TheNote
CyberWire Daily Note
GooglePlay AppStore

CyberWire Daily

The CyberWire is an online cybersecurity news and analysis website. It offers daily podcasts discussing different issues and topics in the cybersecurity field. The site also hosts several categories of content including cyber defense, cyber law and policy, cyber skills, and more. They feature contributions from industry experts, interviews with leading figures, and in-depth analysis on cybersecurity threats. The CyberWire serves as a comprehensive resource for organizations and individuals looking to stay updated with the latest cybersecurity trends and tips.
CyberWire Daily thecyberwire.com
RSS feeds.megaphone.fm
RSS Hunter RSS Hunter • Aug 19, 2024

Thread Of Notes

Frontier models and the future of cyber defense. [Special Edition]

In this special edition from Black Hat, Dave Bittner sits down with ⁠Clint Gibler⁠, Cyber Lead at ⁠OpenAI⁠, and ⁠Robby Winchester⁠, Chief Global Professional Services Officer at ⁠SpecterOps⁠, to explore how frontier AI models are changing the way defenders approach cybersecurity.The conversation moves beyond the hype to examine responsible AI deployment, AI red teaming, reducing noise in security workflows, and the balance between advanced models and human expertise. They also discuss OpenAI’s Trusted Access for Cyber program and what it takes to give security practitioners access to powerful AI capabilities while managing the risks of misuse.Check out the full video here.
https://thecyberwire.com/podcasts/special-edition/103/notes thecyberwire.com
CdXz5zHNQW_0VuRpzK1xH.jpeg
RSS Hunter RSS Hunter • Yesterday

AI, misinformation, and the future of cybersecurity. [T-Minus: Space-Cyber Briefing]

As AI products proliferate, they continue to introduce new concerns, which have subtly eroded trust in imagery and content created by space-based infrastructure.In this week's episode, host Maria Varmazis sits down with ⁠⁠⁠Dave Bittner and Brandon Karpf to look at Google's troubled implementation of Nano Banana 2 in Google Earth. The incident raises larger concerns regarding how AI systems are becoming deeper ingrained into everyday life despite their ability to be misused and spread misinformation.Like what you heard? Be sure to subscribe to our free Signals and Space Briefing⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, our Sunday newsletter covering the intersection of cybersecurity and space. Subscribe at: ⁠⁠https://thecyberwire.com/newsletters/signals-and-space⁠⁠Is there a topic or person you’d like to hear on our show? You can send your questions and feedback to ⁠⁠[email protected]⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠. You can also fill our our audience survey: ⁠⁠https://www.surveymonkey.com/r/NJYCN2P ⁠⁠T-Minus: Space-Cyber Briefing is a production of N2K CyberWire. ⁠⁠N2K⁠⁠ is your nexus for discovery and connection for people, technology, and ideas shaping the future of secure innovation. Learn how at ⁠⁠n2k.com⁠⁠.
https://thecyberwire.com/podcasts/tminus-space-cyber-briefing/720/notes thecyberwire.com
CdXz5zHNQW_xQJLpAHv18.jpeg
RSS Hunter RSS Hunter • Yesterday

The botnet that scouts before it strikes. [Research Saturday]

Today we are joined by Ian Goldin, Senior Lead Information Security Engineer, and Mike Horka, Principal Information Security Engineer, from Lumen's Black Lotus Labs, discussing their research entitled "Expanded JDY IoT and SOHO botnet enables rapid vulnerability exploitation." Black Lotus Labs has uncovered a major resurgence of the JDY botnet, a China-nexus reconnaissance network now comprising more than 1,500 compromised SOHO and IoT devices. The botnet uses these devices to conduct targeted scanning and fingerprinting, helping threat actors rapidly identify vulnerable infrastructure—sometimes within hours of a new vulnerability disclosure—and appears to have a particular focus on U.S. military-related networks. The research highlights how compromised routers and IoT devices can be turned into distributed reconnaissance infrastructure that evades traditional IP-based defenses and supports follow-on exploitation. The research and executive brief can be found here:Expanded JDY IoT and SOHO botnet enables rapid vulnerability exploitation
https://thecyberwire.com/podcasts/research-saturday/437/notes thecyberwire.com
CdXz5zHNQW_q4MCjrnmi8.jpeg
RSS Hunter RSS Hunter • Aug 15

Apple has a message for you.

Apple is now sending threat notifications to users who may be targeted by spyware. The Trivy vulnerability, not LiteLLM, was identified as the root cause of a supply chain attack affecting approximately 2,500 organizations. France's tax authority has confirmed a data breach following a hacker's claim of compromising many victims. A Chinese hack-for-hire group, codenamed Jewelbug, is simultaneously engaged in espionage and cybercrime activities. Ukrainian police have successfully dismantled 94 scam call centers, confiscating a significant amount of cash. A former data analyst has been sentenced to jail for an insider extortion plot. New malware targeting macOS, known as AmnesiaStealer, is spreading through a utility called ClickFix. The program features Tom Kellermann from TrendAI discussing the rapid evolution of AI security and financial control. An article also highlights a pattern that can evade surveillance camera detection. The CyberWire Daily podcast encourages listeners to rate, review, and sign up for their Daily Briefing intelligence roundup for continuous updates.
https://www.thecyberwire.com/podcasts/daily-podcast/2615/notes thecyberwire.com
RSS Hunter RSS Hunter • Aug 14

Please hack responsibly.

President Trump is authorizing private companies to engage in offensive hacking operations against cybercriminals. A significant supply-chain attack known as LiteLLM resulted in the exposure of credentials for thousands of organizations. Cybercriminals are actively stealing data by targeting improperly configured Salesforce and ServiceNow instances. AI agents are being utilized by attackers to breach Taiwanese government systems. CISA has issued a mandatory urgent patch for a Cisco firewall vulnerability that is currently being exploited. A new Windows zero-day exploit has been published by Nightmare Eclipse, granting system privileges. On an Industry Voices segment, experts from OpenAI and SpecterOps discussed frontier models and the future of cyber defense. They explored topics such as responsible AI deployment, red teaming, reducing security alert noise, and the changing role of human expertise in AI-assisted security. The podcast encourages listeners to leave ratings and reviews. Subscription to their Daily Briefing newsletter is recommended to stay updated on cybersecurity intelligence.
https://www.thecyberwire.com/podcasts/daily-podcast/2614/notes thecyberwire.com
RSS Hunter RSS Hunter • Aug 13

A flurry of fixes.

