On 7 October, Hamas launched a series of incursions into Israel. The incursions followed a series of sustained rocket attacks from within Gaza commencing about 06:30hrs (local). The rockets hit several cities, including Tel Aviv, Rehovot, Gedera, and Ashkelon. The rocket attacks were followed by what appears to be, a series of coordinated ground, sea and air attacks by an unverified number of militants who crossed the border into southern Israel and commenced attacking towns and settlements.

The escalation between Israel and Hamas, comes after months of violent clashes in Gaza and the West Bank, which has seen hundreds of Palestinian protesters injured. In a statement on 7 October, Hamas leader, Mohammed Deif stated “We have already warned the enemy before. The occupation committed hundreds of massacres against civilians. Hundreds of martyrs and wounded died this year due to the crimes of the occupation.”

In what would appear to be a rare, yet major intelligence failure, Israel appears to have been caught completely unaware of the attack. Israeli Prime Minister, Benjamin Netanyahu, addressed the Israeli people, stating, that the nation had been subjected to a “murderous attack” and that he had ordered the mobilisation of reserves. He went on to say “We are in a war and we will win it”.

In a further development, reports of Israeli positions coming under fire from Lebanon have resulted in retaliation from the IDF.

The initial Hamas attack saw an unprecedented use of coordinated forces utilising missile salvos, seaborne, light vessel insertion, motorcycle and vehicle insertion and airborne insertion by paragliders. Some 20 towns were targeted and it is reported that Hamas militants went door to door targeting Israeli families. More than 300 Israelis were killed and at least 1800 wounded with reports that as many as 200 civilians were also taken hostage, and moved into Gaza to be used as “human shields”. This is a strategic move to try and protect the Gaza Strip from wide spread and large scale Israeli air strikes.

As anticipated, the Israeli response has been swift and vigorous with Israeli Defence Force (IDF) fighter aircraft’s and helicopters undertaking numerous targeted bombing sorties. IDF spokespersons have warned residents in Gaza to seek shelter away from areas that are being targeted by IDF aircrafts. IDF ground forces appear to be mobilising and will, almost certainly, enter Gaza in the coming hours. News footage appears to show columns of Israeli heavy armour moving towards Gaza.

Furthermore, Hezbollah, based in Lebanon have seized the opportunity to launch an attack of their own. They have carried out a shooting at the border and have also claimed to have launched artillery and guided missiles at Israel following IDF air strikes in the Gaza Strip. Hezbollah have stated these were done as Hezbollah leadership congratulated Hamas on their successes on 7 October. The IDF responded by firing artillery fire at the Lebanese border and have announced that they will operate in all regions to defend the Israeli citizens.

Hamas’s attack was coordinated at a time when Israel is vulnerable. As well as Israeli forces being engaged in regular clashes with Palestinian militants across various parts of the West Bank, the attack also came at a time of unpopular political upheaval in Israel. There have been weekly anti-government demonstrations in Tel Aviv practically throughout the entirety of 2023 calling for the both Prime Minister Netanyahu’s resignation and a cancellation of the judicial reforms. This political volatility has led many IDF reservists, to refuse to undertake their military obligations.

Such a coordinated and well-planned attack will have taken Hamas months to prepare for, and it is a major intelligence failure, that Israel did not pick up on any signs that Hamas was preparing for something. The announcement from Hamas that Iran helped support them in this attack is not at all surprising. The timing of the attack is significant, not only has it occurred at around the 50th anniversary of the Yom Kippur War, in which Israel also suffered a surprise attack from Egypt and Syria, but it also comes at a profoundly delicate moment in regional politics. This is as, if comments are to be believed, the US backing Israeli and Saudia Arabia, are moving towards normalising ties. This attack and the likely Israeli response, however, will almost certainly further complicate this process, and it is likely the attack was designed to highlight that a normalisation of ties with Israel, without negotiation of a settlement for Palestinians, would not improve Israeli or regional security.

