CyberWire Daily - TheNote.app

CyberWire Daily
Follow

The CyberWire is an online cybersecurity news and analysis website. It offers daily podcasts discussing different issues and topics in the cybersecurity field. The site also hosts several categories of content including cyber defense, cyber law and policy, cyber skills, and more. They feature contributions from industry experts, interviews with leading figures, and in-depth analysis on cybersecurity threats. The CyberWire serves as a comprehensive resource for organizations and individuals looking to stay updated with the latest cybersecurity trends and tips.

CyberWire Daily thecyberwire.com

RSS feeds.megaphone.fm

RSS Hunter • Aug 19, 2024

Thread Of Notes

The defense against the AI arts.

The latest AI leader appointed by Trump has resigned, while the Army is reportedly expending its AI resources rapidly. Scammers are impersonating IC3 personnel to target victims, and new HollowGraph malware is leveraging compromised Microsoft 365 calendars for command and control. The Qilin ransomware group is exploiting a critical vulnerability in Palo Alto Networks products. A North Korean campaign is specifically targeting Web3 and cryptocurrency professionals with fake job recruitment scams. Zimbra has released patches for multiple critical security vulnerabilities within its software. The emergence of "shadow AI" is creating significant regulatory challenges. In a major incident, hackers successfully wiped Romania's entire land registry database. The episode features Errol Weiss from Health-ISAC discussing ransomware trends in healthcare and findings from their recent reports. An overlooked automotive security system vulnerability is also highlighted, requiring immediate patching.

https://www.thecyberwire.com/podcasts/daily-podcast/2597/notes thecyberwire.com

RSS Hunter • Yesterday

Behind the friendly face.

There have been several recent cybersecurity incidents, including an autonomous AI-powered breach reported by Hugging Face and a client data breach disclosed by Ernst & Young. Attackers are also actively exploiting a critical ServiceNow flaw, which is a significant concern for companies using this platform. Ransomware gangs are changing their tactics against law firms, making it essential for these organizations to stay vigilant. In an effort to combat these threats, Capital One has open-sourced an AI security tool called VulnHunter. However, AI email filters are being fooled by a technique called text salting, which allows spam to bypass security measures. Additionally, hidden gambling apps have been found in Apple's App Store, and a Florida man has been arrested for spreading malware through video games. The CyberWire Daily podcast discusses these topics and more, including election integrity with guest Tim Starks from CyberScoop. The podcast also covers other cybersecurity news, such as the emergence of an Israeli identity management startup called Oak, which has received $60 million in seed funding. The show provides a daily intelligence roundup and can be followed on LinkedIn, and listeners are encouraged to share their feedback and participate in a brief listener survey. The CyberWire is a production of N2K Networks, providing strategic workforce intelligence and helping companies reach influential leaders in the cybersecurity community.

https://www.thecyberwire.com/podcasts/daily-podcast/2596/notes thecyberwire.com

RSS Hunter • Jul 20

Europe's push for space sovereignty. [T-Minus: Space-Cyber Briefing]

As space becomes an increasingly critical part of modern infrastructure, governments are reevaluating decades of policy to ensure reliable, secure, and independent access to the systems they are increasingly relying on.In this week’s episode, host Maria Varmazis sits down with producer Ethan Cook⁠ to explore Europe's evolving space strategy and how it is increasingly prioritizing space sovereignty. During the conversation, they examine the EU's proposed Space Act and how it aims to improve the region's space security, sustainability, and reliability for years to come.⁠⁠⁠Key sources:EU Space Act.EU Space Strategy for Security and Defense.Like what you heard? Be sure to subscribe to our free Signals and Space Briefing⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, our Sunday newsletter covering the intersection of cybersecurity and space. Subscribe at: https://thecyberwire.com/newsletters/signals-and-spaceIs there a topic or person you’d like to hear on our show? You can send your questions and feedback to [email protected]⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠. You can also fill our our audience survey: https://www.surveymonkey.com/r/NJYCN2PT-Minus: Space-Cyber Briefing is a production of N2K CyberWire. N2K is your nexus for discovery and connection for people, technology, and ideas shaping the future of secure innovation. Learn how at n2k.com.

https://thecyberwire.com/podcasts/tminus-space-cyber-briefing/716/notes thecyberwire.com

RSS Hunter • Jul 19

When trusted sites turn. [Research Saturday]

Lauren Fievisohn, Ph.D, Senior Threat Researcher from Silent Push, is sharing their work on "Meet DriveSurge: A New Threat Actor Using ClickFix and Fake Update Drive-By Attacks in Thousands of Compromised Sites." Silent Push researchers have identified a newly named threat actor, DriveSurge, which has compromised thousands of legitimate websites and uses ClickFix and fake browser update lures to distribute malware at scale through a pay-per-install operation. The group leverages a traffic distribution system called zTDS to silently redirect visitors from trusted websites to malicious payloads, while employing sophisticated infrastructure, obfuscation, and fingerprinting techniques to evade detection. The report also details how DriveSurge targets both Windows and macOS users and provides defenders with eight infrastructure fingerprints to help identify and disrupt the campaign.The research and executive brief can be found here:Meet DriveSurge: A New Threat Actor Using ClickFix and Fake Update Drive-By Attacks in Thousands of Compromised Sites

https://thecyberwire.com/podcasts/research-saturday/433/notes thecyberwire.com

RSS Hunter • Jul 18

A nightmare on Windows street.

A new Windows zero-day vulnerability, Nightmare Eclipse, has been discovered, granting hackers administrative privileges. The ransomware group "The Gentlemen" has emerged as the most prolific threat. CISA has issued an urgent directive for organizations to patch actively exploited Fortinet vulnerabilities. Canadian surveillance legislation is facing increased scrutiny from the United States. Meta's Oversight Board has identified bias in AI censorship, noting that top AI models are less likely to criticize repressive regimes. The U.S. Commerce sector is experiencing a surge in cyberattacks, including DDoS and new fraud tactics. Bangladesh's military is the target of an active espionage campaign attributed to the DoNot APT group. The Hewlett Foundation is investing $100 million in emerging technology and security initiatives. U.S. prosecutors have charged individuals in connection with a cyber-enabled money laundering operation. Nick Stohlman of Imprivata discussed CJIS readiness and identity security for public safety agencies. The source code for an AI music generator, Suno, has been leaked, revealing it scraped data from platforms like YouTube.

https://www.thecyberwire.com/podcasts/daily-podcast/2595/notes thecyberwire.com

RSS Hunter • Jul 17

For hackers, sharing is caring.

