You have to be in it to feel it — the change Switzerland have made, that is.
We’ve seen the record breaking numbers, but until you are immersed in the atmosphere of their adoring supporters, it is hard to assess the impact they are having.
Thursday night felt like the force of a nation was behind them. Every defensive action, every attack on the opposition goal roared home.
From minute one to minute 90, even when they went behind, these fans did not stop; this is the kind of legacy the national team is leaving behind after bowing out this evening.
The country has embraced this tournament like no other, making it one of the most attended championships in history, yet their impact feels more seismic than statistics.
Adorned at the heart of thousands of Swiss supporters ahead of the quarter-final was a banner that quite simply wrote: Time to move mountains.
There is perhaps nothing that greater sums up what the squad has achieved – they made people believe.
They have undoubtedly changed women’s football in Switzerland forever. It feels as though everyone in this country has bought into the sport and to the squad.
For captain Lia Walti, it is something beyond her wildest dreams.
“I hope that the EUROs will give us that extra push for people to see that this game actually has a lot of potential, even in Switzerland, that they want to push, invest, and give the girls a chance, the same as boys,” she told ESPN in June.
If there were any doubts about it being a launchpad for growing the game, those have surely been put to bed.
Even long after full-time, their exit confirmed, supporters remained in full voice in a move that can mean only one thing: We are here to stay. Women’s football is here to stay.
Right now the defeat will hurt the Swiss, naturally, but when the dust settles and they are able to reflect on their historic journey, these players will know that their names will long be remembered as game changers.
The Oskar Nedbal International Viola Competition has announced the 18 semi-finalists for its 7th edition, which will take place in Prague, Czech Republic, from 23 to 26 October 2025.
This year, the competition received a record-breaking 115 applications from 35 countries worldwide. The first round was held via pre-recorded video submissions, from which the jury selected 18 young violists to advance to the live semi-final stage in Prague.
The 2025 semi-finalists are (in alphabetical order):
1. Rodrigo Agudelo Celda (Spain/UK)
2. Diego Alvarado Sánchez (Venezuela)
3. Carla Guillén García (Spain)
4. Sara Furuichi (Japan)
5. Elena Küssner (Germany/Sweden)
6. Jiwon Kim (South Korea)
7. Ayano Nakamura (USA/Japan)
8. Ella Eunsuh Park (USA/South Korea)
9. Junhao Peng (China)
10. Davis Sliecans (Latvia)
11. Marvin Stark (Germany)
12. Julie Svačinová (Finland)
13. Guohan Tang (China)
14. Kyrillos Volkov (Greece)
15. Julia Wawrowska (Poland)
16. Mingyue Yu (China)
17. Zihan Zhang (China)
18. Xunyu Zhou (China)
Open to violists of all nationalities up to the age of 30, the competition offers a total prize pool of CZK125,000 (£4,400). In addition to financial awards, laureates will receive valuable prizes including a fine viola bow by Luboš Odlas, GEWA viola cases, Pirastro strings, rosin and Korfker Rest, as well as concert engagements.
While the first round was completed remotely, both the semi-final and final rounds will be held live in Prague. In the final, the selected candidates will perform a concerto by either Carl Stamitz or Franz Anton Hoffmeister, accompanied by the ensemble Barocco sempre giovane.
The 2025 international jury will be chaired by Garth Knox (Ireland) and comprises competition founder and artistic director Kristina Fialová (Czech Republic), Lena Eckels (Germany), Asbjørn Nørgaard (Denmark) and Jan Pěruška (Czech Republic).
Last year’s edition was won by Seoyeon Ryu, with Momoko Aritomi and Brian Isaacs receiving second and third place respectively.
In The Best of Technique you’ll discover the top playing tips of the world’s leading string players and teachers. It’s packed full of exercises for students, plus examples from the standard repertoire to show you how to integrate the technique into your playing.
In the second volume of The Strad’s Masterclass series, soloists including James Ehnes, Jennifer Koh, Philippe Graffin, Daniel Hope and Arabella Steinbacher give their thoughts on some of the greatest works in the string repertoire. Each has annotated the sheet music with their own bowings, fingerings and comments.
