The role and demand for red-teaming capabilities are growing, as more exploitable CVEs make their way into criminal hands. Being proactive is no longer a capability that can be reserved for annual tests, but a continuous assessment to determine exposure and even through the validation of an organization’s security posture. With this in mind, we are delighted to announce the long awaited availability of Metasploit Pro 5.0.0 –which is not just an update, but a fundamentally new approach to red-teaming, designed with the sole intention of staying ahead of ever-increasingly capable threat actors.
Amongst the multitude of changes, Metasploit 5.0.0 offers an intuitive testing workflow that removes the ever evolving complexity of testing, as well as a suite of powerful new modules and critical enhancements. This is the version you can’t afford to miss. For all the technical details, the granular release notes can be viewed here.
So what’s new?
Intuitive testing workflow
Say goodbye to complexity, as Metasploit Pro has completely overhauled the testing workflow. Updates are highlighted by an intuitive user interface, ensuring that your focus remains on high-value penetration testing and vulnerability validation, not fighting the interface. These changes are the foundation for the future, preserving the core functionality you rely on while enabling even more powerful features down the road.
⠀
Stop guessing and start seeing. The new implementation of Network Topology support provides instant, crystal-clear clarity on hosts that have been compromised, have associated cracked credentials, or captured data. For enterprise environments with vast, complex surfaces, we’ve invested in performance improvements, giving you the power to zoom and pan through hundreds of available hosts with zero lag. This is actionable visualization that transforms data into defense.
⠀
Vulnerability detection improvements
Get the necessary assurance before you click ‘run.’ Metasploit modules can now register crucial vulnerability detection details as part of running. This means that modules capable of running pre-check detection logic give you the full intelligence picture before you attempt exploitation. This new level of transparency and detail empowers you to make smarter, faster decisions, saving you precious time and minimizing the chance of failed module runs and adverse side effects.
⠀
Advanced workflow improvements
Unleash your inner expert with unprecedented control and efficiency. Advanced users of Metasploit Pro will immediately benefit from multiple UX improvements to the single module run page. Tired of manually configuring options? Users now receive intelligent suggestions for applicable values, including network targets, Kerberos credential cache files, and more – streamlining ADCS workflows.
⠀
Furthermore, you now have the ability to manually choose and configure individual payloads, giving you the final word on how you exploit targets. Metasploit Pro will continue to default to the most common payload for each exploit.
Plus, new quality-of-life improvements for replaying module runs ensure that verifying remediation and re-exploiting targets is a seamless, one-click process. Gone are the days of reconfiguring an entire module run to change a single option. The old list view has also been updated to include the ability to view the module option details that a module was run with. These capabilities can additionally be leveraged by advanced users who are interacting with Metasploit Pro in a programmatic fashion or through the command line interface to see exactly how Metasploit Pro is running modules.
⠀
Finally, boost your team’s collaboration with the new session tagging feature. Sessions can now be tagged to facilitate advanced and coordinated post-exploitation workflows. Team members can apply instant, custom tags to track status and flag arbitrary qualities, which significantly improves coordination and organization across multi-person engagements.
AD CS exploitation
Tackle one of the most critical attack vectors in modern networks: Metasploit continues its relentless investment in modern exploitation techniques with the groundbreaking updates to the AD CS Workflows Metamodule. This powerful new feature is a significant advancement, providing security professionals with an automated, comprehensive approach to identifying and leveraging nine common AD CS vulnerabilities.
Now we’ve taken it even further, with new support for the latest and most dangerous ESC flaws: ESC9, ESC10, and ESC16. Take back control of your Active Directory environment and neutralize these threats with surgical precision. For detailed configuration instructions and comprehensive feature documentation, visit our AD CS Workflows MetaModule documentation.
⠀
Session tags
In fast-moving operations, context can disappear quickly as new sessions come online and analysts shift between tasks. Session tagging brings clarity back to your workflow by letting you attach meaningful labels to every open session. Instead of relying on IPs or hostnames alone, you can tag sessions with identifiers that matter to your team – such as priority, environment, or role – making it easy to group related systems and instantly recognize high-value targets.
⠀
SAML Single Sign On
Metasploit Pro now incorporates SAML Single Sign-On (SSO) authentication, providing your team with a simple, unified login experience. By connecting to your centralized directory, users can access Metasploit Pro with the same credentials they use for all other major applications. Administrators can easily configure their identity provider (IDP) to enable a passwordless workflow and utilize existing Multi-Factor Authentication (MFA) services, making access quick, consistent, and part of your standard corporate flow.
These features are available in Metasploit Pro 5.0.0 onwards. We’re also proud to collaborate with our customers, who are often the source of inspiration for product evolution. Ideas for improvements or enhancements can be shared with our Support team to help you refine the idea, then submit it to our Product team on your behalf.
Related viewing
Rapid7 Labs launched a podcast today! Episode 1 of ‘Hacktics & Telemetry’ is now live on Rapid7’s YouTube page. Alongside some expert commentary on emergent threats and an exciting guest spot, the final segment is all about Metasploit Pro 5.0.0. Dive into our official companion blog here, and find the full episode embedded below.
If you spend your days building, shipping, defending, or fixing systems, you already know how this goes. A new technique shows up in a research thread, someone drops a “has anyone checked if we’re exposed?” comment, and suddenly you’re juggling risk, patches, logging gaps, and whatever tool is in the blast radius this week.
That day-to-day reality is why Rapid7 Labs is launching Hacktics and Telemetry, a bi-weekly video and audio podcast with episodes built to fit into a lunch break or a commute. It’s hosted by Rapid7’s Douglas McKee, bringing to the pod years of deep technical and leadership experience, then co-hosted by Jonah ‘CryptoCat’ Burgess – a strong researcher with a solid pulse on the cybersecurity community.
The format stays consistent on purpose. Each episode starts with a scan of what’s emerging, shifts into a guest conversation, then closes with a short segment that ties the story back to mitigation and tooling. The goal is simple: move past theory, show what’s happening with real examples, and leave you with something you can act on.
Episode 1: OpenClaw Risks, RCEs, and Metasploit Pro Updates
Doug and Jonah open by digging into two AI-centric stories from the past week. The first is PhoneLeak, described as data exfiltration in Gemini via phone call. It’s the kind of uncomfortable example that forces practical questions: how do you defend against mobile clickjacking when it’s disguised as a routine CAPTCHA? When an AI assistant has deep extensions into a user’s workspace, how do you prevent malicious prompts from quietly accessing sensitive data like 2FA codes? And perhaps most importantly, how do defenders anticipate and monitor for bizarre, out-of-the-box exfiltration methods—like an AI bypassing SMS confirmations to leak data via DTMF tones on a phone call?
The second story comes from the other side of the AI conversation: an AI agent reportedly identifying an RCE in BeyondTrust remote support, plus discussion of older privileged remote access versions. More automation can mean faster discovery, which shrinks the window between “interesting finding” and “you need to patch this.” That changes how defenders think about exposure, patch prioritization, and what “good enough” means (and looks like) when it comes to monitoring.
In the guest segment, Greg Richardson (Global Advisory CISO & AI Thought Leader, 6 Levers AI) walks through how he uses AI agents in his workflow while keeping control tight. He talks about setting tasks while he sleeps, but the constraints are the point: access is locked down, the agent only touches files he explicitly provides, communication is limited, and token limits help cap the size of any mistake. He also makes a strong case for starting small, with one task at a time, instead of trying to automate dozens of things on day one.
To close out this inaugural episode, the team hits on a SolarWinds Help Desk vulnerability, then shares a quick look at Metasploit Pro 5.0 updates – including more granular payload selection and a walkthrough of the new UI.
If your idea of useful content includes threat trade-offs, concrete mitigations, and a bit of candid “how this actually plays out,” you’re in the right place.
Минаха 6 дни от началото на кампанията за събиране на заявления за гласуване в чужбина за изборите на 19-ти април. Писах за формуляра за подаване на заявления и съвети за попълването му на 6-ти март. Седмица по-рано описах защо сега за разлика от последните няколко години подаването на заявления е от критично значение за отварянето на секции. Това се случва след промени в Изборния кодекс, които връщат правата и възможностите за гласуване на българите в чужбина години назад и създават излишни трудности както в организирането, така и в участието в изборния процес. Тъй като промените станаха буквално в последния момент, имаше несигурност дали ще има кандидати специално за район Чужбина, както и какъв ще е процеса за създаване на секциите. Вероятно затова отново имаше забавяне в публикуването на електронното заявление за гласуване от страна на ЦИК.
Както и предишни години следя активността по подаване на заявления на страницата на Glasuvam.org. Има карта и подробен списък отразяващ точно подадените заявления. Опитал съм се максимално да отразя и решението за автоматично одобрени секции. Имаше проблем с автоматичното следене на заявленията, но се реши. За първите 5 дни графиката на подадените заявления по часове е оценка на база активност предишни години и броя подадени в различни часове сега. На графиката виждате сравнение в светло синьо с активността на последния вот през октомври 2024-та.
Това, което следя също е активността по дни и я сравнявам с изборите през последните 10 години. Тук виждате броят събрани заявления по ден от започването на кампанията – т.е. публикуване на електронния формуляр. През 2024-та имаше доста ниска активност, тъй като доста от секциите бяха отворени автоматично и повечето хора не виждаха смисъл да подават заявления. През 2023-та, 2022-ра и ноември 2021-ва активността беше по-висока, включително на самия вот. Най-много заявления имаше през април и юли 2021-ва като през април имаше рекорден брой събрани в първия ден, както и общо през кампанията. Отговорност за това имаше както най-дългия срок за подаване до сега, така и много добрата координация и работа на доброволци и задгранични огранизации.
Сега виждаме, че събирането върви с добри темпове и се доближава до това през юли 2021-ва. На втората графика виждаме същите данни, но с оставащи дни до крайния срок. Там също се вижда, че въпреки късния старт – едва 19-дни преди срока от 24-ти март – събирането на заявления изпреварва кампаниите от предходните години.
Великобритания, където българите бяха сред най-засегнатите от органиченията в пробмените на Изборния кодекс, показват най-голяма активност. Вижда се, че събирането върви със същите темпове както през юли 2021-ва и изпреварва в пъти събраните заявления две седмици преди крайния срок.
В Германия, където е навярно най-голямата българска диаспора, също има висока активност въпреки, че голям брой секции ще бъдат отворени автоматично както и предишни години. При липса на други променливи, това може да е индикация за значително по-висок интерес към участие в изборите от предходните години. Т.е. може да е индикатор за по-висока изборна активност поне сред сънародниците ни в чужбина, на които мнозинството в този парламент практичесни позволява физически да гласуват.
Събирането на заявления в Турция винаги е показвала различна крива на активност от другите държави. Този път в началото се виждаше липсва на заявления напомнящо на 2017-та, когато десет дни почти никой не подаваше такива. На 4-тия ден обаче се активизираха и вече се движи аналогично на събирането на заявления на последния вот. Общият им брой обаче е сред най-ниския на този етап от кампанията, както и спрямо оставащото време, както се вижда на следващите две графики. Данните за 2026-та са е синьо.
Това е странно предвид, че по подобие на Великобритания не само броят секции е ограничен, но и изрично трябва да се подават заявления, за да е възможно отварянето им, тъй като автоматичното одобрение беше оставено само в рамките на ЕС.
Ако вземем данните за всички други държави освен Турция виждаме, че активността на събиране е идентична с тази от юли 2021-ва.
