Born to Burn: the Battle Born LFP Battery

Would you feel confident in buying US-made LiFePO₄ (LFP) batteries? While the answer here is generally expected to be ‘yes’, especially compared to getting an unbranded LFP battery off eBay from a random seller, the outcome may not be that different. Case in point the 100 Ah, 12 VDC LFP Battle Born battery that [Will Prowse] took a look at to see why its positive terminal gets positively crispy.
Battle Born battery positive terminal. (Credit: Will Prowse, YouTube)
Once the lid was cut off, it’s easy to see what the problem is: the positive terminal is only loosely attached to the bus bar, leading to extremely poor contact. It also appears that there’s a plastic spacer which has properly melted already in this well-used battery that [Will] obtained from a viewer.

This overheating issue with Battle Born batteries has been reported for years now, which makes it a great idea to take a good look at any Battle Born LFP batteries you may have kicking around, as they may be plagued by the same design flaw. Trying to make use of the manufacturer’s warranty could be complicated based on the commentators in the DIY Solar Forum thread, as Battle Born likes to claim that the overheating issue is an external problem and not a design flaw.

Either way, it looks like an incredibly sketchy way to design a battery terminal on an LFP battery that is supposed to surge 100+A. [Will] is requesting that anyone affected posts details in the forum or similar to get all information together, as he looks to push Battle Born on this issue.

What makes this issue worse is that shortly after releasing that first video, Battle Born responded to some concerned customers with a response that claims that their terminal design is a ‘thermal fail-safe’, but as can be seen in [Will]’s follow-up video, it absolutely doesn’t look like one.

youtube.com/embed/XP2yPY57Wjc?…

youtube.com/embed/7fD3yaRvp3o?…

hackaday.com/2025/12/25/born-t…

Threat landscape for industrial automation systems in Q3 2025

Statistics across all threats

In Q3 2025, the percentage of ICS computers on which malicious objects were blocked decreased from the previous quarter by 0.4 pp to 20.1%. This is the lowest level for the observed period.

Percentage of ICS computers on which malicious objects were blocked, Q3 2022–Q3 2025

Regionally, the percentage of ICS computers on which malicious objects were blocked ranged from 9.2% in Northern Europe to 27.4% in Africa.

Regions ranked by percentage of ICS computers on which malicious objects were blocked

In Q3 2025, the percentage increased in five regions. The most notable increase occurred in East Asia, triggered by the local spread of malicious scripts in the OT infrastructure of engineering organizations and ICS integrators.

Changes in the percentage of ICS computers on which malicious objects were blocked, Q3 2025

Selected industries

The biometrics sector traditionally led the rankings of the industries and OT infrastructures surveyed in this report in terms of the percentage of ICS computers on which malicious objects were blocked.

Rankings of industries and OT infrastructures by percentage of ICS computers on which malicious objects were blocked

In Q3 2025, the percentage of ICS computers on which malicious objects were blocked increased in four of the seven surveyed industries. The most notable increases were in engineering and ICS integrators, and manufacturing.

Percentage of ICS computers on which malicious objects were blocked in selected industries

Diversity of detected malicious objects

In Q3 2025, Kaspersky protection solutions blocked malware from 11,356 different malware families of various categories on industrial automation systems.

Percentage of ICS computers on which the activity of malicious objects of various categories was blocked

In Q3 2025, there was a decrease in the percentage of ICS computers on which denylisted internet resources and miners of both categories were blocked. These were the only categories that exhibited a decrease.

Main threat sources

Depending on the threat detection and blocking scenario, it is not always possible to reliably identify the source. The circumstantial evidence for a specific source can be the blocked threat’s type (category).

The internet (visiting malicious or compromised internet resources; malicious content distributed via messengers; cloud data storage and processing services and CDNs), email clients (phishing emails), and removable storage devices remain the primary sources of threats to computers in an organization’s technology infrastructure.

In Q3 2025, the percentage of ICS computers on which malicious objects from various sources were blocked decreased.