The Canada Council of the Arts’ Musical Instrument Bank is 40 years old in 2025. This year’s calendar celebrates some its treasures, including four instruments by Antonio Stradivari and priceless works by Montagnana, Gagliano, Pressenda and David Tecchler.
One more followed at 12 and though he bogeyed 14 – his first of the week – he carded a 67 to head into the weekend alongside Harman.
“I’ve been playing in Europe a lot and being able to experience different kind of courses has helped my game a lot,” he said.
“It will be a lot of pressure for sure, but I just have to find a way to deal with that.
“I think if I play my best, again, I can compete with anyone.”
McIlroy eyes weekend charge
Saturday at The Open is one of the great days in sport and, in Northern Ireland, it is only enhanced by the presence of Rory McIlroy.
The 2014 Champion Golfer has a bit of work to do in order to climb into contention but, at three-under-par and seven shots off the lead, he is still in the fight for the Claret Jug.
McIlroy has been wayward from the tee – he ranks 149th in driving accuracy – and has spent more time in the rough than on the fairway.
But it is a testament to his short game that he scored 69 in round two, one stroke better than yesterday, to sit on three-under-par for the Championship.
Regardless of what happens, this is already a much better week for McIlroy than six years ago, when The Open first returned to Northern Ireland.
McIlroy missed the cut after a horror opening day and, while he has lofty weekend ambitions, he admits that in comparison, he is playing with house money.
“I know what I need to do to get the best out of myself in an environment like that now,” he said.
“It’s incredible to play in front of these fans. I was 20 years ago that I played the North of Ireland here, and never in my wildest dreams did I think that I’d be coming back as a grand slam champion with the support of a nation behind me trying to win The Open.
“I count myself very grateful and very lucky that I’m in this position, and I’m excited for the weekend.”
2 months after Sindoor, Pak’s Rahim Yar Khan base still shut
NEW DELHI: Pakistan’s Rahim Yar Khan airbase, which was hit by Indian missiles during Operation Sindoor over two months ago, is still not operational, an indication of the extent of damage the strategic military installation suffered. Pakistan airport authority is learnt to have issued another ‘Notice to Airmen’, aka ‘Notam’, for its runway, declaring it unusable till Aug 5, sources said.The airbase, located around 230 km south of Bahawalpur, holds a strategic place in Pakistan’s southern air defence due to its proximity to India’s Rajasthan border. It had suffered massive damage in the precision strikes carried out by India early in May. In May-end, PM Narendra Modi had said at a rally in Rajasthan’s Bikaner that the airbase was in ‘ICU’.
‘None Of Pakistani Drones Could…’: CDS Chauhan’s Big Revelation On Operation Sindoor Success
Located within the perimeters of an international airport, the airbase had issued the first Notam on the evening of May 10 declaring the runway non-operational for a week (May 18), and later extended it. Notam was again issued in early June, extending the closure of the airbase until July 4. The latest notice said the runway is unavailable for flight operations due to “work in progress”.The airbase serves as a forward operating base for the Pakistan Air Force central command and was used heavily for military purposes. The missiles fired at Rahim Yar Khan airbase caused a massive crater on its runway, a Pakistan district commissioner had told the local press in May. However, the damage, clearly, was much bigger than a crater as the airbase has been non-functional for over two months.Besides this airbase, simultaneous attacks were carried out on Nur Khan airbase at Chaklala in Rawalpindi, the Rafiqui airbase at Shorkot in Punjab, the Murid airbase in Chakwal and the Chunian airbase in Punjab. Pakistan officials had acknowledged damage to transport aircraft at Nur Khan and technical facilities at Chunian.Similarly, the Markaz Subhan Allah terror camp in Bahawalpur, reduced to rubble in airstrikes, has been shut down indefinitely with the Jaish-e-Muhammed brass looking for a new address, preferably in a densely populated area, sources said.
Astronomers caught a star system at the moment when solid grains began to form planets. This snapshot reveals how planets first start to form, just as Earth once did.
The infant star HOPS-315 sits about 1,300 light-years, roughly 7.6 quadrillion miles, away in the constellation Orion. Around it whirls a disc of gas and dust where heat is high enough to bake rock yet cool enough for those rocks to re-form.