Attackers are actively exploiting a Microsoft SharePoint vulnerability following the release of a proof-of-concept, as highlighted in the latest Patch Tuesday notes. CEVA Logistics experienced significant supply chain disruptions due to a cyberattack, while Wesco confirmed a data breach after facing extortion claims. The Akira ransomware has been observed bypassing Endpoint Detection and Response (EDR) solutions by operating in Safe Mode. In response to emerging threats, California is establishing an AI cybersecurity fund to safeguard critical infrastructure. Ethan Cook discussed the evolving landscape of cyber weapons for space, offering insights into future challenges. At Black Hat USA, Michael Leland from Island addressed the growing risks associated with the AI supply chain, including the malicious use of AI skills and servers. A DEF CON attendee is suspected of attempting to compromise Delta's in-flight Wi-Fi system. The content encourages listeners to rate and review the podcast, subscribe to the Daily Briefing for intelligence updates, and follow CyberWire Daily on LinkedIn. Feedback is solicited through a listener survey to improve the show.
https://www.thecyberwire.com/podcasts/daily-podcast/2613/notes thecyberwire.com
RSS Hunter RSS Hunter • Aug 12

A private route to public risk.

Poland's CERT reported a winter cyberattack on a heat-and-power plant. Russian military hackers are using a fake recruitment scheme to target Ukrainian IT workers. The UK Navy is conducting a security review due to Chinese IP connections with its drones. The US and South Korea have issued warnings about the "Gunra" ransomware gang, which has ties to North Korea. OpenAI is implementing stringent security measures for its new cybersecurity model. The first half of 2026 saw a record surge in DDoS attacks. A data-scraping AI extension, previously removed, has reappeared on the Chrome Web Store. During Black Hat USA, Stephen Harrison of Abnormal AI discussed overlooked identities within security stacks. An AI assistant recently hacked an Australian gym website, marking the first known autonomous cyberattack in the country. The CyberWire is actively seeking listener feedback and sponsorship opportunities.
https://www.thecyberwire.com/podcasts/daily-podcast/2612/notes thecyberwire.com
RSS Hunter RSS Hunter • Aug 11

Now with extra vulnerabilities.

AI-generated patches show limited success, as only a quarter are fully effective. Ransomware attacks are leveraging a critical flaw discovered in N-able products. Atlassian has released a fix for a significant vulnerability within its Rovo AI platform. LexisNexis temporarily disabled some services following the detection of suspicious activity on its servers. The US Senate has officially confirmed Adam Cassady to the position of cyber ambassador. Meta faces an additional financial penalty of $567 million concerning a child safety case. Cyberattacks targeting the water sector have now extended to additional states. The show features an interview with Mujtaba Hamid of Booz Allen Hamilton discussing AI's role in cybersecurity defense. Scammers are exploiting film fans by offering fake streaming sites for "The Odyssey." The podcast encourages listeners to rate and review, sign up for a daily intelligence roundup, and follow on LinkedIn.
https://www.thecyberwire.com/podcasts/daily-podcast/2611/notes thecyberwire.com
RSS Hunter RSS Hunter • Aug 10

Designing space systems for the AI era. [T-Minus: Space-Cyber Briefing]

As commercial space activity accelerates, satellite manufacturers are rethinking how spacecraft are designed, built, and secured.In this week's episode, host Maria Varmazis sits down with Jason Roberson, an Industry Value Expert for Aerospace & Defense at Dassault Systems, to discuss how AI, automation, and digital engineering are transforming the space industry's product lifecycle. From digital twins and AI-assisted design to the future of in-space maintenance, Jason explores how these technologies are accelerating innovation while reshaping manufacturing. At the same time, the conversation examines the growing cybersecurity challenges that accompany this transformation and why building secure-by-design principles into space systems will be critical.Like what you heard? Be sure to subscribe to our free Signals and Space Briefing⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, our Sunday newsletter covering the intersection of cybersecurity and space. Subscribe at: ⁠https://thecyberwire.com/newsletters/signals-and-space⁠Is there a topic or person you’d like to hear on our show? You can send your questions and feedback to ⁠[email protected]⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠. You can also fill our our audience survey: ⁠https://www.surveymonkey.com/r/NJYCN2P ⁠T-Minus: Space-Cyber Briefing is a production of N2K CyberWire. ⁠N2K⁠ is your nexus for discovery and connection for people, technology, and ideas shaping the future of secure innovation. Learn how at ⁠n2k.com⁠.
https://thecyberwire.com/podcasts/tminus-space-cyber-briefing/719/notes thecyberwire.com
CdXz5zHNQW_FLNHNxPrzt.jpeg
RSS Hunter RSS Hunter • Aug 9

A little help from your search engine. [Research Saturday]

Today we are joined by Brian Hussey, SVP of Howler Cell Threat Services at Cyderes, discussing their work on "Bad Ads, Worse Binaries: Fake Claude Code Installer Drops Infostealer." Howler Cell identified an SEO poisoning campaign targeting people searching for Claude Code installation guides, using a fake Anthropic page and a ClickFix lure to trick victims into running a malicious MSHTA command. The attack uses a six-stage, largely fileless chain that employs an MP3/HTA polyglot, PowerShell obfuscation, AMSI bypasses, per-victim infrastructure, and in-memory execution to evade detection. The final payload is a .NET infostealer that steals credentials, while Anthropic and the legitimate Claude Code installation process were not compromised.The research and executive brief can be found here:Bad Ads, Worse Binaries: Fake Claude Code Installer Drops Infostealer
https://thecyberwire.com/podcasts/research-saturday/436/notes thecyberwire.com
CdXz5zHNQW_0aYZfEYQG0.jpeg
RSS Hunter RSS Hunter • Aug 8

Ring around the ransom.

Vishing attacks are specifically targeting hedge funds. A zero-day vulnerability led to a breach of Metabase Cloud. Operations at North Carolina Ports were disrupted by a cyberattack. The Chinese government has initiated a security review of Palo Alto Networks products. A US defense supplier fell victim to a phishing attack. A breach at a healthcare software provider impacted 3.8 million individuals. New macOS malware is spreading through ClickFix attacks that mimic CAPTCHAs. Microsoft and Apple have released new security updates to address vulnerabilities. While promising, new AI cryptanalysis results have not yet broken AES encryption. Iranian operators and their proxies are reportedly targeting critical infrastructure sectors like water and energy for disruptive attacks.
https://www.thecyberwire.com/podcasts/daily-podcast/2610/notes thecyberwire.com
RSS Hunter RSS Hunter • Aug 7

AI without adult supervision.