Percentage of ICS computers on which malicious objects from various sources were blocked

The same computer can be attacked by several categories of malware from the same source during a quarter. That computer is counted when calculating the percentage of attacked computers for each threat category, but is only counted once for the threat source (we count unique attacked computers). In addition, it is not always possible to accurately determine the initial infection attempt. Therefore, the total percentage of ICS computers on which various categories of threats from a certain source were blocked can exceed the percentage of threats from the source itself.

• The main categories of threats from the internet blocked on ICS computers in Q3 2025 were malicious scripts and phishing pages, and denylisted internet resources. The percentage ranged from 4.57% in Northern Europe to 10.31% in Africa.
• The main categories of threats from email clients blocked on ICS computers were malicious scripts and phishing pages, spyware, and malicious documents. Most of the spyware detected in phishing emails was delivered as a password-protected archive or a multi-layered script embedded in an office document. The percentage of ICS computers on which threats from email clients were blocked ranged from 0.78% in Russia to 6.85% in Southern Europe.
• The main categories of threats that were blocked when removable media was connected to ICS computers were worms, viruses, and spyware. The percentage of ICS computers on which threats from this source were blocked ranged from 0.05% in Australia and New Zealand to 1.43% in Africa.
• The main categories of threats that spread through network folders were viruses, AutoCAD malware, worms, and spyware. The percentages of ICS computers where threats from this source were blocked ranged from 0.006% in Northern Europe to 0.20% in East Asia.

Threat categories

Typical attacks blocked within an OT network are multi-step sequences of malicious activities, where each subsequent step of the attackers is aimed at increasing privileges and/or gaining access to other systems by exploiting the security problems of industrial enterprises, including technological infrastructures.

Malicious objects used for initial infection

In Q3 2025, the percentage of ICS computers on which denylisted internet resources were blocked decreased to 4.01%. This is the lowest quarterly figure since the beginning of 2022.

Percentage of ICS computers on which denylisted internet resources were blocked, Q3 2022–Q3 2025

Regionally, the percentage of ICS computers on which denylisted internet resources were blocked ranged from 2.35% in Australia and New Zealand to 4.96% in Africa. Southeast Asia and South Asia were also among the top three regions for this indicator.

The percentage of ICS computers on which malicious documents were blocked has grown for three consecutive quarters, following a decline at the end of 2024. In Q3 2025, it reached 1,98%.

Percentage of ICS computers on which malicious documents were blocked, Q3 2022–Q3 2025

The indicator increased in four regions: South America, East Asia, Southeast Asia, and Australia and New Zealand. South America saw the largest increase as a result of a large-scale phishing campaign in which attackers used new exploits for an old vulnerability (CVE-2017-11882) in Microsoft Office Equation Editor to deliver various spyware to victims’ computers. It is noteworthy that the attackers in this phishing campaign used localized Spanish-language emails disguised as business correspondence.

In Q3 2025, the percentage of ICS computers on which malicious scripts and phishing pages were blocked increased to 6.79%. This category led the rankings of threat categories in terms of the percentage of ICS computers on which they were blocked.

Percentage of ICS computers on which malicious scripts and phishing pages were blocked, Q3 2022–Q3 2025

Regionally, the percentage of ICS computers on which malicious scripts and phishing pages were blocked ranged from 2.57% in Northern Europe to 9.41% in Africa. The top three regions for this indicator were Africa, East Asia, and South America. The indicator increased the most in East Asia (by a dramatic 5.23 pp) as a result of the local spread of malicious spyware scripts loaded into the memory of popular torrent clients including MediaGet.

Next-stage malware

Malicious objects used to initially infect computers deliver next-stage malware — spyware, ransomware, and miners — to victims’ computers. As a rule, the higher the percentage of ICS computers on which the initial infection malware is blocked, the higher the percentage for next-stage malware.
In Q3 2025, the percentage of ICS computers on which spyware and ransomware were blocked increased. The rates were:

• spyware: 4.04% (up 0.20 pp);
• ransomware: 0.17% (up 0.03 pp).