CISA has issued a warning about active attacks targeting Microsoft SharePoint, urging immediate hardening measures. The NSA, in conjunction with other agencies, is promoting coordinated vulnerability disclosure to better collaborate with security researchers. A new macOS threat called ClickLock Stealer is identified, utilizing social engineering and process termination to bypass security. Critical vulnerabilities in Splunk and Zoom have been patched after discovery. The Spirals ransomware has been observed to encrypt entire victim networks in less than 24 hours. New techniques are emerging that exploit a Windows feature to evade Endpoint Detection and Response systems. The LabubaRAT, written in Rust, is being distributed disguised as NVIDIA software. In a significant data privacy development, 23andMe has agreed to an $18 million settlement following its 2023 data breach. The episode also recounts a past, audacious data center heist. Finally, the show features an interview with Ryan Kalember of Proofpoint discussing the emerging insider threat posed by agentic AI.

https://www.thecyberwire.com/podcasts/daily-podcast/2594/notes thecyberwire.com

RSS Hunter • Jul 16

Patchapalooza packs a punch.

SonicWall is urging immediate action to patch actively exploited vulnerabilities. The White House has launched an AI-powered clearinghouse for cybersecurity vulnerabilities. The US Air Force is experiencing widespread quarantines due to cybersecurity issues. Russia has been officially blamed by the UK and EU for a past cyberattack on Poland's power grid. Meta is facing accusations that it used AI to target employees with medical conditions for layoffs. NATO allies are intensifying their collaboration on advanced space capabilities. The Pentagon is now offering paid cyber apprenticeships to cultivate talent. Spanish police have successfully dismantled a significant cybercrime and money-laundering network. The podcast features Clark Frogley discussing the fraud-as-a-service economy and its impact on banks. Recent security advisories highlight numerous vulnerabilities patched by major software and hardware vendors.

https://www.thecyberwire.com/podcasts/daily-podcast/2593/notes thecyberwire.com

RSS Hunter • Jul 15

The ransomware toll road.

The U.S. Treasury has sanctioned a VPN provider linked to ransomware operations. The Pentagon has temporarily halted its CMMC audits due to unspecified reasons. Critical vulnerabilities were discovered in Google Cloud's Dialogflow CX, enabling AI agent hijacking. Estée Lauder has reported a data breach that exposed health records and Social Security numbers. Mobile networks are being exploited to track U.S. personnel, with Iran implicated in one such campaign. Australia has criticized major technology companies for their shortcomings in addressing online child sexual abuse. SAP is urging customers to patch critical flaws affecting its NetWeaver and Commerce Cloud products. CISA has added a Cisco IOS flaw to its catalog of actively exploited vulnerabilities. The U.S. federal government is prioritizing AI investments through increased funding. Finally, some companies are restricting employee AI usage due to high costs.

https://www.thecyberwire.com/podcasts/daily-podcast/2592/notes thecyberwire.com

RSS Hunter • Jul 14

State of the router.

The US and allies are issuing warnings about Russian cyber threats to critical infrastructure amidst new European sanctions. Apple has filed a lawsuit against OpenAI, accusing them of stealing trade secrets to build their hardware business. Progress Software is investigating a potential security incident affecting their ShareFile service. Zimbra has released a patch for a critical vulnerability that could lead to code execution. Researchers have identified CrashStealer, a new macOS malware designed to steal information and disguise itself as a crash reporter. The EPA is assessing the resilience of water utilities against cyberattacks. Scammers are creating fake news websites that closely resemble legitimate ones to trick victims into fraudulent investment schemes. The episode also covers a business briefing and news about Californians exercising their data deletion rights. Brandon Karpf from NTT joins to discuss the 11th Japan-U.S. Cyber Dialogue. Listeners are encouraged to rate and review the podcast and sign up for the Daily Briefing newsletter.

https://www.thecyberwire.com/podcasts/daily-podcast/2591/notes thecyberwire.com

RSS Hunter • Jul 13

Preparing space for Q-day. [T-Minus: Space-Cyber Briefing]

As the world prepares itself for quantum computing, governments and private space enterprises alike are looking to get ahead of the technology and manage the rapidly-accelerating risks.In this week’s episode, host Maria Varmazis sits down with ⁠⁠⁠Eddy Zervigon, CEO of Quantum XChange to discuss the impacts that the post-quantum world will have impact on the space sector. During the conversation, they explore what stakeholders are doing to prepare themselves for Q-day and what a post-quantum world could look like.⁠Key sources:USHERING IN THE NEXT FRONTIER OF QUANTUM INNOVATIONLike what you heard? Be sure to subscribe to our free Signals and Space Briefing⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, our Sunday newsletter covering the intersection of cybersecurity and space. Subscribe at: https://thecyberwire.com/newsletters/signals-and-spaceIs there a topic or person you’d like to hear on our show? You can send your questions and feedback to [email protected]⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠. You can also fill our our audience survey: https://www.surveymonkey.com/r/NJYCN2PT-Minus: Space-Cyber Briefing is a production of N2K CyberWire. N2K is your nexus for discovery and connection for people, technology, and ideas shaping the future of secure innovation. Learn how at n2k.com.

https://thecyberwire.com/podcasts/tminus-space-cyber-briefing/715/notes thecyberwire.com

RSS Hunter • Jul 12

Conti-versal opinions. [Research Saturday]

Today we are joined by Geoff White, host of Cyber Hack and BBC journalist, taking a deep dive into the Conti ransomware gang. Geoff explores an in-depth investigation into the notorious Conti ransomware gang, drawing from thousands of leaked internal messages to reveal how the group operated behind the scenes. The research uncovers surprising internal debates over targeting healthcare organizations, the fallout from accidentally exposing sensitive Saudi royal family data, and frantic efforts to free an arrested gang member. It also offers a rare look at Conti leader Vitaliy Kovalev through newly uncovered video footage, providing an unprecedented glimpse into one of cybercrime's most influential figures.

https://thecyberwire.com/podcasts/research-saturday/432/notes thecyberwire.com

RSS Hunter • Jul 11

GoshDarn it, that’s advanced.

Ransomware is becoming increasingly sophisticated, with new variants exploiting malicious drivers. Zimbra has urged users to patch a critical vulnerability in its Classic Web Client. A vishing campaign is actively targeting Microsoft 365 accounts, employing social engineering tactics. GigaWiper, a destructive malware, combines espionage with multiple payloads for system sabotage. The European Union is taking legal action against member states for insufficient cybersecurity measures. The NSA has reinstated its elite hacking unit under the name Tailored Access Operations (TAO). In Puerto Rico, a government agency inadvertently exposed a million Social Security numbers. A former ransomware negotiator has been imprisoned for assisting the BlackCat ransomware group. Maxim Zavodchik from Akamai discussed new security risks associated with the upcoming MCP specification. Lastly, a thief posed as a Wi-Fi technician to steal a valuable trophy.

https://www.thecyberwire.com/podcasts/daily-podcast/2590/notes thecyberwire.com

RSS Hunter • Jul 10

Who you gonna call?

