85

OVERALL THREAT

Edited by Mitch · analyst 85 · response 85

The risk is high, at 85 out of 100. A higher number means a more serious day. The top stories are: Europe — hybrid disruption; Cyber — active scan; Critical infrastructure — active scan. 10 stories made today's list after repeated stories were removed. The analyst scored it 85. The advice editor scored it 85.

  1. 1. Europe — hybrid disruption. One wave, not two. Bomb warnings diverted and escorted passenger flights over three days, then the same kind of warning emptied newsrooms in Ireland, Britain, and Bulgaria. No explosives were found. No government has shown who sent them.
  2. 2. Cyber — active scan. Security reporters, vendor teams, and Reddit are carrying computer break-ins and ransomware, which is when criminals lock files and demand money. A social-media post is not proof. Treat a security flaw as already in use only when the vendor, or the U.S. cybersecurity agency's list of flaws already used in real attacks, says so. Reddit added 5 posts today. The newest item: Pwning Home Assistant Green: Pre-Auth RCE in Eclipse Mosquitto.
  3. 3. Critical infrastructure — active scan. Utilities, election offices, and outage monitors are the sources for power, water, GPS, and satellite trouble. A Reddit post is included only when it is about a plant, a grid, or a pipe. Reddit added 0 posts today. The newest item: California · 3,562 customers out.
  4. 4. Iran — war. Forces are striking, according to news reports. Casualty figures below are the ones more than one outlet is carrying. A single military claim is not treated as fact. Aramco Tower hit in heart of Saudi capital as Houthis launch fresh strikes.
  5. 5. Poland — many people hurt. Civilians were killed or wounded. Police have not closed the case, so the count can still change. Surgeon having lunch near Krakow shooting undoubtedly saved officer's life, colleague says.
  6. 6. Mexico — crime. Homicide, drug gang, or trafficking reporting is in the news. It stays a crime story unless the attacker is identified as the state. Kenyan doomsday sect leader jailed for 200 years for murder of 190 children.
  7. 7. China — spying. An intelligence service is accused of recruiting or buying access. Being accused is not the same as being found guilty. Trump defends Nvidia CEO amid Chinese spying allegations.
  8. 8. Markets — market stress. Stock indexes fell sharply. The move is being reported as market stress. That does not prove an attack, and it is not a reason to buy or sell.
  9. 9. Japan — ATM / payment outage. Cash machines or payment networks are down. The company that runs the system has not said it was an attack.
  10. 10. Europe — cold-chain / OT cyber. Attackers reached refrigeration controls from outside the building. Supermarket freezers and blood-bank storage are among the systems named. The target is building equipment, not a normal office computer.

SOC-Master

soc

soc live · —

SOC LIVE · 207 feed rows · next X —

last brief —

Live feeds and the bot check every 15 minutes: USGS quakes, MassOutage, payment and ATM outages, NVD CVSS, CISA known-exploited vulns, Krebs, Dark Reading, Schneier, SANS, Project Zero, DFIR Report, Huntress, and the rest of the security blogs, Reddit on cyber and critical infrastructure, hacking news, vendor security response teams including Volexity, the Pentagon pizza index, NOAA solar flares, USGS volcanoes, airline threats, the Iran war including Qeshm and Hormuz, @osint613 on war, and @stefanburnsgeo on quakes and flares.

SOC-MASTER · OPEN A DIAL TO READ THE THREADSlistening

HIGH · 120 threads

MAP FOLLOWS THE DIAL98 points · 16,715 out · —

© OpenStreetMap · © CARTO

All six dials. Click one to filter the map. rose hack · amber vuln · ice infra · white violence · violet intel · teal disaster

UP USGS quakes 10UP MassOutage 20UP CISA KEV 6UP NVD CVSS 6UP Hacker News 4UP BleepingComputer 4UP Google News 6UP Protests 16UP War desk 8UP Crime desk 6UP Violence desk 8UP Espionage 6UP BBC/NYT/Guardian/AJ 14UP NOAA flares 2UP USGS volcanoes 3UP Vendor SRT 21UP Security blogs 22UP Pizza index 2UP Cold chain 4UP OT / ICS 4UP Counterterror 4UP ISAC 7UP IODA 2UP Ransomware 6UP Election Day 1UP GPSJam 18UP Satellite 1UP Aviation 6UP Payments 2UP Markets 5UP Reddit 5DOWN NWS 0UP InciWeb 4DOWN FBI 0UP DHS / USSS 3UP FEMA 2DOWN S&P threats 0