Предвид късния старт и при липса на промяна в динамиката очаквам поне 55 хиляди заявления. Сравнил съм броя заявления събирани по държави в последните 10 години и се вижда, че в Турция се подават между 18 и 28 хиляди на година. Тази година очаквам повече в горния край заради ограниченията. Кривата за активността в другите държави ми показва, че вероятно ще се повтори сценария от юли 2021-ва, когато под 40% от заявленията са в Турция. Ще разберем през следващите две седмици.
Електронния формуляр за заявления за гласуване в чужбина ще намерите на страницата на ЦИК.
Журналистиката е на изчезване. Не ви го казвам аз. Казва го последното проучване на Института „Ройтерс“, което включва елита на новинарската индустрия в 51 държави по света.
Делът на песимистите за бъдещето на професията почти се е удвоил – от 10% през 2022 г. до 18% днес. Паралелно с това оптимизмът се срива – едва 38% от хората, които правят журналистика на най-високо ниво, казват, че професията ще има добро развитие в следващата година. Преди четири години този дял е бил около 60%.
Оптимизъм
2022 60%
2026 38%
Песимизъм
2022 10%
2026 18%
Причините?
Разбира се, виновникът за всичко тези дни – изкуственият интелект. Но не само. И не защото роботи пишат новините, а защото роботи променят пътя на читателите до тях.
Вместо да кликат към медийни сайтове, все повече потребители стигат до информацията директно в търсачката, която им дава синтетично обобщение, сглобено от чуждо (често безплатно) съдържание. Издателите очакват трафикът от търсачки към новинарските сайтове да спадне с около 40% през следващите три години именно заради тезит.нар. zero-click търсения.
Преди
Журналист
→
Медия
→
Търсачка / платформа
→
Читател
Сега
Журналист
→
Медия
→
AI / search
→
Синтетичен отговор
→
Читател
Ключовата промяна е, че читателят все по-често получава отговор, без да стига до оригиналния източник.
Има и друга причина – кризата на релевантност на традиционните медийни брандове, особено на комерсиалните. Години наред те се опитваха да запазят бизнес модела си, лутайки се между страх и неразбиране на социалните мрежи и опита да ги използват като прокси – вход към собствените си платформи, където да монетизират вниманието на аудиторията. Само че през това време публиката тихо се премести другаде, а порасна и нова, която никога не се е информирала от друг екран освен от телефона. За нея „телевизорът“ е YouTube, Instagram и TikTok.
Тук вече говорим за нещо по-дълбоко от технологична промяна. Това е поколенческа и екзистенциална криза.
Журналистиката не просто губи публика – тя губи връзката си с цели поколения и групи от обществото. Губи навика да им бъде нужна.
Политиците също успешно „помагат“ в делегитимирането на новинарските медии. Дали като ги приласкават и подкупват, дали като им викат fake news и мисирки, или просто като ги маргинализират чрез заобикаляне. Могат да си го позволят, защото социалните мрежи им дават достъп до същата, а понякога и до по-голяма публика без досадния посредник журналист, който прекъсва с въпроси. Не дай боже, критични. Или коригира твърдения. Често лъжливи.
Телевизионният фолклор пази спомена за Бойко Борисов и неговата реплика, че идването му в сутрешния блок на Нова телевизия при Ани Цолова и Виктор Николаев (2013–2017) му се струвало като ходене на зъболекар. Не ти е приятно, но трябва.
Сега вече не трябва.
Днес, макар да не е премиер, той има над 300 000 последователи във Facebook и понякога достига до 2 милиона гледания на клипче.
За сравнение: една рейтинг точка в България е около 70 000 души в общата демографска група – т.нар. 4+ (от 4 години нагоре), а сутрешните блокове в последните поне 15 години рядко правят повече от 4–5 рейтинг точки – дори и в най-добрите си времена. Сметката е проста: 300 000 гледания в най-добрия случай, ако станеш рано и отидеш до „телевизора“. А като се има предвид, че Facebook е предпочитаният източник за новини на българите, наравно с телевизиите, наистина не разбирам защо човек трябва да слага костюм и от кръста надолу и да бие път до близки и далечни студиа, за да му прекъсват мисълта.
Разбира се, телевизионните студиа бяха удобно обзаведени с хора, които не прекъсват мисли. Дали защото нямат с какво да ги прекъснат, дали заради смразяващия ефект на празните столчета.
Но това, струва ми се, е по-неуспешната стратегия за умъртвяване на журналистиката. Защото е твърде груба, твърде публична, а и успехът е често пирова победа. Все пак, каквото и да казват рейтингите, ясно е, че никой не гледа това, което в момента дават сутрин по bTV. Има и контрареакция, която дори и пренебрежимо малка, за да създаде реален бизнес проблем, e достатъчно голяма, за да създаде криза на влиянието. Не е удобно, когато в собствения ти ефир през ден ти повтарят, че си изпълнил политическа поръчка, включително собствените ти гости, дошли да се възползват от твоята публика, но и да ѝ отбележат, че седи на пресен гроб.
И да, това не е възпряло хората да си гледат „Ергенът“.
За сравнение, когато ABC се опитаха да спрат Джими Кимъл миналата есен и публиката възприе това като политически мотивирано решение под натиска на консервативни лидери и медии, реакцията беше 7 милиона отказали се от стрийминг услугите на компанията (Disney+ и Hulu). Седем милиона. Това е около един на всеки 30 потребители. И да, при платформи гиганти това не звучи като фатален удар. Но когато загубата се случи за няколко дни, дори и многомилиардни корпорации си взeмат бележка. Кимъл беше върнат на екран, а първият му епизод след прекъсването записа рекордна гледаемост.
Но пък на принципа на снежната топка натрупващите се случаи на обезглавяване на журналистиката година след година доведоха до качествени изменения. За първи път миналата седмица новоизбран министър-председател, пък макар и служебен, избра за първото си програмно интервю не голям телевизионен ефир, а нишов интернет подкаст.
Гостуването на Гюров в „Бюрото на Константин Вълков“ дава ясен знак: големите политически процеси, включително и предизборните кампании, вече имат нов терен. И той е в интернет.
Електоратът е във Facebook и TikTok, не пред телевизора
Особено младите и особено негласуващите. Те познават Юксел Кадриев като поет от Instagram, а за сутрешните блокове разбират, когато откъси от тях попаднат в клиповете на „Цанов НАПРЕД и НАГОРЕ“. Те не включват телевизора, освен на Netflix, и не познават лицата и имената от телевизионните студиа. Вероятно и Косьо Вълков не познават – той също идва от преддигиталната епоха. Но завоят е ясен.
Взе го и Бойко Борисов, който досега поне не показва да е загубил природно силните си медийни инстинкти. През януари, след дълго мълчание, той даде общо четири пространни интервюта. Макар при него миксът между традиционни и нови медии да беше по-балансиран между старите брандове, като „Капитал“ и bTV, и YouTube каналите на Явор Дачков и Мартин Карбовски.
Това изместване на голямата конкуренция от телевизията към интернет не е само български феномен. По света вече е стандарт. Най-гледаните политически разговори в САЩ през последните години не са телевизионни интервюта, а подкасти. Някои от тях – като на Джо Роган – достигат аудитория, сравнима с тази на национални телевизии. Голяма част от подкастите направиха възможна безапелационната победа на Тръмп, който видя потенциал в т.нар. manosphere – общо название за онлайн общности, форуми и инфлуенсъри, които обсъждат мъжествеността, отношенията между половете и ролята на мъжете в обществото, като в тези общности често се появяват мизогиния, конспиративни идеи и радикализиране на млади мъже. Знаме на маносферата в глобален мащаб е Андрю Тейт, в местен се опитват да бъдат хора като Киро Брейка. И резултатите са налице. В глобално проучванеGen Z се оказа най-консервативното от години насам, като 30% от младите мъже смятат, че жените трябва да им се подчиняват.
Но подобни формати не са само крайнодесни. Във Великобритания The Rest Is Politics събира милиони гледания и често задава дневния ред на политическия разговор в страната.
Хора, които се явяват нещо като продължение на журналистиката в дигиталната епоха. Понякога са бивши журналисти. Понякога просто харизматични коментатори. В много случаи аудиторията им вече е по-голяма от тази на традиционни редакции и те развиват собствена медийна екосистема, създавайки едновременно възможност и риск за журналистиката, каквато я познаваме.
Алгоритми
Подреждат какво виждаме, кога го виждаме и колко често го виждаме.
Нюзинфлуенсъри
Превръщат новините в директен, персонален канал към аудиторията.
Политици
Все по-често комуникират без журналистически посредник.
→
→
→
Публика
Вниманието вече се разпределя между много гласове
Журналистиката не изчезва, но губи монопола върху това кой обяснява света.
Това е криза не само на бизнес модел, а и на посредничество.
От една страна, нюзинфлуенсърите достигат до групи, които са завинаги загубени за традиционните медии. Вероятно стоят в основата на Gen Z активизма, залял площадите миналата година не само в България. За тези нови публики журналистиката не е институция, нито е система от правила и стриктни принципи за работа с информация.
Журналистиката е съдържание. Парасоциално свързване с лице, глас, профил, таг. Изискването тук не е истината или фактите.
В изследване на Pew Research потребителите очертават профила на идеалния нюзинфлуенсър така: да ми помага да разбирам актуалните събития и проблеми; да реагира бързо, когато нещо се случва; да е автентичен – разбирай, да говори от свое име или поне така да изглежда. „Да ме забавлява и да споделя моите ценности и мнения“ е важно в различна степен за 70% от анкетираните.
Сега сравнете това с ценностите на журналистическата професия и ще разберете откъде идва рискът на новия модел.
Единственото общо е целта – да информира и да разяснява социално значими процеси. При нужда – бързо. И с това приликите свършват. Докато журналистиката търси факти, тук нуждата е от споделени преживявания, мнения и ценности. Търси се общност, формирана на основата на емоционални сходства.
Мислят като мене, значи това, което ми казват, е вярно. Ако мнението ми харесва, нямам нужда от факти. Ако фактите развалят споделеното ни мнение, ще си намерим алтернативни факти. За да опазим общността.
Докато от журналистите се очаква да се стремят към обективност и дистанцираност от всички страни, да се пазят да не стават част от историята, която представят, и да се стараят отчетливо да отделят мнение от факт, от инфлуенсърите се иска персонифицирано съдържание, което да забавлява и утвърждава. Докато в журналистиката конфликтът е норма и начин на мислене, в социалните мрежи той е белег за токсичност и води до блокиране и канселиране.
Освен това, за разлика от редакциите, инфлуенсърите рядко имат процес по проверка на фактите или задължение за поправяне на грешки. И когато съдържанието се движи от алгоритми, подсилващи емоцията и конфликта, изкушението да се гони тренд, който става вайръл, вместо най-постижимата версия на истината е огромно.
Така именно нюзинфлуенсърите стават и потенциален основен източник на дезинформация. А по-тихата промяна е, че изтънялото доверие допълнително се измества от институции към личности.
В политиката това води до вълна от мачопопулизъм. В медиите – до фен бази и парцелиране на публиката на твърди ядра на принципа свой–чужд. А онези „архивни“ журналисти, които отказват да се влеят в която и да било идеологическа ниша и продължават да бъдат критични към всяка власт и всяка идеология, в крайна сметка се оказват обречени да загубят всяка публика. Защото, както видяхме и по случая „Петрохан“,
и добрите, и лошите не искат журналистика, когато не харесват новините.