GhostApproval highlights vulnerabilities in AI coding assistants, while Microsoft addresses the RoguePlanet zero-day. Over 70 cybersecurity firms have endorsed a new AI Charter. An Ohio county reportedly paid a $1 million ransom. AssuranceAmerica disclosed a breach impacting nearly seven million individuals. Australia has decommissioned thousands of broadband routers. Israeli fintech Nayax and Japanese telco KDDI both reported cyber incidents, with KDDI's affecting 12 million. A global anti-fraud operation led to thousands of arrests. Ben Yelin discussed the EU Cloud and AI Development Act. Slopfix, ironically using AI, battles AI-generated code bloat.

https://www.thecyberwire.com/podcasts/daily-podcast/2589/notes thecyberwire.com

RSS Hunter • Jul 9

Azure you concerned?

Accenture has confirmed a data breach after a hacker offered stolen data for sale, highlighting the ongoing threat of cyberattacks. A nationwide outage in Australia is being investigated, with concerns that it may have been caused by a foreign-launched cyberattack. The UK is planning to build an autonomous AI-powered "Cyber Shield" to defend the nation against cyber threats. The Cybersecurity and Infrastructure Security Agency (CISA) is expected to finalize its critical infrastructure reporting rule in September. A recent operation known as "NewsJunkie" has been disrupted, which was involved in faking CTV ad traffic. Agentic AI has been found to trigger endpoint detection and response (EDR) systems, highlighting the potential risks of AI-powered attacks. CISA has partnered with Mythos to conduct vulnerability scans, using AI-powered technology to identify potential threats. Meta is facing potential fines of up to $1.4 trillion in state lawsuits, related to its handling of user data. A recent report has found that many cybersecurity workers have been told to conceal breaches, highlighting the need for greater transparency in the industry. The Linux Foundation's Akrites initiative is a coordinated industry effort to harden the world's most critical open source software against AI-enabled cyber threats, and is being discussed by Russ Anderson, COO and co-founder of RapidFort, on the CyberWire Daily podcast.

https://www.thecyberwire.com/podcasts/daily-podcast/2588/notes thecyberwire.com

RSS Hunter • Jul 8

Welcome home, hacker.

CERT/CC has issued a warning about an unpatched backdoor found in Tenda routers. Adobe is actively working to fix a critical flaw in their ColdFusion software that is already being exploited by attackers. Canada has disclosed details about its offensive cyber operations conducted last year. Anthropic has removed hidden tracking mechanisms from its AI chatbot Claude Code. Chinese AI models are becoming more competitive as U.S. providers increase their pricing. U.S. cloud companies are voicing objections to new security regulations proposed by South Korea. Microsoft's device telemetry data played a crucial role in identifying an alleged Scattered Spider hacker. Spanish police, with assistance from the FBI, have apprehended an individual suspected of being a pro-Russia hacktivist. Orla Daly of Skillsoft discussed the current state of AI guardrails and organizational readiness.

https://www.thecyberwire.com/podcasts/daily-podcast/2587/notes thecyberwire.com

RSS Hunter • Jul 7

NetNut gets cracked.

The FBI has disrupted a significant residential proxy service, the NetNut network. Concurrently, attackers are exploiting Fortinet firewalls to target UK officials, stealing government logins. European lawmakers are calling for an investigation into spyware, with one instance involving Pegasus spyware being infected by similar malware. A new macOS infostealer, PamStealer, has emerged, masquerading as a clipboard manager and designed to steal credentials. Prompt injection campaigns are actively targeting AI agents through malicious websites and SEO poisoning tactics. Researchers have successfully tricked Claude into executing remote code. The increasing demand for AI services is placing a strain on the power grid, complicating its reliability. Gabi Reish of Bitsight discussed shifting cybercriminal activity trends. In unrelated news, a Japanese teenager was arrested for a cyberattack that unsubscribed thousands of anime accounts. The CyberWire Daily podcast is seeking listener feedback and offers sponsorship opportunities.

https://www.thecyberwire.com/podcasts/daily-podcast/2586/notes thecyberwire.com

RSS Hunter • Jul 6

Commercializing space. [T-Minus: Space-Cyber Briefing]

Over the past two decades, the space industry has changed dramatically, evolving from a largely government led effort to one that is now rooted in private enterprises driving growth and innovation.In this week’s episode, host Maria Varmazis sits down with ⁠⁠⁠Damian DiPippa, CEO of Auria Space, to discuss how the commercialization of the space industry is driving new changes. During the conversation, they explore the future of command and control, cyber resilience, and the growing partnership between commercial and national security space.Like what you heard? Be sure to subscribe to our free Signals and Space Briefing⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, our Sunday newsletter covering the intersection of cybersecurity and space. Subscribe at: https://thecyberwire.com/newsletters/signals-and-spaceIs there a topic or person you’d like to hear on our show? You can send your questions and feedback to [email protected]⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠. You can also fill our our audience survey: https://www.surveymonkey.com/r/NJYCN2PT-Minus: Space-Cyber Briefing is a production of N2K CyberWire. N2K is your nexus for discovery and connection for people, technology, and ideas shaping the future of secure innovation. Learn how at n2k.com.

https://thecyberwire.com/podcasts/tminus-space-cyber-briefing/714/notes thecyberwire.com

RSS Hunter • Jul 5

Is your enterprise AI strategy delivering ROI yet? [AI Security Brief]

Many enterprises are in a disruptive phase of AI adoption, facing more process changes than immediate value delivery. This aligns with historical patterns of digital transformations, where significant disruption precedes tangible outcomes. Dr. Grace Trinidad from IDC highlights that AI adoption is a complex process, not just a simple tool deployment. Business and technology leaders must carefully consider how to integrate AI into existing operational workflows. Emerging risks in this area include token consumption and the need for AI FinOps for security and cost management. Dr. Trinidad suggests that AI ontologies will become crucial business differentiators in the future. Understanding this current phase is essential for organizations to accurately assess their AI adoption progress. The AI Security Brief aims to provide leaders with insights into AI trends, threats, and critical decisions. TrendAI focuses on proactive AI security to enable innovation while mitigating risk. The discussion offers clarity on where organizations truly stand in their AI journeys.

https://thecyberwire.com/podcasts/ai-security-brief/4/notes thecyberwire.com

RSS Hunter • Jul 4

CyberWire Daily at 10: The vulnerabilities, zero‑days, and hardware flaws over the last decade. [Special Edition]

In this special edition of CyberWire Daily’s 10th anniversary series, N2K CyberWire's Maria Varmazis and Dave Bittner discuss 10 years of vulnerabilities, zero‑days, and hardware flaws. Together they reflect on the last decade of cybersecurity vulnerabilities, exploring key shifts, landmark incidents like WannaCry and Log4Shell, and the evolving landscape shaped by hardware issues and AI. Join Maria and Dave as they discuss how these changes impacted security practices and the importance of vigilance in a rapidly interconnected world.

https://thecyberwire.com/podcasts/special-edition/101/notes thecyberwire.com

RSS Hunter • Jul 3

The people's AI?