PIZZA MONITOR

war feed · Intel

DOUGHCON 4NORMAL

1 elevated · VA 1 · MD 0 · DC 0 · checked Nov 8, 10:40 PM ET

  • VADomino's McLean · Langley1.2× · 8

Counted only when SLICEWATCH marks a shop surge or elevated. Typical hours stay off the count. Shops are the DMV desk around the Pentagon, White House, Capitol, Langley, Meade, Andrews, Belvoir, and Baltimore.

STAN THE ANALYST

score 85 · Mitch edited

10 stories are at the top of today's report. The lead is Poland · many people hurt.

These are related reports, not proven links, and not a list of targets.

BILLY THE RESPONDER

score 85 · Spencer's recipes included

5 stories need a public response. The lead is Europe · hybrid disruption.

Advice for staying safer. Not an order, not a target list, and not instructions for an attack.

  • Europe · hybrid disruption

    needs attention

    One wave, not two. Bomb warnings diverted and escorted passenger flights over three days, then the same kind of warning emptied newsrooms in Ireland, Britain, and Bulgaria. No explosives were found. No government has shown who sent them.

    • Governments
      1. Treat a wave of airline bomb threats as one aviation-security picture, even when each alert is assessed as a hoax.
      2. Point the public only at the airline and the airport. Do not repeat the text of the threat.
    • Businesses
      1. Airlines and airports should follow their own security checklist and say plainly when a search found nothing.
      2. Do not publish passenger lists, gate changes beyond what travelers need, or how the warning arrived.
    • Public
      1. Follow the airline and the airport. A diversion is not a reason to share the threat message.
      2. Ignore posts that claim to know what is on the plane.
    • Spencer · incident response
      1. Follow the crew, the airport, or the building staff. Do not go looking for the threat.
      2. Turn off forwarding. Do not send the threat text, the photo, or the sender's name.
      3. Stay where you were told to stay until the official all-clear.

  • Cyber · active scan

    needs attention

    Security reporters, vendor teams, and Reddit are carrying computer break-ins and ransomware, which is when criminals lock files and demand money. A social-media post is not proof. Treat a security flaw as already in use only when the vendor, or the U.S. cybersecurity agency's list of flaws already used in real attacks, says so. Reddit added 5 posts today. The newest item: Pwning Home Assistant Green: Pre-Auth RCE in Eclipse Mosquitto.

    • Governments
      1. Pass the Cyber advisory to agencies and to operators of critical infrastructure.
      2. Ask sector leads to confirm whether the affected product is in use. Do not attach exploit detail.
      3. Keep the public note to impact and the official fix.
    • Businesses
      1. Find every system running the product named in the Cyber advisory.
      2. Apply the vendor fix or the documented mitigation. If you cannot patch today, isolate the system.
      3. Check logs for the activity the advisory describes, then tell customers only what you have confirmed.
    • Public
      1. Install the update from the vendor or the device maker.
      2. Ignore messages that offer a workaround, a crack, or a patch link.
      3. If a store or bank says a service is down, use their official app or site, not a link from a text.
    • Spencer · incident response
      1. Turn off the network on the affected computer. Unplug the cable or disable Wi-Fi. Leave the machine on.
      2. Turn off shared folders and remote desktop for the rest of the office until you know what else was reached.
      3. Do not pay, and do not open links in the ransom note. Restore from a backup that was not connected to the infected network, after the vendor patch is installed.

  • Critical infrastructure · active scan

    needs attention

    Utilities, election offices, and outage monitors are the sources for power, water, GPS, and satellite trouble. A Reddit post is included only when it is about a plant, a grid, or a pipe. Reddit added 0 posts today. The newest item: California · 3,562 customers out.

    • Governments
      1. Pass the public sector note to water, electric, and election operators. Do not republish anything marked a restricted warning.
      2. For elections, point the public at the official state site. For utilities, use the operator's own outage and water notices.
    • Businesses
      1. Water, electric, and election offices should apply the published fix and keep control systems off the open internet.
      2. Confirm the notice is a public notice or a public blog post before you forward it.
    • Public
      1. Use the official election site and your utility's own page. Ignore texts that offer a voting fix or a bill reset.
      2. If GPS interference is on the map, do not trust one navigation source for routing or timing.
    • Spencer · incident response
      1. Confirm the report with the named agency or company before you change how you operate.
      2. Until that confirmation, turn off any access to the internet you do not need.

