The Russian hacker group Secret Blizzard has developed its long-running Kazuar backdoor into a modular peer-to-peer (P2P) botnet designed for long-term persistence, stealth, and data collection.

Secret Blizzard, whose activity overlaps that of Turla, Uroburos, and Venomous Bear, has been associated with the Russian intelligence service (FSB) and is known for targeting government and diplomatic organizations, defense-related entities, and critical systems across Europe, Asia, and Ukraine.

The Kazuar malware has been documented since 2017, and researchers found that its code lineage goes as far back as 2005. Its activity has been linked to the Turla espionage group working for the FSB.

In 2020, researchers exposed its deployment in attacks targeting European government organizations. Three years later, it was seen deployed in attacks against Ukraine.

“Leading” Kazuar

Microsoft researchers analyzed a recent variant of Kazuar and observed that the malware now operates using three distinct modules: kernel, bridge, and worker.

The Kernel module is the central coordinator that manages tasks, controls other modules, elects a leader, and orchestrates communications and data flow across the botnet.

The leader is essentially one infected system within a compromised environment or network segment, which communicates with the command-and-control (C2) server, receives tasks, and forwards them internally to the other infected systems.

Non-leader systems enter “silent” mode and don’t communicate directly with the C2. This results in better stealth and reduced detection surface.

“The Kernel leader is the one elected Kernel module that communicates with the Bridge module on behalf of the other Kernel modules, reducing visibility by avoiding large volumes of external traffic from multiple infected hosts,” explains Microsoft.

The process for selecting the leader is internal and autonomous, using uptime, reboot, and interruption counts.

The Bridge module acts as the external communications proxy that relays traffic between the elected Kernel leader and the remote C2 infrastructure using protocols like HTTP, WebSockets, or Exchange Web Services (EWS).

Internal communications rely on IPC (inter-process communication), including Windows Messaging, Mailslots, and named pipes, blending well with normal operational noise. The messages are AES-encrypted and serialized with Google Protocol Buffers (Protobuf).

The Worker module performs the actual espionage operations, such as:

• keylogging
• capturing screenshots
• harvesting data from the filesystem
• performing system and network reconnaissance
• collecting email/MAPI data (including Outlook downloads)
• monitoring windows
• stealing recent files

The collected data is encrypted, staged locally, and later exfiltrated through the Bridge module.

Microsoft underlines Kazuar’s versatility, which now supports 150 configuration options allowing operators to enable/disable specific security bypasses, perform task scheduling, time the data theft and size of exfiltration chunks, perform process injection, manage tasks and command execution, and more.

Regarding the security bypass options, Kazuar now offers Antimalware Scan Interface (AMSI) bypass, Event Tracing for Windows (ETW) bypass, and Windows Lockdown Policy (WLDP) bypass.

Secret Blizzard typically seeks long-term persistence on target systems for intelligence collections. The actor exfiltrates documents and email content that has political importance.

Microsoft recommends that companies focus their defense on behavioral detection rather than static signatures, as Kazuar’s modular and highly configurable nature makes the threat particularly evasive.

Automated pentesting tools deliver real value, but they were built to answer one question: can an attacker move through the network? They were not built to test whether your controls block threats, your detection rules fire, or your cloud configs hold.

This guide covers the 6 surfaces you actually need to validate.

Advertisement

Download Now

RJ Scaringe has raised more than $12.3 billion across three startups, and the pace is accelerating. The Rivian founder and CEO, who holds a doctorate in mechanical engineering from MIT, is now simultaneously running an electric vehicle manufacturer, an autonomous micromobility company, and an industrial AI robotics startup, each attracting capital at a speed that would be remarkable for any single venture.

The latest data point arrived this week when Mind Robotics, Scaringe’s industrial robotics company, closed a $400 million round led by Kleiner Perkins, bringing its total funding to more than $1 billion and its valuation to $3.4 billion. The venture arms of Volkswagen and Salesforce also participated. Mind Robotics was founded in 2025, initially as an internal Rivian project called “Project Synapse,” and has raised $115 million in seed funding, $500 million in a Series A in March, and now $400 million more in under two months. The company is building AI-powered robots designed to handle the dexterous, reasoning-intensive manufacturing tasks that conventional factory automation cannot, using Rivian’s own production lines as a live training environment.