OpenAI is reportedly considering an equity plan to share AI profits with the public. Cisco has confirmed that its unified Communications Manager platform is actively being exploited by attackers. Researchers have identified the first documented instance of an autonomous ransomware operation. A partnership between Vect and TeamPCP has been formed to conduct ransomware campaigns. The FortiBleed campaign has been linked to credential harvesting and subsequent ransomware attacks. A stealthy malware called Veil#Drop is being used to deploy the PureLog Stealer. Scammers are targeting small businesses with fraudulent emails impersonating law enforcement. A vulnerability in Apple's Hide My Email feature may expose users' real email addresses. An alleged member of the Scattered Spider hacking group has been extradited to the United States. The podcast also features a discussion on the Supreme Court's ruling regarding geofence warrants.

https://www.thecyberwire.com/podcasts/daily-podcast/2585/notes thecyberwire.com

RSS Hunter • Jul 2

The AI lock comes off.

The US has lifted its export ban on Anthropic's advanced AI models, allowing their return to the market. Adobe and Citrix have rapidly released crucial patches to address significant vulnerabilities in their software. A new and rapidly evolving DDoS threat known as RustDuck has been identified, showing signs of organized growth. The ransomware group The Gentlemen has escalated its attacks with an exploit capable of disabling endpoint detection and response systems. Rocket Lab is making a substantial investment by acquiring Iridium, aiming to create a fully integrated space company. Researchers have developed and revealed a new type of ransomware that operates entirely within a web browser, making it difficult for traditional antivirus software to detect. Concerns are growing regarding New Zealand's cybersecurity preparedness following several major attacks. Iran's persistent cyber espionage activities, including a recent focus on economic espionage and intellectual property theft, are drawing renewed attention. The episode features Donald Codling, CISO at REGO, discussing the vital connection between security by design, psychological safety, and digital trust. Finally, a reminder is given to sign up for the Daily Briefing and follow CyberWire Daily on LinkedIn to stay informed.

Hacker & Security News on Bluesky @hacker.at.thenote.app bsky.app

RSS Hunter • Jul 1

The court draws a privacy line.

The Supreme Court has placed limits on geofence warrants, requiring police to obtain them before accessing Google location data. The Department of Homeland Security intends to expand CISA by hiring more cybersecurity professionals and appointing a new director. The State Department is offering a substantial reward for information leading to the identification of Russian hackers targeting communication platforms. A novel legal theory could significantly alter how data is shared between the European Union and the United States. Recent cyberattacks have impacted the D.C. Housing Authority, causing its website to go offline. Vulnerabilities in Oracle and SimpleHelp software are currently being actively exploited by malicious actors. Malware was discovered on Japanese military networks, having been present for almost a year via infected USB drives. Stolen data from an Apple supplier, including a list of parts and images for a future iPhone model, has surfaced online. John Cannava, CIO at Ping Identity, highlighted that identity threats persist year-round, especially during busy periods like major events. The Secret Service is reportedly reducing its reliance on company-issued phones, indicating a shift in security practices for BYOD.

https://www.thecyberwire.com/podcasts/daily-podcast/2583/notes thecyberwire.com

RSS Hunter • Jun 30

AI behind the velvet rope.

The US government is imposing export controls on advanced AI models, potentially creating opportunities for rivals. Russian threat actors are targeting secure messaging platforms like Signal to steal account verification codes and PINs. A high-severity vulnerability in the Linux kernel, dubbed DirtyClone, allows for privilege escalation to root access. Investigations suggest that federal websites are violating privacy rules through their redesigns. Microsoft has disrupted a campaign involving over a hundred malicious browser extensions that stole credentials and engaged in ad fraud. Researchers have discovered that carefully crafted GitHub repositories can trick AI coding agents into executing malware. The Department of Justice has successfully seized hundreds of domains used for illegal World Cup streaming. An Anonymous-linked hacker received an 18-month sentence for website defacement, specifically a cyberattack on the Texas GOP. Dylan Sandlin from the NACD highlighted cyber risk as a critical concern for corporate boards. Finally, an issue has emerged where AI models used for medical diagnosis could potentially reveal the training data they used, raising patient privacy concerns.

https://www.thecyberwire.com/podcasts/daily-podcast/2582/notes thecyberwire.com

RSS Hunter • Jun 29

Uniting Women in Cyber Podcast: Breaking Barriers in Cybersecurity with Cybersecurity Girl. [Special Edition]

In this Special Edition episode, N2K CyberWire's Dave Bittner sits down with Caitlin Sarian, widely known as Cybersecurity Girl, to explore how storytelling, authenticity, and community are reshaping a more human-centered cybersecurity landscape.Recorded live at The Cyber Guild's Uniting Women in Cyber (UWIC) Event last fall, this candid conversation highlights Caitlin’s unconventional path into cybersecurity and her mission to make the industry more accessible and relatable for all. Together, they explore how breaking down technical barriers can unlock new pathways into the field especially for those from nontraditional backgrounds.UWIC brings together industry leaders, practitioners, and emerging talent to advance the cybersecurity workforce through leadership, innovation, and inclusion. Join us on Oct 8 for UWIC 2026!

https://thecyberwire.com/podcasts/special-edition/99/notes thecyberwire.com

RSS Hunter • Jun 28

Space supply chain pressures. [T-Minus: Space-Cyber Briefing]

Despite the space sector seeing greater investment and attention year-over-year, the sector still remains bound by an outdated and ineffective supply chain, especially in the United States.In this week’s episode, host Maria Varmazis sits down with Doug Anderson, Partner at PwC, and Steve Jordan-Tomaszewski, Vice President of the Space Systems Division at AIA, to dive into PwC’s recent study looking at the sector’s supply chain limitations. During the conversation, they examine the supply chain’s base risks and bottlenecks, and what strategies can be utilized to address these concerns. Key sources:Strengthening America’s space supply chainLike what you heard? Be sure to subscribe to our free Signals and Space Briefing⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, our Sunday newsletter covering the intersection of cybersecurity and space. Subscribe at: https://thecyberwire.com/newsletters/signals-and-spaceIs there a topic or person you’d like to hear on our show? You can send your questions and feedback to [email protected]⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠. You can also fill our our audience survey: https://www.surveymonkey.com/r/NJYCN2PT-Minus: Space-Cyber Briefing is a production of N2K CyberWire. N2K is your nexus for discovery and connection for people, technology, and ideas shaping the future of secure innovation. Learn how at n2k.com.