Един тежък криминален случай отново и по болезнен за всички ни начин показа до каква степен държавата е абдикирала от основни свои функции, оставяйки гражданите си абсолютно уязвими: от образование, през защита на горите, до правораздаване и служби за сигурност. Когато доверието в институциите, призвани да търсят истината, практически липсва, Facebook неизбежно се превръща в министерство на истината, а три милиона следователи – в разследващи журналисти.
Хора, които едно интервю не са вземали през живота си, се надпреварват да дават съвети на Миролюба Бенатова, Генка Шикерова и Мария Черешева:
кои въпроси трябва да се задават;
кога и при какви условия могат да прекъсват събеседник;
трябва ли да се правят интервюта при незавършени разследвания;
трябва ли да се говори с жертви на престъпления;
кои майки имат право да говорят и кои – не.
Напоследък си мисля, че наблюдаваме как в края на земния си път журналистиката изпълнява самоотвержено своята последна обществена функция – да обедини иначе необединими обществени групи. Едните харесват Украйна, другите ходят на 3 март с руско знаме. Едните харесват гей парада, другите – парада на традиционното българско семейство. Едните искат България винаги в Европа, другите – никога срещу Русия.
Свързва ги само едно.
Че журналистите са гадове.
А „гадовете“ са малцината останали нормални журналисти, които имат комбинацията от опит, гръбнак, познания и интегритет да пазят журналистиката от фенщината. И им се занимава с това. Казвам „малцина“ и мога да ги назова поименно – не са повече от 20. Признавам си, че имам специално отношение към тях. Като към защитен вид. Защото алтернативата е Андрю Тейт или Киро Брейка.
Баланс, стандарти и етика. Това, разбира се, са много важни категории в нашата професия. И извратени до пълната им антитеза в родните ни медийни условия. Не защото не са съществени, а защото в лицето на користни играчи и/или непрофесионалисти могат да бъдат прилагани, както дяволът чете евангелието. Или, за да съм по-конкретна – както българска прокуратура делото за КТБ.
Мога да дам пример от годините ми като шеф на новините в Нова телевизия.
Когато започна разследването срещу Делян Пеевски по Глобалния закон „Магнитски“ и се появиха първите данни, че може да му бъдат наложени санкции за корупция, ръководството на телевизията имаше сериозен проблем, че отразяваме темата. Подозирам, че проблемът е бил на някого извън телевизията. Но аргументите звучаха познато. Същите аргументи, които чуваме днес по казуса „Петрохан“.
„Това е неприключило производство.“
„Защо трябва да правите интервюта на парче?“
„Защо давате думата на адвокати на обвиняеми?“ (В онзи случай – Цветан Василев, който след фалирането на КТБ вече беше готов да говори срещу бившите си ортаци.)
„Къде е другата гледна точка?“ (Пеевски тогава все още не говореше пред асансьора.)
„Защо не изчакате разследването да приключи, да отиде някой до САЩ, да прочете всички тези документи, които се цитират като основание за санкциите, и тогава да направите журналистическо разследване?“
Ако бяхме следвали тези „професионални“ препоръки, вероятно и до днес нямаше да сме споменали темата „Магнитски“ в новините. Което, подозирам, е била и целта.
Но сега виждам същите аргументи от хора, с които довчера протестирахме в защита на Мария Цънцарова и свободата на журналистиката.
През годините съм стигала до един и същ извод:
всеки защитава до кръв свободата на словото, с което е съгласен.
Докато журналистиката защитава нашата кауза, тя е необходима. Когато обаче започне да задава неудобни въпроси на „нашите“ или срещу „нашите“, изведнъж се оказва проблем. Само че свободата на медиите има нужда от защита точно тогава, когато в търсене на истината стига до неудобни и непопулярни тези.
На ежедневна база журналистиката рови в неподреденото. Осветява ъгли на споделените ни обществени килери, които са непоносими, разхвърляни и често миришат или изглеждат неприятно.
И точно тогава ни трябва – за да ни води през тези неосветени коридори, докато се прояснят силуетите на истината срещу караконджулите на фалшивите новини, пропагандата, конспирацията и обикновения информационен хаос.
Може би е нужно тук да обясним какво всъщност прави журналистът.
Защо прекъсва? Защо задава въпрос по няколко пъти? Защо работи по неразкрити престъпления? Защо понякога се движи по тънкия лед между интереса на малцина и нуждата за информираност на мнозина?
В Етичния кодекс на журналистите – този, който всички обичат да цитират, но малцина са чели – има няколко основни принципа.
Първият е:
Търси фактите и ги съобщавай.
Не „Търси фактите и ако се харесват на публиката, ги съобщавай“. Не е и „Търси фактите и ако са забавни, ги публикувай“.
Вторият е:
Минимизирай вредата.
Обърнете внимание – не е „Не вреди“. Вреди с мярка. Тоест професията допуска, че в процеса на търсене на истината неизбежно може да се стигне до вреда. Нашият стандарт е да направим най-голямото възможно добро за най-голям брой хора.
Това означава, че понякога ще задаваме въпроси, които връщат събеседниците ни на места, на които те не искат да бъдат. Разбира се, с нужните защити за най-незащитените – деца, жертви на престъпления и т.н. И обратно – за хората с публична власт пространството на лична защита следва да е силно ограничено до липсващо. Но никъде етичните стандарти не ни задължават да не поемаме рискове. В името на това обществото да знае.
Аз лично винаги ще избера разговор със свидетел на престъпление пред камера – с всички произтичащи от това етични дилеми – вместо журналистика по режисирано изтекли показания от МВР. Защото истинската журналистика се прави пред очите и от името на публиката. Другото е пиар.
Разликата между пиара и журналистиката се разбира, когато ти потрябва журналист. От вида честен и безпристрастен. От Червената книга на онези, пазили се да стоят между агитките, понасяйки удари от всички страни. Изпаднали в слаба позиция, добри и лоши, свои и чужди, либерали и консерватори пак се обединяват – този път в нуждата. И започват да викат почтената журналистика. Изненадани, бившите силни разбират, че за слабите журналистика няма. Ами няма – медиите са или ваши, или са срещу вас. Ти си го избра, както е казал мъдрецът.
Този смешен плач плакаха всички – от Цветан Цветанов, през Иван Гешев, до Ахмед Доган и Цветан Василев. Последният, участвал лично в процеса по придобиването на едни медии и обезшумяването на други в силните години на КТБ, днес пише в личния си сайт, че бил цензуриран от неетични журналисти или техните редактори. Нима?
Има нещо поучително в това как всички цензори намразват цензурата, упражнявана от някой друг, след като собствената им хунта ги избута отвъд разделението свой–чужд. Мило е, но не върши работа дори и за кратковременно злорадство.
През това време в TikTok и Instagram постжурналистиката експериментира и с нов бизнес модел: директна връзка с публиката чрез абонаменти, дарения и платформи за подкрепа. Не рекламодателят, а зрителят плаща.
От една страна, това би трябвало да е добре. Американският медиен критик Ей Джей Либлинг още през 1960 г. отбелязва: „Свободата на пресата е гарантирана за онези, които притежават преса.“
A. J. Liebling, „Do You Belong in Journalism?“, The New Yorker, 1960
Но когато читателите и зрителите станат инвеститори, и то в среда, която от години е нормализирала нагласата да третира медиите като наемници на частен капитал, тогава и капиталисти на дребно могат да започнат да си искат своето. И ако не им харесва отражението в огледалото, да пожелаят да убият този, който го държи. Или поне да спрат да си плащат абонаментите.
А на пазара оцеляват идеи, стоки и услуги, от които някой има нужда. Икономистите му викали jobs-to-be-done теория. Хората „наемат“ продукт или услуга, за да им свършат определена работа. Ако се появи по-добър (евтин, лесен, забавен) начин да се свърши същата „работа“, старият продукт изчезва.
Доскоро журналистите малко елитарно и самонадеяно смятаха, че имат запазеното място на важни и нужни на обществото.
А може би вече не.
Няма да е първата професия, която е изчезнала поради отпаднала необходимост.
Съвсем не е невъзможно да си представим, че един ден и журналистиката ще се подреди в музея на професиите – до глашатая, телефонистката и словослагателя (този, който реди металните букви в печатарството). Заместена от създателите на новинарско съдържание за тези, които си плащат за споделеност и забавление.
Today, Cloudflare is introducing a new suite of fraud prevention capabilities designed to stop account abuse before it starts. We’ve spent years empowering Cloudflare customers to protect their applications from automated attacks, but the threat landscape has evolved. The industrialization of hybrid automated-and-human abuse presents a complex security challenge to website owners. Consider, for instance, a single account that’s accessed from New York, London, and San Francisco in the same five minutes. The core question in this case is not “Is this automated?” but rather “Is this authentic?”
Website owners need the tools to stop abuse on their website, no matter who it’s coming from.
Now, we’re combining these powerful tools with new ones. Disposable email check and email risk help you enforce security preferences for users who sign up with throwaway email addresses, a common tactic for fake account creation and promotion abuse, or whose emails are deemed risky based on email patterns and infrastructure. We’re also thrilled to introduce Hashed User IDs — per-domain identifiers generated by cryptographically hashing usernames — that give customers better insight into suspicious account activity and greater ability to mitigate potentially fraudulent traffic, without compromising end user privacy.
The new capabilities we’re announcing today go beyond automation, identifying abusive behavior and risky identities among human users and bots. Account Abuse Protection is available in Early Access, and any Bot Management Enterprise customer can use these features at no additional cost for a limited period, until the general availability of Cloudflare Fraud Prevention later this year. If you want to learn more about this Early Access capability, sign up here.
Leaked credentials make logins all too vulnerable
The barrier to entry for fraudulent behavior is dangerously low, especially with the availability of massive datasets and access to automated tools that commit account fraud at scale. Website owners aren’t just dealing with individual hackers, but industrialized fraud. Last year, we highlighted how 41% of logins across our network use leaked credentials. This number has only grown following the exposure of a database holding 16 billion records, and multiple high-profile breaches have since come to light.
Access to a large database of leaked credentials is only useful if an attacker can cycle through them quickly across many sites to identify which accounts are still vulnerable due to password reuse. In our Black Friday analysis in 2024, we observed that more than 60% of traffic to login pages across our network was automated. That’s a lot of bots trying to break in.
To help customers protect their login endpoints from constant bombardment, we added account takeover(ATO)-specific detections to highlight suspicious traffic patterns. This is part of our recent focus on per-customer detections, in which we provide behavioral anomaly detection unique to each bot management customer. Today, bot management customers can see and mitigate attempted ATO attacks in their login requests directly on the Security analytics dashboard.
In the card on the left within the Security analytics dashboard, you can view and address attempted account takeover attacks.
In the last week, our ATO detections combined caught an average of 6.9 billion suspicious login attempts daily, across our network. These ATO detections, along with the many other detection mechanisms in our bot management solution, create a layered defense against ATO and other malicious automated attacks.
From automation to intent and identity
To discern automation, or to discern intent and identity? That is the question. Our answer: yes and yes, as both are critical layers of a robust security posture. Attackers now operate at a scale previously reserved for enterprise services: they leverage massive credential leaks, use human-powered fraud farms to spoof devices and locations, and create synthetic identities to maintain thousands — even millions — of fake accounts for promotion and platform abuse. A human being with automated tools could be draining accounts, abusing promotions, committing payment fraud, or all of the above.