Scaringe’s second venture, Also, is an electric micromobility company spun out of Rivian in 2025. It has raised more than $300 million, including a $200 million Series C led by Greenoaks in March that valued the company at over $1 billion. DoorDash invested alongside a multi-year commercial agreement to deploy Also’s purpose-built autonomous small EVs for last-mile delivery. The company’s product lineup includes a $3,500 e-bike and a four-wheeled cargo EV designed to fit in a bike lane.

The overwhelming majority of the $12.3 billion, more than $11 billion, went into Rivian itself, most of it between 2018 and the company’s blockbuster IPO in November 2021. Rivian was founded in 2009 as Mainstream Motors and operated in near-obscurity for nearly a decade before revealing its R1T truck and R1S SUV prototypes at the 2018 Los Angeles Auto Show. The money followed quickly: Amazon led a $700 million round in early 2019, Ford invested $500 million, and by the end of that year Rivian had closed four funding rounds. A $2.5 billion raise in July 2020 and a $2.65 billion raise six months later preceded the IPO, which generated nearly $12 billion in gross proceeds at $78 per share and briefly valued the company at more than $100 billion.

Today, Rivian’s market capitalisation stands at approximately $18.2 billion, a significant decline that reflects the broader struggles of the EV sector. But the company continues to attract major partnerships. Volkswagen has overtaken Amazon as Rivian’s largest shareholder through a $5.8 billion software joint venture, and Uber struck a deal worth up to $1.25 billion for up to 50,000 autonomous Rivian R2 robotaxis across 25 cities by 2031.

What makes Scaringe unusual is not just the quantity of capital but the breadth. Supersized seed rounds have become more common in recent years, but they have generally gone to defence tech or AI startups founded by former OpenAI or Anthropic employees, not to electric micromobility or industrial robotics. Eclipse, one of Scaringe’s biggest backers and a lead investor in both Also and Mind Robotics, credits his combination of engineering depth and product instinct. Jiten Behl, partner at Eclipse and a former Rivian executive, described Scaringe’s ability to communicate a vision without overselling as “an art.”

The comparison to other serial entrepreneurs who have raised billions across multiple ventures, Elon Musk, Sam Altman, Palmer Luckey, is inevitable but imprecise. Multiple investors told TechCrunch that Scaringe’s distinguishing quality is the absence of self-promotion. “It’s not about him,” one insider said. “When you talk to him, he has enthusiasm about the product that is completely external.” Joe Fath, also at Eclipse, noted that Scaringe “has the rare combination of being a truly great engineer while also having an exceptional instinct for product design,” a pairing he described as “incredibly uncommon.”

The question that follows from $12.3 billion across three companies, all run by the same person, is whether Scaringe can sustain the pace. He travels between Palo Alto, Irvine, Rivian’s factory in Normal, Illinois, and a second factory under construction in Georgia. Mind Robotics is scaling rapidly, Also is preparing to deliver its first US products in 2026, and Rivian is ramping the R2 SUV while navigating a hostile tariff environment that has seen at least a dozen EV models cancelled or paused this year.

The industrial robotics market is attracting capital at an extraordinary rate, with companies from 1X to Unitree to Foundation Industries all raising hundreds of millions for physical AI systems. Mind Robotics’ pitch, that it has access to a live high-volume factory floor for training data, gives it a structural advantage most competitors lack. Whether that advantage translates into a durable business depends on execution at a scale that even Scaringe has not yet attempted.

Behl framed the question differently. “The big question is, how much can he do?” he said. “That’s a question that already assumes he’s reaching his limit. The thing is, he doesn’t look at it that way.“

Cybersecurity researchers at Cyera have disclosed four vulnerabilities in OpenClaw that, when chained together, allow an attacker to steal sensitive data, escalate privileges, and establish persistent control over a compromised host. The flaws, collectively dubbed “Claw Chain,” affect OpenClaw’s OpenShell managed sandbox backend and its MCP loopback runtime. All four have been patched in OpenClaw version 2026.4.22.