Israel’s failure to see this attack coming will likely prompt an aggressive response from them. Already air strikes in the Gaza Strip have killed at least 234 Palestinians. It is highly likely that the IDF will enter the Gaza Strip, as they seek to not only rescue Israeli citizens but retaliate against Hamas. The vows from the Israeli government to exact a “mighty vengeance” and to “turn them [Hamas] to rubble“ only further increases the likelihood of a full-scale ground invasion of Gaza

Meanwhile, the activity from Hezbollah indicates that the events of yesterday are realistically likely to see Lebanon brought into the conflict making it a broader, wider regional conflict. It is highly possible that Hamas-aligned groups in the West Bank become involved, which would effectively mean that Israel has to fight on a possible three fronts. Israel’s response will not only be shaped by the fact it is reacting to a major intelligence failure, but also by the fact that the current Israeli government is the most right-wing nationalist in its history. As such, there have already been calls to reoccupy and destroy the Gaza Strip. Ultimately, however, for many Israelis, the most damaging element of this attack is that it will have deflated the idea in their minds that due to the billions spent on border security, they were safe and secure.

Whether you are considering an evacuation or seeking to continue operations while ensuring the safety of your team, we are here to assist.

For those seeking a secure exit from Israel, Solace Global offers comprehensive journey management services:

The news comes after the recent Defcon hacking conference where Marcello Salvati, a researcher affiliated with Rapid 7, gave an eye-opening talk that demonstrated a method for leveraging the “biggest transactional email service” and Cloudflare, effectively circumventing the safeguards of SPF (Sender Policy Framework) and DMARC (Domain-based Message Authentication, Reporting, and Conformance).

While the initial insights shared during the talk have seen some partial mitigation measures implemented, particularly with the use of Cloudflare workers and MailChannels, a disconcerting concern still persists.

Inclusion of the MailChannels SPF record may expose domains and users to impersonation risks. A recent solution has been introduced to address this concern. Given that a significant portion of the 2 million domains lacks these protective measures, it opens the door to widespread misuse of the MailChannels service.

The author highlights the absence of sender identity verification, allowing anyone to register on their website for a mere $80 and employ their “normal” SMTP relay to maliciously spoof customer domains.

Furthermore, another discovery reveals the adoption of a novel email service known as ARC, which inherently reduces spam scores.

Solace Cyber’s threat researchers, utilising SMTP, have validated these findings as genuine threats, emphasising the importance of organisations implementing countermeasures promptly.

In a recent incident, security experts at Truesec noticed Microsoft Teams messages originating from third-party accounts, delivering ZIP files that purported to be from the victims HR department.

Initially, the attack commenced with a social engineering tactic aimed at enticing the recipient to click on the .zip file, which contained an LNK (shortcut) file masquerading as a PDF document.

Upon execution, this file triggered a VBScript that initiated the download of a payload utilizing curl.exe and harnessed AutoIT in conjunction with a compiled AutoIT script. The outcome of this process was the detection of the file as DarkGate Malware by VirusTotal.

The malware supports a magnitude of malicious activities including remote access tooling, cryptocurrency mining, keylogging and a built-in stealer.

This particular phishing campaign is still in its early days.

Given the limited range of mitigation methods currently available and the probability that users have not been adequately trained to recognise this specific threat vector, they may be more susceptible to this tactic compared to traditional email-based attacks.

In an era marked by rapid technological advancements, the automotive industry is undergoing a transformative shift. With the advent of connected vehicles, autonomous driving, and integrated smart systems, vehicles have evolved from mere mechanical machines to sophisticated computers on wheels. While this evolution brings remarkable benefits, it also introduces a new frontier of challenges, primarily in the realm of cyber security. This blog explores the growing influence of cyber security threats on the automotive industry and the measures being taken to address these challenges.

Connected vehicles have become a symbol of convenience and innovation. However, the integration of internet connectivity into cars also presents a potential gateway for cyber attackers. Hackers can exploit vulnerabilities in infotainment systems, telematics, and communication protocols to gain unauthorised access to a vehicle’s network. This access could lead to unauthorised control over critical functions, jeopardising passenger safety.

The pursuit of autonomous driving has further intensified the need for robust cyber security. Autonomous vehicles rely on an array of sensors, cameras, and data-sharing mechanisms to navigate roads safely. Any compromise in the integrity of these systems could result in accidents or even intentional harm. Protecting these vehicles from hacking attempts is crucial to ensure public trust and safety in this transformative technology.

