r/SecOpsDaily

Apple has started sending a fresh wave of Threat Notifications to users in over 92 countries, warning they may be targeted by state-sponsored mercenary spyware. These are the same notifications Apple introduced last year to replace the old "state-sponsored" alerts, and they are triggered by threat intelligence and internal detection—not a specific CVE or active exploit chain.

Technical Breakdown

• Threat Actor: State-sponsored mercenary spyware groups (e.g., NSO Group, Intellexa). Apple does not attribute the campaign publicly.
• Detection Method: Apple relies on internal threat intelligence and behavioral analysis, not a specific signature or known exploit. This means the alert can fire even if no malware is found on-device.
• Notification Mechanism: Sent via email and iMessage to the Apple ID associated with the account. Users also see a red banner at the top of appleid.apple.com.
• Targeting: High-risk individuals—journalists, activists, politicians, diplomats. The current wave spans 92+ countries.
• No IOCs provided: Apple does not share hashes, domains, or IPs with the target. This is a "you may be targeted" warning, not a forensic report.

Defense If you or your org receive one of these, treat it as a high-fidelity signal. Immediately:

1. Enable Lockdown Mode on all Apple devices.
2. Review device logs for anomalous processes or profiles.
3. Reset Apple ID credentials and review authorized devices.
4. Contact Apple Security Research directly for device forensics support.

This is not a false positive—Apple has a strong track record of accuracy with these notifications.

Source: https://www.bleepingcomputer.com/news/apple/apple-sends-new-threat-notification-alerts-over-mercenary-spyware-attacks/

Hi Reddit,

DDoS attacks are becomeing larger and cheaper to launch, so we work on a scalable open source solution to mitigate them.

Tempesta xFW's core is XDP and TC eBPF programs implementing volumetric DDoS filtering. A user-space daemon handles gRPC requests from CLI tool or WebAPI (via C library).

It supports two packet-path architectures:

• host-based protection, such as CDN edge or on-premises application delivery controller (ADC) cases, where the host is a TCP connection endpoint. This is good for protecting a local web or DNS server.

• router-based protection, such as ISP, hosting, or IaaS provider cases, where the host routes IP packets to protected servers or networks.

Router-based deployment can be always-on/pass-through or on-demand/redirection protection. In the later case, a node may not "see" normal clean traffic and may receive only traffic containing a DDoS attack. Also, the node may receive only client-to-server traffic, as in direct server return (DSR) or some traffic scrubbing scenarios. In this mode a DDoS sensor and mitigation controllers are typically needed.

Traffic performance metrics are exported in Prometheus format.

DDoS incidents are aggregated per source IP and logged to Clickhouse for analysis.

A dry-run (evaluation) - mode allows you to observe all reported incidents and metrics without blocking traffic..

Single Xeon Gold 6348 with ConnectX-6 dual 100Gbps reach 196Mpps and 176Gbps of filtering capacity.

• GitHub repository
• documentation
• performance benchmarks
• Netdev 0x1a talk