https://thecyberwire.com/podcasts/tminus-space-cyber-briefing/713/notes thecyberwire.com

RSS Hunter • Jun 28

More bark than byte. [Research Saturday]

This week we are joined by Daniel Schwalbe, Chief Information Security Officer & Head of Investigations at DomainTools, discussing their work on "ZionSiphon OT Malware First Attempts? Psyops? Both?" Researchers at DomainTools take a closer look at ZionSiphon, a purported operational technology malware sample targeting the water sector, and find that despite its alarming appearance, it lacks many of the capabilities needed to function as a credible cyber-physical weapon. They break down the malware's architecture, its operational shortcomings, and why it may be more of a prototype or proof of concept than a deployable threat. With heightened concern surrounding attacks on critical infrastructure amid the ongoing U.S.-Iran conflict, the research offers timely insight into separating genuine OT threats from overhyped malware.The research and executive brief can be found here:Threat Intelligence Report: ZionSiphon OT Malware First Attempts?

https://thecyberwire.com/podcasts/research-saturday/431/notes thecyberwire.com

RSS Hunter • Jun 27

Factory reset required.

Tata Electronics and Bajaj Auto are still recovering from recent cyberattacks. The FCC has implemented new rules for undersea cables to enhance national security. CISA has issued a warning about a vulnerability in PTC software that is actively being exploited. The Gamaredon group is updating its methods and using legitimate services to conceal its activities. Hackers linked to Iran are weaponizing public warning systems for psychological operations. Threat actors are specifically targeting critical infrastructure throughout Southeast Asia. A framework known as DCloud is reportedly fueling a global scam economy. Polish authorities have successfully dismantled a SIM-swapping gang. France's national statistics agency experienced a cyberattack impacting nearly 13,000 employees. Michael Fanning from Splunk joined to discuss how AI reveals existing problems.

https://www.thecyberwire.com/podcasts/daily-podcast/2581/notes thecyberwire.com

RSS Hunter • Jun 26

Gone with the command.

An international operation successfully disrupted the Amadey and StealC malware infrastructure. Australian intelligence chief warned that nation-state hackers are preparing to sabotage critical infrastructure. A new stealthy backdoor may be linked to an initial access broker, and researchers have identified a supply chain vulnerability named "Cordyceps." Iran-linked MuddyWater is disguising its espionage efforts as ransomware attacks, while Cal Water disputes hacking claims about its systems. Russia reportedly continued using Cellebrite phone-cracking tools despite a ban. China's 360 cybersecurity firm has developed AI tools to compete with Anthropic's Mythos. A DraftKings hacker, known as 'Snoopy,' received an eighteen-month prison sentence. The guest, Erich Kron of KnowBe4, discussed the CAPY program, offering free cybersecurity training for families. The show also noted that nearly half of LG smart TV apps contain residential proxy SDKs.

https://www.thecyberwire.com/podcasts/daily-podcast/2580/notes thecyberwire.com

RSS Hunter • Jun 25

Klue me in on the breach.

LastPass has confirmed that customer information was affected by the Klue breach, though they assert passwords remain secure. Attackers are actively exploiting a vulnerability in Cisco Unified Communications Manager. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has flagged actively exploited flaws in Ubiquiti and Lantronix devices, urging immediate patching. New flaws in DifyTap could allow unauthorized access to private AI conversations across different users. Researchers discovered that an AI plugin registry permitted unofficial tools to impersonate legitimate software. The launch of the xpl0itrs leak site suggests a move towards comprehensive cyber extortion services. Indian automotive giant Bajaj Auto has fallen victim to a ransomware attack. The U.S. government is urging Meta to allow its AI models to undergo national security reviews. An individual accused of administering a criminal marketplace has been extradited to the United States. Furthermore, the U.S. has expanded sanctions against a Cambodian network involved in cyber fraud operations.

https://www.thecyberwire.com/podcasts/daily-podcast/2579/notes thecyberwire.com

RSS Hunter • Jun 24

All eyes on AI.

The Five Eyes intelligence alliance has issued a warning that artificial intelligence could significantly amplify cyberattacks in the coming months. Tata Electronics, a supplier for major companies like Apple and Tesla, has confirmed a data breach where sensitive documents were allegedly stolen. Researchers have published new analysis regarding the FortiBleed vulnerability and its exploitation. Meanwhile, a breach at Gizmodo has exposed its readers to a malware campaign called ClickFix. A concerning new BootROM exploit has emerged, capable of bypassing Apple's crucial SecureROM defenses and potentially affecting millions of iPhones. Members of the cybercrime group Scattered Spider have pleaded guilty in the UK for their involvement in various cyberattacks. Attackers are actively exploiting a flaw in the Gravity SMTP plugin to steal sensitive information from WordPress websites. In a proactive move to enhance national security, an Executive Order has been signed to accelerate the federal government's transition to post-quantum cryptography. Industry experts are discussing progress and remaining challenges in achieving quantum readiness for critical infrastructure. This collection of news highlights the rapidly evolving landscape of cyber threats and security responses.

https://www.thecyberwire.com/podcasts/daily-podcast/2578/notes thecyberwire.com

RSS Hunter • Jun 23

The Klue is in the data trail.

A supply-chain attack on Klue has impacted several cybersecurity firms. A new ransomware called Prinz Eugen has been identified and is noted for its polished nature. The ShinyHunters group has leaked sensitive data belonging to 10,000 employees of the Council of Europe. Security agencies are warning about the FortiBleed operation, which targets credential harvesting. A data breach in Texas has affected hunting and fishing licensees. Microsoft has linked the Mastra AI supply-chain attack to North Korean hackers. The Vidar infostealer has developed a new method to bypass Chrome's encryption. Brazil is investigating a suspected hack of its emergency alert system. The "Industry Voices" segment features a discussion on AI-powered attacks becoming a commodity. This brief also mentions Apple patching a vulnerability in Beats Studio Buds.

https://www.thecyberwire.com/podcasts/daily-podcast/2577/notes thecyberwire.com

RSS Hunter • Jun 22

Vulnerability response: Built for humans, outpaced by machines. [CyberWire-X]