Connected vehicles generate an immense amount of data related to driving patterns, user preferences, and geolocation. This data is not only valuable for manufacturers but also for malicious actors seeking to exploit personal information for financial gain or other nefarious purposes. Ensuring the privacy of user data has become a significant concern, necessitating stringent data protection measures.

The automotive industry relies on a complex global supply chain, which can inadvertently introduce vulnerabilities. If even a single component or software module is compromised at any point in the supply chain, it could potentially expose the entire vehicle fleet to cyber threats. Collaborative efforts between manufacturers and suppliers are essential to establish a chain of trust and enhance cyber security resilience.

Recognising the severity of cyber security threats, the automotive industry has begun taking proactive measures. Collaboration between automakers, technology companies, and cyber security experts has led to the development of best practices, guidelines, and standards specifically tailored to the industry’s unique challenges. Organisations like the Automotive Information Sharing and Analysis Center (Auto-ISAC) have been established to facilitate information sharing and coordination among industry stakeholders.

To mitigate cyber security risks, manufacturers are increasingly adopting a “security by design” approach. This strategy involves integrating cyber security measures at every stage of a vehicle’s development lifecycle. From concept and design to manufacturing and maintenance, security considerations are embedded to create a holistic and robust cyber security framework.

As the automotive industry accelerates toward a future defined by connectivity and automation, the spectre of cyber security threats looms large. The intersection of technology and transportation has brought unprecedented conveniences and efficiencies, but it has also exposed vehicles to new forms of risk.

Organisational compute and infrastructure, such as classic on-premises server rooms, datacentres and cloud-based services are all subject to regular attack and the colocation of many services, often with network cross over between, has simply increased the scope and availability of a reachable threat surface.

By employing our Anticipate, Protect, and Respond strategy in the realm of cyber security, Solace Cyber has formulated a variety of service packages that can assist the industry in navigating this crossroad. These packages are built upon our core Real-time Risk Platform initially, scaling out to extend all the way up to our comprehensive safeguarding service suite of Solace Cyber Secure 360.

By acknowledging these challenges and collectively working towards innovative solutions we can build a safer and more secure automotive landscape for everyone.

Find out more about how Solace Cyber can support you on your cyber secure journey.

In the early hours of 30 August, the Gabonese Election Centre (CGE) announced that President Ali Bongo had won a third term in office, having received 64.27 percent vote share in Saturday’s general election. However, just after 05:00 local time, a group of senior officers from the Gabonese military announced on television channel, Gabon 24, that they had seized power with the full support of the Gabonese security and defence forces.​

​

Introducing themselves as members of The Committee of Transition and the Restoration of Institutions, the officials stated that the election results were cancelled, all borders were closed until further notice and state institutions – the government, the senate, the national assembly, the constitutional court and the election body – were dissolved. ​

​

Following the announcement, domestic and regional sources reported gunfire could be heard in the capital Libreville. However, as the day progressed, the streets appeared calm, and crowds of  citizens peacefully took to the streets. Videos circulating on social media showed multiple instances of people celebrating and cheering, often in close proximity to the country’s armed forces. So far, there has been no signs of widespread protest or alarm. Several hours after the officers’ announcement, internet access also appeared to be restored for the first time since Saturday’s vote. ​

​

The Gabonese government has yet to make an official statement, with President Bongo reportedly under house arrest, surrounded by his family and doctors.​

Ahead of the coup, there was significant concern over potential unrest following Saturday’s presidential, parliamentary and legislative elections that the opposition alleged were plagued by fraud. Questions over the election’s transparency were re-enforced by the lack of international observers, the suspension of foreign media broadcasts, the decision to cut internet service, and the imposing of a nationwide curfew.​

​

President Ali Bongo and his father, Omar Bongo, have ruled Gabon since 1967, but frustrations with the political dynasty had been growing for several years ahead of Saturday’s election. The Central African nation is a major oil producer, so much so that it is a member of OPEC, as well as being a major exporter of uranium and magnesium. Indeed, the country is home to over one-quarter of the world’s proven magnesium reserves. However, Bongo has done little to channel its oil and other wealth towards the population of some 2.3 million people, a third of whom live in poverty. ​

​

This is also not the first attempt in recent history to overthrow Bongo as in January 2019 he and the Gabonese government were able to foil an attempted military coup after soldiers briefly seized the state radio station and broadcasted a message saying Bongo, who had suffered a stroke months earlier, was no longer fit for office.

