Aggregator
Chinese Refiners Pay Record Premiums For Russian ESPO Crude
Authored by Irina Slav via OilPrice.com,
Chinese refiners are paying a hefty premium for Russia's ESPO crude to replace Iranian crude that independent refiners were importing before the U.S. installed its naval blockade on the country.
East Siberia-Pacific Ocean crude, or ESPO, for delivery in November is trading at a premium of over $7 per barrel, with offers reaching as high as $10 per barrel over Brent crude, Bloomberg reported today, citing traders. The blend is loaded from Russia's Far East coast and can reach the buyers in China in less than a week, the publication noted.
China is the biggest buyer of ESPO crude, with a market share of 83% for the first seven months of the year. However, this share is down from 88% a year earlier. The change came amid stronger ESPO buying from Indian refiners, whose market share for the Far Eastern Russian crude blend went up from 12% to 16% for the first seven months of the year, according to data from Kpler and Vortexa. Total oil exports from Russia's Far Eastern port of Kozmino ticked up by 6% over the first seven months of the year.
India raised its ESPO imports due to the slump in overall Chinese oil imports between May and June, and the supply disruptions in the Middle East, which delayed many term cargoes Indian refiners were expecting in the early summer.
Normally, Indian refiners prefer the Urals blend but have now warmed up to ESPO even though it takes longer to reach its destinations in India and is costlier than Urals. However, the Far Eastern blend is a good backup option for Indian buyers in times of disruption, according to energy analysts.
Meanwhile, India's crude oil imports from Russia are estimated to have eased in August from July's record high, as Ukrainian attacks on Russian export infrastructure and competition from China for Russia's barrels have dented Indian intake of Moscow's oil.
Tyler Durden Thu, 09/03/2026 - 21:45Nick Kyrgios eligible to return to tennis after accepting one-month ban for positive cocaine test
Alexandra Eala gets revenge on rival as Filipina phenom rolls into third round of US Open
Motorcyclist ‘intentionally’ plowed into Teamsters protest crowd outside Amazon warehouse
Bibi Makes Crystal Clear That Toppling Iran Is Israel's 'Central Mission, Within Reach'
The Trump White House is reportedly looking to try and keep things 'quiet' related to the Iran war and Strait of Hormuz leading into the November midterms, after an intense flare-up in fighting this week.
"Top aides to President Donald Trump are pushing to keep the Iran war from escalating before November's midterm elections to staunch Republican electoral losses, four people familiar with the discussions said, a strategy already under strain as the U.S. and Iran exchanged back-and-forth attacks overnight," Reuters reports.
However, over in Israel the war rhetoric is still cranked to a ten. Prime Minister Benjamin Netanyahu has made it crystal clear in fresh Thursday remarks that total 'regime collapse' remains his 'central' goal.
He declared that the "central mission" is to topple the Iranian regime, asserting that the goal is "within reach," during a Rosh Hashanah event attended by the IDF General Staff Forum in Tel Aviv.
"The regime is now faltering. It is weaker than ever. It is fighting for its survival," he claimed. He also described this was partly due to Israel's successful Gaza campaign going back to Oct.7, 2023, and the anti-Hezbollah mission.
"I am confident in our ability to remove this threat once and for all – in other words, to topple this regime," Netanyahu said.
"That is the central mission that still lies ahead of us, but it is close. It is not impossible. It is within reach," he emphasized.
"It is no coincidence that they are not attacking us. They are attacking everyone except us. They know our strength, the force of our blows and our determination," he continued.
Israel's defense ministry has lately made clear it will unleash militarily on Iran if the Islamic Republic dares to attack Israel, even if it's some kind of 'limited' assault on Israeli assets and interests.
Netanyahu also warned, "Don’t mess with us. If you have learned anything, don’t mess with us. We have the strength, the determination and the internal unity to defeat you."
But Israel clearly wants the United States to continue to do the heavy lifting. Typically its leadership gets louder in making the case for anti-Tehran escalation anytime Washington seems to back off the military pressure.
And so it's no coincidence that this week...
The Jerusalem Post runs an op-ed suggesting using indebted Americans to invade Iran...words fail me. pic.twitter.com/h7qISeAdOg
— Marcus Stanley (@MarcusMStanley) September 3, 2026Israeli officials have all the while continued to tout that Mossad assets have been in place inside the Islamic Republic, hinting that some kind of 'uprising' could take place.
And yet after six months of war, there really hasn't been much in the way of a groundswell of protest action in the streets. It remains a martial law situation, and the fact that the Iranian population itself is under the US bombs has naturally translated into citizens not wanting to be seen rooting for the enemy. The whole war-time situation also essentially grants authorities more 'power' to crack down, as it typically goes.
Tyler Durden Thu, 09/03/2026 - 21:20Salacious details of ex-Labor Secretary Lori Chavez-DeRemer’s strip club visit, relationship with bodyguard revealed in IG report
Lakers’ next target could be snatched away by defending champs
The Giants lineage and Ice Bowl pedigree Ben Mann brings as he tries to write his own Big Blue story
Naomi Osaka survives rough second set to reach third round of US Open
UNC probe turns to Steve Belichick over potential drug use in investigation twist
Historically black LA neighborhood explodes with racism claims and forces Latino run club to move event
China-Linked Hackers Hid In Cisco Routers, Stole Administrator Credentials: Report
Authored by Arthur Zhang via The Epoch Times,
A China-linked cyberespionage group compromised Cisco routers and hid its activity from the network administrators who managed them, cybersecurity firm Sygnia said in an Aug. 27 report.