Beyond that, automation is accessible like never before, particularly as users become better acquainted with using AI agents and even long-standing, “traditional” browsers move toward having agentic capabilities by default. Whether it’s a lone actor using an AI agent or a coordinated fraud campaign, the threat isn’t as simple as a single script — it can involve human intent, with automated execution.
Consider the following scenarios we’ve heard from our customers:
We have 1,000 new users this month, but more than half of them are fake identities who benefit from a free trial, then disappear.
The attacker logged in with the correct password, so how do I know that it isn’t the real user?
This entity is acting at human pace, and they are draining accounts.
These problems can’t be solved by only assessing automation; they require checking for authenticity and integrity. This is the gap that our dedicated fraud prevention capabilities address.
Assessing suspicious emails
Let’s start by assessing the earliest point of potential account abuse: account creation. Fake or bulk account creation is one of the biggest topics in conversations about website fraud, as it can open the door for attackers to access an application — or even an entire business model.
Cloudflare is giving customers the tools to assess suspicious account creation at the source in two ways:
Disposable email check: Detect when users sign up with disposable, or throwaway, email addresses commonly used for promotion abuse and fake account creation. These disposable email services allow attackers to spin up thousands of “unique” accounts without maintaining real infrastructure, particularly unauthenticated disposable emails that provide instant access without account creation or free unlimited email aliases. Customers can use this binary field as they build rules to enforce security preferences, choosing to block all disposable emails outright, or perhaps issuing a challenge to anyone attempting to create an account with a disposable email.
Email risk: Cloudflare analyzes email patterns and infrastructure to provide risk tiers (low, medium, high) that customers can use in security rules. We know that not all email addresses are created equal; an address with the format [email protected] carries different risk characteristics than [email protected]. Email risk tiers allow customers to express their tolerance for risk and friction at the point of account creation.
Both disposable email check and email risk are now available in security analytics and security rules, equipping website owners to protect their account creation flow. These detections address a fundamental problem: by the time an account is committing abuse, it’s already too late. The website owner has already paid acquisition costs, the fraudulent user has consumed promotional credits, and remediation requires manual review. Mitigating suspicious emails means adding the appropriate friction at signup — the moment it matters most.
Introducing Hashed User IDs
Understanding patterns of abuse requires visibility: not only into the network, but of account activity. Traditionally, security has meant looking through the lens of IPs and isolated HTTP requests to spot automated activity, but website owners aren’t just thinking in terms of network signals; they are also considering their users and known accounts. That’s why we’re expanding our mitigation toolbox to match the way applications are actually structured, focusing on user-based detection of fraudulent activity.
Attackers can effortlessly rotate IPs to hide their tracks. But forcing them to repeatedly generate new, credible accounts introduces massive friction, especially when combined with account creation protections. When we look past the network layer and map fraudulent actions to a given compromised or abusive account, we can spot targeted behavior tied to a single, persistent actor and put a stop to the abuse. In this way, we’re shifting the defense strategy to the account level, instead of playing whack-a-mole with rotating IP addresses and residential proxies. This means that our customers can mitigate abusive behavior based on the way their applications separate identity.
To arm website owners with this capability, Cloudflare is releasing a Hashed User ID that customers can use in Security analytics, Security rules, and Managed Transforms. User IDs are per-domain, cryptographically hashed versions of the values in the username field, and each user ID is an encrypted, unique, and stable identifier generated for a given username on a customer application. Importantly, the actual username is not logged or stored by Cloudflare as part of this service. As with leaked credentials check and ATO detections, which identify login traffic and then encrypt credentials for comparison, we are prioritizing end user privacy while empowering our customers to take action against fraudulent behavior.
With access to Hashed User IDs, website owners can:
See top users: Which accounts have the most activity?
See when a unique user logs in from a country they usually don’t — or multiple countries in one day!
Mitigate traffic based on unique user, such as blocking a user with historically suspicious activity.
Combine fields to see when accounts are being targeted with leaked credentials.
See what network patterns or signals are associated with unique users.
The expanded view of a single Hashed User ID within the Security analytics dashboard, showing the activity details of that unique user, including their login location and their browser.
This user-level visibility transforms how website owners can investigate and mitigate traffic. Instead of examining individual requests in isolation, our customers can see the full picture of how attackers are targeting and hiding among legitimate users.
Take the next step in account protection today
If you want to learn more about this Early Access capability, sign up here. All Bot Management Enterprise customers are eligible to add these new Account Abuse Protection features today, and we’d love to open the conversation with any and all prospective Bot Management customers.
While bot detections will continue to answer the question of automation and intent, fraud detections delve into the question of authenticity. Together, they give website owners comprehensive tools to fight against the full spectrum of account abuse. This suite is one step in our ongoing investment to protect the entire user journey — from account creation and login to secure checkouts and the integrity of every interaction.
Grab is Southeast Asia’s leading superapp, providing a suite of services that bring essential needs to users throughout the region. Its offerings include ride-hailing, food delivery, parcel delivery, mobile payments, and more. With safety, efficiency, and user-centered design at heart, Grab remains dedicated to solving everyday issues and improving the lives of millions. As our app continues to expand, we identified platform-level performance challenges that were affecting user experience across the board. In this article, we share how we successfully enabled R8 optimization for the Grab Android app, achieving significant improvements in app size, startup time, and stability through innovative AI-assisted debugging techniques.
Introduction
Since 2024, our team observed a concerning trend: Application Not Responding (ANR) rates were spiking across the Grab app. Unlike typical isolated issues, the data revealed that ANRs were happening everywhere, not confined to specific features or modules. This pattern pointed to platform-level causes, with our analysis showing strong correlations between ANRs and several factors like memory pressure (particularly when garbage collection was triggered), ad-heavy user flows, overhead from heavy use of Jetpack Compose within XML layouts, and XML views within Compose code.
The Android community had long proven that R8 optimization (beyond basic code shrinking) could deliver substantial performance gains and app size reductions. As Grab has been adopting Jetpack Compose over the last two years, Google’s Jetpack Compose performance documentation specifically recommends R8 optimization for Compose-heavy apps. This made it a natural solution for our systemic performance issues.
The challenge at scale
However, enabling R8 optimization for Grab’s Android app was far from straightforward. Our app operates at a massive scale with over 9 million lines of code and more than a hundred engineers actively working on it daily. While we had basic R8 shrinking enabled, advanced optimization had proven challenging despite multiple attempts over six years (earlier with adopting DexGuard, later with R8 optimization).
In 2022, we almost succeeded with R8 optimization after successfully rolling it out onto our early access build. We were unfortunately faced with critical roadblocks that compelled us to put the project on hold. After analyzing our previous attempts and the current project situation, we identified three fundamental challenges that had to be solved simultaneously.
This article explains how we tackled each challenge through targeted innovations, including AI-assisted debugging for slow investigation cycles, pragmatic testing strategy for validation at scale, and optimized feedback loop for rapid iteration.
Understanding R8 optimization
Before diving into our solution, it’s important to understand what R8 optimization actually provides beyond basic R8 shrinking.
Figure 1. The R8 processing pipeline involves multiple interconnected phases that transform, analyze, and optimize code. Understanding this complexity helps explain both the benefits of optimization and why debugging issues become challenging.
What we had in place
With minifyEnabled=true and shrinkResources=true using proguard-android.txt, we already had:
Tree shaking (shrink phase): Removes unused/unreachable code.
Code minification (obfuscation): Renames classes/methods to short names.
Resource shrinking: Removes unused XML files and drawables.
Desugaring: Java 8+ compatibility.
What’s new with optimization
By switching to proguard-android-optimize.txt, we gained access to:
Method inlining: Replaces method calls with actual code, reducing call overhead.
Class merging: Makes code more compact by combining similar classes.
Constant folding: Pre-computes constant expressions at compile time.
Dead code elimination: More aggressive than tree shaking, removes unreachable branches.
Devirtualization: Converts virtual calls to direct calls when possible.
These optimizations work together to improve runtime performance while significantly reducing app size.
Three core challenges
Despite R8’s clear benefits, enabling it at Grab’s scale remains hard. Lessons from prior attempts and current project context surfaced three fundamental challenges we needed to solve.
Challenge 1: Slow debugging
R8 optimization issues are notoriously difficult to debug:
Code is obfuscated, class names become a, b, c.
Code is modified, inlined, merged, and optimized beyond recognition.
Stack traces are unreadable without proper mapping files when crashes occur.
Pinpointing the root cause requires manual reverse engineering.
The challenge was compounded by limited bandwidth and high labor requirements. Most issues had to be either addressed directly or have solutions provided for other teams to fix. Manual decompilation, deobfuscation, and context gathering for each issue are inherently time-consuming, making the investigation cycle prohibitively slow.
Challenge 2: Testing at scale
R8 optimization affects every corner of the app. Unlike feature-specific changes, enabling optimization transforms how the entire codebase is compiled, inlined, and optimized. A single misconfiguration or missing keep rule can break seemingly unrelated features across different modules and Software Development Kits (SDKs).
When we first enabled R8 optimization, the impact was immediate and widespread—most of the app’s features simply stopped working correctly. This presented us with a deeper problem: not just how to test, but what kind of testing strategy would actually give us confidence to roll out to production.
In theory, R8 optimization works reliably with standard codebases that follow Google’s and the community’s best practices. However, considering the large scale of Grab’s project, legacy code patterns, reflection usage, and SDK integrations have been accumulated over the years, creating numerous edge cases.
This combination makes comprehensive testing necessary, but at our scale, it’s nearly impossible to execute due to:
Full regression testing: Requires significant effort from all teams across the organization.
Quality Assurance (QA) resource constraints: Exhaustive testing is impractical.
High-quality bar: At Grab, app stability and zero runtime errors are non-negotiable standards.
This creates a catch-22: we need broad coverage because consistency can’t be guaranteed everywhere, yet the scale makes that coverage infeasible.
Challenge 3: Slow feedback
Due to the large scale of the project, compiling a build with R8 optimization enabled on a standard engineering laptop is physically impossible. This created a significant bottleneck: a slow feedback loop where every experimental change required a remote Continuous Integration (CI) build to verify, with each R8-optimized build taking up to 2 hours to complete.
Additionally, R8 treats debug and release build types differently. At Grab, we have a QA build for QA testing. This is a debug build type with R8 enabled, pointed to our staging environment. We had to ensure this QA build’s R8 configuration matched our production build exactly. This alignment was critical for catching R8-specific issues during QA testing that would actually reflect production behavior.
Our three-innovation solution
To overcome these three fundamental challenges, we developed a comprehensive strategy centered on targeted innovations that addressed each bottleneck:
Innovation 1: AI-assisted debugging
Solving challenge 1:
How do we speed up the investigation of R8 issues in obfuscated, optimized code at scale? The answer is in emerging AI technology that wasn’t available during our previous attempts.
The AI context at Grab:
Unlike 2022 and earlier attempts, the landscape had changed dramatically. After the LLM explosion, Grab proactively promoted Large Language Model (LLM) usage to boost engineering productivity. Over the past two years, Grab has dedicated 1 to 2 months annually for engineers to learn how to use AI efficiently. This investment in AI literacy became crucial for this project.
This year, my team gained experience building Model Context Protocol (MCP) servers and identified an opportunity: applying this technology to solve the R8 debugging challenge.