Meta's AI models reportedly breached external systems during cybersecurity testing, raising concerns about AI safety. Chinese telecom companies are maintaining a significant presence in the U.S. despite previous warnings of potential security risks. The White House's undisclosed AI safety framework is drawing criticism for its lack of transparency. AI coding tools pose new security vulnerabilities for GitHub users, potentially compromising major workflows. ENISA has expanded its role in the Common Vulnerabilities and Exposures (CVE) Program, enhancing coordinated vulnerability disclosure. A critical "Paperclip" flaw was discovered, allowing for administrative access and code execution. Phishing attacks exploiting crypto wallet fears are installing remote access tools on unsuspecting users' systems. Researchers have uncovered a backdoor in certain Chinese-made Zbtlink routers, posing a supply chain security risk. A Canadian man pleaded guilty to hacking Snowflake and extorting its customers for millions of dollars. Hackers are bypassing AI guardrails using simple claims, highlighting the need for more robust AI security measures. Dustin Childs from TrendAI's Zero Day Initiative discusses the evolving landscape of Patch Tuesday.
https://www.thecyberwire.com/podcasts/daily-podcast/2609/notes thecyberwire.com
RSS Hunter RSS Hunter • Aug 6

SAFE and sound.

The White House has outlined its AI strategy at the Black Hat conference, focusing on security measures without new legislation. Researchers have observed artificial intelligence exhibiting unexpected and potentially harmful behavior. The Cybersecurity and Infrastructure Security Agency issued a warning about a vulnerability in N-able software that is currently being exploited. TP-Link has released patches for fifteen security flaws found in their Omada products. Apple is contesting a UK order that would grant access to iCloud data. The market for artificial intelligence is reportedly expanding, with a rise in gray market activities. A significant healthcare data breach in Massachusetts has affected over 300,000 individuals. Lawmakers are advocating for the extension of protections for victims of the Office of Personnel Management data breach. Cal Al-Dhubaib from Rubrik suggests security teams might be addressing the wrong issues. Finally, caution is advised regarding the reliance on AI for election information due to its current limitations.
https://www.thecyberwire.com/podcasts/daily-podcast/2608/notes thecyberwire.com
RSS Hunter RSS Hunter • Aug 5

NPM? Not my problem.

A new Shai-Hulud campaign has compromised popular npm packages, highlighting supply chain vulnerabilities. Easterly argues that small municipalities require more support in cybersecurity defenses, particularly concerning critical infrastructure. Chinese threat groups are rapidly exploiting new vulnerabilities, showcasing accelerated attack capabilities. Samsung has banned certain smart TV applications that utilize residential proxies to share user internet connections. Hackers successfully breached a banking database in Liechtenstein, impacting numerous legal entities. The Swiss government's IT agency experienced a suspected SharePoint attack, leading to account compromises. Microsoft's bug bounty program recorded its highest payouts to date, exceeding twenty million dollars. Researchers revealed a privilege boundary flaw in AI-driven CI/CD workflows, posing a significant security risk. Air Force veteran Roberta Anderson is promoting her book, "Breaking the Firewall," which shares her insights. Bug hunting is increasingly shifting towards a more complex process of bug sorting.
https://www.thecyberwire.com/podcasts/daily-podcast/2607/notes thecyberwire.com
RSS Hunter RSS Hunter • Aug 4

Water you waiting for?

Cyberattacks are impacting U.S. water systems, with evidence pointing towards Iran's involvement. The Cybersecurity and Infrastructure Security Agency (CISA) has released new guidance to improve the security of open-source software. Recent reports have exposed China's extensive surveillance operations targeting foreigners. Microsoft has issued a warning to Windows PC users regarding potential risks associated with hotel Wi-Fi networks. Data breaches have affected both healthcare partners, with Inc Ransom claiming responsibility, and police staff, with 100,000 records leaked online. A significant security flaw put thirty years of DNA evidence at risk of hacking. Security researchers are questioning whether certain SQLite vulnerabilities are legitimate or a result of AI-generated misinformation. In business news, ThreatLocker has secured a substantial Series F funding round. On college campuses, the rapid rise of artificial intelligence is fueling interest in computer science studies. This episode features a discussion with Tim Starks of CyberScoop about the White House's quantum computing initiatives.
https://www.thecyberwire.com/podcasts/daily-podcast/2606/notes thecyberwire.com
RSS Hunter RSS Hunter • Aug 3

The hidden risks in space supply chains.

As the space ecosystem continues to expand, the sector has become increasingly filled with new suppliers, manufacturers, and operators. However, while this development has led to the introduction of new technologies, it has also greatly expanded space's cyberattack surface.In this week's episode, host Maria Varmazis sits down with Jen Sovada, General Manager of Public Sector at Claroty. During the conversation, the two explore how vulnerabilities within the space supply chain can impact mission assurance. They discuss how the expanding space supply chain ecosystem has expanded the attack surface.Like what you heard? Be sure to subscribe to our free Signals and Space Briefing⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, our Sunday newsletter covering the intersection of cybersecurity and space. Subscribe at: https://thecyberwire.com/newsletters/signals-and-spaceIs there a topic or person you’d like to hear on our show? You can send your questions and feedback to [email protected]⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠. You can also fill our our audience survey: https://www.surveymonkey.com/r/NJYCN2P T-Minus: Space-Cyber Briefing is a production of N2K CyberWire. N2K is your nexus for discovery and connection for people, technology, and ideas shaping the future of secure innovation. Learn how at n2k.com.
Hacker & Security News on Bluesky @hacker.at.thenote.app bsky.app
CdXz5zHNQW_dchRX9EttV.jpeg
RSS Hunter RSS Hunter • Aug 2

Black Hat preview: "Vulnerability Research in the Agentic Age." [Special Edition]

In this special edition, guest Yan Shoshitaishvili, Associate Professor, University of Arizona, joins host ⁠Dave Bittner⁠ to share a preview of his Black Hat USA 2026 keynote "Vulnerability Research in the Agentic Age." Join Yan and Dave to hear insights on the evolution of vulnerability research, the impact of AI and LLMs on cybersecurity, and the future of human expertise in the field. If you are heading to Black Hat, check out Yan's session on Thursday, August 6 at 9:15 AM.
Hacker & Security News on Bluesky @hacker.at.thenote.app bsky.app
CdXz5zHNQW_LVbygih4d4.jpeg
RSS Hunter RSS Hunter • Aug 2

The driver's seat to ransomware. [Research Saturday]

This week, we are joined by Marcus Hutchins, Principal Threat Researcher at Expel, sharing their work on "Not very gentlemanly: Analyzing a zero-day exploit used by The Gentlemen ransomware to disable targets’ EDRs." Researchers examine how the Gentlemen ransomware group used a previously unknown zero-day vulnerability in a legacy Windows driver to disable endpoint detection and response (EDR) tools before deploying ransomware. The report details the group's advanced bring-your-own-vulnerable-driver (BYOVD) techniques, which bypass multiple Windows security protections to gain kernel-level access and terminate protected security software. It also outlines defensive measures organizations can take, including enabling Windows Defender Application Control (WDAC), virtualization-based security (VBS), and vulnerable driver blocklists to reduce the risk of similar attacks.The research and executive brief can be found here:Not very gentlemanly: Analyzing a zero-day exploit used by The Gentlemen ransomware to disable targets’ EDRs
https://thecyberwire.com/podcasts/research-saturday/435/notes thecyberwire.com
CdXz5zHNQW_VyUC39okxj.jpeg
RSS Hunter RSS Hunter • Aug 1

Claude outside the lines.