For years, security teams had time between discovery and exploitation. Time to triage. Time to validate. Time to prioritize what to fix first. AI has compressed that window. Frontier models now discover and chain vulnerabilities faster than human analysts can confirm them, and the gap between finding and fixing is shrinking in both directions. In this episode of CyberWire-X, N2K’s ⁠Dave Bittner⁠ and Federico Kirschbaum, Head of XBOW Security Lab, explore what it actually means to run autonomous offensive security, why validation workflows built for quarterly testing cycles struggle to keep up, and how practitioners are redefining what a tested application looks like when the pace of offense has fundamentally changed.

https://thecyberwire.com/podcasts/cyberwire-x/57/notes thecyberwire.com

RSS Hunter • Jun 21

Navigating the GPS threat landscape, with Brandon Karpf. [T-Minus: Space-Cyber Briefing]

Traditionally, GPS jamming attacks have been confined to the ground; however, new data shows that these attacks could be moving to target signals before they even reach the ground.In this week’s episode, host Maria Varmazis sits down with Dave Bittner and Brandon Karpf to discuss recent research that suggests the attack landscape for GPS attacks is expanding. If this research is accurate, these attacks represent a significant evolution for how defenders think about this critical technology.Key sources:Something is jamming GPS over Europe. Here's what we found.Chasing Lightning: Detecting, Characterizing, and Identifying a Powerful Space-Based GNSS Interference Source.EKS 5.Like what you heard? Be sure to subscribe to our free Signals and Space Briefing⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, our Sunday newsletter covering the intersection of cybersecurity and space. Subscribe at: https://thecyberwire.com/newsletters/signals-and-space Is there a topic or person you’d like to hear on our show? You can send your questions and feedback to [email protected]⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠. You can also fill our our audience survey: https://www.surveymonkey.com/r/NJYCN2P T-Minus: Space-Cyber Briefing is a production of N2K CyberWire. N2K is your nexus for discovery and connection for people, technology, and ideas shaping the future of secure innovation. Learn how at n2k.com.

https://thecyberwire.com/podcasts/tminus-space-cyber-briefing/712/notes thecyberwire.com

RSS Hunter • Jun 21

Peeling back Banana RAT. [Research Saturday]

This week, we are joined by Tom Kellermann, Trend Micro's VP of AI Security and Threat Research, discussing their work on "Inside SHADOW-WATER-063’s Banana RAT: From Build Server to Banking Fraud." Researchers from Trend Micro's MDR team uncovered the full operation behind Banana RAT, a sophisticated banking trojan they track as SHADOW-WATER-063, by analyzing both attacker infrastructure and infected victim systems. The malware uses fileless PowerShell execution, layered obfuscation, and remote-control capabilities to steal credentials, manipulate banking sessions, intercept Pix QR code payments, and facilitate financial fraud targeting Brazilian banks. The campaign appears to be operated by a Brazilian Portuguese-speaking cybercriminal group with ties to the broader Tetrade banking malware ecosystem and may be evolving toward a malware-as-a-service model.The research and executive brief can be found here:⁠Inside SHADOW-WATER-063’s Banana RAT: From Build Server to Banking Fraud

https://thecyberwire.com/podcasts/research-saturday/430/notes thecyberwire.com

RSS Hunter • Jun 20

CyberWire Daily at 10: A decade of leaks, espionage, and influence operations. [Special Edition]

In this special edition of CyberWire Daily’s 10th anniversary series, N2K CyberWire's Maria Varmazis and Dave Bittner discuss leaks, espionage and influence operations over the past 10 years. Together they reflect on a decade of cybersecurity developments, focusing on the pivotal year 2016 where a shift occurred. Join N2K as we cover the rise of nation-state cyber operations, major leaks like the Panama Papers and DNC email hacks, and the evolving landscape of cyber norms, trust, and threat perception.

https://thecyberwire.com/podcasts/special-edition/99/notes thecyberwire.com

RSS Hunter • Jun 19

The botnet browser blues.

International law enforcement has successfully disrupted the SocGholish botnet, a significant achievement in combating cybercrime. The UK's cyber chief emphasized that cybersecurity is an ongoing contest, not merely a risk management exercise. Ukraine has been granted access to the EU's cybersecurity reserve, enhancing its defenses against major attacks. Meanwhile, the criminal group known as Gentlemen is reportedly upgrading its ransomware capabilities. A supply chain attack targeting WordPress via the ShapedPlugin update flow has led to malware distribution. Critical security patches have been released by vendors like F5, Atlassian, and Splunk to address vulnerabilities. A new threat called agentjacking is emerging, specifically targeting AI coding assistants by exploiting fake bug reports. Kodak has confirmed a data breach, which was subsequently claimed by the hacking group ShinyHunters. The program features Ben Yelin discussing the failure to reauthorize FISA section 702, highlighting a critical national security debate. Finally, criminal coders are experiencing anxiety about the potential for AI to automate their own illicit activities.

https://www.thecyberwire.com/podcasts/daily-podcast/2576/notes thecyberwire.com

RSS Hunter • Jun 18

The nominee in limbo.

The CyberWire Daily reports on several significant cybersecurity incidents and policy developments. President Trump has halted a key intelligence nomination, raising questions about leadership. The FBI has issued a warning about a new phishing threat targeting Microsoft 365 users. France has decided to cut ties with Palantir due to concerns about overreliance on US technology. A new Android banking trojan capable of complete device takeover has emerged.Fortinet firewalls have been targeted, with reports indicating a significant number have been compromised. CISA has issued an emergency directive for federal agencies to patch a critical vulnerability in Joomla. Data from Madison Square Garden, including information related to the Knicks, has been leaked online. Additionally, malware has been discovered hidden within Steam wallpapers, posing a risk to gamers.The DOJ has argued that artificial intelligence is vital for national security in a recent lawsuit. The podcast also features Christy Wyatt, CEO of Absolute Security, discussing a new ebook from her company. Listeners are encouraged to subscribe to the Daily Briefing for intelligence updates and to follow CyberWire Daily on LinkedIn. The CyberWire is a production of N2K Networks.

https://www.thecyberwire.com/podcasts/daily-podcast/2575/notes thecyberwire.com

RSS Hunter • Jun 17

No Mythos of escape.

