CyberWire Daily

Adam Khan, VP of Security Operations at Barracuda, joins to discuss his team's work on "The evolving use of QR codes in phishing attacks." Cybercriminals are evolving phishing tactics by embedding QR codes, or “quishing,” into PDF documents attached to emails, tricking recipients into scanning them to access malicious websites that steal credentials.

Barracuda researchers found over half a million such emails from June to September 2024, with most impersonating brands like Microsoft, DocuSign, and Adobe to exploit urgency and trust. To counter these attacks, businesses should deploy multilayered email security, use AI-powered detection tools, educate employees on QR code risks, and enable multifactor authentication to safeguard accounts.

The research can be found here:

• Threat Spotlight: The evolving use of QR codes in phishing attacks

Russian hackers attack Ukraine’s state registers. NotLockBit is a new ransomware strain targeting macOS and Windows. Sophos discloses three critical vulnerabilities in its Firewall product. The BadBox botnet infects over 190,000 Android devices. BeyondTrust patches two critical vulnerabilities. Hackers stole $2.2 billion from cryptocurrency platforms in 2024. Officials dismantle a live sports streaming piracy ring. Rockwell Automation patches critical vulnerabilities in a device used for energy control in industrial systems. A new report from Dragos highlights ransomware groups targeting industrial sectors. A Ukrainian national is sentenced to 60 months in prison for distributing the Raccoon Infostealer malware. We bid a fond farewell to our colleague Rick Howard, who’s retiring after years of inspiring leadership, wisdom, and camaraderie. The LockBit gang tease what’s yet to come. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Today’s guest segment is bittersweet as we bid farewell to our beloved Rick Howard, who’s retiring after years of inspiring leadership, wisdom, and camaraderie. Join us in celebrating his incredible journey, sharing heartfelt memories, and letting him know just how deeply he’ll be missed by all of us here at N2K.

Ukraine’s state registers hit with one of Russia’s largest cyberattacks, officials say (The Record)

NotLockBit - Previously Unknown Ransomware Attack Windows & macOS (GB Hackers)

Critical Sophos Firewall Vulnerabilities Let Attackers Execute Remote Code (Cyber Security News)

Botnet of 190,000 BadBox-Infected Android Devices Discovered (SecurityWeek)

BeyondTrust Security Incident — Command Injection and Escalation Weaknesses (CVE-2024-12356, CVE-2024-12686) (SOCRadar)

Crypto-Hackers Steal $2.2bn as North Koreans Dominate (Infosecurity Magazine)

Massive live sports piracy ring with 812 million yearly visits taken offline (Bleeping Computer)

Rockwell PowerMonitor Vulnerabilities Allow Remote Hacking of Industrial Systems (SecurityWeek)

Ransomware Attackers Target Industries with Low Downtime Tolerance (Infosecurity Magazine)

Ukrainian Raccoon Infostealer Operator Sentenced to Prison in US (SecurityWeek)

NetWalker Ransomware Operator Sentenced For Hacking Hundreds Of Organizations (Cyber Security News)

LockBit Admins Tease a New Ransomware Version (Infosecurity Magazine)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

CISA urges senior government officials to enhance mobile device security. Russian state-sponsored hacker group Sandworm is targeting Ukrainian soldiers. A website bug in GPS tracking firm Hapn is exposing customer information. Multiple critical vulnerabilities have been identified in Sharp branded routers. Ireland’s Data Protection Commission fines Meta $263 million for alleged GDPR violations. Google releases an urgent Chrome security update to address four high-rated vulnerabilities. Cyberattacks on India-based organizations surged 92% year-over-year. Cybercriminals target Google Calendar to launch phishing attacks. Fortinet patches a critical vulnerability in FortiWLM. Juniper Networks warns of a botnet infection targeting routers with default credentials. Our guest is Jeff Krull, principal and practice leader of Baker Tilly's cybersecurity practice, with advice on using employee access controls to limit internal cyber threats. When is “undesirable” a badge of honor?