The Cisco logo is displayed in front of Cisco headquarters in San Jose, Calif., on Feb. 9, 2024. Justin Sullivan/Getty ImagesThe group also recorded traffic moving through the devices and used them to probe other high-value networks, according to the report.
The hackers compromised systems that verify whether network administrators are authorized to log in to routers and other equipment, allowing them to capture administrator credentials, Sygnia said.
Sygnia tracks the group as Fire Ant and describes it as China-nexus. The firm has not publicly tied the hackers to a specific Chinese government agency, nor have they disclosed the affected organizations or countries, and no U.S. victim has been publicly identified.
Cisco on Sept. 2 separately issued a critical security-hardening update for IOS XR, the router operating system involved in Sygnia's investigation. Cisco said the update addresses seven groups of vulnerabilities discovered through internal testing and not known to be actively exploited.
Cisco's advisory does not mention Fire Ant or Sygnia's investigation, and Sygnia did not identify a Cisco vulnerability used in the attacks.
Hackers Hid Activity on RoutersSygnia began investigating after researchers found a hidden network tunnel operating through a Cisco router but absent from the device's normal configuration records. Investigators later found malware designed specifically for IOS XR.
Routers direct data between networks. Controlling one can allow an intruder to watch traffic passing through it or use the device as a path toward other systems.
Sygnia said Fire Ant hid activity by suppressing some router logs and changing the information administrators received when they checked the equipment, leaving them with an incomplete picture of what was running on the device.
Fire Ant also recorded network traffic from several Cisco routers and sent the files to outside servers, Sygnia said. Some of that collection was carried out through a legitimate administrator account.
Investigators traced one hidden connection to another compromised computer. From there, Sygnia said, Fire Ant tested connections to other high-value systems, including systems associated with critical infrastructure.
Sygnia documented scanning and connection attempts, but did not report that those downstream systems were successfully breached.
The firm described the approach as going after a "target behind the target"-first taking control of trusted network equipment and then looking for paths into other organizations.
Administrator Logins TargetedFire Ant also compromised systems that verify whether network administrators are authorized to log in to routers and other equipment. Those login verification systems use a protocol known as TACACS.
Sygnia found malware embedded in that login verification process that could capture administrator credentials as administrators signed in.
The firm named the tool TacTap and said it was unaware of that particular technique having been publicly documented before.
Sygnia said Fire Ant's methods strongly overlap with those of UNC3886, another China-linked cyberespionage group previously investigated by Google-owned Mandiant. The firm stopped short of identifying the two as the same actor.
Similar techniques have been documented in other Chinese state-sponsored hacking campaigns, according to the United States and allied governments. Those campaigns were separate from Fire Ant.
A 2025 joint advisory from U.S. and allied cyber agencies described Chinese state-sponsored hackers targeting major telecommunications routers and other devices at the edges of networks.
The advisory described hidden tunnels, traffic collection, efforts to obtain administrator credentials, and use of compromised routers to reach additional networks. The agencies said much of the traffic collection they observed involved Cisco IOS devices.
The advisory did not identify Fire Ant.
Cisco's Long Record in ChinaSeparate from the Fire Ant investigation, Cisco has a decades-long record in China involving networking equipment, technical cooperation, and a large training program.
The U.S.-China Economic and Security Review Commission wrote in 2008 that Cisco routers and switches had become "cornerstones" of Golden Shield, a Ministry of Public Security project used for police networking, internet monitoring, censorship, and surveillance.
An internal Cisco presentation from 2002 described Golden Shield as a business opportunity and listed planning, construction, technical training, and operations maintenance among areas in which Cisco could participate.
The presentation cited Chinese authorities' goal of using the system against Falun Gong and other groups they viewed as threats to Communist Party rule.
Cisco also developed a broad networking training program in China.
The company opened its first Networking Academy in mainland China at Fudan University in September 1998 and later expanded the program to universities across the country.
Cisco sued Huawei in 2003, alleging that the Chinese telecommunications company copied portions of Cisco's networking software, technical documentation, and other intellectual property.
By April 2004, Cisco said it had 198 academies in China, with 17,370 students enrolled and 20,520 graduates.
That year, Cisco signed a $37.7 million agreement with China's Ministry of Education covering networking courses, professional certifications, and instructor training at 35 national software colleges.
In October 2004, Cisco and Beijing University of Posts and Telecommunications established a network-security training center that Cisco said would train high level telecommunications security personnel and provide practical instruction to undergraduate, graduate, and doctoral students.
By 2009, Cisco said more than 100,000 students in China had received training through more than 250 networking academies.
California-based cybersecurity firm SentinelOne reported in 2025 that two people associated with companies named in the Salt Typhoon advisory appeared in Chinese university records as participants in a 2012 Cisco Networking Academy competition.
SentinelOne said corporate, patent, education, and employment records made it highly likely that the competitors were the same people later associated with the companies named in the Salt Typhoon advisory.
Those records do not connect either person to Fire Ant or establish that Cisco training was connected to their later cyber activity.
Initial Access Remains UnknownSygnia has not disclosed how Fire Ant first obtained the privileged access needed to compromise the Cisco routers.
Its report does not identify a Cisco vulnerability used in the attack. The Cybersecurity and Infrastructure Security Agency declined to comment on Sygnia's report.
Sygnia, Cisco, and Google's Mandiant did not respond to requests for comment by publication time.
Tyler Durden Thu, 09/03/2026 - 20:55