Emergency talks between Anthropic and the White House regarding the Fable 5 AI model have reportedly failed. A researcher clarified that the issue stemmed from a simple code-fixing prompt, not a jailbreak attempt. Meanwhile, former President Trump is advocating for enhanced national security systems. Microsoft has released a patch for a critical vulnerability affecting its Copilot enterprise search feature. The ShinyHunters group is exploiting a zero-day flaw in PeopleSoft, targeting universities. DragonForce ransomware was found to have remained hidden within Microsoft Teams for an extended period. Amos Stealer is now specifically targeting macOS devices to steal credentials and keychain data. CISA has mandated a three-day patching deadline for a critical cPanel plugin flaw. The investigation into Delta Air Lines' 2024 system meltdown, linked to a CrowdStrike outage, has concluded without penalty. Researchers have demonstrated how easily AI search results can be manipulated using platforms like Reddit. The episode features Mike Fey, CEO of Island, discussing SASE architecture, and mentions a KPMG report retraction due to AI hallucinations.

https://www.thecyberwire.com/podcasts/daily-podcast/2574/notes thecyberwire.com

RSS Hunter • Jun 16

The fable ends before it begins.

Anthropic has deactivated its Fable 5 and Mythos 5 models to adhere to a government directive. OpenAI is currently facing an investigation from multiple state attorneys general. The Handala hacking group has claimed responsibility for breaching a California water utility. ShinyHunters has reportedly affected another victim with their cyberattacks. The FBI, in collaboration with Google, has successfully taken down a significant phishing platform known as Outsider Enterprise. A global transportation smishing campaign is a major concern, with Bogdan Botezatu from Bitdefender discussing Operation Road Trap. The increasing sophistication of deepfake technology is causing even experts to doubt their own perceptions. A former school district employee has been sentenced to jail for hacking their previous employer. Cyber leaders are defending Anthropic's decision regarding their banned models. The cybersecurity business is seeing substantial investment, with Cyera raising $600 million in a Series G funding round.

https://www.thecyberwire.com/podcasts/daily-podcast/2573/notes thecyberwire.com

RSS Hunter • Jun 15

Securing satellites already in space, with journalist Shaun Waterman. [T-Minus: Space-Cyber Briefing]

For years, space cybersecurity has been a long sought after goal, but due to operational constraints, it was largely unfeasible.In this week’s episode, host Maria Varmazis sits down with journalist Shaun Waterman to discuss his recent article “The Newest Space Race is Cyber.” As space has increasingly become a critical infrastructure component, industry leaders and security agencies alike have begun to launch new initiatives to improve capabilities both on the ground and in orbit.Key sources:The Newest Space Race is Cyber.DHS Wants Satellite Volunteers to Test New Cyber Tools.Five Teams of Hackers will Compete to Breach US Satellite in Space.Like what you heard? Be sure to subscribe to our free Signals and Space Briefing⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, our Sunday newsletter covering the intersection of cybersecurity and space. Subscribe at: ⁠https://thecyberwire.com/newsletters/signals-and-space⁠ Is there a topic or person you’d like to hear on our show? You can send your questions and feedback to ⁠[email protected]⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠. You can also fill our our audience survey: ⁠https://www.surveymonkey.com/r/NJYCN2P⁠ T-Minus: Space-Cyber Briefing is a production of N2K CyberWire. ⁠N2K⁠ is your nexus for discovery and connection for people, technology, and ideas shaping the future of secure innovation. Learn how at n2k.com.

https://thecyberwire.com/podcasts/tminus-space-cyber-briefing/711/notes thecyberwire.com

RSS Hunter • Jun 14

Vulnerability management at AI speed. [CyberWire-X]

In large enterprise software companies, vulnerability management teams are facing unprecedented speed and scale as AI accelerates both discovery and exploitation of security issues. In this episode of CyberWire-X, N2K’s Dave Bittner is joined by Adobe’s Daniel Ventura, Senior Manager of the Vulnerability Operations Center, and Sangeeta Arora, Director of Vulnerability Management, to discuss how Adobe is evolving its vulnerability management strategy to keep pace with AI-driven threats. They share real world insights on prioritization, crossteam partnership, and how modern programs can balance speed with meaningful risk reduction.

https://thecyberwire.com/podcasts/cyberwire-x/56/notes thecyberwire.com

RSS Hunter • Jun 14

This Sparrow doesn't migrate. [Research Saturday]

Martin Zugec, Technical Solutions Director at Bitdefender, discussing their work on "FamousSparrow APT Targets Azerbaijani Oil and Gas Industry." Bitdefender researchers uncovered a sustained cyber espionage campaign by the China-linked FamousSparrow group targeting an Azerbaijani oil and gas company, highlighting the growing focus on critical energy infrastructure in the South Caucasus. The attackers repeatedly exploited the same vulnerable Microsoft Exchange server over multiple months, deploying evolving versions of Deed RAT and Terndoor malware through sophisticated DLL sideloading techniques designed to evade detection and maintain persistence. The operation underscores FamousSparrow's adaptability and persistence, demonstrating how advanced threat actors continually refine their tooling and return to compromised environments until vulnerabilities are fully remediated and access is cut off.The research and executive brief can be found here:FamousSparrow APT Targets Azerbaijani Oil and Gas Industry

https://thecyberwire.com/podcasts/research-saturday/429/notes thecyberwire.com

RSS Hunter • Jun 13

Deadline-driven defense.

CISA is urging federal agencies to adopt a more strategic approach to vulnerability patching. Meanwhile, the House of Representatives failed to extend the FISA surveillance law. Europol has disrupted a significant cryptocurrency laundering operation, potentially linked to the "AudiA6" service, cutting off cybercriminals from substantial funds. GitHub is implementing security updates for npm to better protect against software supply chain attacks. Anthropic has denied claims that their Fable 5 AI model can be easily "jailbroken." CISA has issued a directive demanding federal agencies patch a critical, actively exploited Ivanti Sentry vulnerability within three days. Google has confirmed that the ShinyHunters group exploited a zero-day vulnerability in Oracle PeopleSoft. Evidence suggests APT28, a Russian military intelligence group, is using compromised edge devices and the MooBot botnet for its operations. Discussions are ongoing regarding increased funding for the CyberCorps scholarship program to keep pace with AI advancements. Finally, a problematic software update reportedly disabled air conditioning in Amazon delivery drivers' vehicles during hot weather.

https://www.thecyberwire.com/podcasts/daily-podcast/2572/notes thecyberwire.com

RSS Hunter • Jun 12

The court calls Google’s bluff.

Google is facing potential liability for false information generated by its AI Overviews, a ruling originating from Germany. The White House has paused public assessments of AI models due to growing national security concerns. Anthropic has launched a new, safer version of its AI technology. OpenAI has identified and addressed Chinese influence operations targeting AI discussions in the United States. A powerful new backdoor malware, MLTBackdoor, has been identified, posing a significant threat. Critical vulnerabilities have been discovered in Ivanti Sentry and Veeam Backup & Replication, prompting urgent patch releases. Supply chain attacks are evolving on the Python Package Index (PyPI), with new malware targeting developers. A massive data breach in South Korea has resulted in a record-breaking fine for an e-commerce company. The FIFA World Cup is being analyzed through the lens of AI and common clichés. Peter Barker from Ping Identity discussed how identity is becoming the central control plane for work involving humans, automation, and AI.