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Our guest is Jeff Krull, principal and practice leader of Baker Tilly's cybersecurity practice, talking about using employee access controls to limit internal cyber threats.

CISA urges senior government officials to lock down mobile devices amid ongoing Salt Typhoon breach (The Record)

Sandworm-linked hackers target users of Ukraine’s military app in new spying campaign (The Record)

Tracker firm Hapn spilling names of thousands of GPS tracking customers (TechCrunch)

Multiple security flaws reported in SHARP routers (Beyond Machines)

Meta fined $263 million for alleged GDPR violations that led to data breach (The Record)

Update Google Chrome Now—4 New Windows, Mac, Linux Security Warnings (Forbes)

India Sees Surge in Banking, Utilities API Attacks (Dark Reading)

Google Calendar Phishing Scam Targets Users with Malicious Invites (Hackread)

Fortinet Patches Critical FortiWLM Vulnerability (SecurityWeek)

Juniper Warns of Mirai Botnet Targeting Session Smart Routers (SecurityWeek)

Recorded Future CEO Calls Russia’s “Undesirable” Listing a “Compliment” (Infosecurity Magazine)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

The U.S. considers a ban on Chinese made routers. More than 200 Cleo managed file-transfer servers remain vulnerable. The Androxgh0st botnet expands. Schneider Electric reports a critical vulnerability in some PLCs. A critical Apache Struts 2 vulnerability is being actively exploited. Malicious campaigns are targeting Chinese-branded IoT devices. A Nebraska-based healthcare insurer discloses a data breach affecting over 225,000 individuals. IntelBroker leaks 2.9GB of data from Cisco’s DevHub environment. CISA issues a Binding Operational Directive requiring federal agencies to enhance cloud security. On today’s CERTByte segment, Chris Hare and Dan Neville unpack a question targeting the Network+ certification. INTERPOL says, “Enough with the pig butchering.“

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

This week, Chris is joined by Dan Neville to break down a question targeting the Network+ certification (N10-008 expires on 12/20/24 and the N10-009 update launched on June 20th of this year). Today’s question comes from N2K’s CompTIA® Network+ Practice Test, both exam versions of which are offered on our site.

Have a question that you’d like to see covered? Email us at certbyte@n2k.com. If you're studying for a certification exam, check out N2K’s full exam prep library of certification practice tests, practice labs, and training courses by visiting our website at n2k.com/certify. To get the full news to knowledge experience, learn more about our N2K Pro subscription at https://thecyberwire.com/pro.

Please note: The questions and answers provided here and on our site are not actual current or prior questions and answers from these certification publishers or providers.

U.S. Weighs Ban on Chinese-Made Router in Millions of American Homes (Wall Street Journal)

Attack Exposure: Unpatched Cleo Managed File-Transfer Software (BankInfo Security)

Androxgh0st Botnet Targets IoT Devices, Exploiting 27 Vulnerabilities (Hackread)

Schneider Electric reports critical flaw in Modicon Programmable Logic Controllers (Beyond Machines)

RATs can sniff out your Chinese-made web cameras: here’s how to defend yourself (Cybernews)

Regional Care Data Breach Impacts 225,000 People (SecurityWeek)

Hacker IntelBroker Leaked 2.9GB of Data Stolen From Cisco DevHub Instance (Cyber Security News)

New critical Apache Struts flaw exploited to find vulnerable servers (Bleeping Computer)

CISA Issues Binding Operational Directive for Improved Cloud Security (SecurityWeek)

Playbook for Strengthening Cybersecurity in Federal Grant Programs for Critical Infrastructure (CISA)

INTERPOL urges end to 'Pig Butchering' term, cites harm to online victims (INTERPOL) 