Our solution:
At Grab, we use GitLab for Continuous Integration and Continuous Delivery (CI/CD). To tackle R8 debugging bottlenecks, we built a comprehensive solution combining:
Automatic Android Application Package (APK) decompilation: Parse and decompile APKs.
Stack trace deobfuscation: Automatically map obfuscated traces to source code.
Class/method context fetching: Pull relevant decompiled code sections for analysis.
AI and CI pipeline workflow:
We developed a systematic two-phase approach for investigating and fixing each runtime issue, combining AI assistance with parallel testing. The phase breakdown is as follows:
Phase 1: MCP server tools for debugging
Detect runtime issue: From End-to-End (E2E) tests, QA testing, or crash reports.
Engineer and AI analysis: The engineer uses AI assistance to analyze the decompiled code context and note down multiple solution approaches.
Phase 2: GitLab CI integration
We leveraged the GitLab CLI tool (glab) and instructed AI to use it for interacting with our CI pipeline:
AI creates multiple Merge Requests (MRs): Using glab CLI, AI creates merge requests for different solution approaches from Phase 1, each triggering CI compilation.
Track progress: Maintain an MD file as the source of truth for the investigation, containing all notes about the issue (root cause analysis, test cases, test branches, CI build status).
AI fetches APK from CI: Using glab CLI to retrieve built APKs from completed CI pipelines.
Verify: Ask AI to use Android Debug Bridge (ADB) to install APK, then manually test the fix.
Iterate: If issues remain, loop back to step 2 for further analysis.
Why this worked:
Our approach functions as an AI assistant that:
Decodes the obfuscated code automatically.
Finds the relevant code sections without manual searching.
Suggests multiple solutions based on the context provided by the MCP tools.
Creates multiple test branches simultaneously and runs parallel CI builds to test different approaches.
Tracks everything to ensure no progress is lost on complex investigations.
Instead of testing solutions one-by-one (waiting 2 hours per build), AI creates multiple MRs in parallel, dramatically accelerating the verification process. Engineers focus on making decisions about which solutions to pursue while the AI handles both the mechanical work and the parallel experimentation.
The impact: Accelerating investigation
While investigating a single R8 issue might still take days, our MCP tools dramatically accelerated critical investigation tasks. Manual tasks that previously took hours for decompilation, deobfuscation, and context gathering were reduced to minutes. Additionally, AI assistance significantly sped up the analysis phase, helping engineers quickly identify patterns, suggest solutions, and explore multiple approaches in parallel, both analytically and through simultaneous CI builds, further accelerating the overall investigation process.
Innovation 2: Pragmatic testing strategy
Solving challenge 2:
How do we do testing at scale? How do we validate R8 optimization across a mature codebase containing more than seven million lines of code when comprehensive testing is necessary but impossible? Our solution came from a critical insight about R8 issues at scale.
Testing approaches that don’t work with R8:
Unit tests: Run on Java Virtual Machine (JVM), while R8 optimizations affect Android Runtime behavior – fundamentally different environments.
UI tests with R8: Community solutions exist as Gradle plugins, but our tests run on Bazel – complex setup and reliability concerns.
Key insight:
From our experience, R8 issues tend to share similar root causes across the codebase. Legacy patterns like reflection usage, parser implementations, and dynamic class loading follow consistent patterns within a large codebase. This insight led to two key advantages:
Fix one, help many: Fixing one place often resolves issues in others.
Pattern recognition: Once we identify a pattern, we can search the codebase to find similar issues instead of waiting for QA to discover them.
If we could identify and fix these pattern-based issues, we could address many problems without testing every corner of the app. We decided to start with critical paths and expand from there. This “ripple effect” strategy began at the center with the most important flows, then expanded by identifying common root causes and similar patterns across the codebase.
We designed a progressive risk-based validation strategy:
Stage 1: E2E tests – pattern discovery phase: Fortunately, we had existing E2E tests covering most critical paths in the project, and they could be executed with R8 optimization enabled. Initially, all E2E tests failed after enabling optimization. This became our opportunity for pattern discovery. We systematically fixed issues and applied our pattern-based approach to resolve similar problems across the project.
Stage 2: QA smoke tests – coverage expansion: After E2E tests stabilized, we requested our QA team to run smoke tests on critical flows, especially those not covered by E2E automation. This caught additional edge cases and validated that the pattern-based fixes we applied were effective across different user journeys. We fixed any issues that appeared during this phase.
Stage 3: Daily QA build enablement – real-world integration: After confirming stability in controlled testing, we made a significant decision to enable R8 optimization in our daily QA build (the build our QA team uses for daily feature testing). This integrated R8 optimization into the normal development workflow without requiring additional testing effort.
Stage 4: Regression testing and Grab Early Access (GEA) – parallel production-scale validation: After confirming stability in daily QA builds, we moved to production-scale validation with two parallel tracks. Every release at Grab includes regression testing covering all critical paths and new features. With R8 optimization now enabled in the QA build, we ran regression tests using this build for a few weeks, providing sustained validation across multiple release cycles. One week after regression testing, we rolled out to GEA, Grab’s internal production release channel for Grab employees and partners. While GEA users typically receive features one week before general production rollout, for this R8 optimization project, we extended the GEA phase to 2 weeks, given the significance of the change. With hundreds of daily active users using the app in real-world production conditions during this extended period, we encountered only one remaining R8 issue during the GEA phase. This combination of regression testing and real-world GEA production usage gave us the confidence needed before full production rollout.
Pattern-based issue resolution:
Throughout these validation phases, when we identified R8 issues, we followed a systematic pattern-based resolution process.
Identify the issue: Catch the failure through E2E, QA, or monitoring.
Find the pattern: Analyze the root cause to identify if it’s a common pattern across the codebase.
Detect similar instances: Search the entire codebase to find the same pattern across different modules and the internal SDKs.
Coordinate fixes: Create tickets requesting teams to modify their code to prevent the same issue in their modules.
This approach required cross-team coordination for fixing, but critically, not for testing. The difference is significant: asking teams to fix identified issues in their modules is much more scalable than requiring all teams to perform comprehensive testing upfront.
Production rollout results:
When we made it to production, only one issue escaped to production. Notably, we had actually detected this issue through our pattern-based approach during testing and created a ticket for the responsible team to fix it. However, with ongoing daily development, the team missed one instance when implementing the fix, which caused the production issue.
This demonstrates that while our testing strategy worked effectively, human coordination challenges can still occur at scale. With a project of this scale, having only one small production issue is considered a highly successful rollout.
This approach transformed an “impossible” comprehensive testing problem into a manageable, systematic validation process, reducing what would have been months of coordinated testing effort to days, proving that a smart strategy can overcome resource constraints.
Innovation 3: Optimized feedback loop
Solving challenge 3:
The slow feedback challenge—2-hour CI builds and QA configuration misalignment—created a bottleneck for R8 debugging. We addressed this through a comprehensive infrastructure strategy targeting these critical areas:
Remote compilation to enable local build and fast feedback loop:
At Grab, we used to use Mainframer for remote execution to handle slow performance on local Gradle builds. However, since migrating to Bazel (only for the debug build without R8 enabled), we removed the large-scale Mainframer setup for every engineer. From that experience, to tackle the local compilation blocker for R8 builds, we decided to deploy a new Mainframer setup, a much smaller one with one powerful Amazon Elastic Compute Cloud (EC2) instance, serving as a solution for local compilation in a short time.
This targeted deployment transformed physically impossible local R8 builds into a manageable remote process, enabling engineers to test R8 changes without requiring powerful local hardware.
The performance improvement was substantial: from up to 2 hours in CI to around 1 hour with Mainframer—a ~50% reduction that enabled rapid iteration cycles essential for R8 debugging.
QA build configuration alignment:
We eliminated the critical gap between QA and production R8 behavior by aligning build configurations exactly. The key change was setting debuggable = false for QA builds while maintaining the environment configuration.
From our understanding, R8 applies different optimization levels based on the debuggable flag, with more aggressive optimizations when debuggable=false. This ensured our QA testing reflected actual production R8 processing. We preserved DEBUG = true to maintain staging environment routing while achieving R8 parity.
This infrastructure foundation was essential, providing faster feedback loops that accelerated verification and investigation, while the QA build configuration matching production exactly was critical for catching real production issues during testing.
A lucky break
Perhaps most surprising: the R8 flakiness issue that blocked us in 2022 (Issue #240077160) appears to have been resolved by the R8 team. We encountered no build determinism issues during this attempt, which significantly smoothed our path to production.
Results
After ~10 weeks of systematic implementation led by one engineer collaborating with multiple teams across the organization, we achieved substantial improvements using Android Gradle Plugin 8.6.1 with R8 version 8.6.39:
Stability: Around 25% reduction in ANR rates.
App size: Reduced by 21.6MB (16% decrease) in download size on our reference device (zipped APK).
Performance: Nearly 27% improvement in startup time. After enabling R8 optimization, we saw ~12% app startup improvement. However, during our analysis, we discovered that our existing baseline and startup profiles implementation was incorrect. After proper implementation, the combination of R8 optimization plus the corrected profiles delivered the full 27% improvement.
These results exceeded our initial targets and validated the significant effort required to enable R8 optimization at scale.
What’s next
Our journey doesn’t end here. We’re exploring several areas for continued optimization:
R8 full mode: More extreme/aggressive optimization than the current mode for additional performance benefits.
Revisit R8 keep rules: Clean up unnecessary rules that prevent optimization, and implement a governance solution to guardrail R8 rules in our pre-merge CI pipeline.
Dead code removal for experiment framework: We discovered a solution to help R8 understand our experiment framework flags and remove dead branches for fully turned-off features.
Conclusion
Enabling R8 optimization for the Grab Android app at scale required innovation beyond traditional debugging approaches. By combining AI-assisted debugging, pragmatic testing strategies, and infrastructure investment, we overcame challenges that had blocked previous attempts for many years.
For other teams considering R8 optimization at scale: the journey is challenging, but the results speak for themselves. With the right tools, strategy, and team collaboration, it’s achievable even for the largest codebases.
Join us
Grab is a leading superapp in Southeast Asia, operating across the deliveries, mobility, and digital financial services sectors. Serving over 900 cities in eight Southeast Asian countries: Cambodia, Indonesia, Malaysia, Myanmar, the Philippines, Singapore, Thailand, and Vietnam. Grab enables millions of people every day to order food or groceries, send packages, hail a ride or taxi, pay for online purchases or access services such as lending and insurance, all through a single app. We operate supermarkets in Malaysia under Jaya Grocer and Everrise, which enables us to bring the convenience of on-demand grocery delivery to more consumers in the country. As part of our financial services offerings, we also provide digital banking services through GXS Bank in Singapore and GXBank in Malaysia. Grab was founded in 2012 with the mission to drive Southeast Asia forward by creating economic empowerment for everyone. Grab strives to serve a triple bottom line. We aim to simultaneously deliver financial performance for our shareholders and have a positive social impact, which includes economic empowerment for millions of people in the region, while mitigating our environmental footprint.
Powered by technology and driven by heart, our mission is to drive Southeast Asia forward by creating economic empowerment for everyone. If this mission speaks to you, join our team today!
A recently enacted law in California imposes an age-verification requirement on
operating-system providers beginning next year. The language of the Digital
Age Assurance Act does not restrict its requirements to proprietary or commercial
operating systems; projects like Debian, FreeBSD, Fedora, and others seem to be on
the hook just as much as Apple or Microsoft. There is some hope that the law will be
amended, but there is no guarantee that it will be. This means that the developer
communities behind Linux distributions are having to discuss whether and how to
comply with the law with little time and even less legal guidance.