The attack chain works in four stages. First, a malicious plugin, prompt injection, or compromised external input gains code execution inside the OpenShell sandbox. Second, two of the vulnerabilities, CVE-2026-44113 and CVE-2026-44115, are exploited to expose credentials, secrets, and sensitive files. Third, CVE-2026-44118 is used to obtain owner-level control of the agent runtime by exploiting an improperly validated ownership flag. Fourth, CVE-2026-44112, the most severe of the four with a CVSS score of 9.6, is used to plant backdoors, modify configuration, and establish persistence outside the sandbox.

The most architecturally interesting flaw is CVE-2026-44118, which stems from OpenClaw trusting a client-controlled flag called senderIsOwner without validating it against the authenticated session. Any non-owner loopback client could impersonate an owner and gain control over gateway configuration, cron scheduling, and execution environment management. The fix, according to OpenClaw’s advisory, involves issuing separate owner and non-owner bearer tokens, with senderIsOwner now derived exclusively from the authenticating token rather than from a spoofable header.

The two TOCTOU (time-of-check/time-of-use) race conditions, CVE-2026-44112 and CVE-2026-44113, allow attackers to bypass sandbox restrictions and redirect file writes or reads outside the intended mount root. CVE-2026-44115 exploits an incomplete allowlist by embedding shell expansion tokens inside a heredoc body, enabling execution of commands that would otherwise be blocked at runtime.

The 💜 of EU tech

The latest rumblings from the EU tech scene, a story from our wise ol’ founder Boris, and some questionable AI art. It’s free, every week, in your inbox. Sign up now!

What makes Claw Chain particularly concerning is that each step looks like normal agent behaviour to traditional security controls. “By weaponizing the agent’s own privileges, an adversary moves through data access, privilege escalation, and persistence, using the agent as their hands inside the environment,” Cyera said. The attack broadens blast radius while making detection significantly harder, because the malicious actions are indistinguishable from the legitimate operations the agent is designed to perform.

This is not the first time OpenClaw’s security has come under scrutiny. In January, a critical remote code execution vulnerability (CVE-2026-25253) allowed any website a user visited to silently connect to the agent’s local server through an unvalidated WebSocket, chaining a cross-site hijack into full code execution. A Koi Security audit of ClawHub, OpenClaw’s skill marketplace, found 341 malicious entries out of 2,857 available skills, with attacks designed to steal credentials, open reverse shells, and hijack agents for cryptocurrency mining.

Nvidia addressed some of these structural security concerns in March with NemoClaw, an enterprise layer that adds sandbox orchestration, privacy guardrails, and security hardening on top of OpenClaw. The product was built in partnership with Cisco, CrowdStrike, Google, and Microsoft Security. But NemoClaw operates at the infrastructure level, not the application level, and the Claw Chain vulnerabilities sit inside OpenClaw’s own sandbox implementation, meaning even NemoClaw-hardened deployments would have been affected before the patch.

The scale of the exposure is significant. OpenClaw has more than 3.2 million users, is integrated with ChatGPT subscriptions through OpenAI, and has been adopted as an enterprise platform by Nvidia (NemoClaw) and Tencent (ClawPro). A significant portion of the installed base is running older, unpatched versions, and attackers have been targeting known vulnerabilities in versions prior to 2026.1.30 since at least February.

Security researcher Vladimir Tokarev has been credited with discovering and reporting the issues. Users are advised to update to version 2026.4.22 immediately. The broader lesson is one the AI agent industry has been slow to internalise: when an autonomous agent has access to files, credentials, APIs, and network resources, compromising the agent is functionally equivalent to compromising the user. Traditional perimeter security was not designed for a world in which the most privileged entity inside the environment is software that executes instructions from external sources.

Claw Chain is unlikely to be the last vulnerability disclosure of this kind. It may, however, be the one that forces the industry to treat AI agent security with the same rigour it applies to operating systems and cloud infrastructure, rather than as an afterthought bolted onto a product that was never designed to be this important.