The strength of Gabon’s extractive-based economy means that it is Africa’s third most wealthy country by GDP per capita. However, with large swathes of the country still living in poverty, it is highly likely that the state has failed to transfer much of this wealth to ordinary citizens. It is likely that economic disparities have been one of the major triggers for the coup. This is likely supported by the lack of public resistance and the fact that celebrations have been seen on the streets of Libreville and other major population centres across the country.​

​

Furthermore, the coup has yet to be characterised by anti-French rhetoric in a similar vein to the recent West and Central African coups in countries like Niger and Mali. However, the coup is almost certainly another problem for Paris in Africa, with multiple French companies operating in the country. Unlike the other coups in Africa, it is doubtful that the Gabonese coup leaders will seek Russian support in favour of maintaining Western relations. Gabon has traditionally had weak ties with Russia and unlike much of Africa, has not been threatened with major insurgencies and security issues. Moreover, Gabon was one of the countries in Africa that voted against Russia at the United Nations in the 2022 resolution on Ukraine.​

​

Economically, the coup is almost certainly going to lead to price volatility in global oil and magnesium markets. Gabon has strong economic links with both France, and increasingly with China, and it is a major exporter of commodities to these nations. Reports indicate that some foreign companies like the French mining company, Eramet, have already suspended operations in Gabon in response to the coup. It is therefore highly likely that both France and China will be looking for the political situation to be resolved quickly, and there is a realistic possibility of diplomatic involvement from both Paris and Beijing. ​

​

In the immediate future, it is unlikely that any major protests or armed clashes will break out as the Gabonese security forces are seemingly onside, and most indications suggest the public is too. The turning on of the internet was likely a move to win over the public as well as signal a different approach to governance than the Bongo regime. However, this also presents an increased potential for demonstrations and protests, both in favour and against the coup, to occur as information is spread on social media. There is a realistic possibility of sustained demonstrations which will likely lead to disruption in major population hubs. Borders will likely remain closed for upcoming days, but if scenes remain calm, borders are likely to reopen quicker than seen in Niger and Mali.

On the morning of 26 July, multiple domestic and regional sources reported that a potential coup was underway in Niamey, Niger. Early indications suggested that the Presidential Guard had blocked the entrance to the Presidential Palace, and detained President Mohamed Bazoum. Concurrently, government ministries next to the palace were blockaded, with those inside, including the Minister of the Interior, detained.

By early afternoon, the Niger Armed Forces (FAN) and National Guard had both deployed in the vicinity of the Presidential Palace. The FAN and the Presidential office both released statements asserting that the ongoing coup attempt was being driven by “anti-republican” elements and gave the Presidential Guard an “ultimatum” to stand down and release President Bazoum, or face being attacked. Unverified social media reports have subsequently described armoured FAN columns entering Niamey. Further unverified reports later emerged of roadblocks appearing across the city.

The conditions in Niamey remained calm initially, however, as the situation developed businesses were reputedly told to close and residents were ordered to stay at home. Operations at Diori Hamani International Airport currently remain unaffected, with flight tracking data showing that both inbound and outbound flights were operating as normal.

Since 2020, several coups have taken place across the Sahel region, most notably in neighbouring Mali and Burkina Faso. The key driver for instability has been the inability of central governments to guarantee internal security from a myriad of insurgencies and terrorist actors. Niger has been increasingly afflicted by the instability affecting the wider region. In the southeast, Niger is battling incursions from Boko Haram and in the west of the country, the government is attempting to contain threats from Islamic State’s Sahel Province.
Due to the external and internal threats posed by these actors, Niger has become a major operating base for Western nations in the region. Indeed, both France and the USA utilise the country as a base for operations in the wider Sahel.
This relationship has grown in significance for Western governments as relations with other states in the region, such as Mali and Burkina Faso, have broken down in the wake of their own respective coups, leading to the expulsion of French forces.