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

The Biden administration takes its first step to retaliate against China for the Salt Typhoon cyberattack. The Feds release a draft National Cyber Incident Response Plan. Telecom Namibia suffers a cyberattack. The Australian Information Commissioner has reached a $50 million settlement with Meta over the Cambridge Analytica scandal. CISA releases its 2024 year in review. LastPass hackers nab an additional five millions dollars. Texas Tech University notifies over 1.4 million individuals of a ransomware attack. Researchers discover a new DarkGate RAT attack vector using vishing. A fraudster gets 69 months in prison. On our Threat Vector segment, David Moulton speaks with Nir Zuk, Founder and CTO of Palo Alto Networks about predictions for 2025. Surveillance tweaks our brains in unexpected ways. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

On our Threat Vector segment, we preview this week’s episode where host David Moulton talks with Nir Zuk, Founder and CTO of Palo Alto Networks. They talk about Palo Alto Networks' predictions for 2025, focusing on the shift to unified data security platforms and the growing importance of AI in cybersecurity. You can catch new episodes of Threat Vector every Thursday here and on your favorite podcast app. 

Biden Administration Takes First Step to Retaliate Against China Over Hack (The New York Times)

US Unveils New National Cyber Incident Response Plan (Infosecurity Magazine)

Telecom Namibia Cyberattack: 400,000 Files Leaked (The Cyber Express)

Landmark settlement of $50m from Meta for Australian users impacted by Cambridge Analytica incident (OAIC)

CISA Warns of New Windows Vulnerability Used in Hacker Attacks (CyberInsider)

CISA 2024 Year in review (CISA)

LastPass threat actor steals $5.4M from victims just a week before Xmas (Cointelegraph)

Texas Tech University Data Breach Impacts 1.4 Million People (SecurityWeek)

Microsoft Teams Vishing Spreads DarkGate RAT (Dark Reading)

Man Accused of SQL Injection Hacking Gets 69-Month Prison Sentence (SecurityWeek)

The psychological implications of Big Brother’s gaze (SCIMEX)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

A cyberattack in Rhode Island targets those who applied for government assistance programs. U.S. Senators propose a three billion dollar budget item to “rip and replace” Chinese telecom equipment. The Clop ransomware gang confirms exploiting vulnerabilities in Cleo’s managed file transfer platforms. A major Southern California healthcare provider suffers a ransomware attack. A leading US auto parts provider discloses a cyberattack on its Canadian business unit.SRP Federal Credit Union notifies over 240,000 individuals of cyberattack.  A sophisticated phishing campaign targets YouTube creators.  Researchers identify a high-severity vulnerability in Mullvad VPN. A horrific dark web forum moderator gets 30 years in prison. Our guests are Perry Carpenter and Mason Amadeus, hosts of the new FAIK Files podcast. Jailbreaking your license plate. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Our guests are Perry Carpenter and Mason Amadeus, hosts of The FAIK Files podcast, talking about their new show. You can find new episodes of The FAIK Files every Friday on the N2K CyberWire network. 

Personal Data of Rhode Island Residents Breached in Large Cyberattack (The New York Times)

Senators, witnesses: $3B for ‘rip and replace’ a good start to preventing Salt Typhoon-style breaches ( CyberScoop)

Clop ransomware claims responsibility for Cleo data theft attacks (Bleeping Computer)

Hackers Steal 17M Patient Records in Attack on 3 Hospitals (BankInfo Security)

Major Auto Parts Firm LKQ Hit by Cyberattack (Securityweek)

SRP Federal Credit Union Ransomware Attack Impacts 240,000 (Securityweek)

ConnectOnCall Announces 914K-Record Data Breach (HIPAA Journal)

Malware Hidden in Fake Business Proposals Hits YouTube Creators (Hackread)

Critical Mullvad VPN Vulnerabilities Let Attackers Execute Malicious Code (Cyber Security News) 

Texan man gets 30 years in prison for running CSAM exchange (The Register)

Hackers Can Jailbreak Digital License Plates to Make Others Pay Their Tolls and Tickets (WIRED)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Please enjoy this encore episode of Career Notes.