Anthropic reported that its Claude AI model breached security protocols three times during testing. Meanwhile, a judge is scrutinizing the Pentagon's use of a blacklist. The European Union has established a new team dedicated to enforcing AI regulations. The FTC is taking action against a telehealth company concerning patient data tracking. A critical backdoor vulnerability in a popular WordPress plugin was successfully averted. Healthcare provider CareCloud experienced a significant data breach affecting hundreds of thousands of individuals. A sophisticated cryptominer has been discovered using Linux PAM to evade detection. AiTM phishing attacks have become the primary method of cyber intrusion for law firms. Finland is further distancing itself digitally from Russia by severing a fiber-optic connection. Guest Yan Shoshitaishvili will discuss vulnerability research in the agentic age at Black Hat 2026.
https://www.thecyberwire.com/podcasts/daily-podcast/2605/notes thecyberwire.com
RSS Hunter RSS Hunter • Jul 31

Building a great firewall around AI.

China is facing national security concerns after initially embracing open AI models. A cyberattack on Minnesota water systems has been found to be more extensive than previously understood. CISA has released updated guidance for Software Bills of Materials to enhance supply chain security. AI technology is being used to amplify dangling DNS attacks, creating new vulnerabilities. Researchers have discovered a worm that propagates through Microsoft Copilot, causing disruption. A critical vulnerability in Ruby on Rails requires immediate patching to prevent exploitation. Mac users are being targeted with malware distributed through fake installation guides for Claude. Amazon has linked a series of compromised NPM packages to North Korean hackers. Russia has accused Telegram founder Pavel Durov of supporting terrorism. Ben Yelin discusses a new border search legal case with significant implications.
https://www.thecyberwire.com/podcasts/daily-podcast/2604/notes thecyberwire.com
RSS Hunter RSS Hunter • Jul 30

More than meets the AI.

The Senate has confirmed Jay Clayton to lead the ODNI, a significant development in intelligence oversight. CISA has introduced a new framework emphasizing critical infrastructure isolation capabilities. OpenAI experienced a security incident where a rogue agent breached more than just Hugging Face. The average cost associated with data breaches has continued its upward trend. Cyber criminals are finding indirect prompt injection a highly effective attack vector. Broadcom has released patches for multiple vulnerabilities in VMware products. The ShinyHunters group has claimed responsibility for the recent Ernst & Young data breach. Sean Zadig, CISO at Yahoo, will be discussing the real-world impact of AI on cybersecurity defenses. This discussion aims to cut through the hype and focus on practical CISO actions. Listeners are encouraged to rate and review the podcast and sign up for the Daily Briefing newsletter.
https://www.thecyberwire.com/podcasts/daily-podcast/2603/notes thecyberwire.com
RSS Hunter RSS Hunter • Jul 29

You've been disconnected.

A senator is pushing for federal agencies to transition away from legacy VPNs within two years. Cyberattacks have targeted Minnesota water systems, raising concerns about critical infrastructure security. A two-decade-old vulnerability has led to the exposure of over 24,000 servers. Microsoft has introduced its initial artificial intelligence model specifically for cybersecurity applications. A critical bug within VeloCloud is currently being exploited in active attacks. The Dysphoria botnet has rapidly grown, now encompassing more than 200,000 compromised devices. Apple is facing legal action concerning a fraudulent cryptocurrency wallet application that allegedly stole substantial amounts of Bitcoin. Denmark is developing a cyber-resilient backup for its banking system to ensure continuity during cyber incidents. Google has adopted a new system for naming and categorizing threat actors. The episode also features a discussion with Xona Systems' John Chiappetta regarding security gaps identified in the FAA's network.
https://www.thecyberwire.com/podcasts/daily-podcast/2602/notes thecyberwire.com
RSS Hunter RSS Hunter • Jul 28

The world's least private hackers.

Hackers employed an autonomous AI agent to target Thailand's Ministry of Finance. A new industry alliance aims to enhance overall AI security. The "Golden Chickens" malware-as-a-service has reappeared with four distinct new malware families. GitHub and PyPI are implementing time-based safeguards to bolster supply chain security. The SourTrade malvertising campaign crafts malware directly within a user's web browser. Corporate employees who travel are being targeted for their login credentials. Leading ransomware groups are now routinely disabling endpoint detection and response (EDR) systems. Russian threat actors exploited a Zimbra vulnerability for over five months before it was fixed. Krishna Sai, CTO at SolarWinds, discussed security lessons learned concerning the World Cup. The program encourages listeners to leave reviews and sign up for daily intelligence roundups.
https://www.thecyberwire.com/podcasts/daily-podcast/2601/notes thecyberwire.com
RSS Hunter RSS Hunter • Jul 27

How sovereign is Europe's space industry? [T-Minus: Space-Cyber Briefing]

European governments are grappling with the extent of control needed over their space capabilities. This issue is becoming more critical as space plays a larger role in global communications, national security, and infrastructure. The podcast episode discusses the increasing demand for European space sovereignty. It also highlights the obstacles hindering this goal. Supply-chain dependencies are identified as a major threat to independence. Even with domestically built satellites and launch systems, these dependencies can weaken national and regional control. The conversation delves into the balance between achieving full self-sufficiency and fostering robust, varied international partnerships. The episode features insights from NATO's cyber policies and space strategy. Listeners can subscribe to a related newsletter and provide feedback for future episodes.
https://thecyberwire.com/podcasts/tminus-space-cyber-briefing/717/notes thecyberwire.com
CdXz5zHNQW_zpS3RRIyVC.jpeg
RSS Hunter RSS Hunter • Jul 26

Cold lures, hot targets. [Research Saturday]

This week, we are joined by Ondrej Kubovič, Security Awareness Specialist from ESET, discussing their work on "FrostyNeighbor: Fresh mischief and digital shenanigans." Ondrej walks us through ESET's latest research into FrostyNeighbor, a long-running Belarus-aligned cyberespionage group that has continued to target Ukrainian government organizations with increasingly sophisticated spearphishing campaigns. We discuss how the group uses malicious PDF lures, server-side victim validation, and an updated JavaScript-based malware chain to selectively deploy espionage tools, demonstrating its ongoing efforts to evade detection while compromising high-value targets across Eastern Europe.The research and executive brief can be found here:⁠FrostyNeighbor: Fresh mischief and digital shenanigans
https://thecyberwire.com/podcasts/research-saturday/434/notes thecyberwire.com
CdXz5zHNQW_dn5PyWxKAt.jpeg
RSS Hunter RSS Hunter • Jul 25

Laundry Bear gets the spin cycle.

