MeridianMeridian

JPAAWG 9th General Meeting to Examine AI-Driven Messaging Threats and Global Standards in Tokyo

The Japan Anti-Abuse Working Group will hold its ninth annual General Meeting on November 5-6, 2026, in Tokyo as a hybrid event focused on evolving messaging security challenges. Keynote speaker Tom Bartel from M3AAWG will address worldwide anti-abuse trends and the practical realities of AI-powered attacks and defenses. Sessions will cover the recently standardized DMARCbis specification under RFC 9989, ongoing work on DKIM2 to counter replay attacks, BIMI logo display adoption, and sender guidelines for AI-generated email summaries. Practical workshops will teach DMARC report analysis using real sample data along with related technologies such as ARC, DNSSEC, and MTA-STS. Government agencies including the National Police Agency and Ministry of Internal Affairs and Communications will also present, alongside a dedicated track on post-quantum cryptography.

Security NEXTTranslated from Japanese

Read at source

The Japan Anti-Abuse Working Group (JPAAWG) will convene its 9th General Meeting on November 5 and 6, 2026, in Tokyo as a hybrid event centered on the rapidly changing landscape of messaging security.

Following the accelerated evolution of AI since the second half of 2026, email and messaging environments face increasingly sophisticated threats. The two-day program brings together international experts, researchers, and practitioners to share the latest global developments and operational know-how.

Keynote speaker Tom Bartel of M3AAWG will present on worldwide messaging abuse countermeasures and the current state of AI-enabled attacks and defenses. Additional sessions will introduce IETF standardization efforts, including the revised DMARC specification published as RFC 9989 (DMARCbis) in May 2026 and work toward DKIM2 to mitigate DKIM replay attacks.

Experts will also discuss phishing trends and countermeasures, sender authentication guidelines, and the adoption status of BIMI for displaying sender logos. Sessions will address the implications of AI-driven email summarization and filtering for senders.

Practical tracks will cover foundational topics such as email architecture and DNS, followed by hands-on DMARC report analysis using real-world sample data. Participants will learn to interpret reports and apply findings operationally, with coverage of ARC, BIMI, DNSSEC, and MTA-STS.

Roundtable discussions will allow attendees to exchange experiences and challenges directly. Government sessions featuring the National Police Agency, Ministry of Internal Affairs and Communications, and Public Security Intelligence Agency are planned, along with a dedicated program on post-quantum cryptography.

The venue is Otemachi Place Hall & Conference. Select sessions will be streamed online, while others are limited to in-person participants. Attendance is free but requires advance registration via the official event website.

JPAAWGM3AAWGTom BartelDMARCDKIM2BIMIRFC 9989
ShareXFacebookLinkedInReddit
Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Fraud & Social Engineering

Scammers Use *#62# USSD Command to Fabricate Surveillance Claims and Steal Victims' Funds
Fraud & Social Engineering

Scammers Use *#62# USSD Command to Fabricate Surveillance Claims and Steal Victims' Funds

Fraudsters are exploiting the USSD command *#62# to convince targets that their phones are being tapped, then directing them to hand over cash to supposed couriers. The scheme begins with a familiar pretext such as a doorphone replacement or parcel delivery, after which the victim is tricked into revealing a verification code that the attackers themselves sent. A fake government official then claims the victim's account has been compromised and an extremist has been granted power of attorney. Victims are instructed to visit a counterfeit state website, enter *#62#, and interpret the displayed forwarding number as proof of interception. In reality the code only reveals call-forwarding settings for when the phone is unreachable, often showing a voicemail or missed-call service number. T-Bank warns that the displayed number has no connection to surveillance and urges anyone receiving such calls to hang up and contact the real organization through official channels.

AntiMalwareOct 28, 2026Translated from Russian

Aroshka Cloud Faces Scrutiny Over Alleged False Claims of SOC 24/7 Operations and High-End Infrastructure
Fraud & Social Engineering

Aroshka Cloud Faces Scrutiny Over Alleged False Claims of SOC 24/7 Operations and High-End Infrastructure

StackWorks has published the fourth installment in its investigative series on Aroshka Cloud, detailing how the cloud storage provider accused the studio of orchestrating a DDoS attack shortly after the third part appeared. The service published five posts claiming technical evidence linked StackWorks to the attack, including IP traces from Moscow, Ufa, and Stavropol, while asserting that its SOC 24/7 team mitigated a 3.5 Gbit/s assault within seconds. StackWorks responded with a pre-trial claim demanding removal of the posts and a public retraction, which Aroshka Cloud rejected within seven minutes. Analysis of the provider’s own Kwork job postings reveals requests for template-based support staff, a five-VDS server pool, and later up to eight NVIDIA H200 GPUs with InfiniBand, contradicting public statements about multi-country data centers and round-the-clock security engineers. Further inconsistencies include mismatched time zones in email headers, inflated user statistics, and reliance on the BeDrive script rather than custom development. The investigation continues with plans to involve law enforcement regarding suspicious visitor logs.

HabrOct 25, 2026Translated from Russian

Reports Surface on Alleged De-Anonymization of Admins Running Major Russian Hacker Forums
Fraud & Social Engineering

Reports Surface on Alleged De-Anonymization of Admins Running Major Russian Hacker Forums

An independent researcher has compiled publicly available information pointing to the possible identities of administrators behind prominent Russian-language darknet forums including exploit.in and duty-free.to. The analysis traces exploit.in back to its 2006 launch by a user known as Toha, later linked to Ukrainian authorities or associates, with the forum reportedly transferred or sold. Forum moderator Quake3, identified in open sources as Anatoly Kravchuk, ceased activity in October 2026 and appears on a German police wanted list. Additional details from forum posts and anonymous Telegram channels name Mikhail Rytikov, known as Abdulla, as a key figure tied to server hosting and operations. The report also notes the recent involvement of known Russian hacker wazawaka on duty-free.to and highlights the declining viability of several legacy forums due to law enforcement actions. All claims are presented as unverified public speculation without new original sourcing.

HabrOct 24, 2026Translated from Russian