Melissa McClure of Leiden University led the international team that pieced together these first moments of planetary assembly. Their finding gives researchers a live laboratory that mirrors the opening chapter of the Solar System’s own story.
How planets form from early solids
In primitive meteorites, tiny calcium-aluminum-rich inclusions tell us that the Solar System’s clock started ticking 4.567 billion years ago. Those inclusions condensed from a searing vapor and seeded every terrestrial planet we know.
Because the clock starts with condensation, catching that step beyond the Sun has been an astronomer’s white whale.
The new observation marks the first time any telescope has seen gas-phase silicon monoxide (SiO) alongside freshly crystallizing silicates in the same patch of a protoplanetary disc.
McClure’s team spotted the minerals within an orbit comparable to our asteroid belt. That match matters, for it pins early chemistry to a region that later fed Earth with water and metals.
Crystals forming around HOPS-315
The James Webb Space Telescope (JWST) collects infrared light that pierces the dust cocoon shrouding HOPS-315, revealing the distinct fingerprint of hot SiO molecules. Those molecules glow at about 2,200°F, a temperature that vaporizes most common rocks.
ALMA, the Atacama Large Millimeter/submillimeter Array, then measured the same region at millimeter wavelengths and mapped where the glow comes from.
By combining the two views, scientists confirmed that both gas and solid forms of silicon occupy a ring no farther than 2 astronomical units from the star.
Handling these observations is tricky because HOPS-315 also drives a jet rich in SiO. The team disentangled the jet’s signal from the disc’s by checking velocities, the jet gas races outward, whereas disc material orbits sedately.
A final check involved comparing the brightness of different SiO lines. The ratio matched laboratory predictions for vapor that is actively condensing, adding yet another layer of confidence to the result.
Planets forming from gas and crystals
Crystalline silicates appear where cooling vapor meets a sharp fall in temperature. The presence of both phases at one location means condensation is happening right now, not long ago nor far away in another part of the disc.
“This process has never been seen before in a protoplanetary disc, or anywhere outside our Solar System,” said Edwin Bergin of the University of Michigan, a co-author on the study.
He adds that the minerals are the same kind locked inside 4.5-billion-year-old meteorites on Earth’s shelves.
This is HOPS-315, a baby star where astronomers have observed evidence for the earliest stages of planet formation. Together with data from the James Webb Space Telescope (JWST), these observations show that hot minerals are beginning to solidify. In orange we see the distribution of carbon monoxide, blowing away from the star in a butterfly-shaped wind. In blue we see a narrow jet of silicon monoxide, also beaming away from the star. These gaseous winds and jets are common around baby stars like HOPS-315. Click image to enlarge. Credit: ALMA(ESO/NAOJ/NRAO)/M. McClure et al.
“We’re really seeing these minerals at the same location in this extrasolar system as where we see them in asteroids in the Solar System,” said co-author, Logan Francis from the Advanced Functional Fabrics of America (AFFOA).
He notes that the condensation zone sits at almost the same orbital radius as our asteroid belt.
The mineral grains measure less than a micrometer across, yet they mark the first step toward kilometer-scale planetesimals. Electrostatic forces will make them clump for thousands of years until gravity takes over.
HOPS-315 mirrors Earth’s origins
Laboratory studies show that minerals rich in silicon and oxygen condense first, followed quickly by iron-nickel alloys and then more volatile compounds.
Seeing hot SiO vapor around HOPS-315 hints that a similar chemical parade is marching there.
By estimating the star’s luminosity and the disc’s temperature gradient, McClure’s group concludes that crystalline silicates could mass about a tenth of the Moon. That is plenty to seed multiple rocky planets if subsequent growth is efficient, as models suggest.
Isotopic work on chondrules indicates that the earliest building blocks in our own Solar System formed within the first million years, a timescale now testable in real time with HOPS-315.
Matching astronomical data to isotope chronometers promises a much sharper picture of planet formation than meteoritic studies alone.
The discovery may also shed light on why Earth contains less carbon than nebular models predict. If early minerals trap oxygen and silicon immediately, carbon may remain gaseous longer and get pushed outward before it can join newborn worlds.