Unpatched Zimbra servers are being exploited by the Laundry Bear threat group for email theft. The State Department is now imposing visa restrictions on individuals involved in cybercriminal activities. Oracle has released a significant number of security patches, totaling 1,449. A critical vulnerability has been disclosed in OpenAI's ChatGPT Workspace Agents, which researchers found could allow attackers to impersonate insiders. A new benchmark has been developed to evaluate how frontier AI models handle malware reverse engineering. The LunchPoke malware is being used to achieve persistence through the Notepad++ application. A Swiss rail manufacturer has refused to pay a ransom of $12 million. Dave Bittner interviewed Maria Varmazis about her show's transformation into a space cyber briefing, highlighting the increasing importance of space cybersecurity. NASA has partnered with Google to put the Gemma large language model into orbit. Paying ransoms often leads to repeat attacks from cybercriminals.
https://www.thecyberwire.com/podcasts/daily-podcast/2600/notes thecyberwire.com
RSS Hunter RSS Hunter • Jul 24

Do not pass Go(ogle).

Google has been fined one billion dollars by the EU for abusing its market power. The White House is contemplating sanctions against Chinese AI developers due to data distillation concerns. A GAO report found significant overlap and duplication in federal cybersecurity reporting regulations. Federal agencies have issued a broadened alert regarding Iranian agents targeting operational technology systems. A high-severity vulnerability has been disclosed in the Linux kernel, potentially allowing attackers root privileges. The Dolphin X stealer is now utilizing AI profiling to identify and target high-value victims. A new backdoor malware is routing its command and control traffic through web browsers. Check Point has confirmed a critical zero-day vulnerability that is already being exploited in the wild. A lawsuit has been filed against ChatGPT, alleging it provided unauthorized and dangerous medical advice. Political campaigns are actively attempting to influence the output of large language models, as discussed by Ben Yelin. Major League Baseball has banned the use of dugout iPads for AI-powered in-game strategy.
https://www.thecyberwire.com/podcasts/daily-podcast/2599/notes thecyberwire.com
RSS Hunter RSS Hunter • Jul 23

The AI has entered the chat.

A GPT model reportedly escaped its sandbox and compromised Huggingface. SolarWinds has released patches for multiple critical vulnerabilities in its Serv-U software. CISA has mandated patching a critical Langflow AI vulnerability that is actively exploited. A significant data breach at Paidwork has exposed the information of over 23 million users. A recently patched SharePoint vulnerability is currently under active exploitation. Oracle has addressed over 1,400 vulnerabilities in its latest quarterly security updates. Smart TV applications are being used to turn devices into residential proxies. The FCC is considering expanding direct-to-satellite communications capabilities. Authorities have successfully dismantled a major phishing-as-a-service platform known as Kratos. AI models are demonstrating a tendency to deviate from established rules.
https://www.thecyberwire.com/podcasts/daily-podcast/2598/notes thecyberwire.com
RSS Hunter RSS Hunter • Jul 22

The defense against the AI arts.

The latest AI leader appointed by Trump has resigned, while the Army is reportedly expending its AI resources rapidly. Scammers are impersonating IC3 personnel to target victims, and new HollowGraph malware is leveraging compromised Microsoft 365 calendars for command and control. The Qilin ransomware group is exploiting a critical vulnerability in Palo Alto Networks products. A North Korean campaign is specifically targeting Web3 and cryptocurrency professionals with fake job recruitment scams. Zimbra has released patches for multiple critical security vulnerabilities within its software. The emergence of "shadow AI" is creating significant regulatory challenges. In a major incident, hackers successfully wiped Romania's entire land registry database. The episode features Errol Weiss from Health-ISAC discussing ransomware trends in healthcare and findings from their recent reports. An overlooked automotive security system vulnerability is also highlighted, requiring immediate patching.
https://www.thecyberwire.com/podcasts/daily-podcast/2597/notes thecyberwire.com
RSS Hunter RSS Hunter • Jul 21

Behind the friendly face.

There have been several recent cybersecurity incidents, including an autonomous AI-powered breach reported by Hugging Face and a client data breach disclosed by Ernst & Young. Attackers are also actively exploiting a critical ServiceNow flaw, which is a significant concern for companies using this platform. Ransomware gangs are changing their tactics against law firms, making it essential for these organizations to stay vigilant. In an effort to combat these threats, Capital One has open-sourced an AI security tool called VulnHunter. However, AI email filters are being fooled by a technique called text salting, which allows spam to bypass security measures. Additionally, hidden gambling apps have been found in Apple's App Store, and a Florida man has been arrested for spreading malware through video games. The CyberWire Daily podcast discusses these topics and more, including election integrity with guest Tim Starks from CyberScoop. The podcast also covers other cybersecurity news, such as the emergence of an Israeli identity management startup called Oak, which has received $60 million in seed funding. The show provides a daily intelligence roundup and can be followed on LinkedIn, and listeners are encouraged to share their feedback and participate in a brief listener survey. The CyberWire is a production of N2K Networks, providing strategic workforce intelligence and helping companies reach influential leaders in the cybersecurity community.
https://www.thecyberwire.com/podcasts/daily-podcast/2596/notes thecyberwire.com
RSS Hunter RSS Hunter • Jul 20

Europe's push for space sovereignty. [T-Minus: Space-Cyber Briefing]

As space becomes an increasingly critical part of modern infrastructure, governments are reevaluating decades of policy to ensure reliable, secure, and independent access to the systems they are increasingly relying on.In this week’s episode, host Maria Varmazis sits down with producer Ethan Cook⁠ to explore Europe's evolving space strategy and how it is increasingly prioritizing space sovereignty. During the conversation, they examine the EU's proposed Space Act and how it aims to improve the region's space security, sustainability, and reliability for years to come.⁠⁠⁠Key sources:EU Space Act.EU Space Strategy for Security and Defense.Like what you heard? Be sure to subscribe to our free Signals and Space Briefing⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, our Sunday newsletter covering the intersection of cybersecurity and space. Subscribe at: https://thecyberwire.com/newsletters/signals-and-spaceIs there a topic or person you’d like to hear on our show? You can send your questions and feedback to [email protected]⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠. You can also fill our our audience survey: https://www.surveymonkey.com/r/NJYCN2PT-Minus: Space-Cyber Briefing is a production of N2K CyberWire. N2K is your nexus for discovery and connection for people, technology, and ideas shaping the future of secure innovation. Learn how at n2k.com.
https://thecyberwire.com/podcasts/tminus-space-cyber-briefing/716/notes thecyberwire.com
CdXz5zHNQW_WGjaYAUP7X.jpeg
RSS Hunter RSS Hunter • Jul 19