The tension arising out of the conflict in Iran is beginning to show signs of expanding beyond a strictly regional crisis. Following our recent published advisories, this communication is intended to outline and summarize the detection and enrichment coverage available to Rapid7 customers, broadly assess the macro cyber threat landscape, and demonstrate the specific actions undertaken within the Rapid7 portfolio to assure our customers of the protection they receive and can expect moving forward. For a research-driven companion piece from Rapid7 Labs, dive intoIran’s Cyber Playbook in the Escalating Regional Conflict.
Tracking the campaigns associated with the current conflict
There exists a number of threat campaigns (both directly and indirectly) associated with groups associated with Iranian APT actors. In order to track details of these campaigns, any relevant indicators of compromise will be made available within Intelligence Hub.
Figure 1: A screenshot of the collective campaign available within Intelligence Hub.
⠀
As additional intelligence is identified and verified this campaign (and any others) will be incorporated and made available both within the detection stack across the Rapid7 portfolio, but equally for enrichment purposes within Intelligence Hub.
Hacktivist activity and Digital Risk Protection (DRP) coverage
Since the regional military escalations began in late February 2026, Rapid7 Labs has tracked a significant and ongoing spike in retaliatory cyber activity targeting regional and Western infrastructure. What we’re seeing falls into two broad buckets. The first is state-directed operations, primarily espionage and data exfiltration, carried out by actors like:
MuddyWater/Seedworm (MOIS)
CyberAv3ngers (IRGC)
The Handala persona (assessed as being maintained by Void Manticore under MOIS direction).
The second is a much noisier layer of hacktivist activity, stemming from groups that lack sophistication but generate outsized visibility through DDoS campaigns and public breach claims. These groups include:
Keymous+
DieNet
NoName057(16).
A major theme across this escalation is fabrication. Many of the breach claims circulating on Telegram and dark web forums are exaggerated or outright fake. Threat actors, especially on the hacktivist side, are recycling old leaked datasets, overstating their access, and running what amount to psychological operations aimed at causing panic and reputational damage. That said, where state-directed actors are involved, legitimate data theft is a real concern, and there is a strong likelihood that stolen material will be weaponized publicly and quickly.
Rapid7’s Digital Risk Protection platform is purpose-built to cover exactly these kinds of threats. Here is how our coverage maps to the current activity:
Dark web and forum monitoring — The coordination and announcements driving these campaigns are happening across Telegram, X (formerly Twitter), and dark web leak sites. DRP continuously monitors clear, deep, and dark web sources, with proprietary crawlers, inspecting tens of millions of pages. This gives us visibility into restricted forums and early warning when campaigns begin targeting specific organizations or sectors.
Data leakage detection and claim verification — With so many unsubstantiated breach claims in circulation, the ability to quickly distinguish real exposures from fabricated ones is critical. DRP monitors threat actor dumps and leak sites for exposed company assets and correlates what it finds against each customer’s digital footprint, giving organizations a clear answer on whether a claimed breach actually affects them.
Brand security and phishing defense — Threat actors are exploiting public confusion to register lookalike domains, clone websites, and create impersonation profiles on social media. DRP identifies these phishing and impersonation threats and supports the takedown of the attacker’s infrastructure.
Analyst-verified intelligence — Our threat intelligence analysts investigate and triage what surfaces through the platform to ensure customers receive only intelligence that has been verified and is actionable. When a real compromise or data exposure is confirmed, our team works directly with the affected organization to assess the impact and support remediation.
CVE intelligence
To fuel the data leak and psychological operations discussed above, state-directed actors like MuddyWater and Void Manticore are actively weaponizing recently disclosed, high-impact vulnerabilities. Rather than focusing on a single product, these APTs are broadly targeting a combination of internet-facing edge devices, enterprise management infrastructure, and client productivity software to gain their initial foothold.
The vulnerabilities being leveraged in these campaigns all provide either authentication bypass or remote code execution, giving attackers a direct path into the environment. Once inside, the goal is the same every time: establish persistence and get data out. As noted above, any legitimate data stolen during these intrusions is highly likely to be handed off to hacktivist personas and weaponized publicly to support the broader disinformation campaigns.
The following CVEs have been identified as actively exploited or assessed as high-priority targets in the current threat environment:
CVE-2026-1281
Description: A critical command injection vulnerability in Ivanti Endpoint Manager Mobile (EPMM) that grants unauthenticated attackers root-level remote code execution. This has been leveraged as a zero-day vulnerability to compromise mobile endpoint management environments. Tied to: MuddyWater (MOIS)
Description: A critical OS command injection vulnerability in PHP running in CGI mode on Windows. By exploiting Windows “Best-Fit” encoding behaviors, attackers can bypass escape mechanisms and execute arbitrary code on the host server. Tied to: Void Manticore (the MOIS-affiliated actor that maintains the Handala hacktivist persona)
Description: An unauthenticated file upload flaw in SmarterTools SmarterMail. Attackers exploit a path traversal weakness via the guid variable to drop malicious files, such as webshells or malicious cron jobs.
Description: An unauthenticated session bypass vulnerability impacting N-able N-Central. Attackers frequently chain this with an XML External Entity (XXE) vulnerability to read highly sensitive local configuration and backup files from the host infrastructure.
Description: A security feature bypass vulnerability in Microsoft Word that allows an unauthorized attacker to bypass Object Linking & Embedding (OLE) mitigations locally. Exploitation requires user interaction to open a maliciously crafted document.
Rapid7 Coverage: Analyzed extensively in Rapid7’s Patch Tuesday – February 2026 blog post and prioritized for customer patching due to active exploitation
Detection and Response for Rapid7 customers
Rapid7’s Threat Hunting team has been actively hunting for activity related to Iranian actors since the regional conflict began. We are utilizing threat intelligence related to new indicators of compromise and known tactics, techniques, and procedures to conduct these hunts. If we have validated findings, the MDR SOC will investigate and communicate the details of findings using the standard notification processes.
Following our recent published advisories, this publication is intended to outline a summary of the cyber activities associated with the tension. Based on the available information, we believe the conflict is beginning to show signs of expanding beyond a strictly regional crisis. Initial threat reporting pointed to a measurable increase in cyber activity linked to the crisis predominantly focused on hacktivist mobilization, with reports of phishing campaigns, and claims of data theft and disruptive operations. For a companion piece focused around our customers, dive into Rapid7 Detection Coverage for Iran-Linked Cyber Activity.
Cyber activity by groups associated with Iran and their affiliated ecosystems have begun to surface. Much of the visible activity currently appears to have limited immediate operational impact as it consists primarily of website defacements, distributed denial-of-service (DDoS) attacks, coordinated messaging campaigns, phishing attempts, and reconnaissance against exposed digital infrastructure. While these incidents may appear opportunistic or symbolic, historical patterns of such behavior suggest that this activity can represent early-stage signaling, pressure, and preparatory shaping operations rather than isolated disruption.
Iran’s cyber ecosystem operates through a layered structure that includes state-linked advanced persistent threat (APT) groups, proxy actors, hacktivist personas, and sympathetic foreign collectives. Even when not centrally coordinated, these actors often converge on the same narratives and target sets during geopolitical crises, enabling simultaneous visible disruption and covert intelligence-driven intrusion activity. As the conflict evolves, this ecosystem provides a scalable and deniable tool for retaliation that can gradually intensify.
It is very likely that the cyber risk will widen accordingly as the current conflict continues. Governments and organizations located in regions hosting U.S. military infrastructure or closely aligned with U.S. and Israeli positions may face increased exposure, particularly across sectors such as logistics, critical infrastructure, public administration, energy, and telecommunications.
Strategic context and operational trends
Iran does not operate according to a single publicly articulated cyberwarfare doctrine. Instead, its cyber strategy has evolved pragmatically as part of the country’s broader asymmetric security model. Since 2010, there has been an expansion of its cyber capabilities as instruments for intelligence gathering, internal control, retaliation, coercive messaging, and regional influence. Cyber operations are therefore best understood not as a separate military domain with a fully transparent doctrine, but as an adaptable component of the regime’s survival and strategic competition against outsiders.
Broadly speaking, Iranian cyber activity tends to serve three overlapping strategic objectives. The first is regime security and domestic control, in which cyber tools support surveillance, information control, and disruption of dissident or opposition networks. The second is strategic intelligence collection, in which state-linked actors target governments, defense organizations, technology providers, telecommunications firms, and critical infrastructure to gather political, military, and economic intelligence. The third is coercive signaling and regional influence, in which cyber operations impose costs on adversaries, shape perceptions, and demonstrate retaliatory capability while remaining below the threshold of overt interstate war.
A key feature of this regime’s approach is the development of long-term access. Iranian APT groups often conduct sustained intrusion campaigns focused not only on immediate collection but also on access persistence, credential harvesting, and network familiarity. In a crisis environment, these pre-existing footholds can become strategically important, supporting either intelligence collection or later disruptive operations. This is one reason current low-visibility intrusions deserve as much analytical attention as public hacktivist claims. The visible DDoS or defacement campaign may dominate headlines, but the more significant strategic risk often lies in covert access established inside other targets.
Another defining feature of Iran’s cyber strategy is its layered operational model. State-linked APT groups frequently operate alongside contractors, proxies, persona-driven influence actors, and hacktivist collectives. This structure offers several advantages: it creates deniability, increases operational tempo; broadens the range of possible targets; and allows Iran-aligned ecosystems to combine disruptive spectacle with intelligence-driven depth. During periods of heightened tension, this blended model enables visible pressure operations to coexist with quieter espionage or pre-positioning campaigns. Current reporting on the conflict strongly supports this interpretation, with activist and proxy campaigns surging in parallel to concern over state-linked phishing, malware, wipers, and infrastructure-focused targeting.
Iran’s threat actor landscape
State sponsored
Iran’s cyber capabilities are distributed across a hybrid ecosystem of state institutions, intelligence services, military structures, and semi-official operators. Rather than relying on a single centralized cyber command, Tehran appears to allocate responsibilities across different organs, primarily the Islamic Revolutionary Guard Corps and the Ministry of Intelligence and Security, with support from contractors, front entities, and affiliated personas. Strategic coordination of the cyber domain is overseen by the Supreme Council of Cyberspace, while operational activities are carried out through a mix of official and semi-official channels.
IRGC-linked actors
The Islamic Revolution Guard Corp (IRGC) maintains one of Iran’s most visible offensive cyber capabilities and has been associated with cyber espionage, influence operations, credential theft, and politically aligned disruptive activity. Among the principal IRGC-linked actors are APT35 (also known as Charming Kitten or Mint Sandstorm), which has long conducted spear-phishing and credential-harvesting operations against diplomats, journalists, researchers, and policy communities; APT42 is an actor particularly associated with surveillance and social engineering targeting dissidents, activists, journalists, and policy experts. Cotton Sandstorm (also known as Holy Souls and Emennet Pasargad), meanwhile, has been linked to both espionage and influence-oriented operations targeting regional adversaries and Western institutions. Recent reporting also highlights continued concern around malware associated with this broader actor set, including infostealing and espionage tooling used in phishing-led operations.
