the command will reorganise existing structures to improve coordination and operational effectiveness.

The announcement comes ahead of the government’s Strategic Defence Review, due to be published on 2 June. The review will set out priorities for defence spending and assess the threats facing the UK, the capabilities required to address them, the condition of the Armed Forces, and the resources available. It is expected to highlight the growing impact of daily cyber attacks on national security and the economy.

To support the new command, the Ministry has introduced an accelerated recruitment route for cyber specialists. This new pathway, announced in February, shortens basic training from ten weeks to four, followed by a three-month programme focused on military cyber skills.

Recruitment and retention remain a key challenge. General Sir Jim Hockenhull, Commander of Strategic Command, previously noted that the competition for digital talent is particularly intense, stating that the UK is currently at a disadvantage in this area. Lieutenant General Tom Copinger-Symes, Deputy Commander of Strategic Command, also highlighted the skills shortage as a more immediate concern than funding.

The review describes the Cyber and Electromagnetic Command as a formation that will consolidate expertise in electromagnetic operations, such as degrading command and control systems, jamming signals to drones or missiles, and intercepting adversary communications. The intention is to ensure these capabilities are available at the right time and place to support integrated military operations.

Hockenhull has also pointed out that the UK’s focus on operations in Iraq and Afghanistan over the past two decades led to a reduced emphasis on electromagnetic capabilities, except in limited areas. He noted that the conflict in Ukraine has demonstrated the importance of integrating cyber and electromagnetic tools with conventional military operations.

In 2024, both Ukraine and Russia have announced plans to establish a new branch within the country’s armed forces specialising in drone warfare and the use of unmanned aerial vehicles (UAVs).

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!

Japan to develop new cybersecurity strategy and measures

The Japanese government is preparing to develop a new cybersecurity strategy within the year, aiming to address growing digital threats targeting both public institutions and private enterprises. As part of the forthcoming strategy, the government plans to transition its internal communications systems from public-key cryptography to post-quantum cryptography, which is considered more resilient against potential cyberattacks enabled by quantum computing technologies.

In a recent development, Defence Minister Gen Nakatani met with Lithuanian Defence Minister Dovile Šakalienė in Tokyo, where both sides agreed to strengthen bilateral cooperation on cybersecurity. A Japanese Ministry of Defence expert will be sent to Lithuania in June to engage with local specialists, who are recognised for their expertise in managing persistent cyber threats, particularly those attributed to Russian state-linked actors.

The agreement follows an earlier announcement that Japan intends to expand its pool of specialist cybersecurity personnel from the current 24,000 to at least 50,000 by 2030. The target was introduced in response to a Ministry of Economy, Trade and Industry (METI) panel recommendation that the country needs approximately 110,000 skilled cybersecurity professionals to meet growing demand.

Under new regulatory measures due to take effect in 2026, the government will also begin inspecting the cybersecurity practices of private companies. Firms failing to meet the established standards may risk losing access to state subsidies.

Earlier this year, the parliament passed a new law enabling active cyberdefence measures, allowing authorities to legally monitor communications data during peacetime and neutralise foreign servers if cyberattacks occur.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!

Chinese state-linked hackers use Google Calendar to steal data

In a report published this week, analysts at Google have uncovered a campaign in which a China-linked group known as APT41 targeted government ministries and other organisations.

Victims received spearphishing emails directing them to a ZIP file hosted on a compromised official website. Inside, a PDF and some insect images were designed to tempt users into clicking.

Opening the PDF quietly installed a programme called ToughProgress, which runs entirely in a device’s memory to evade antivirus checks. Once active, the malware stole sensitive files and prepared them for exfiltration.

Google Calendar became the hackers’ secret communication channel. An event dated 30 May 2023 carried encrypted data stolen from victims in its description.

Further entries in July contained new instructions. ToughProgress regularly checked the attacker-controlled calendar, decrypted any commands and uploaded its results back as new calendar events.

APT41 is one of China’s most active state-linked cyber groups. US authorities charged five members in 2020 with over a hundred intrusions worldwide and issued arrest warrants for operatives including Zhang Haoran and Tan Dailin.

Earlier investigations tie the group to long-running breaches of Southeast Asian government agencies and a Taiwanese research institute working on strategic technology.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!