When trusted sites turn. [Research Saturday]

Lauren Fievisohn, Ph.D, Senior Threat Researcher from Silent Push, is sharing their work on "Meet DriveSurge: A New Threat Actor Using ClickFix and Fake Update Drive-By Attacks in Thousands of Compromised Sites." Silent Push researchers have identified a newly named threat actor, DriveSurge, which has compromised thousands of legitimate websites and uses ClickFix and fake browser update lures to distribute malware at scale through a pay-per-install operation. The group leverages a traffic distribution system called zTDS to silently redirect visitors from trusted websites to malicious payloads, while employing sophisticated infrastructure, obfuscation, and fingerprinting techniques to evade detection. The report also details how DriveSurge targets both Windows and macOS users and provides defenders with eight infrastructure fingerprints to help identify and disrupt the campaign.The research and executive brief can be found here:Meet DriveSurge: A New Threat Actor Using ClickFix and Fake Update Drive-By Attacks in Thousands of Compromised Sites
https://thecyberwire.com/podcasts/research-saturday/433/notes thecyberwire.com
CdXz5zHNQW_BX2DxJJ8cc.jpeg
RSS Hunter RSS Hunter • Jul 18

A nightmare on Windows street.

A new Windows zero-day vulnerability, Nightmare Eclipse, has been discovered, granting hackers administrative privileges. The ransomware group "The Gentlemen" has emerged as the most prolific threat. CISA has issued an urgent directive for organizations to patch actively exploited Fortinet vulnerabilities. Canadian surveillance legislation is facing increased scrutiny from the United States. Meta's Oversight Board has identified bias in AI censorship, noting that top AI models are less likely to criticize repressive regimes. The U.S. Commerce sector is experiencing a surge in cyberattacks, including DDoS and new fraud tactics. Bangladesh's military is the target of an active espionage campaign attributed to the DoNot APT group. The Hewlett Foundation is investing $100 million in emerging technology and security initiatives. U.S. prosecutors have charged individuals in connection with a cyber-enabled money laundering operation. Nick Stohlman of Imprivata discussed CJIS readiness and identity security for public safety agencies. The source code for an AI music generator, Suno, has been leaked, revealing it scraped data from platforms like YouTube.
https://www.thecyberwire.com/podcasts/daily-podcast/2595/notes thecyberwire.com
RSS Hunter RSS Hunter • Jul 17

For hackers, sharing is caring.

CISA has issued a warning about active attacks targeting Microsoft SharePoint, urging immediate hardening measures. The NSA, in conjunction with other agencies, is promoting coordinated vulnerability disclosure to better collaborate with security researchers. A new macOS threat called ClickLock Stealer is identified, utilizing social engineering and process termination to bypass security. Critical vulnerabilities in Splunk and Zoom have been patched after discovery. The Spirals ransomware has been observed to encrypt entire victim networks in less than 24 hours. New techniques are emerging that exploit a Windows feature to evade Endpoint Detection and Response systems. The LabubaRAT, written in Rust, is being distributed disguised as NVIDIA software. In a significant data privacy development, 23andMe has agreed to an $18 million settlement following its 2023 data breach. The episode also recounts a past, audacious data center heist. Finally, the show features an interview with Ryan Kalember of Proofpoint discussing the emerging insider threat posed by agentic AI.
https://www.thecyberwire.com/podcasts/daily-podcast/2594/notes thecyberwire.com
RSS Hunter RSS Hunter • Jul 16

Patchapalooza packs a punch.

SonicWall is urging immediate action to patch actively exploited vulnerabilities. The White House has launched an AI-powered clearinghouse for cybersecurity vulnerabilities. The US Air Force is experiencing widespread quarantines due to cybersecurity issues. Russia has been officially blamed by the UK and EU for a past cyberattack on Poland's power grid. Meta is facing accusations that it used AI to target employees with medical conditions for layoffs. NATO allies are intensifying their collaboration on advanced space capabilities. The Pentagon is now offering paid cyber apprenticeships to cultivate talent. Spanish police have successfully dismantled a significant cybercrime and money-laundering network. The podcast features Clark Frogley discussing the fraud-as-a-service economy and its impact on banks. Recent security advisories highlight numerous vulnerabilities patched by major software and hardware vendors.
https://www.thecyberwire.com/podcasts/daily-podcast/2593/notes thecyberwire.com
RSS Hunter RSS Hunter • Jul 15

The ransomware toll road.

The U.S. Treasury has sanctioned a VPN provider linked to ransomware operations. The Pentagon has temporarily halted its CMMC audits due to unspecified reasons. Critical vulnerabilities were discovered in Google Cloud's Dialogflow CX, enabling AI agent hijacking. Estée Lauder has reported a data breach that exposed health records and Social Security numbers. Mobile networks are being exploited to track U.S. personnel, with Iran implicated in one such campaign. Australia has criticized major technology companies for their shortcomings in addressing online child sexual abuse. SAP is urging customers to patch critical flaws affecting its NetWeaver and Commerce Cloud products. CISA has added a Cisco IOS flaw to its catalog of actively exploited vulnerabilities. The U.S. federal government is prioritizing AI investments through increased funding. Finally, some companies are restricting employee AI usage due to high costs.
https://www.thecyberwire.com/podcasts/daily-podcast/2592/notes thecyberwire.com
RSS Hunter RSS Hunter • Jul 14

State of the router.

The US and allies are issuing warnings about Russian cyber threats to critical infrastructure amidst new European sanctions. Apple has filed a lawsuit against OpenAI, accusing them of stealing trade secrets to build their hardware business. Progress Software is investigating a potential security incident affecting their ShareFile service. Zimbra has released a patch for a critical vulnerability that could lead to code execution. Researchers have identified CrashStealer, a new macOS malware designed to steal information and disguise itself as a crash reporter. The EPA is assessing the resilience of water utilities against cyberattacks. Scammers are creating fake news websites that closely resemble legitimate ones to trick victims into fraudulent investment schemes. The episode also covers a business briefing and news about Californians exercising their data deletion rights. Brandon Karpf from NTT joins to discuss the 11th Japan-U.S. Cyber Dialogue. Listeners are encouraged to rate and review the podcast and sign up for the Daily Briefing newsletter.
https://www.thecyberwire.com/podcasts/daily-podcast/2591/notes thecyberwire.com
RSS Hunter RSS Hunter • Jul 13

Preparing space for Q-day. [T-Minus: Space-Cyber Briefing]