MOIS-linked actors
The Ministry of Intelligence and Security (MOIS) operates parallel cyber capabilities that tend to emphasize intelligence collection, long-term access, and strategic espionage. The most prominent groups in this cluster include MuddyWater and OilRig (also known as APT34). CISA has previously described MuddyWater as an Iranian government-sponsored actor conducting cyber espionage and malicious cyber operations across multiple sectors, while current reporting continues to place the group among the most operationally relevant Iranian state-linked threats in the present crisis environment. OilRig remains a longstanding espionage actor focused on governments, financial institutions, energy entities, and other strategic organizations.
These actors illustrate Iran’s distributed cyber-operational model: Intelligence-driven access development, influence, psychological pressure, and opportunistic disruptive action are not separate lines of effort but parts of a broader strategic continuum.
Parallel hacktivist and proxies
Beginning in June 2025, a noticeable surge in hacktivist and proxy cyber activity accompanied the broader escalation of tensions in the Middle East. This reflects a recurring pattern observed during previous geopolitical crises, in which ideologically aligned non-state cyber actors mobilize alongside, or in parallel with, state-linked cyber operations. In the current confrontation, this dynamic has again expanded the cyber landscape beyond traditional state-directed espionage or sabotage.
By early March 2026, several dozen hacktivists or proxy collectives emerged related to the conflict. These groups vary significantly in capability and reliability. Some focus on distributed denial-of-service (DDoS) attacks, while others conduct website defacements or hack-and-leak campaigns. Some primarily amplify claims of compromise that are exaggerated or only partially verifiable. Their significance, therefore, lies less in technical sophistication than in the cumulative pressure they place on defenders and the broader information environment.
In crisis situations, this activity can produce strategic effects. Numerous low-impact incidents can consume defensive resources, complicate attribution, and obscure more sophisticated intrusions occurring simultaneously. Hacktivist campaigns may therefore function as distractions, signals, or psychological pressure while more capable actors pursue quieter access to high-value networks. For this reason, the analytical distinction between advanced persistent threat (APT) activity and hacktivism can become blurred during periods of geopolitical confrontation.
Several collectives active in the current environment publicly position themselves as ideologically aligned with Iran or with members of the so-called “Axis of Resistance.” Among the more visible groups are Handala Hack Team, Dienet, FAD Team, APT IRAN, Cyber Islamic Resistance, and Fatimion cyber team.These actors frequently frame their operations as retaliatory cyber campaigns targeting Israeli, Western, or allied regional entities, claiming responsibility for activities such as website defacements, DDoS attacks, and hack-and-leak operations targeting mainly government, telecommunications, energy, and financial entities. Although many claims remain difficult to verify independently, their messaging strategy often emphasizes their psychological and reputational impact.
In parallel, several pro-Russia hacktivist groups have also engaged in operations linked to the confrontation, including NoName057(16), Sever Killer, and Russian Legion. These groups typically conduct large-scale DDoS campaigns targeting government portals, financial services, and transportation or telecommunications infrastructure in states perceived as supporting Israel or broader Western policy positions. Their participation illustrates how regional conflicts can attract cyber actors from outside the immediate theater when ideological alignment or strategic narratives converge.
Cyber activities linked to the ongoing conflict
Iranian APT group operations
Beyond the highly visible hacktivist activity circulating on social media, defacement platforms, and Telegram channels, a quieter but more strategically significant layer of cyber operations is unfolding through Iranian state-linked APT groups. These operations appear ongoing and aligned with broader geopolitical objectives tied to the current conflict environment.
Recent threat reporting indicates continued operations by the Iranian APT group, MuddyWater, which is widely assessed to be linked to MOIS. Since at least early February 2026, reporting has suggested potential compromises or attempted intrusions targeting organizations associated with the United States and allied interests.
According to public reporting, activity linked to the group was reportedly observed within the networks of a United States–based bank, a United States airport, a nonprofit organization operating across the United States and Canada, and a software company with operations in Israel. In several of these incidents, threat actors reportedly deployed a previously undocumented backdoorknown as Dindoor, suggesting a coordinated, ongoing campaign rather than isolated compromise events.
Hacktivist and proxy disruption activities
The most visible form of cyber activity so far remains hacktivist and proxy-led disruption.
DDoS attacks are among the most common tactics employed by hacktivist groups. Pro-Russia groups such as NoName057(16) and Server Killer, along with other pro-Iran collectives affiliated with them, have been linked to waves of coordinated DDoS attacks against Israel, Qatar, Bahrain, and other politically symbolic targets. These attacks are generally inexpensive and cause only short-term technical damage, but they remain strategically useful because they disrupt public services, tie up defense resources, generate media coverage, and fuel the narrative of a sustained cyber response.
Figure 1: Telegram post from pro-Russia hacktivist groups claiming responsibility for targeting an Israeli website in support of Iran
⠀
Website defacement also remains a common tactic. Groups such as FAD Team, 313, and Cyber Islamic Resistance have been associated with claims of attacks on several websites. Although defacements are technically simple to execute, they remain analytically significant: They are highly visible, rapidly disseminated, and psychologically impactful, often creating an exaggerated perception of widespread systemic compromise.
Data breaches represent a far more significant dimension of cyber operations. The Iranian-aligned group Handala, in particular, continues to blend political messaging with claims of data theft and the selective release of allegedly compromised information. The group recently asserted that it had infiltrated a Saudi energy company and exfiltrated internal documents, framing the operation as a combination of data exfiltration, coercive pressure, and psychological warfare targeting the energy sector. Even when the full authenticity of released datasets cannot be independently verified, the publication of partially credible material can still generate substantial reputational damage and potential operational disruption for affected organizations.
Targeting critical infrastructure has emerged as one of the most concerning aspects of the current cyber activity by pro-Iran hacktivists and proxy collectives. Groups operating in this ecosystem, including Iranian APTs, Handala, and networks associated with the Cyber Islamic Resistance umbrella, have publicly claimed operations targeting infrastructure across the region. Recent Telegram posts indicate that an Iranian APT group claimed responsibility for attempts to sabotage Jordanian critical infrastructure, while other Iran-aligned hacktivist personas have asserted access to sectors including fuel systems, water utilities, and other operational technology environments.
In a separate case, the Handala Hack Team has alleged that it compromised both Oil and gas companies in the United Arab Emirates and Israel, claiming to have exfiltrated more than 1.3 TB of sensitive data from oil and gas sector networks. These claims, which would represent a significant intrusion into Middle Eastern energy infrastructure if confirmed, have circulated primarily through hacktivist communication channels and social media reporting and have not been independently verified.
Figure 2: IRAN APT group claimed attempts to target Jordanian critical infrastructure
⠀
Although many of these claims remain difficult to independently verify, the recurring focus on industrial control systems and essential services is analytically significant. Hacktivist collectives aligned with Iranian geopolitical narratives frequently leverage infrastructure-related claims as part of information operations designed to amplify perceived impact, generate psychological pressure, and signal the potential for escalation into operational technology environments. Even when technical disruption is limited or exaggerated, the persistent narrative around infrastructure compromise can shape defensive priorities and highlight potential escalation pathways within the broader cyber conflict.
Sectoral exposure and risk landscape
In the current geopolitical context, cyberattacks extend far beyond military networks and defense institutions. Modern cyber operations increasingly aim to affect the broader ecosystem that supports government activity, economic stability, and public trust. Consequently, adversaries seek not only technically vulnerable targets but also organizations whose compromise or disruption can increase visibility, influence public perception, or create cascading effects across interconnected systems.
A successful intrusion into a widely used service provider, a major infrastructure operator, or a publicly accessible institution can quickly produce consequences that extend far beyond the initial target, affecting supply chains, service availability, and public confidence. In this context, cyber operations often serve multiple purposes simultaneously: intelligence gathering, strategic positioning within critical networks, and generating disruption or exerting influence during periods of heightened geopolitical tension.
At present, several sectors appear particularly exposed:
Government institutions and public administration
Defense and aerospace industry
Energy sector, including oil, gas, and electricity
Telecommunications providers
Financial services
Transportation systems
However, the risk landscape extends beyond these sectors themselves. Organizations that form part of the broader digital supply chain supporting these industries may also represent attractive entry points. This includes cloud service providers, managed service providers, technology vendors, and other third-party platforms that maintain privileged access to client environments. Compromising such intermediaries can allow adversaries to reach high-value targets indirectly. By gaining access to a supplier or service provider, attackers may obtain pathways into multiple networks simultaneously, access sensitive information, or move laterally across interconnected operational systems. Supply chain compromise, therefore, offers both scale and stealth, making it an increasingly common tactic in sophisticated cyber campaigns.
Geopolitical alignment can also influence targeting decisions. Organizations based in countries that host United States military assets or are publicly aligned with United States or Israeli policy positions may attract additional attention from adversaries. In these cases, targeting can carry symbolic, political, or strategic value beyond the immediate technical impact of the intrusion. Within this environment, cyber exposure can generally be understood through three overlapping targeting dynamics.
Symbolic targets include municipalities, universities, media outlets, and public institutions. These organizations may be targeted primarily for visibility, messaging, or propaganda purposes. Even limited disruption or data exposure can generate headlines and amplify the perceived reach of the attackers.
Operational targets include sectors that support everyday economic and social activity, such as telecommunications providers, transportation systems, payment networks, and fuel distribution infrastructure. Disruptions in these areas can quickly affect daily life, creating public anxiety and increasing pressure on authorities to respond.
Strategic targets consist of entities whose compromise offers long-term intelligence or operational value. This category includes defense contractors, major financial institutions, government networks, and operators of critical infrastructure. In these cases, adversaries may prioritize persistence and stealth to collect intelligence, monitor decision-making processes, or maintain access that could be leveraged during future crises.
Taken together, these targeting patterns illustrate a broader shift in cyber operations: Attackers are increasingly selecting targets not only for their intrinsic value, but for the broader political, economic, and societal effects that disruption or compromise can produce.
What should organizations monitor?
In the current phase of the conflict, organizations should continue to monitor for indicators that activity is shifting from opportunistic disruption toward deliberate intrusion or access preparation.
Internet-facing infrastructure is often the initial entry point. Elevated scanning or probing of public websites, VPN gateways, remote access portals, cloud services, and email authentication infrastructure may indicate early reconnaissance. While some scanning is routine, sudden increases in probing activity or authentication attempts should be treated as potential precursors to intrusion.
Phishing and social engineering campaigns are also likely to intensify. Threat actors may exploit developments in the conflict by using lures that reference civil defense alerts, battlefield updates, humanitarian messaging, or urgent requests that appear to originate from leadership or trusted partners. In some cases, malicious applications or replicas of legitimate services may be used to harvest credentials or deploy malware.
Credential misuse remains a primary access vector. Security teams should monitor for abnormal authentication patterns, including logins from unusual geographic locations, access at unexpected hours, repeated failed logins followed by success, changes to multi-factor authentication settings, or the creation of new privileged accounts.
Organizations operatingcritical infrastructure should closely monitor activities within their operational environments. Suspicious access to remote management platforms, unusual connectivity between IT and OT networks, or unexpected activity involving engineering workstations or vendor access channels may signal reconnaissance within sensitive systems.
Finally, monitoring the broader information environment can provide early warning and signal the need to increase monitoring. Hacktivist groups frequently use platforms such as Telegram and X to circulate target lists, claim attacks, or release fragments of allegedly stolen data tied to geopolitical events. Tracking these channels can help organizations identify potential targets and strengthen their defensive posture before malicious activity reaches their networks.
This is a guest post by Satoru Ishikawa, Solutions Architect at Classmethod in partnership with AWS.