What’s next in watching planets form
Over the next year, ALMA will return to HOPS-315 to look for water ice farther out in the disc.
If water lines up beyond the silicate ring, astronomers can test whether rocky seeds migrate inward before they acquire ice mantles, a step that may explain why Earth ended up with oceans.
JWST will track how the SiO signature evolves. A steady decline would show vapor freezing out, whereas a surge could hint at heating bursts from magnetic flares or spiral shocks.
Witnessing the dawn of a new solar system. Credit: ESO
Beyond the specifics of HOPS-315, the result boosts confidence that rocky planets are common. If condensation begins so early, many stars may launch planet formation well before their gas discs disperse, leaving time for worlds to migrate, collide, and settle into stable orbits.
Astronomer Elizabeth Humphreys at ESO, who was not involved in the study, said she was “really impressed” that the team could pinpoint the first solids.
She argues that the synergy of Webb and ALMA is revealing a Universe “in which the steps toward life-bearing planets start earlier than we dared hope.”
The study is published in Nature.
—–
Like what you read? Subscribe to our newsletter for engaging articles, exclusive content, and the latest updates.
Check us out on EarthSnap, a free app brought to you by Eric Ralls and Earth.com.
Honda has been nearly unstoppable in the 2025 NTT INDYCAR SERIES season, claiming 11 wins in 12 races, including a perfect 3-for-3 record on street circuits.
Dating back to the 2022 Toronto race weekend, Honda has captured 13 of the last 14 street circuit victories. That stretch includes a podium sweep on the 1.786-mile Exhibition Place track last season.
Heading into this weekend, Honda remains the heavy favorite to collect more hardware. But if Chevrolet is going to mount a challenge, keep an eye on Christian Lundgaard and his No. 7 Arrow McLaren Chevrolet, a pairing that was ninth-fastest in Friday’s practice with a lap of 1 minute, 1.1962 seconds.
Lundgaard’s lone career victory in 64 starts came in Toronto in 2023 — 37 races ago — where he won from pole position while driving a Honda for Rahal Letterman Lanigan Racing. It remains his last NTT P1 Award.
“Coming to Toronto always brings back great memories,” Lundgaard said. “I’ve had strong results here in the past, including my first win. I’m excited for the weekend ahead. We know what it takes to be quick here, so now it’s all about putting it together and making it happen.”
This season, Lundgaard has averaged an eighth-place finish on street circuits, including a podium at Long Beach. He has also never finished worse than eighth at Toronto, highlighted by a charge from 16th to seventh in last year’s event.
Here are three observations about the first practice in preparation for Sunday’s Ontario Honda Dealers Indy Toronto, plus other notes of interest:
· The Turn 8 runoff proved to be a trouble spot during the session. At one point, Scott McLaughlin (No. 3 Gallagher Insurance Team Penske Chevrolet), Santino Ferrucci (No. 14 Sexton Properties/AJ Foyt Racing Chevrolet) and Pato O’Ward (No. 5 Arrow McLaren Chevrolet) all ended up in the runoff simultaneously due to separate incidents. The flurry of mistakes wasn’t surprising as Toronto’s street circuit is notoriously bumpy and slick. Friday’s session also featured both Firestone Firehawk primary and alternate tires, giving drivers a chance to push the limits ahead of qualifying.
· Alex Palou (No. 10 DHL Chip Ganassi Racing Honda) opted to use two sets of primary tires during Friday’s practice session, leaving him with just three sets for the remainder of the weekend. With some drivers predicting Sunday’s race could require a three-stop strategy, tire management may prove critical, especially if primary tires emerge as the preferred compound. That would leave Palou with only one fresh set for qualifying and two for Saturday’s practice. Palou has yet to win at Toronto and struggled in qualifying. In three career starts, he’s never advanced past the first round of qualifying, starting 22nd, 15th, and 18th. Despite those setbacks, the three-time series champion has consistently charged through the field, finishing sixth, second, and fourth.