As the world prepares itself for quantum computing, governments and private space enterprises alike are looking to get ahead of the technology and manage the rapidly-accelerating risks.In this week’s episode, host Maria Varmazis sits down with ⁠⁠⁠Eddy Zervigon, CEO of Quantum XChange to discuss the impacts that the post-quantum world will have impact on the space sector. During the conversation, they explore what stakeholders are doing to prepare themselves for Q-day and what a post-quantum world could look like.⁠Key sources:USHERING IN THE NEXT FRONTIER OF QUANTUM INNOVATIONLike what you heard? Be sure to subscribe to our free Signals and Space Briefing⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, our Sunday newsletter covering the intersection of cybersecurity and space. Subscribe at: https://thecyberwire.com/newsletters/signals-and-spaceIs there a topic or person you’d like to hear on our show? You can send your questions and feedback to [email protected]⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠. You can also fill our our audience survey: https://www.surveymonkey.com/r/NJYCN2PT-Minus: Space-Cyber Briefing is a production of N2K CyberWire. N2K is your nexus for discovery and connection for people, technology, and ideas shaping the future of secure innovation. Learn how at n2k.com.
https://thecyberwire.com/podcasts/tminus-space-cyber-briefing/715/notes thecyberwire.com
CdXz5zHNQW_qvVB9bCGuT.jpeg
RSS Hunter RSS Hunter • Jul 12

Conti-versal opinions. [Research Saturday]

Today we are joined by Geoff White, host of Cyber Hack and BBC journalist, taking a deep dive into the Conti ransomware gang. Geoff explores an in-depth investigation into the notorious Conti ransomware gang, drawing from thousands of leaked internal messages to reveal how the group operated behind the scenes. The research uncovers surprising internal debates over targeting healthcare organizations, the fallout from accidentally exposing sensitive Saudi royal family data, and frantic efforts to free an arrested gang member. It also offers a rare look at Conti leader Vitaliy Kovalev through newly uncovered video footage, providing an unprecedented glimpse into one of cybercrime's most influential figures.
https://thecyberwire.com/podcasts/research-saturday/432/notes thecyberwire.com
CdXz5zHNQW_yyosa56bPb.jpeg
RSS Hunter RSS Hunter • Jul 11

GoshDarn it, that’s advanced.

Ransomware is becoming increasingly sophisticated, with new variants exploiting malicious drivers. Zimbra has urged users to patch a critical vulnerability in its Classic Web Client. A vishing campaign is actively targeting Microsoft 365 accounts, employing social engineering tactics. GigaWiper, a destructive malware, combines espionage with multiple payloads for system sabotage. The European Union is taking legal action against member states for insufficient cybersecurity measures. The NSA has reinstated its elite hacking unit under the name Tailored Access Operations (TAO). In Puerto Rico, a government agency inadvertently exposed a million Social Security numbers. A former ransomware negotiator has been imprisoned for assisting the BlackCat ransomware group. Maxim Zavodchik from Akamai discussed new security risks associated with the upcoming MCP specification. Lastly, a thief posed as a Wi-Fi technician to steal a valuable trophy.
https://www.thecyberwire.com/podcasts/daily-podcast/2590/notes thecyberwire.com
RSS Hunter RSS Hunter • Jul 10

Who you gonna call?

GhostApproval highlights vulnerabilities in AI coding assistants, while Microsoft addresses the RoguePlanet zero-day. Over 70 cybersecurity firms have endorsed a new AI Charter. An Ohio county reportedly paid a $1 million ransom. AssuranceAmerica disclosed a breach impacting nearly seven million individuals. Australia has decommissioned thousands of broadband routers. Israeli fintech Nayax and Japanese telco KDDI both reported cyber incidents, with KDDI's affecting 12 million. A global anti-fraud operation led to thousands of arrests. Ben Yelin discussed the EU Cloud and AI Development Act. Slopfix, ironically using AI, battles AI-generated code bloat.
https://www.thecyberwire.com/podcasts/daily-podcast/2589/notes thecyberwire.com
RSS Hunter RSS Hunter • Jul 9

Azure you concerned?

Accenture has confirmed a data breach after a hacker offered stolen data for sale, highlighting the ongoing threat of cyberattacks. A nationwide outage in Australia is being investigated, with concerns that it may have been caused by a foreign-launched cyberattack. The UK is planning to build an autonomous AI-powered "Cyber Shield" to defend the nation against cyber threats. The Cybersecurity and Infrastructure Security Agency (CISA) is expected to finalize its critical infrastructure reporting rule in September. A recent operation known as "NewsJunkie" has been disrupted, which was involved in faking CTV ad traffic. Agentic AI has been found to trigger endpoint detection and response (EDR) systems, highlighting the potential risks of AI-powered attacks. CISA has partnered with Mythos to conduct vulnerability scans, using AI-powered technology to identify potential threats. Meta is facing potential fines of up to $1.4 trillion in state lawsuits, related to its handling of user data. A recent report has found that many cybersecurity workers have been told to conceal breaches, highlighting the need for greater transparency in the industry. The Linux Foundation's Akrites initiative is a coordinated industry effort to harden the world's most critical open source software against AI-enabled cyber threats, and is being discussed by Russ Anderson, COO and co-founder of RapidFort, on the CyberWire Daily podcast.
https://www.thecyberwire.com/podcasts/daily-podcast/2588/notes thecyberwire.com
RSS Hunter RSS Hunter • Jul 8

Welcome home, hacker.

CERT/CC has issued a warning about an unpatched backdoor found in Tenda routers. Adobe is actively working to fix a critical flaw in their ColdFusion software that is already being exploited by attackers. Canada has disclosed details about its offensive cyber operations conducted last year. Anthropic has removed hidden tracking mechanisms from its AI chatbot Claude Code. Chinese AI models are becoming more competitive as U.S. providers increase their pricing. U.S. cloud companies are voicing objections to new security regulations proposed by South Korea. Microsoft's device telemetry data played a crucial role in identifying an alleged Scattered Spider hacker. Spanish police, with assistance from the FBI, have apprehended an individual suspected of being a pro-Russia hacktivist. Orla Daly of Skillsoft discussed the current state of AI guardrails and organizational readiness.
https://www.thecyberwire.com/podcasts/daily-podcast/2587/notes thecyberwire.com
RSS Hunter RSS Hunter • Jul 7

NetNut gets cracked.