AndaSeat is primarily known for its broad range of gaming chairs – and, more recently, the launch of its very first standing desk. And though it wasn’t evident at the time, it was a clear signal of intent: the company is spreading its wings from gamer-focus to home office furniture as a whole.

Ahead of this interview, a representative told me, “In terms of office furniture, we’ve been placing increasing emphasis on how products fit into more compact, multi-functional environments – where a single chair can support both focused work and more relaxed, recreational use.”

Noble Audio is using CanJam Singapore 2026 to introduce the FoKus Apollo Pro, a limited run version of its hybrid wireless headphone platform. Building on the original FoKus Apollo, the Apollo Pro adds upgraded acoustic tuning, more premium fabrics and finishes, new voice prompts, and updated ear pads with two new color choices.

However, its unique driver configuration remains the key point. Most premium wireless headphones focus on ANC, app features, battery life, and codec support, but Noble is leaning harder into acoustic design with a hybrid driver platform that combines dynamic and planar magnetic technology in a wireless over-ear portable design.

Debuting May 16th and 17th, the FoKus Apollo Pro is aimed at listeners who want a more refined version of the Apollo concept. However, its limited run release suggests Noble is testing new tuning before committing to a full production roll-out, since the original Apollo model has been quite popular and won numerous industry awards.

Refined Hybrid Driver Architecture

At the core of the FoKus Apollo Pro is Noble’s hybrid driver configuration, which pairs a dynamic driver with a planar magnetic driver in each earcup. The design is intended to combine the bass weight and impact typically associated with dynamic drivers with the speed, clarity, and detail retrieval often associated with planar magnetic designs.

Tuning

The Apollo Pro also introduces updated acoustic tuning intended to improve tonal balance, clarity, and overall presentation. Noble says the changes deliver deeper and tighter bass, improved detail retrieval, and a more open soundstage. Combined with Noble’s wireless platform and upgraded construction, the Apollo Pro is positioned as a more refined version of the Apollo for both home and portable listening.

Elevated Materials & Premium Craftsmanship

Noble has also updated the Apollo Pro’s materials and finishing details, with changes focused on appearance, comfort, and portability.

The Apollo Pro uses Italian Alcantara on the headband, revised gunmetal accents, upgraded fabric cabling, and new ear pad materials. Noble says the more breathable fabric on the ear cushions is intended to reduce heat buildup during longer listening sessions.

The packaging has also been made more compact, giving the Apollo Pro a more travel friendly footprint while preserving the premium presentation expected from a limited run release.

Voice Prompt

Apollo Pro also introduces Voice Prompt functionality, replacing traditional notification tones with spoken voice confirmations for key functions and mode changes, including ANC activation and other onboard controls.

Noble’s Flagship Wireless Platform

Powered by the Qualcomm QCC3084 chipset and compatible with the Noble FoKus companion app, the Apollo Pro combines high-end wireless audio performance with everyday usability and customization. With the Noble FoKus App (iOS, Android), users can manage playback settings, EQ adjustments, and access additional headphone functionality.

Wireless support includes LDAC, AAC, aptX, aptX HD, and SBC Bluetooth codecs, giving the Apollo Pro broader compatibility across Android, iOS, and other Bluetooth sources.

Pro Tip: The Apollo Pro also provides wired connectivity via an included 3.5 mm cable with 6.3 mm and 4.4mm adapters.

Comparison

The Bottom Line 

The FoKus Apollo Pro gives Noble a more serious foothold in full size wireless headphones by leaning on something most rivals are not offering: a hybrid dynamic and planar magnetic driver platform inside a Bluetooth headphone. Add LDAC, AAC, aptX, aptX HD, and SBC support, upgraded materials, revised tuning, Italian Alcantara, more breathable ear pads, and limited run positioning, and this becomes more than a cosmetic Apollo refresh.

What appears to be missing is the broader ecosystem strength of Apple, Sony, Sonos, Bowers & Wilkins, and Bose. Those brands bring deeper app integration, stronger ANC reputations, spatial audio platforms, and mainstream retail muscle. Noble’s play is different: better driver story, enthusiast credibility, premium materials, and a more focused sound-first approach. 