· Seven different teams were represented in the top eight of Friday’s speed chart led by Andretti Global’s Kirkwood. Team Penske was the only organization to place multiple drivers in the top eight, with McLaughlin in second and Will Power (No. 12 Verizon Team Penske Chevrolet) in fifth. Rounding out the top eight were Palou (Chip Ganassi Racing) in third, Marcus Armstrong (Meyer Shank Racing w/Curb-Agajanian) in fourth, Callum Ilott (PREMA Racing) in sixth, Pato O’Ward (Arrow McLaren) in seventh, and David Malukas (AJ Foyt Racing) in eighth.
DeFrancesco Returns Home For Third Toronto Start
Ontario native Devlin DeFrancesco is the lone Canadian in this weekend’s 27-driver field. He was 25th-quickest in Friday’s session.
Making his third Toronto start, his best result came in 2022, qualifying 12th and finishing 18th.
“I love Toronto,” DeFrancesco said. “I got my first Fast 12 here and always look forward to going home. A lot of my family will be at the race.”
Born 15 weeks premature and given last rites multiple times at Toronto’s Sunnybrook Hospital, DeFrancesco defied the odds. Now driving the No. 30 HUB International Honda for Rahal Letterman Lanigan Racing, he’s optimistic after a strong showing on Detroit’s bumpy street circuit — a layout similar to Toronto — and is encouraged RLL’s 2023 win with Lundgaard.
“We found a few things, performance-wise wise on the Detroit street course that has helped us quite a bit so that is an avenue we will follow. This team has been very strong in Toronto the last couple of years, so we should be fast.”
ECR Brings Momentum
Alexander Rossi returned to Toronto after being forced to sit out last year’s event with a hand injury suffered in a crash in practice. This time around, he left Friday unscathed, turning the 17th quickest lap (1:02.2232).
Rossi, in his first year driving the No. 20 ECR Java House Chevrolet, has three career top-10 finishes at the venue, including a runner-up in 2017 driving for Andretti Global. Half of his four top-10s this season have come on street courses.
“The Toronto circuit is one that is always a great mix of exciting and challenging,” Rossi said. “I am looking forward to competing this weekend after missing last year’s race.”
Teammate Christian Rasmussen, fresh off two top-10s at Iowa, is also feeling confident. He’s 15th in points, just ahead of Rossi in 16th and was 12th overall (1:02.0923) on Friday.
“There’s definitely momentum on our side,” he said. “Hopefully, we can build on that and have another strong result.”
Rasmussen earned his first professional win at this track in 2019, competing in USF2000. He claimed his first INDYCAR SERIES podium at World Wide Technology Raceway on June 15 — the second of four top-10 finishes this season, all coming on oval tracks.
Team owner Ed Carpenter knows Rasmussen’s aggressive driving style isn’t always popular with competitors, but he’s not concerned.
“He’s super aggressive,” Carpenter said. “I don’t know if everyone likes it, but from my perspective, I love it. If he’s making people nervous out there, I don’t see a problem with that. He’s been aggressive long enough now and pulls off a lot of really slick moves. He’s done it enough that it’s clearly not a fluke.”
Odds and Ends
· Toronto is the second-shortest street circuit on the NTT INDYCAR SERIES calendar. At 1.786 miles, it’s slightly longer than Detroit’s 1.645-mile, 10-turn layout, the shortest street course in the series. By comparison, St. Petersburg measures 1.8 miles with 14 turns, and Long Beach is 1.968 miles with 11 turns. Despite their compact sizes, these circuits offer plenty of corners to challenge drivers and create separation in the field. Toronto has 11 turns, just one more than Detroit.
Scott Dixon was 13th in Friday’s session. The lack of overall speed in the No. 9 PNC Bank Chip Ganassi Racing Honda is somewhat concerning because he has a six-spot grid penalty in Sunday’s race. Dixon suffered the same penalty at Detroit when he qualified 10th but rolled off 16th in the race. He climbed to finish 11th. Dixon is a four-time Toronto winner and has 12 career top-five finishes at the track. That’s tied with Michael Andretti for most all-time.
· The series returns to the track at 10:30 a.m. Saturday for the second practice session in advance of the three-round knockout NTT P1 Award qualifying session scheduled to begin at 2:35 p.m. Both Saturday sessions will air on FS1, FOX Sports app and INDYCAR Radio Network.