Further strengthening this relationship is the fact that Niger’s President was democratically elected in 2021 and is one of the region’s few remaining democratically elected heads of state. However, in February 2023 protests erupted in the capital, Niamey, with demonstrators expressing their dissatisfaction with a sustained French military presence in the country, with many believing that the foreign presence was either ineffective or had exacerbated security concerns.

At the time of writing, there has been no official statement from Presidential Guard. However, given the recent regional trends, it is highly likely that this attempted coup has transpired due to concerns regarding the deteriorating security of Niger.

This is further evidenced by the fact that the Presidential Guard has also apprehended the Minister of the Interior, who is the person ultimately responsible for policing and internal security in Niger. The recent uptick in attacks near the borders with Burkina Faso and Mali likely provided the catalyst for the current situation.

As the situation develops, it is almost certain that key transport routes and critical locations across Niamey will be seized by rival forces. This will include Niamey’s key river crossings, which connect the main part of the city on the eastern bank of the Niger River to its western parts, the international airport, and state TV and radio offices. At the time of writing, it is believed that President Mohamed Bazoum remains in detention.

The success of the ongoing attempted coup remains to be seen. Initial signs suggest that the FAN and National Guard have remained loyal to President Bazoum and are willing to fight. If this remains the case, it is unlikely that the coup succeeds due to the disparity in military firepower between the two sides. This result would ultimately see the Presidential Guard purged.

However, should the coup succeed, civil unrest, both in favour and against, will highly likely occur. A transitional military council will likely take over the government and immediately revise the stationing of foreign militaries in Niger. The removal of the last remaining Western forces in the region will likely create a security vacuum, that will almost certainly benefit the insurgencies and terrorist groups in Niger and the wider region.

A critical pre-authentication vulnerability in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway) is currently being exploited by threat actors who have been able to execute code with zero credentials.

A critical pre-authentication vulnerability in the NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway) was discovered in the first week of July. This vulnerability is currently being exploited by threat actors and has been tracked as CVE-2023-3519, which carries a 9.8 CVSS.

This has led Citrix to issue updates for affected products – it’s recommended that all those affected install the updates immediately.

The vulnerability allows an attacker with zero credentials to execute code. There is no need for an attacker to worry about MFA in this scenario as its pre-authentication.  

The following supported versions of NetScaler ADC and NetScaler Gateway are affected by the vulnerabilities: 

Note: NetScaler ADC and NetScaler Gateway version 12.1 is now End Of Life (EOL) and is vulnerable. 

The vulnerability, which is tracked as CVE-2023-27997 is a pre-authentication remote code execution vulnerability, which if left unpatched, could lead to critical organisational risk.

The SSL-VPN vulnerability would allow an attacker with zero credentials to execute arbitrary code during the pre-authentication stage. This means, the attacker could circumnavigate MFA.

The MOVEit transfer application used to transfer files has a zero-day vulnerability in the form of an SQL injection vulnerability. This in turn allows the adversary to drop a web shell on the host inside the MOVEit wwwroot directory. After which time, the attacker could then download any file within MOVEit and install a backdoor.

A known breach involving Zellis, a supplier of IT services for payroll and human resources says a “small number” of organisations have been affected.

The ransomware group “Cl0p” has posted on their ransomware site that they are exploiting the MOVEit vulnerability. Microsoft have also attributed the attack to Cl0p. The recent attacks do not show signs of encryption, although there is potential for this to occur as well as lateral spread.

The group states on their Darknet page that they’ll post the names of the organisations compromised on June 14th 2023 if the targeted organisation hasn’t already contacted them. In the past 24 hours the BBC, Boots and British Airways have confirmed they’ve been impacted.

The UK’s National Cyber Security Centre said it was “monitoring the situation” and urged organisations using the compromised software to carry out security updates. As of today, results from internet reconnaissance show that there are 127 instances in the UK of the MoveIT Transfer application and 1853 in the US.

Due to the growing number of compromised organisations and the current supply chain spread the impact is still yet to be fully materialised.

Organisations without the vendor’s latest patch against CVE-2023-34362 should assume breach and conduct investigative and remediation efforts where the service is publicly accessible.

The vulnerability has been exploited by the threat group APT28, also known as Fancy Bear, Sofacy, and STRONTIUM since April 2022.