Hacker & Security News on Bluesky @hacker.at.thenote.app bsky.app

RSS Hunter • Jun 11

The patch pile reaches new heights.

Microsoft's recent Patch Tuesday addressed an unprecedented 206 bugs, including three zero-days. Critical infrastructure received increased attention as Congress proposed improvements to cyber plans, particularly in light of rising AI threats. A new Windows zero-day exploit, dubbed "RoguePlanet," has been released, posing a significant risk. Mobile AI applications are creating security blind spots, with a large percentage of mobile AI traffic flowing unseen by security professionals. AI agents themselves are proving susceptible to phishing attacks, as demonstrated by a recent experiment. Browser extensions represent another vulnerability, with two Chrome extensions exposing over ten million users to compromise. Spammers are increasingly using legitimate cloud services, such as Google Cloud Storage, to hide their malicious activities. CISA has recognized cybersecurity talent by announcing the winners of its annual President's Cup competition. The episode also features Joe Sykora, CEO of Coro, discussing the managed service provider (MSP) landscape. Finally, reports indicate a slight decrease in the volume of robocalls received by U.S. consumers.

https://www.thecyberwire.com/podcasts/daily-podcast/2570/notes thecyberwire.com

RSS Hunter • Jun 10

A checkmark for trust, a payload for theft.

Miasma malware is affecting Microsoft systems, while SAP has addressed critical vulnerabilities in its software. Google quickly patched a Chrome zero-day exploit that was actively being used. The npm ecosystem is being weaponized by CanisterWorm, and Mac users are targeted by a new malvertising threat. France is investigating a security breach on its secure messaging platform. Insurers are re-evaluating their approach to AI-related risks. The FBI has introduced a new list of wanted fraudsters. A U.S. citizen has admitted to spying for China. Steve Winterfeld from Akamai discusses how AI-powered bots are increasing attacks on financial services. A significant hotel bill was reversed due to a cyber-attack.

https://www.thecyberwire.com/podcasts/daily-podcast/2569/notes thecyberwire.com

RSS Hunter • Jun 9

Meta’s recovery plan needed recovery.

Meta's recent bug in a support tool inadvertently exposed over 20,000 Instagram accounts. CISA has issued a warning about active attacks targeting a vulnerability in SolarWinds Serv-U software. WordPress sites are also at risk due to the exploitation of a widely used plugin. A new variant of the Gafgyt botnet has emerged, expanding its malicious reach. Threat actors known as "Pink" are stealing cloud data using vishing and legitimate tools. Allegations have surfaced accusing IBM and AT&T of concealing hacks. Separately, a dark web drug dealer received a sentence of over 26 years. Tim Starks discussed ongoing debates regarding staffing and budget cuts at CISA. NATO recently participated in a cyber attack simulation where Ukraine acted as the adversary. The CyberWire Daily podcast is produced by N2K Networks.

https://www.thecyberwire.com/podcasts/daily-podcast/2568/notes thecyberwire.com

RSS Hunter • Jun 8

Spoofing ships, jamming drones: how GPS manipulation confuses and compromises. [T-Minus: Space-Cyber Briefing]

GPS constellations have become foundational in modern society supporting everything from navigation to financial services, making the impacts of GPS disruptions all the more concerning.As reliance on these systems have grown, so too have efforts by threat actors to disrupt them through techniques such as jamming and spoofing. As these attacks have become more effective, they are becoming increasingly common, especially in conflict zones where disruption and confusion can prove exceedingly valuable.Key sources:Information about GPS JammingWhat is GPS Spoofing?GPS jamming: The invisible battle in the Middle EastLike what you heard? Be sure to subscribe to our free Signals and Space Briefing⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, our Sunday newsletter covering the intersection of cybersecurity and space. Subscribe at: https://thecyberwire.com/newsletters/signals-and-space Is there a topic or person you’d like to hear on our show? You can send your questions and feedback to [email protected]⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠. You can also fill our our audience survey: https://www.surveymonkey.com/r/NJYCN2P T-Minus: Space-Cyber Briefing is a production of N2K CyberWire. N2K is your nexus for discovery and connection for people, technology, and ideas shaping the future of secure innovation. Learn how at n2k.com.

https://thecyberwire.com/podcasts/tminus-space-cyber-briefing/710/notes thecyberwire.com

RSS Hunter • Jun 7

You've been muted...permanently. [Research Saturday]

Ismael Valenzuela, Arctic Wolf’s VP of Labs, Threat Research and Intelligence, discusses their work on "BlueNoroff Uses ClickFix, Fileless PowerShell, and AI-Generated Fake Zoom Meetings to Target Web3 Sector." Arctic Wolf researchers uncovered a sophisticated campaign by North Korean threat group Lazarus Group subgroup BlueNoroff that targets cryptocurrency and Web3 executives through fake Zoom and Microsoft Teams meetings, using typo-squatted links, ClickFix-style attacks, and AI-generated deepfakes to steal credentials and cryptocurrency-related data. The attackers built a self-reinforcing operation that captures victims’ webcam footage and Telegram sessions, then repurposes those assets alongside AI-generated images to create increasingly convincing fake meeting participants for future attacks. Researchers identified more than 100 victims across 20 countries, with the campaign primarily targeting CEOs, founders, investors, and senior leaders in the cryptocurrency, blockchain, and financial sectors as part of a long-running effort to steal digital assets and gain access to high-value networks.The research and executive brief can be found here:BlueNoroff Uses ClickFix, Fileless PowerShell, and AI-Generated Fake Zoom Meetings to Target Web3 Sector

https://thecyberwire.com/podcasts/research-saturday/428/notes thecyberwire.com

RSS Hunter • Jun 6

The NSA gets an AI upgrade.

The National Security Agency is reportedly using Anthropic's Mythos for cyber operations. There are discussions about a Palantir executive potentially leading CISA. A critical Linux flaw is currently being exploited in active attacks. Minecraft malware has become a commercialized offering. An npm package has been compromised as part of the Miasma worm campaign. Researchers have documented the first instance of an AI-driven container escape. A browser supply-chain attack and a university data breach have been reported, affecting individuals unexpectedly. TryHackMe's Co-Founder, Ashu Savani, discussed building effective SOC and IR teams. Online traffic is now predominantly generated by bots, exceeding human activity. The episode encourages listeners to leave ratings and reviews and offers a daily intelligence roundup.

https://www.thecyberwire.com/podcasts/daily-podcast/2567/notes thecyberwire.com

RSS Hunter • Jun 5