The Writers Guild of America has called on New York state officials to launch an investigation into Paramount following its sudden decision to cancel The Late Show with Stephen Colbert.
In a strongly worded statement issued on Friday, the Writers Guild of America East and the Writers Guild of America West asked New York state attorney general Letitia James to investigate Paramount over “potential wrongdoing” after the company announced the cancellation of the ‘Late Show’ on Thursday.
The unions pointed to Paramount’s decision earlier this month to settle what it condemned as a “baseless lawsuit” brought against 60 Minutes and CBS News by Donald Trump for $16m. Trump had claimed that CBS News misleadingly edited an interview with Kamala Harris last fall during the presidential campaign.
Citing the California state senate’s decision in May to launch an inquiry into Paramount’s $16m settlement with Trump as precedent, the unions said: “Given Paramount’s recent capitulation to President Trump in the CBS News lawsuit, the Writers Guild of America has significant concerns that The Late Show’s cancelation is a bribe, sacrificing free speech to curry favor with the Trump administration as the company looks for merger approval.”
It continued: “Cancelations are part of the business, but a corporation terminating a show in bad faith due to explicit or implicit political pressure is dangerous and unacceptable in a democratic society. Paramount’s decision comes against a backdrop of relentless attacks on a free press by President Trump, through lawsuits against CBS and ABC, threatened litigation of media organizations with critical coverage, and the unconscionable defunding of PBS and NPR.”
The unions called on James to launch an investigation into Paramount, saying that she is “no stranger to prosecuting Trump for illegal business practices”.
“We call on our elected leaders to hold those responsible to account, to demand answers about why this beloved program was canceled and to assure the public that Colbert and his writers were not censored due to their views or the whims of the president,” the WGA added.
A spokesperson for James’s office said the NYAG office is monitoring the situation.
The cancellation comes after Colbert – who has long been a critic of Trump on his show – called Paramount’s settlement a “big fat bribe” on air on Monday.
“As someone who has always been a proud employee of this network, I am offended… I don’t know if anything – anything – will repair my trust in this company. But, just taking a stab at it, I’d say $16m would help,” he said.
Echoing Colbert’s disapproval, Jon Stewart, who works for Comedy Central – which is also owned by Paramount – condemned the deal on air last week, calling it “shameful”.
He added: “I would assume internally, this is devastating to the people who work in a place that pride themselves on contextual, good journalism?”
Following Paramount’s announcement, numerous lawmakers have weighed in on the cancellation, casting skepticism at the company.
Massachusetts senator Elizabeth Warren wrote on X: “CBS canceled Colbert’s show just THREE DAYS after Colbert called out CBS parent company Paramount for its $16M settlement with Trump – a deal that looks like bribery.”
Similarly, Vermont senator Bernie Sanders said: “CBS’s billionaire owners pay Trump $16 million to settle a bogus lawsuit while trying to sell the network to Skydance. Stephen Colbert, an extraordinary talent and the most popular late night host, slams the deal. Days later, he’s fired. Do I think this is a coincidence? NO.”
In a statement on Thursday evening, CBS executives said that the decision to cancel the show was “purely a financial decision against a challenging backdrop in late night”, adding that it was “not related in any way to the show’s performance, content or other matters happening at Paramount”.
Hit a high note with the Pokémon GO’s Summer Concert event, ringing out July 19 to July 22, 2025, from 5:00 p.m. to 8:00 p.m. local time each day. During this time, Trainers can listen to a special selection of in-game background music composed by legendary Pokémon video game series composer and Chief Creative Fellow of The Pokémon Company, Junichi Masuda.
Stay out of treble with these event bonuses:
Lure Modules activated during the event will last for one hour.
Lure Modules will attract the following Pokémon during the event.
Jigglypuff
Lotad
Kricketot
Chatot
Audino
Noibat
Popplio
Increased chance of encountering Shiny Chatot at PokéStops with active Lure Modules.
Throughout Summer Concert, you can spin Photo Discs at PokéStops to obtain event-themed Field Research tasks. Rewards for completing this research include encounters with Spinda. Lucky Trainers might even encounter a Shiny Spinda.