Price & Availability

The Noble FoKus Apollo Pro is being shown at CanJam Singapore, May 16-17, 2026. Global availability is available at NobleAudio.com and selected retailers for $699 USD / £649 / €749. However, these may not stick around long as only a limited production run was announced — not a permanent addition to the lineup.

The original Noble FoKus Apollo is available for $649 at Amazon.

Related Reading:

What’s going on with the U.S. job market? “The economy is growing. Unemployment is low,” notes the Washington Post. “And yet, for millions of workers, finding a job has become harder than at almost any other point in decades,” with the hiring rate “well below pre-pandemic levels for more than a year.”

Part of the problem? “Of the net 369,000 positions added across the entire economy since the start of 2025, health care alone accounted for nearly 800,000 — meaning every other sector, taken together, shed jobs.” By the end of 2025 nearly half of college graduates ages 22 to 27 were working at jobs that didn’t require a degree, according to stats from New York’s Federal Reserve Bank.

The headline unemployment rate, at 4.2%, looks healthy. But that figure has been buoyed by a shrinking labor force: Fewer people are actively looking for work, which keeps the rate down even as hiring slows…

[Some large tech companies] are trying to recalibrate after their hiring sprees of 2021 and 2022, when many had raised pay, offered flexible schedules and signed people quickly… Higher interest rates have also made expansion more expensive, pushing many firms to invest in technology rather than headcount. Another reason hiring has slowed is uncertainty about AI. Even though the technology has not yet replaced large numbers of workers, it is already shaping how companies think about hiring. “I don’t think this is AI displacement,” said Ben Zweig, chief executive of Revelio Labs, a workforce data company. “What we’re seeing is anticipatory.” Instead of rushing to bring on new workers, some firms are waiting to see how the technology evolves and which tasks it will eventually take over.
A 39-year-old web developer tells the Post it took 453 job applications to get a handful of interviews and two offers. And a journalism school graduate said they’d sent hundreds of job applications but most led nowhere, and they’re now couch-surfing to save money.

But the problem seems even worse for young people. One 18-year-old told the Post that in a year and a half of job searching, they’d yet to even meet an employer in person.

The unemployment rate for people ages 22 to 27 who recently completed college hit 5.6% in the final months of 2025 — well above the 4.2% rate for all workers, according to national data from the Federal Reserve Bank of New York… At one point last summer, new workforce entrants made up a larger share of the unemployed than at any point since the late 1980s — higher even than during the Great Recession. When hiring slows, the door closes first on those without an existing foothold. For the class of 2026, the timing could hardly be worse.

“It is getting increasingly clear that young people are being more affected by AI than older workers,” Zweig said. Companies are not eliminating jobs at scale, but many are slow to hire junior workers. At the same time, older workers are staying in the labor force longer, leaving fewer openings for new arrivals. Even when jobs are available, the bar has shifted. Positions once considered entry level now often require several years of experience, technical expertise and familiarity with AI tools. With fewer openings and more applicants, companies are holding out for candidates who can do the job immediately and need little training… Employers are also looking for a different mix of skills. An analysis of millions of job postings by Indeed found that communication skills now appear in nearly 42% of all listings, while leadership skills feature in nearly a third — capabilities that are harder to prove on a résumé and harder still to demonstrate without an existing professional network. Christine Beck, a career coach who works with early-career job seekers, said employers are asking more of the people they do hire.

The Bear season 5 is the last course on the hit FX Networks show’s menu. Indeed, the culinary comedy-drama will bow out after serving its final meal on June 25/26, so we’ll have to savor every morsel once it’s released.

Before Carmy and company pre-heat the titular restaurant’s stoves for the final time, you’ll want to know more about The Bear‘s last hurrah — and this guide has got you covered. From its confirmed launch dates and likely cast, to where the story could go and whether any spin-offs could get made, here’s everything we know so far about the series’ forthcoming season.

The Bear season 5 release date