SOFX

Global conflict & battlefield tech. Publisher of the SOFX Report, trusted by 70K+ readers.

[SOFX @SOFXnetwork]

Researchers at the University of Toronto reported on June 2 that publicly available AI models can power a self-propagating malware worm that adapts its attacks to Linux, Windows, and IoT devices. The study found the worm exploited real-world network vulnerabilities and used infected machines to run AI models, raising concerns that any internet-connected device could become a target or launch point for further attacks.

[SOFX @SOFXnetwork]

An Iranian drone and missile attack on June 4 killed one person and wounded more than 60 at Kuwait International Airport, according to Kuwaiti authorities. Kuwait said Iran launched 30 missiles and drones targeting civilian infrastructure, while Tehran denied responsibility. The strike came as U.S.-Iran ceasefire talks continued, with President Donald Trump saying a broader peace agreement could be reached soon.

[SOFX @SOFXnetwork]

A June 3 SITREP by Dino Garner assessed that no Taiwan-China threat classifications changed this cycle, but pressure increased across key domains. The report identified the Malacca Strait, rare earth supply chains, global LNG markets, and Taiwan’s semiconductor fabrication complex as the most critical nodes, warning that the highest near-term risk may be an accidental escalation stemming from PLA command disruptions rather than a deliberate decision by Beijing.

[SOFX @SOFXnetwork]

Israeli warplanes conducted about 30 strikes across southern Lebanon on June 3, according to Lebanon’s National News Agency, one day after President Donald Trump said Israel and Hezbollah had agreed that “all shooting will stop.” The same day, CENTCOM said Iran launched missiles toward Bahrain and Kuwait, all of which failed or were intercepted, while U.S. forces conducted a strike on an Iranian military control site on Qeshm Island and the Treasury sanctioned Iran’s Nobitex crypto exchange.

[SOFX @SOFXnetwork]

The Financial Times reports U.S. officials are discussing the potential deployment of nuclear-capable dual-capable aircraft to additional NATO members, with Poland and the Baltic states expressing interest. The talks come as the Trump administration plans to reduce parts of the U.S. military footprint in Europe while also announcing an additional 5,000 troops for Poland following talks between Elbridge Colby and Paweł Zalewski.

[SOFX @SOFXnetwork]

Internal government documents obtained by Wired show the FBI, DHS, and regional intelligence centers are tracking what they describe as “anti-tech extremism” tied to growing opposition to AI. Reports warn of potential threats to data centers and critical infrastructure, while authorities linked recent incidents to anti-AI motives, including an April 2026 Molotov cocktail attack targeting OpenAI CEO Sam Altman’s home and a shooting at the home of Indianapolis council member Ron Gibson after he backed a $500 million data center project.

[SOFX @SOFXnetwork]

Joint Special Operations Task Force-Somalia is seeking three cultural and political advisors to support U.S. forces with Somali politics, tribal dynamics, translation, and local engagement. The contractors, expected to begin work in September, will operate from Mogadishu and travel across Somalia, Djibouti, and Kenya. The move follows AFRICOM commander Gen. Dagvin Anderson’s warning that force reductions have hindered intelligence collection, while AFRICOM conducted 49 strikes in Somalia during the first three months of 2026.

[SOFX @SOFXnetwork]

Iran suspended negotiations with the U.S. on June 2, including talks on ending the Strait of Hormuz blockade, citing Israeli military operations in Lebanon, according to Iranian state media. President Donald Trump later said talks were continuing and confirmed discussions with Benjamin Netanyahu and Hezbollah representatives. Meanwhile, CENTCOM reported intercepting two Iranian ballistic missiles aimed at U.S. positions in Kuwait and confirmed the loss of a U.S. MQ-1 drone, followed by strikes on Iranian military targets in Goruk and Qeshm Island.

[SOFX @SOFXnetwork]

Carnival Corporation disclosed on June 2 that a cyberattack detected in April exposed personal data belonging to 5,995,277 individuals after a threat actor used a social engineering attack against a single employee account. Compromised information may include passport and driver’s license numbers, along with contact and birth date data. The extortion group ShinyHunters claimed responsibility and allegedly published the stolen data after Carnival declined to pay a ransom.