The percentage of ICS computers on which miners of both categories were blocked decreased. The rates were:

• miners in the form of executable files for Windows: 0.57% (down 0.06 pp), it’s the lowest level since Q3 2022;
• web miners: 0.25% (down 0.05 pp). This is the lowest level since Q3 2022.

Self-propagating malware

Self-propagating malware (worms and viruses) is a category unto itself. Worms and virus-infected files were originally used for initial infection, but as botnet functionality evolved, they took on next-stage characteristics.

To spread across ICS networks, viruses and worms rely on removable media and network folders in the form of infected files, such as archives with backups, office documents, pirated games and hacked applications. In rarer and more dangerous cases, web pages with network equipment settings, as well as files stored in internal document management systems, product lifecycle management (PLM) systems, resource management (ERP) systems and other web services are infected.

In Q3 2025, the percentage of ICS computers on which worms and viruses were blocked increased to 1.26% (by 0.04 pp) and 1.40% (by 0.11 pp), respectively.

AutoCAD malware

This category of malware can spread in a variety of ways, so it does not belong to a specific group.

In Q3 2025, the percentage of ICS computers on which AutoCAD malware was blocked slightly increased to 0.30% (by 0.01 pp).

For more information on industrial threats see the full version of the report.

securelist.com/industrial-thre…

Twelve Days of Christmas as Performed By 1980s Speech Chip

In a curious historical twist, the “Twelve days of Christmas” are actually the days of revelry that followed the 25th. The preceding period, Advent, was traditionally a fast, not unlike Lent. When and why a fast became an excuse for chocolate calendars we cannot say, but this historical information is presented to explain that this great hack by [Kevin], making a vintage speech synthesizer chip sing the classic carol will remain relevant at least until January 5th — or perhaps even the 19th, for the Orthodox amongst us.

The chip in question is an SP0256A-AL2, which you may remember from various speech projects for 8-bit computers back in the day. It can talk, after a fashion, by reproducing 56 “allophones” — the sounds that make up English speech — from ROM. Singing, though? We cannot recall much of that back in the day, but then, a talking computer was impressive enough.

As it turns out this is building on an earlier hack [Kevin] did in which he used an Arduino to make the venerable speech chip MIDI controllable. In that project’s write-up it is revealed that a Si5351 programmable clock module is used to give a variable pitch signal to the speech synthesizer. In this way he’s able to get about an octave an a half, which is good enough when the carol in question only spans one octave.

Of course the pitch signal needs to be varied by something and for that the venerable Arduino once again takes the place of an 8-bit computer. In this case it’s pre-programmed, but can also be set up for MIDI control.Of course nothing says you can’t use true retro hardware or a more-capable RP2040 instead of the Amtel chip.

It’s sad to think how much compute power has been wasted this year on AI-generated novelty carols when a little bit of 1980s silicon and some ingenuity can do nearly as good — or better, depending on your tastes.

makertube.net/videos/embed/diB…

hackaday.com/2025/12/25/twelve…

EDR Nel mirino: i forum underground mettono in vendita NtKiller

All’interno di un forum underground chiuso, frequentato da operatori malware e broker di accesso iniziale, è comparso un annuncio che ha attirato l’attenzione della comunità di cyber threat intelligence. Il post promuove “NtKiller”, una presunta utility “kernel-level” progettata per disattivare in modo silente antivirus, EDR, con riferimenti espliciti a rootkit, persistenza avanzata e bypass UAC zero-day.

Il prezzo dichiarato è di 500 dollari, con contatti diretti via Telegram e una lista di soluzioni di sicurezza “supportate” che include nomi di primo piano: Windows Defender, ESET, Kaspersky, Bitdefender, Malwarebytes e altri.

Una proposta che, se autentica, si colloca nella fascia alta del cybercrime-as-a-service.