  • Iran · war

    needs attention

    Forces are striking, according to news reports. Casualty figures below are the ones more than one outlet is carrying. A single military claim is not treated as fact. Aramco Tower hit in heart of Saudi capital as Houthis launch fresh strikes.

    • Governments
      1. Issue a consular note for people in Iran and point them at the official account of events.
      2. Keep emergency services on the posture already published. Do not freelance a new threat level.
      3. Correct casualty claims that your own spokespeople have not confirmed.
    • Businesses
      1. Account for staff and contractors in Iran.
      2. Postpone nonessential travel and site visits.
      3. Follow your country's foreign office and insurer guidance before reopening a local office.
    • Public
      1. If you are in Iran, avoid strike sites, protests, and areas the authorities have closed.
      2. Follow local authorities and your embassy, not a viral clip.
      3. Do not amplify an unverified casualty claim.
    • Spencer · incident response
      1. If you are in Iran, leave the block where strikes, crowds, or closed streets are.
      2. Turn off location sharing on public posts. Follow your embassy or the local authorities.
      3. If you cannot leave, shelter inside and stay away from windows.

  • Poland · many people hurt

    needs attention

    Civilians were killed or wounded. Police have not closed the case, so the count can still change. Surgeon having lunch near Krakow shooting undoubtedly saved officer's life, colleague says.

    • Governments
      1. Issue a consular note for people in Poland and point them at the official account of events.
      2. Keep emergency services on the posture already published. Do not freelance a new threat level.
      3. Correct casualty claims that your own spokespeople have not confirmed.
    • Businesses
      1. Account for staff and contractors in Poland.
      2. Postpone nonessential travel and site visits.
      3. Follow your country's foreign office and insurer guidance before reopening a local office.
    • Public
      1. If you are in Poland, avoid strike sites, protests, and areas the authorities have closed.
      2. Follow local authorities and your embassy, not a viral clip.
      3. Do not amplify an unverified casualty claim.
    • Spencer · incident response
      1. Run if you can see a safe way out. Leave bags behind.
      2. Hide if you cannot run. Lock the door, turn off the lights, and silence your phone.
      3. Fight only if you cannot run or hide and you are in immediate danger. Use whatever is at hand.
      4. When police arrive, show empty hands and do what they say.

REGIONS

World

Scan · onVerify · passSizer · idleWatch · openStan · 10Billy · respondSpencer · recipeMitch · editLog · idleYou · read

CASE · ENTRY vs EXIT

OPEN

$AHYISE

DISASTERwatching
entry
11-06 01:13 · lock 70%
exit
still open
size
not sized
where
USGS Volcano

reason Ahyi Seamount · YELLOW / ADVISORY — NMI Ahyi Seamount YELLOW/ADVISORY - No signs of unrest in satellite data; no significant geophysical signals.

source post
$ tail -f night.log340 lines
  1. solar ENTER $DAYFLA NOAA SWPC M3.57-day flares 110 · A 0 · B 13 · C 90 · M 7 · X 0 · strongest M3.5 — GOES primary X-ray flare counts for the last 7 days.
  2. 11-08 20:36 ENTER $GREATS USGS Volcano ORANGEGreat Sitkin · ORANGE / WATCH — AVO Great Sitkin ORANGE/WATCH - Slow eruption of lava within the summit crater continues.
  3. 11-08 19:29 ENTER $KILAUE USGS Volcano YELLOWKilauea · YELLOW / ADVISORY — HVO Kilauea YELLOW/ADVISORY - The Halema'uma'u eruption of Kīlauea is currently paused after episode 56 fountaining ended on November 5. The summit is reinflating and the next epis
  4. 11-06 01:13 ENTER $AHYISE USGS Volcano YELLOWAhyi Seamount · YELLOW / ADVISORY — NMI Ahyi Seamount YELLOW/ADVISORY - No signs of unrest in satellite data; no significant geophysical signals.

LOG

would you escalate this? → reading the log

showing 207 of 207 on screen