UK bolsters digital defences with new Cyber Command after Ukraine lessons

The UK’s Ministry of Defence (MoD) will establish a Cyber and Electromagnetic Command to unify defensive cyber operations and coordinate offensive capabilities alongside the National Cyber Force.

However, this move follows recommendations in the upcoming strategic defence review, due on 2 June 2025, which will define the UK’s force structure and investment priorities.

The rapid sharing of intelligence across ships, aircraft, tanks and personnel is a core aim of the new formation. Defence Secretary John Healey has stressed that future conflicts ‘will be won through forces that are better connected, better equipped and innovating faster than their adversaries.’

However, a major concern is the lack of digital expertise, as Strategic Command chief Gen. Sir Jim Hockenhull warned: ‘the first battle of the next war is the battle for talent.’ To tackle this shortfall, the MoD has launched an accelerated recruitment pipeline, reducing basic training from ten weeks to just four, followed by three months of specialised cyber instruction.

Insights from Russia’s campaign in Ukraine have underlined the importance of electromagnetic capabilities such as jamming drones, intercepting communications and degrading enemy command and control.

Strategic Command chief Sir Jim Hockenhull warned that siloed cyber efforts must be fully integrated into operational planning to seize the advantage in modern warfare.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!

China blamed of cyberattack on Czech Republic government networks

Prague has formally accused China of launching a malicious cyber campaign against its Foreign Affairs ministry’s unclassified communications network. Beijing’s embassy in Prague dismissed the allegations and urged an end to what it called ‘microphone diplomacy.’

Investigators trace the operation back to the Czech Republic’s 2022 EU presidency, attributing it to APT31, a group allegedly operating under China’s Ministry of State Security. After detecting the intrusion, officials rolled out a more secure communications platform in 2024.

Foreign Minister Jan Lipavský summoned China’s ambassador to stress the severity of the breach, which targeted emails and other documents related to Asia. The government condemned the incident as an attack on its critical infrastructure.

International partners have rallied behind Prague. NATO and the EU have condemned the attack and the US Bureau of Cyberspace and Digital Policy has called on China to meet its international cybersecurity commitments.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!

DeepSeek updates its R1 AI model

Chinese AI startup DeepSeek has rolled out an updated version of its R1 reasoning model on the popular developer platform Hugging Face. The release was quietly announced via a WeChat post and marks a continuation of DeepSeek’s effort to challenge leading players in the AI field, including US-based OpenAI.

The new R1 model is a minor update, released under the permissive MIT license, allowing commercial use. However, the Hugging Face repository only includes the model’s configuration files and internal weights, with no public documentation describing the model’s capabilities.

https://twitter.com/deepseek_ai/status/1881318130334814301

These ‘weights’ — the parameters that determine how an AI model behaves — total a massive 685 billion, making the model too large to run on standard consumer hardware without special adaptations. DeepSeek gained attention earlier this year when the original R1 demonstrated competitive performance against leading models from OpenAI.

That advancement hasn’t gone unnoticed by international observers; US regulators have expressed concern over the potential national security risks posed by DeepSeek’s technologies. Despite the controversy, the company continues to make bold moves on the global AI stage.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!

UK and EU strengthen maritime and cyber security

The UK and the EU have agreed to step up cooperation on cybersecurity as part of a wider defence and security pact.

The new framework, signed on 19 May, marks a major shift towards joint efforts in countering digital threats and hybrid warfare.

Instead of managing these challenges separately, the UK and EU will hold structured dialogues to address cyberattacks, disinformation campaigns, and other forms of foreign interference.

The deal outlines regular exchanges between national security officials, supported by thematic discussions focused on crisis response, infrastructure protection, and online misinformation.

A key aim is to boost resilience against hostile cyber activity by working together on detection, defence, and prevention strategies. The agreement encourages joint efforts to safeguard communication networks, protect energy grids, and strengthen public awareness against information manipulation.

The cooperation is expected to extend into coordinated drills and real-time threat sharing.

While the UK remains outside the EU’s political structure, the agreement positions it as a close cyber security partner.

Future plans include exploring deeper collaboration through EU defence projects and potentially forming a formal link with the European Defence Agency, ensuring that both sides can respond more effectively to emerging digital threats.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!