It was initially reported to Microsoft by the Ukrainian CERT. According to Microsoft, “a Russia-based threat actor” exploited the vulnerability in targeted attacks against several European organizations in government, transportation, energy, and military sectors.

Currently 15 organisations are believed to have been targeted or breached using CVE-2023-23397.

Solace Cyber Head of Incident Response believes with high certainty that this particular vulnerability will be used by other threat actors – equating to a vast quantity of attacks in the coming days to weeks.

As of 16/03/2023 proof of concept code has been developed by security researchers and it is likely to be used in subsequent attacks by other threat actors.

The attack involves the attacker sending an Outlook note or task to the victim, triggering the notification sound file mechanism, which sends an NTLM negotiation request to the attacker-controlled SMB share. The threat actors accomplish this using extended MAPI properties that contain UNC paths. The vulnerability can be exploited with a simple, specially crafted email, even if the victim doesn’t open the item.

However, it’s worth noting that this vulnerability cannot be exploited with Outlook for iOS, Mac, or Outlook for Android. Nevertheless, it affects all Windows versions of Outlook that are currently supported.  

Note: Those at a higher risk include remote workers due to home firewalls that do not block SMB traffic.

This can be done by emailing all end users to advise a manual update of Microsoft Office (click-to-run) or updating via alternative methods. If you require assistance with auto-patching solace cyber can assist.

Preferably this is run in audit mode only so that forensic data can be reviewed. If the script produces results it is recommended that you review the UNC paths in the outlook items to ensure no exploitation has occurred. 

At around 06:45 local time on 11 January 2023, several people were injured after a lone individual attacked commuters at the Gare du Nord train station in Paris, France. Those present during the incident suggested that the attacker was targeting passengers indiscriminately.

Police officers responding to the incident reportedly fired several shots at the attacker, who was arrested at the scene and remains in a critical condition. Unverified reports suggest that the attacker was first interdicted by an off-duty police officer, although this has not been officially confirmed.

The French Interior Minister Gérald Moussa Darmanin has confirmed that six people have been injured in the attack, including one police officer. A security cordon remains in place around the station, with emergency services still on site.

Police and security officials have not commented on a suspected motive for the attack, and a criminal investigation has been launched.

In the immediate aftermath of the incident, rail network TER Hauts-de-France noted that rail traffic had been disrupted both to and from Paris Nord, with some services still delayed. Limited disruption has been reported for the local road network.

Although officials have not commented on the exact motive for the attack, the methodology (bladed weapon) and targeting preferences (busy transport hub during morning commute) indicate that this incident is highly likely to be terror-related.

There have been a considerable number of high-profile terror incidents in France in recent years, with most attacks in the 21st century conducted either by violent Islamist extremists, or by individuals with extreme right-wing or racist ideologies.

The apparently indiscriminate nature of this attack likely suggests that this incident was an act of Islamist terror, since racially- motivated attacks are highly targeted.

The attack at the Gare du Nord comes less than three weeks (23 December) after a racially-motivated shooting attack killed three at a Kurdish cultural centre and nearby café on the Rue d’Enghien, in the 10th arrondissement, less than 2km from the Gare du Nord station. That incident prompted extensive unrest amongst the local Kurdish population and was condemned by the Kurdish Democratic Council of France (CDK-F).

Previous Islamist terror attacks in France have been motivated by perceived or genuine attacks against ethnic minority, immigrant or Islamic communities.

As of 4th October 2022, Microsoft have confirmed that two Zero-day vulnerabilities affect Microsoft Exchange Server 2013, Exchange Server 2016, and Exchange Server 2019. Microsoft have stated that Exchange Online customers do not need to take any action, however if you have a Hybrid Exchange infrastructure this advice still applies.

Further updates and details on the potential vulnerability can be found here

In addition to Microsoft guidance, Solace Cyber recommend that the mitigation be further tightened by altering the URL block string:

.*autodiscover\.json.*Powershell.*

Solace Cyber are offering an initial consultation to determine if a compromise has already occurred and can action any implementation required to secure your operations.

This update is correct as of 12.23 GMT on 4th October 2022. The situation continues to develop rapidly, so please contact the team for an initial conversation with the latest advice.

