robin🪶

Cybersecurity🖱️ | SIGINT 📡🛰️

[robin🪶 @rob_OSINT]

Underground bunker entrance at Fuerte Tiuna (🇻🇪 main military HQ) in Caracas, captured in today's high-res satellite imagery. Coords: 10.4398701, -66.9063259. Reports indicate Maduro attempted to flee to a secure room/bunker here during the Jan 3 US operation before capture.

[Christiaan Triebert @trbrtc]

Here’s that suspected entrance to the underground bunker at Fuerte Tiuna, in Caracas, where Maduro reportedly tried to flee to, on today’s satellite image from @vantortech.

[Dave Kennedy @HackingDave]

Check out what NightBeacon CMD is all about from MSSP Alert:

https://t.co/b2ak6PaYO2

#BinaryDefense

[Elon Musk @elonmusk]

@IntCyberDigest Linus is right, as usual

[Arena.ai @arena]

Big news: Kimi-K3 by @Kimi_Moonshot is now #1 in the Frontend Code Arena with 1679 pts, surpassing Claude Fable 5.

This is a 17-place jump from Kimi-k2.6 (#18 -> #1).

In Frontend, Kimi-K3 ranked #1 in 6 of 7 domains: Brand & Marketing, Reference-Based Design, Data & Analytics, Consumer Product, Simulations, and Content Creation Tools, landing #2 only in Gaming behind Fable 5.

The full model weights will be released by July 27.

Congrats to the @Kimi_Moonshot team on this major milestone!

[Critical Threats @criticalthreats]

A new rebel alliance conducted a large-scale attack against the Central African Armed Forces (FACA) and their Russian Wagner Group allies along the Central African Republic (CAR)-Sudan border in late June, marking the most significant escalation in northeastern CAR since early 2023.

The Sudanese paramilitary Rapid Support Forces (RSF) may have enabled the assault, which could complicate the CAR’s potential emerging role as a node in Emirati-RSF supply lines. ⬇️🧵

[National Crime Agency (NCA) @NCA_UK]

Two young men have been sentenced for launching a cyber attack on Transport for London (TfL) which cost tens of millions of pounds in losses and inconvenienced thousands of customers.

Thalha Jubair and Owen Flowers were identified by the NCA and @CityPolice following the attack on TfL’s network in 2024.

They both pleaded guilty to the attack last month in what was only the second criminal prosecution of its kind in the UK under the Computer Misuse Act (CMA).

Jubair and Flowers were both leading members of the online criminal collective known as Scattered Spider.

Today both were each sentenced to five years and six months imprisonment.

Read the full story ➡️ https://t.co/tN9SqQt4OQ

[Polymarket @Polymarket]

BREAKING: China's Kimi K3 ranks #1 on the Frontend Code Arena, surpassing Claude Fable 5.

[Forensic OSINT @ForensicOsint]

Most investigators are one logged-in account away from being deanonymized. Usually one open tab, not a clever attack.

I wrote up the OPSEC checklist I actually use on cases.

Free to read → https://t.co/DsfJCnJiDb

[robin🪶 @rob_OSINT]

@NahamSec Hi🍻

[𝚃𝚊𝚌𝚝𝚒𝚌𝚊𝚕 𝙾𝚂𝙸𝙽𝚃 𝕏 @OSINT_Tactical]

This version is a game changer !

[Elon Musk @elonmusk]

That’s how making a startup succeed goes

[robin🪶 @rob_OSINT]

@IAMERICAbooted 👍

[International Cyber Digest @IntCyberDigest]

Dawg, activate Windows so we can track your GDID.

[Aditya Kalra @adityakalra]

⚡ 🚨 BREAKING: Files tied to India's largest nuclear power plant Kudankulam have surfaced on the dark web -- including purported blueprints of its ventilation systems and a control room floor layout....

What's in the data leak? Nearly 19,000 files tied to Kudankulam are part of a larger 858,000-file cache ransomware group World Leaks says it stole from Anil Ambani's Reliance Group. The files include vendor proposals and records of a joint inspection between the plant's operator and Reliance, with photos of equipment.

Why did Reliance have these docs? Reliance Infrastructure won a contract in 2018 to build support infrastructure for the plant's Unit 3 and Unit 4. Reliance says there was a "partial breach" of its data on a server hosted by Yotta Data Services Private Limited. Yotta says it caught suspicious activity on that server on May 29 and Reliance flagged the leak claims to Yotta in late June.

Significance? "The exposure of such data could show an adversary not just who has access to the project but which systems that access reaches," Nickolas Roth of the Nuclear Threat Initiative told us.

World Leaks context? In June, World Leaks told Reuters it had sought $1.5 million in ransom for Tata Group files that contained confidential component designs of clients Apple and Tesla, adding that it posted the data after Tata "ignored" its demand.

Nuclear Power Corporation has been communicating with Reliance about the breach and India's main cybersecurity agency CERT-In is looking into the incident, a source said.

Story with @MunsifV. Read here https://t.co/xe4StYf5X8

[André Baptista @0xacb]

We just open-sourced EthiBench: a new evaluation protocol for AI pentesting agents.

Ground truth and code available here: https://t.co/bIXIpSK45X

[the reporters' collective @reporters_co]

Investigation: Banned in Europe, Scanning Faces in India

Cant sell it in the EU. But Spanish firm Herta's facial recognition software is being used to scan millions of citizens across railway stations, temples and more. With @investigate_eu @_infoLibre

1/5

[infoLibre @_infoLibre]

‼️ Investigación | La vigilancia biométrica prohibida en la UE se propaga por India exportada por España

infoLibre, medio colaborador de la red internacional @investigate_eu, participa y publica en exclusiva en España esta información
https://t.co/GZGRShApZ1

[Soxoj @Sox0j]

Maigret 0.6.3 is out! 🕵️

115 site checks fixed, 15 new sites added, better Chinese-site support, improved Cloudflare bypass, and upgraded PDF templates.

Over the past few months, I’ve been receiving more and more fixes from the community. Maigret now gets over 100K installs per month, with more than 1M installs in total! 🚀

👉 Try it yourself: https://t.co/zuPPTC8vao

[The Sentry @TheSentry_Org]

Russia is replacing the Wagner Group with the Kremlin-controlled Africa Corps. This is not a shadow operation; it is a deliberate expansion of Russian power.

Our investigation reveals that the Africa Corps is leveraging Russian and Guinean businesses for military purposes. And we found evidence that the Guinea Conakry port terminal, operated by two Russian-Guinean companies, is a major hub.

Civilians are paying the price: Russian fighters perpetrate rape, torture, beheadings, mutilation, and summary executions.

Read our report to learn more about why this change is important: https://t.co/uvkQgestfP

[Stinky @Stinky915846091]

Geolocation of a USAF Airstrike which impacted a taxiway at a drone base west of Choghadak.

Location: 28.978861, 50.993754
XXHV+GGR Choghadak, Bushehr Province, Iran
@GeoConfirmed
H/T: @GEOIMINT

[Stephen Fewer @stephenfewer]

Earlier this year I built out an unauth RCE chain against SharePoint, we disclosed it to Microsoft in May and today they have patched out the chains auth bypass vuln, CVE-2026-55040. Disclosure details on the @rapid7 blog, full technical details to be published at a later date...