[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f0tV9ZrSfADR20QY-cFV44-v8UbsyN30NVrRn3VSUFOI":3},{"article":4,"iocs":53,"watch_terms":61,"solutions":62,"lesson":149},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"f207349d-0011-4371-ac2d-f2efe5779ed8","Apps Marketed to US Troops Are Shipping Chinese and Russian Code","apps-marketed-to-us-troops-are-shipping-chinese-and-russian-code-62d879","A first-of-its-kind analysis found more than one in eight apps built for US service members carried foreign code—some from firms in nations the Pentagon designates as adversaries.","Researchers from Purdue, West Point, and FIU analyzed 220+ mobile apps marketed to US military personnel and found that 12.5% contained third-party code from adversarial nations, including Huawei SDKs and Russian ad services. The discovery raises concerns that hostile governments could exploit location tracking and personal data to identify troop deployments, unit movements, and sensitive facility access. This research highlights a decade-long warning about the data-broker economy's threat to military personnel, recently confirmed when US Central Command acknowledged adversaries are exploiting commercial location data to target American forces in active war zones.","Study finds over 12% of apps marketed to US troops contain code from Chinese, Russian, and other foreign vendors.","https:\u002F\u002Fwww.wired.com\u002Fstory\u002Fapps-marketed-to-us-troops-are-shipping-chinese-and-russian-code\u002F","https:\u002F\u002Fmedia.wired.com\u002Fphotos\u002F6a590c08ef566878c27c1e0d\u002Fmaster\u002Fpass\u002FSecurity_Apps%20Marketed%20to%20US%20Troops%20Are%20Shipping%20Chinese%20and%20Russian%20Code,%20Study%20Finds_v1.jpg","2026-07-20T09:30:00+00:00","2026-07-20T10:00:11.880844+00:00",9,[17,20,22,24,26,29],{"name":18,"type":19},"Huawei","vendor",{"name":21,"type":19},"Yandex",{"name":23,"type":19},"Google",{"name":25,"type":19},"Facebook",{"name":27,"type":28},"HMS Core","product",{"name":30,"type":31},"Chinese Government (implied)","threat_actor","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":32,"icon":34,"name":35,"slug":36},null,"Supply Chain","supply-chain",[38,43,48],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,58],{"type":55,"value":56,"context":57},"malware","HMS Core (Huawei Mobile Services Core)","Huawei software kit found in 12+ apps marketed to US military; capable of location mapping, ad delivery, and media storage with remote update capability.",{"type":55,"value":59,"context":60},"Yandex (Russian ad service)","Russian advertising service embedded in military-targeted apps; poses data exfiltration risk.",[23,18,21],{"controls":63,"vendors":148},[64,92,121],{"slug":65,"name":66,"problem":67,"products":68},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[69,77,85],{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":87,"url":90,"description":91},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"slug":93,"name":94,"problem":95,"products":96},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[97,105,113],{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"bitsight","Bitsight","\u002Fvendor-logos\u002Fbitsight.png","bitsight-tprm","Bitsight Third-Party Risk Management","https:\u002F\u002Fwww.bitsight.com\u002Fproducts\u002Fthird-party-risk-management","Supplier assessments and continuous monitoring based on security ratings.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"onetrust","OneTrust","\u002Fvendor-logos\u002Fonetrust.png","third-party-management","OneTrust Third-Party Management","https:\u002F\u002Fwww.onetrust.com\u002Fsolutions\u002Fthird-party-management\u002F","Supplier inventory, risk assessments and monitoring across privacy and security.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"upguard","UpGuard","\u002Fvendor-logos\u002Fupguard.png","upguard-vendor-risk","UpGuard Vendor Risk","https:\u002F\u002Fwww.upguard.com\u002Fproduct\u002Fvendor-risk","Supplier security questionnaires, ratings and continuous monitoring.",{"slug":122,"name":123,"problem":124,"products":125},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[126,134,140],{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":135,"product_name":136,"url":138,"description":139},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":144,"product_name":145,"url":146,"description":147},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",[],{"slug":150,"title":151,"body":152,"framework_refs":153,"framework_notes":165},"adversarial-nation-code-found-in-apps-marketed-to-us-military-personnel","Adversarial Nation Code Found in Apps Marketed to US Military Personnel","Researchers discovered that over 12% of mobile apps marketed to US troops contained third-party SDKs and ad libraries originating from China and Russia, introducing covert data collection capabilities into devices used by military personnel. The root cause is a failure in supply chain oversight — neither app developers nor end users scrutinized the origin of embedded third-party code, allowing adversarial nation components to reach sensitive user populations by default. This matters because location telemetry, behavioral data, and device identifiers harvested through these SDKs can be aggregated by hostile intelligence services to map troop movements, identify deployment patterns, and expose sensitive facility access. US Central Command has already confirmed adversaries are actively exploiting commercial location data to target American forces in active combat zones, making this a kinetic, life-safety risk — not merely a privacy concern.",[154,155,156,157,158,159,160,161,162,163,164],"NIST SP 800-161 (Supply Chain Risk Management)","NIST SP 800-124 (Mobile Device Security)","NIST AC-3 (Access Enforcement)","NIST SI-7 (Software, Firmware, and Information Integrity)","CIS Control 2 (Inventory and Control of Software Assets)","CIS Control 13 (Data Protection)","CIS Control 16 (Application Software Security)","DoD Instruction 8551.01 (Ports, Protocols, and Services Management)","GDPR Article 44 (Transfers to Third Countries)","NIST CSF DE.CM-7 (Monitoring for Unauthorized Personnel, Connections, Devices, and Software)","CMMC Level 2 Practice MP.L2-3.8.7 (Control use of removable media)",{}]