At around 0400 local time, gunfire and explosions were reported from military bases inside Ouagadougou. Eyewitnesses and social media also reported gunfire from the vicinity of the Presidential Palace and Camp Baba Sy, where the current transitional government headquarters are located. Multiple roads inside the capital are reportedly blocked and military personnel have deployed on the streets. Local media claim that the immediate vicinity of the national television offices (RTB) is inaccessible due to military roadblocks. Images posted to social media appear to indicate state TV outages in Burkina Faso, although this has not been confirmed.

Heavily armed personnel are now reportedly present along the “strategic axes” of Ouagadougou, although no further details regarding their exact location are currently available. The current whereabouts of Burkina Faso’s President Paul Henri Damiba, who came to power after a military coup in January 2022, are also unconfirmed, although he reportedly remains inside the capital.

Sporadic gunfire continues several hours after the initial reports of violence. The situation remains highly volatile, with violence ongoing throughout the capital, and the current tactical situation remains unclear due to difficulties obtaining accurate information from the ground. Burkina Faso has rapidly become the epicentre of the violence that began in neighbouring Mali in 2012 but which has since spread across the Sahel region south of the Sahara Desert. The Burkina Faso military has been conducting a series of operations against Islamist militants across the country’s East and Sahel regions in recent months, with military forces claiming to have killed over 100 militants in the past month alone.

Although not yet confirmed, this incident bears all the hallmarks of an attempted military coup. Burkina Faso last experienced a military coup in January 2022 and has been under transitional military rule since then. During the January coup, gunfire was reported from military bases across the capital and soldiers were reported to have seized the Sangoulé Lamizana barracks and surrounded the RTB offices. Soldiers subsequently appeared on national TV to announce the overthrow of former President Roch Kabore. Around eight days later, the military junta restored the constitution and appointed Paul-Henri Sandaogo Damiba as interim president.

Control of state television apparatus appears to be a reliable coup indicator. In 2021, soldiers appeared on national television in Guinea to announce a military coup which deposed longstanding President Alpha Conde. In this way, further reports of soldiers entering the RTB offices in Ouagadougou should be considered likely indicators of a confirmed coup attempt.

Although unclear, ‘strategic axes’ of the capital very likely refer to the Boulevard des Tensoba, the area around the US Embassy and Presidential Palace near Boulevard Muammar Kaddafi, Avenue Kadiogo and Avenue de la Nation.

The situation in the capital comes just 24 hours after protests against President Damiba, blaming him for the deteriorating security situation in the country, and just days after at least ten soldiers were killed and 30 injured in an attack on a military convoy near Gaskindé. These incidents follow a sustained pattern of violence in the north of the country which appears to be spreading to the capital, as security forces battle to contain an expanding Islamist militancy. On 7 August, the government were forced to deny reports that they intended to sign a truce with militant groups until their planned transition to democracy was complete.

It therefore remains likely that elements within the Burkina Faso military have attempted to launch a coup against the current junta. The situation will almost certainly remain delicate and highly volatile in the immediate term.

• Widespread unrest and violence remain possible in the short term. Travellers should avoid all ongoing military activity and any large public gatherings as the security situation may deteriorate quickly and without warning.
• In the event of a significant security development, travellers in Burkina Faso should follow any instructions issued by the government or military authorities.
• If violence escalates inside the capital, consider departing from Ouagadougou whilst commercial options are available.
• Key military and political infrastructure inside the capital are very likely to remain focal points for violence. You should be particularly vigilant in these areas and follow any specific advice from the local
security authorities.
• Expect significant travel disruption and an enhanced security force posture inside Ouagadougou in the short term.
• Always follow all instructions and orders from security forces. ​Where possible, avoid areas of active conflict and remain inside a secure location away from windows.

• Ensure that you always carry personal identification documents. Consider making photocopies of important documents in case of confiscation, theft or loss.​
• Emergency services may be unable to support you in the short term. Be aware of what consular support may be available to you in-country.
• Exercise increased caution, remain vigilant, be aware of your surroundings and report any suspicious activity to security personnel as soon as possible.
• If caught in the vicinity of a security incident, seek shelter immediately and leave the area if safe to do so. Continue to adhere to all instructions issued by authorities and obey any security cordons in place.
• Monitor the Solace Secure platform and trusted local media for updates.