[SOFX @SOFXnetwork]

U.S. Central Command said a U.S. aircraft disabled the Gambia-flagged cargo ship Lian Star on May 30 after it ignored more than 20 warnings and continued toward an Iranian port in the Gulf of Oman. CENTCOM said a Hellfire missile struck the vessel’s engine room. The action marks the fifth commercial ship disabled since the blockade of Iranian shipping routes began on April 13.

[SOFX @SOFXnetwork]

Researchers at Northwestern Polytechnical University in Xi’an have developed HG-STR, an AI algorithm designed to coordinate drone swarms in jammed environments with degraded visibility. Led by Zhang Dong, the team reported a 100% kill rate in simulations and said the system can continue tracking and engaging targets even when communications are disrupted. Real-world flight testing is planned next.

[SOFX @SOFXnetwork]

Israeli forces have captured Beaufort Ridge and the Crusader-era Beaufort Castle in southern Lebanon, marking Israel’s deepest advance into the country in more than 26 years, Defense Minister Israel Katz said June 1. The IDF said it also seized Wadi al-Saluki to establish operational control and dismantle Hezbollah infrastructure. The move follows continued Hezbollah drone and rocket attacks, including five rockets fired toward northern Israel on Sunday.

[SOFX @SOFXnetwork]

Russia and Afghanistan’s Taliban government signed a military-technical cooperation agreement during the International Security Forum in Moscow, Russian media reported May 28. Taliban defense minister Mohammad Yaqoob and Russian Security Council Secretary Sergei Shoigu discussed expanding bilateral ties as Moscow continues strengthening relations with the Taliban after formally recognizing its rule and removing the group from Russia’s terrorist list in 2025.

[SOFX @SOFXnetwork]

CENTCOM confirmed adversaries have used commercially available phone location data to track and surveil U.S. troops in active war zones, according to a letter from Sen. Ron Wyden released May 29. The command said hostile actors exploited data collected through apps, websites, and adtech systems, while lawmakers urged the Pentagon to disable advertising IDs on military devices and restrict Chrome browser use over security concerns.

[SOFX @SOFXnetwork]

The FBI warned on May 21 that a phishing-as-a-service platform called Kali365 is being used to hijack Microsoft 365 accounts by stealing OAuth access tokens that bypass multi-factor authentication. First observed in April and sold via Telegram for about $250 per month, the tool uses fake SharePoint, OneDrive, and Teams emails directing victims to Microsoft’s legitimate device login page. The FBI advised organizations to block device code flow where possible and monitor suspicious authentication activity linked to token theft.

[SOFX @SOFXnetwork]

A CSIS report says the U.S. will need at least three years to rebuild stockpiles of Tomahawk missiles, THAAD systems, and Patriot interceptors depleted during the Iran conflict. The report warns the shortfall could affect deterrence in the Western Pacific, including a potential Taiwan crisis, despite the Trump administration’s proposed $1.5 trillion 2027 defense budget.

[SOFX @SOFXnetwork]

Russia’s State Duma approved legislation allowing the central bank, Sberbank, and other financial institutions to deploy anti-drone systems and arm employees against UAV threats amid increased Ukrainian strikes. The measure permits jamming, disrupting, or destroying drones without waiting for state security forces, though it still requires approval from Russia’s upper house and President Vladimir Putin.

[SOFX @SOFXnetwork]

The Pentagon has ordered 30,000 one-way attack drones and plans to scale production past 300,000 by early 2027, but the effort faces supply chain concerns as China produces about 98% of the world’s rare earth magnets used in drone motors and weapons systems. The Pentagon began restricting China-origin rare earth materials for military platforms ahead of a January 2027 ban, while investing in U.S. suppliers including MP Materials and new mining projects in Wyoming, Montana, and Nebraska.

[SOFX @SOFXnetwork]

U.S. Central Command said on May 27 that U.S. forces conducted strikes on two Islamic Revolutionary Guard Corps (IRGC) boats and a surface-to-air missile site in southern Iran after missile launches, drone activity, and small boat movements near the Strait of Hormuz. CENTCOM said the action was a self-defense measure and did not end the ongoing ceasefire with Iran.

[SOFX @SOFXnetwork]

Human Rights Watch reported on May 27 that a UAE-based company recruited Colombian private military contractors, trained them at military facilities in Abu Dhabi, and deployed them to Sudan to support the Rapid Support Forces (RSF). HRW said the operation began in 2024 and linked contractors to fighting in El Fasher in October 2025, while the UAE denied facilitating recruitment or transfers.