Disclaimer: Questo rapporto include screenshot e/o testo tratti da fonti pubblicamente accessibili. Le informazioni fornite hanno esclusivamente finalità di intelligence sulle minacce e di sensibilizzazione sui rischi di cybersecurity. Red Hot Cyber condanna qualsiasi accesso non autorizzato, diffusione impropria o utilizzo illecito di tali dati. Al momento, non è possibile verificare in modo indipendente l’autenticità delle informazioni riportate, poiché l’organizzazione coinvolta non ha ancora rilasciato un comunicato ufficiale sul proprio sito web. Di conseguenza, questo articolo deve essere considerato esclusivamente a scopo informativo e di intelligence.

Cosa sono gli EDR

Gli EDR (Endpoint Detection and Response) sono soluzioni di sicurezza avanzata progettate per andare oltre il tradizionale antivirus. Il loro compito non è solo bloccare file malevoli, ma monitorare costantemente il comportamento del sistema.

In sintesi, un EDR:

• raccoglie telemetria continua dagli endpoint;
• analizza processi, chiamate di sistema, driver e memoria;
• correla eventi sospetti nel tempo;
• consente risposta attiva, come l’isolamento del sistema o la terminazione di processi.

A differenza degli AV classici, molti EDR operano a livello kernel, rendendo più difficile la loro disattivazione da parte di codice malevolo eseguito in user-mode.

Perché gli EDR sono un obiettivo primario

Nel cybercrime moderno, soprattutto nel contesto ransomware e intrusioni mirate, la prima fase dopo l’accesso iniziale è quasi sempre la neutralizzazione delle difese. Un EDR attivo:

• registra le azioni dell’attaccante;
• può generare alert in tempo reale;
• può interrompere la catena di attacco prima della fase finale.

Per questo motivo, la capacità di “accecamento” o disattivazione silente degli EDR è diventata un valore di mercato nei forum underground.

Come vengono aggirati gli EDR (livello concettuale)

I post come quello su NtKiller fanno riferimento a tecniche note a livello teorico, già osservate in campagne APT e ransomware avanzate. Non si tratta di exploit “magici”, ma di abusi profondi dell’architettura del sistema operativo.

Tra le macro-categorie di bypass comunemente discusse nei circuiti underground:

1. Abuso del livello kernel
   Portare codice malevolo allo stesso livello di privilegio dell’EDR riduce drasticamente la capacità di difesa. A questo livello, i controlli diventano una “lotta tra pari”.
2. Manipolazione dei driver
   L’uso (o abuso) di driver vulnerabili firmati è una tecnica storicamente osservata per ottenere operazioni privilegiate senza exploit diretti del kernel.
3. Disattivazione indiretta
   Invece di “uccidere” l’EDR, alcuni malware puntano a:
   
   • degradarne la visibilità;
   • interferire con la telemetria;
   • bloccare componenti di logging o comunicazione.

   
   

4. Persistenza invisibile
   Rootkit e meccanismi di avvio precoce permettono al malware di caricarsi prima delle soluzioni di sicurezza.
5. Bypass dei controlli di elevazione
   I riferimenti a UAC bypass indicano tecniche per ottenere privilegi elevati senza allertare l’utente, spesso sfruttando fiducia implicita in componenti di sistema.

Marketing underground e realtà operativa

Va sottolineato che non tutti gli annunci nei forum underground corrispondono a strumenti realmente efficaci. Molti sono:

• rebranding di tool già noti;
• proof-of-concept venduti come “weapon-grade”;
• vere e proprie truffe interne al mondo criminale.

Post come questo confermano che:

• gli EDR restano centrali nella difesa;
• il kernel è diventato un campo di battaglia;
• la sicurezza endpoint deve essere affiancata da monitoraggio comportamentale, hardening del driver model e threat hunting proattivo.

Per i difensori, osservare questi forum non significa “imparare ad attaccare”, ma capire come ragiona l’avversario, quali promesse vengono vendute e quali capacità sono considerate “di valore” nel sottobosco cybercriminale.

L'articolo EDR Nel mirino: i forum underground mettono in vendita NtKiller proviene da Red Hot Cyber.