Enjoy tuning in to an epic Summer Concert, Trainers!
The UK’s National Cyber Security Centre (NCSC) has issued a formal notice attributing a series of hostile cyber attacks using a variety of malware dubbed Authentic Antics to Russian-state operated advanced persistent threat (APT) group Fancy Bear.
Authentic Antics is designed to steal login credentials and tokens for its victims email accounts, allowing Russian cyber spies to establish long-term access to their surveillance targets.
Fancy Bear, which goes by APT28 in some threat matrices, is operated as part of the 85th Main Special Service Centre, Military Unit 26165, and ultimately answers to the GRU, a successor intelligence agency to the KGB of Cold War legend.
“The use of Authentic Antics malware demonstrates the persistence and sophistication of the cyber threat posed by Russia’s GRU,” said NCSC operations director Paul Chichester.
“NCSC investigations of GRU activities over many years show that network defenders should not take this threat for granted and that monitoring and protective action is essential for defending systems.
“We will continue to call out Russian malicious cyber activity and strongly encourage network defenders to follow advice available on the NCSC website,” said Chichester.
Working with NCC Group, which provided samples of Authentic Antics, the NCSC’s experts have conducted a lengthy analysis of the malware – this can be read in full here – which blends in with everyday, legitimate activity to enable Fancy Bear to maintain persistent endpoint access to Microsoft cloud accounts.
The malware has been widely used since about 2023, and runs within Microsoft Outlook processes where it displays malicious login prompts to its target in order to get them to enter their credentials, which are then intercepted along with OAuth 2.0 authentication tokens for various applications, likely including Exchange Online, SharePoint and OneDrive.
The NCSC said it had been cleverly designed to exploit growing familiarity among end-users with genuine Microsoft authentication prompts, including generating prompts from within Outlook processes, and ensuring they do not display too frequently.
Authentic Antics does not communicate with any command and control (C2) infrastructure and cannot receive additional tasking. It talks only to legitimate services, meaning that when it is active it is much harder to pick out – for example it exfiltrates its victims’ data by sending emails from the compromised account to an email address controlled by Fancy Bear – these sent emails do not show up in the victim’s sent items folder.
The agency said that “significant thought” had gone into Authentic Antics’ design to ensure it blends in with normal activity. Among other things, its presence on disk is limited, it stores data in Outlook-specific registry locations, and its codebase includes genuine Microsoft authentication library code as an obfuscation method.
“It is clear the intention of the malware is to gain persistent access to victim email accounts. This highlights the benefit of monitoring your tenant for suspicious logins,” said the NCSC’s analysts.
Sanctions
The attribution comes alongside the announcement of wider sanctions against three GRU Units – including Unit 26165 – and 18 officers and agents who allegedly run cyber and information interference operations in support of Russia’s geopolitical and military objectives.
Among those sanctioned are GRU military intelligence officers who targeted and surveilled the device of Yulia Skripal, daughter of double agent Sergei Skripal, prior to the infamously botched Novichok poisoning attempt against them in 2018 that claimed the life of a British national, Dawn Sturgess.
“GRU spies are running a campaign to destabilise Europe, undermine Ukraine’s sovereignty and threaten the safety of British citizens,” said foreign secretary David Lammy.
“The Kremlin should be in no doubt: we see what they are trying to do in the shadows and we won’t tolerate it. That’s why we’re taking decisive action with sanctions against Russian spies.
Speaking in support of the UK’s actions, a Nato spokesperson condemned Russia’s ongoing malicious cyber activities, noting other attributions made to Fancy Bear, which earlier this year was called out for targeting Western logistics and technology organisations involved in supporting the defence of Ukraine.
“We call on Russia to stop its destabilising cyber and hybrid activities. These activities demonstrate Russia’s disregard for the United Nations framework for responsible state behaviour in cyberspace, which Russia claims to uphold,” a spokesperson said.
“Russia’s actions will not deter Allies’ support to Ukraine, including cyber assistance through the Tallinn Mechanism and IT capability coalition. We will continue to use the lessons learned from the war against Ukraine in countering Russian malicious cyber activity.”