In April 2025, AWS announced the deprecation of Amazon Redshift DC2 instances, guiding users to migrate to either Redshift RA3 instances or Redshift Serverless. Redshift RA3 instances and Serverless adopt a design that separates storage and compute, offers new features such as data sharing, concurrency scaling for writes, zero-ETL , and cluster relocation.
In this post, we share insights from one of our customers’ migration from DC2 to RA3 instances. The customer, a large enterprise in the retail industry, operated a 16-node dc2.8xlarge cluster for business intelligence (BI) and ETL workloads. Facing growing data volumes and disk capacity limitations, they successfully migrated to RA3 instances using a Blue-Green deployment approach, achieving improved ETL query performance and expanded storage capacity while maintaining cost efficiency.
Amazon Redshift architecture types
Amazon Redshift offers two deployment options: Provisioned mode, where you choose the instance type and number of nodes and manage resizing as needed, and Redshift Serverless, which automatically provisions data warehouse capacity and intelligently scales the underlying resources. The following diagram compares these two architecture types.
Provisioned clusters require you to determine cluster size in advance, but you can optimize costs by purchasing Reserved Instances (RI) or scheduling pause and resume actions. Serverless automatically provisions resources as needed, with a pay-per-use model where you only pay for compute resources consumed. Both services support migration between each other and offer the same features including SQL, zero-ETL, and Federated Query capabilities. For specific pricing details, see Amazon Redshift pricing.
This section describes the customer’s migration from Amazon Redshift DC2 to RA3 instance types. The migration used a Blue-Green deployment approach that minimized downtime while achieving both cost optimization and performance improvement.
The customer’s workload had the following characteristics:
Use cases
The customer had the following key use cases for their Amazon Redshift deployment:
Query via BI tool during business hours
High volume of read queries
Peak access during Mondays and beginning of months
Data processing in early morning
Concentrated write queries for data loading and transformation
Steady-state workload characteristics
Run queries more than 16 hours daily
Requirements
The customer had the following key requirements for their Amazon Redshift migration:
Performance
Use auto-scaling (such as concurrency scaling) during peak access periods
Data size
Disk capacity expansion needed
Cost Management
Easy budget prediction and management
Utilize discount services for long-term usage
Compatibility
Maintain compatibility with existing applications and BI tools
Avoid endpoint changes
Availability
Maximum downtime of 8 hours acceptable during migration
Network
Do not modify the existing 2-Availability Zone (AZ) subnet configuration
When to migrate
To be conducted during low-load days and hours
Planned downtime possible within 8 hours
Key considerations in system design, implementation, and operation included extended operation hours, ease of budget prediction and management, cost optimization through Reserved Instances (RI), and maintaining compatibility with existing systems (avoiding endpoint changes). The customer evaluated Amazon Redshift Serverless, which offered attractive features such as a pay-per-use model, automatic scaling capabilities, and the potential for better price performance for variable workloads. While both Redshift Serverless and provisioned clusters could effectively support their workload patterns, the customer chose the provisioned model with RA3 nodes, leveraging their years of operational experience with provisioned environments, existing RI strategy, and established capacity planning approach.
Features of RA3 instance type
Built on the AWS Nitro System, RA3 instances with managed storage adopt an architecture that separates computing and storage, allowing independent scaling and separate billing for each component. These instances use high-performance SSDs for hot data and Amazon S3 for cold data, providing ease of use, cost-effective storage, and fast query performance. For more details, refer to Amazon Redshift RA3 instances with managed storage.
Migration prerequisites
The customer had the following migration prerequisites in place:
The customer used a Redshift cluster with 16 nodes of dc2.8xlarge configuration.
The customer chose a Blue-Green deployment approach for migration, where they would restore from a snapshot to RA3 instance type, enabling quick rollback if necessary.
The customer implemented cluster switching and rollback through endpoint switching using cluster identifier rotation.
Amazon Redshift’s Classic Resize functionality had been enhanced, for resizing to RA3 instance types, significantly reducing the write-unavailable period. Based on PoC testing, after initiating the resize, the cluster’s status was modifying for 16 minutes before it became available. Based on these results, the customer proceeded with the Classic Resize approach.
Cluster sizing
Sizing involved determining the instance type and number of nodes for the migration target. Sizing points considered workload characteristics such as CPU-intensive (queries using high CPU), I/O-intensive (queries with high data read/write), or both.When migrating from DC2 instance types, additional nodes might be required depending on workload requirements. Nodes were added or removed based on the computing requirements for necessary query performance.
For this migration, the customer proceeded with a cost-efficient 6-node ra3.16xlarge cluster to stay within existing budget constraints. However, since this node count could face throughput limitations during certain times, they enabled concurrent scaling for the RA3 instance type to handle spike access.
Concurrency scaling provides up to 1 hour of free credits per day for each active cluster, accumulating up to 30 hours. On-demand usage fees apply when exceeding this free tier.While the customer chose to implement concurrency scaling, Elastic Resize to temporarily increase nodes during peak loads was also considered but rejected due to on-demand costs for additional nodes and the brief disconnection period during switching.
Managed storage cost
RA3 instances use Redshift Managed Storage (RMS), which is charged at a fixed GB-month rate. The customer’s approximately 2 TB of data required including storage costs in the estimates. For pricing details, see Amazon Redshift pricing.
Migration step from DC2 to RA3
After creating an RA3 cluster from the DC2 cluster’s snapshot, the customer swapped the cluster identifiers. The following diagram shows this process.
Take a snapshot of the current DC2 cluster.
Restore RA3 cluster from the snapshot with a different cluster identifier (Classic Resize)
Swap the cluster identifiers between the current DC2 cluster and the new RA3 cluster.
If any issues arise after the cluster switch, you can quickly roll back by returning the original DC2 cluster to its original cluster identifier.
Note: Restore from a snapshot
Running the restore operation using CLI commands is recommended to minimize operational errors and ensure reproducibility. The following is a sample command.
The time required for the restore and classic resize steps can vary significantly depending on data volume and target cluster specifications. The customer conducted a rehearsal beforehand to measure the actual required time.
Test results
Before the production migration, the customer created a test cluster by restoring a snapshot to the RA3 instance type. While Redshift Test Drive is typically useful for workload testing, this customer faced unique constraints: enabling audit logging in their production cluster would require configuration changes, cluster restarts, and complex approval processes under their strict change management policies. To address this, they developed a custom load testing tool that captured workload patterns using Amazon Redshift system views (SYS_QUERY_HISTORY and SYS_QUERY_TEXT), which maintain 7 days of query history. The tool replayed 55,755 historical queries with 50-way parallelism against both DC2 and RA3 clusters, comparing metrics including query execution time, CPU utilization, and disk I/O. Query result caching was disabled during testing to ensure accurate comparisons.
BI query performance
BI queries were tested using the custom load testing tool. The results represent the average execution time from 15 test runs of 55,755 queries executed with 50-way parallelism. Without concurrency scaling, the dc2.8xlarge 16-node cluster averaged 45.82 seconds per query, while the ra3.16xlarge 6-node cluster averaged 91.30 seconds. This indicated that RA3 instances showed longer execution times for short and medium queries in a direct migration without optimizations. However, enabling concurrency scaling improved RA3 performance progressively. With concurrency scaling enabled at maximum 2 clusters, the ra3.16xlarge 6-node cluster achieved an average of 72.48 seconds per query, a 21% improvement over the non-scaled configuration.
Node Type / Number of nodes
Average Query Time
ra3.16xlarge 6-node cluster
72.48 seconds
ETL query performance comparison
For long-running ETL queries (execution time greater than 10 minutes), the RA3 cluster demonstrated better performance than DC2. These results represented a direct migration of the customer’s workload with no optimizations applied.
For the Large-scale data load workload 1, the ra3.16xlarge cluster completed the query 28% faster than the dc2.8xlarge cluster (41 minutes vs. 57 minutes).
For the Complex transformation workload 1, the ra3.16xlarge cluster was 23% faster (1 hour 1 minute vs. 1 hour 20 minutes).
These results indicated that the RA3 node type was more performant for time-intensive data loading and transformation tasks. The higher CPU utilization values for RA3 suggested more effective compute resource usage.
Node Type / Number of nodes
Average Query Time
MAXCPU%
ra3.16xlarge 6-node cluster
41 mins 09 seconds
11:45
dc2.8xlarge 16-node cluster
57 mins 07 seconds
10:85
Node Type / Number of nodes
Average Query Time
MAXCPU%
ra3.16xlarge 6-node cluster
1 hour 01 mins 33 seconds
74:23
dc2.8xlarge 16-node cluster
1 hour 20 mins 36 seconds
53:58
Performance tuning
Based on the test results, the customer identified that RA3 showed longer execution times for short and medium BI queries but faster performance for long-running ETL queries compared to DC2. To optimize overall performance, they focused on identifying slow queries and frequently referenced tables, prioritizing optimizations with the highest impact.
Performance tuning strategy
The customer considered several optimization strategies to leverage RA3’s architectural advantages. One key strategy involved pre-processing ad-hoc short and medium query workloads during low-load periods, creating pre-processed tables or materialized views for queries that repeatedly performed joins, aggregations, filters, and projections. RA3’s separated compute and storage architecture, with cost-effective large-scale storage, supported this approach.
Converting regular views to materialized views
Analysis of slow queries revealed the use of joins in views, and frequently referenced tables were being accessed multiple times through these views. As a countermeasure, the customer replaced frequently used regular views with materialized views, removing unnecessary data ranges and redundant columns.
Amazon Redshift supports incremental updates of materialized view contents via the REFRESH MATERIALIZED VIEW command, enabling efficient data updates.
Materialized views and query rewrite
By converting regular views to materialized views, existing queries may be automatically optimized through the “query rewrite” feature provided by the query planner. For more details, refer to “Automatic query rewriting to use materialized views“.
Automatic tuning with AutoMV
On the DC2 cluster, disk utilization consistently exceeded 80%, which disabled the AutoMV feature due to insufficient disk space. With RA3’s expanded storage, automatic tuning through AutoMV became possible, leading to further performance improvements. For more details about AutoMV, refer to Automated materialized views.
Performance tuning results
After applying these optimizations, the customer achieved the following results:
Maintained existing performance while controlling cost increases
Achieved higher CPU utilization while maintaining throughput
Enhanced dynamic throughput during peak load periods using concurrency scaling’s automatic scaling
Conclusion
In this post, you learned how a large retail enterprise successfully migrated from Amazon Redshift DC2 to RA3 instances. The Blue-Green deployment approach enabled a safe migration with quick rollback capability, while the separated compute and storage architecture of RA3 provided flexibility to handle growing data volumes. Although RA3 showed different performance characteristics for short BI queries compared to DC2, the customer achieved significant improvements in long-running ETL query performance (up to 28% faster for data loads and 23% faster for complex transformations). By leveraging RA3-specific features such as materialized views and AutoMV, they optimized overall query performance while maintaining cost efficiency through Reserved Instances and concurrency scaling.
Moonforge is an operating system framework for Linux devices that
simplifies the process of building and maintaining custom operating
systems.
It provides a curated collection of Yocto layers and configuration
files that help developers generate immutable, maintainable, and
easily updatable operating system images.
The goal is to offer the best possible developer experience for
teams building embedded Linux products. Moonforge handles the complex
aspects of operating system creation, such as system integration,
security, updates, and infrastructure, so developers can focus on
building and deploying their applications or devices.
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.