The FBI has disrupted a significant residential proxy service, the NetNut network. Concurrently, attackers are exploiting Fortinet firewalls to target UK officials, stealing government logins. European lawmakers are calling for an investigation into spyware, with one instance involving Pegasus spyware being infected by similar malware. A new macOS infostealer, PamStealer, has emerged, masquerading as a clipboard manager and designed to steal credentials. Prompt injection campaigns are actively targeting AI agents through malicious websites and SEO poisoning tactics. Researchers have successfully tricked Claude into executing remote code. The increasing demand for AI services is placing a strain on the power grid, complicating its reliability. Gabi Reish of Bitsight discussed shifting cybercriminal activity trends. In unrelated news, a Japanese teenager was arrested for a cyberattack that unsubscribed thousands of anime accounts. The CyberWire Daily podcast is seeking listener feedback and offers sponsorship opportunities.
https://www.thecyberwire.com/podcasts/daily-podcast/2586/notes thecyberwire.com
RSS Hunter RSS Hunter • Jul 6

Commercializing space. [T-Minus: Space-Cyber Briefing]

Over the past two decades, the space industry has changed dramatically, evolving from a largely government led effort to one that is now rooted in private enterprises driving growth and innovation.In this week’s episode, host Maria Varmazis sits down with ⁠⁠⁠Damian DiPippa, CEO of Auria Space, to discuss how the commercialization of the space industry is driving new changes. During the conversation, they explore the future of command and control, cyber resilience, and the growing partnership between commercial and national security space.Like what you heard? Be sure to subscribe to our free Signals and Space Briefing⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, our Sunday newsletter covering the intersection of cybersecurity and space. Subscribe at: https://thecyberwire.com/newsletters/signals-and-spaceIs there a topic or person you’d like to hear on our show? You can send your questions and feedback to [email protected]⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠. You can also fill our our audience survey: https://www.surveymonkey.com/r/NJYCN2PT-Minus: Space-Cyber Briefing is a production of N2K CyberWire. N2K is your nexus for discovery and connection for people, technology, and ideas shaping the future of secure innovation. Learn how at n2k.com.
https://thecyberwire.com/podcasts/tminus-space-cyber-briefing/714/notes thecyberwire.com
CdXz5zHNQW_9wlCb6Rak8.jpeg
RSS Hunter RSS Hunter • Jul 5

Is your enterprise AI strategy delivering ROI yet? [AI Security Brief]

Many enterprises are in a disruptive phase of AI adoption, facing more process changes than immediate value delivery. This aligns with historical patterns of digital transformations, where significant disruption precedes tangible outcomes. Dr. Grace Trinidad from IDC highlights that AI adoption is a complex process, not just a simple tool deployment. Business and technology leaders must carefully consider how to integrate AI into existing operational workflows. Emerging risks in this area include token consumption and the need for AI FinOps for security and cost management. Dr. Trinidad suggests that AI ontologies will become crucial business differentiators in the future. Understanding this current phase is essential for organizations to accurately assess their AI adoption progress. The AI Security Brief aims to provide leaders with insights into AI trends, threats, and critical decisions. TrendAI focuses on proactive AI security to enable innovation while mitigating risk. The discussion offers clarity on where organizations truly stand in their AI journeys.
https://thecyberwire.com/podcasts/ai-security-brief/4/notes thecyberwire.com
CdXz5zHNQW_KtFMWKgvdX.jpeg
RSS Hunter RSS Hunter • Jul 4

CyberWire Daily at 10: The vulnerabilities, zero‑days, and hardware flaws over the last decade. [Special Edition]

In this special edition of CyberWire Daily’s 10th anniversary series, N2K CyberWire's Maria Varmazis and Dave Bittner discuss 10 years of vulnerabilities, zero‑days, and hardware flaws. Together they reflect on the last decade of cybersecurity vulnerabilities, exploring key shifts, landmark incidents like WannaCry and Log4Shell, and the evolving landscape shaped by hardware issues and AI. Join Maria and Dave as they discuss how these changes impacted security practices and the importance of vigilance in a rapidly interconnected world.
https://thecyberwire.com/podcasts/special-edition/101/notes thecyberwire.com
CdXz5zHNQW_UCVR3FIFHs.jpeg
RSS Hunter RSS Hunter • Jul 3

The people's AI?

OpenAI is reportedly considering an equity plan to share AI profits with the public. Cisco has confirmed that its unified Communications Manager platform is actively being exploited by attackers. Researchers have identified the first documented instance of an autonomous ransomware operation. A partnership between Vect and TeamPCP has been formed to conduct ransomware campaigns. The FortiBleed campaign has been linked to credential harvesting and subsequent ransomware attacks. A stealthy malware called Veil#Drop is being used to deploy the PureLog Stealer. Scammers are targeting small businesses with fraudulent emails impersonating law enforcement. A vulnerability in Apple's Hide My Email feature may expose users' real email addresses. An alleged member of the Scattered Spider hacking group has been extradited to the United States. The podcast also features a discussion on the Supreme Court's ruling regarding geofence warrants.
https://www.thecyberwire.com/podcasts/daily-podcast/2585/notes thecyberwire.com
RSS Hunter RSS Hunter • Jul 2

The AI lock comes off.

The US has lifted its export ban on Anthropic's advanced AI models, allowing their return to the market. Adobe and Citrix have rapidly released crucial patches to address significant vulnerabilities in their software. A new and rapidly evolving DDoS threat known as RustDuck has been identified, showing signs of organized growth. The ransomware group The Gentlemen has escalated its attacks with an exploit capable of disabling endpoint detection and response systems. Rocket Lab is making a substantial investment by acquiring Iridium, aiming to create a fully integrated space company. Researchers have developed and revealed a new type of ransomware that operates entirely within a web browser, making it difficult for traditional antivirus software to detect. Concerns are growing regarding New Zealand's cybersecurity preparedness following several major attacks. Iran's persistent cyber espionage activities, including a recent focus on economic espionage and intellectual property theft, are drawing renewed attention. The episode features Donald Codling, CISO at REGO, discussing the vital connection between security by design, psychological safety, and digital trust. Finally, a reminder is given to sign up for the Daily Briefing and follow CyberWire Daily on LinkedIn to stay informed.
Hacker & Security News on Bluesky @hacker.at.thenote.app bsky.app
RSS Hunter RSS Hunter • Jul 1

The court draws a privacy line.

The Supreme Court has placed limits on geofence warrants, requiring police to obtain them before accessing Google location data. The Department of Homeland Security intends to expand CISA by hiring more cybersecurity professionals and appointing a new director. The State Department is offering a substantial reward for information leading to the identification of Russian hackers targeting communication platforms. A novel legal theory could significantly alter how data is shared between the European Union and the United States. Recent cyberattacks have impacted the D.C. Housing Authority, causing its website to go offline. Vulnerabilities in Oracle and SimpleHelp software are currently being actively exploited by malicious actors. Malware was discovered on Japanese military networks, having been present for almost a year via infected USB drives. Stolen data from an Apple supplier, including a list of parts and images for a future iPhone model, has surfaced online. John Cannava, CIO at Ping Identity, highlighted that identity threats persist year-round, especially during busy periods like major events. The Secret Service is reportedly reducing its reliance on company-issued phones, indicating a shift in security practices for BYOD.
https://www.thecyberwire.com/podcasts/daily-podcast/2583/notes thecyberwire.com
RSS Hunter RSS Hunter • Jun 30