Senior security researcher from Secureworks Marcelle Lee shares her career journey into cybersecurity and how she helps solve hard problems in her daily work. Marcelle came into cybersecurity not through any traditional path. She describes her route from a different field and starting in cyber at her local community college through a grant program. Marcelle took full advantage of the opportunities she had and grew her career from there. She recommends finding your specialty, but continue to build other skills. As a woman in the field, she is a strong proponent of diversity and encouraging others to find what excites them. And, we thank Marcelle for sharing her story with us.

This week, we are joined by Andrew Morris, Founder and CTO of GreyNoise, to discuss their work on "GreyNoise Intelligence Discovers Zero-Day Vulnerabilities in Live Streaming Cameras with the Help of AI." GreyNoise discovered two critical zero-day vulnerabilities in IoT-connected live streaming cameras, used in sensitive environments like healthcare and industrial operations, by leveraging its AI-powered detection system, Sift.

The vulnerabilities, CVE-2024-8956 (insufficient authentication) and CVE-2024-8957 (OS command injection), could allow attackers to take full control of affected devices, manipulate video feeds, or integrate them into botnets for broader attacks. This breakthrough underscores the transformative role of AI in identifying threats that traditional systems might miss, highlighting the urgent need for robust cybersecurity measures in the expanding IoT landscape.

The research can be found here:

• GreyNoise Intelligence Discovers Zero-Day Vulnerabilities in Live Streaming Cameras with the Help of AI

The U.S. dismantles the Rydox criminal marketplace.  File-sharing provider Cleo urges customers to immediately patch a critical vulnerability. A Japanese media giant reportedly paid nearly $3 million to a Russia-linked ransomware group. The largest Bitcoin ATM operator in the U.S. confirms a data breach. Microsoft quietly patches two potentially critical vulnerabilities. Researchers at Claroty describe a malware tool used by nation-state actors to target critical IoT and OT systems. Dell releases patches for a pair of critical vulnerabilities. A federal court indicts 14 North Korean nationals for a scheme funding North Korea’s weapons programs. Texas accuses a data broker of sharing sensitive driving data without consent. Tim Starks, senior reporter at CyberScoop, joins Dave to explore the FCC's groundbreaking proposal to introduce cybersecurity rules linked to wiretapping laws. How the bots stole Christmas. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Tim Starks, senior reporter at CyberScoop, joins Dave to explore the FCC's groundbreaking proposal to introduce cybersecurity rules linked to wiretapping laws. Read more about it in Tim’s article.

Rydox Cybercrime Marketplace Disrupted, Administrators Arrested (SecurityWeek)

Cleo urges customers to ‘immediately’ apply new patch as researchers discover new malware (The Record)

Japanese game and anime publisher reportedly pays $3 million ransom to Russia-linked hackers (The Record)

Bitcoin ATM Giant Byte Federal Hit by Hackers, 58,000 Users Impacted (Hackread)

Microsoft Patches Vulnerabilities in Windows Defender, Update Catalog (SecurityWeek)

Researchers Discover Malware Used by Nation-Sates to Attack OT Systems (Infosecurity Magazine)

Critical Dell Security Vulnerabilities Let Attackers Compromise Affected Systems (Cyber Security News)

14 North Korean IT Workers Charged, US to Offer $5 Million Rewards for Info (Cyber Security News)

Texas adds data broker specializing in driver behavior to list of alleged privacy law violators (The Record)

UK Shoppers Frustrated as Bots Snap Up Popular Christmas Gifts (Infosecurity Magazine)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

ChatGPT and Meta face widespread outages. Trump advisors explore splitting NSA and CyberCom leadership roles. A critical vulnerability in Apache Struts 2 has been disclosed. “AuthQuake” allowed attackers to bypass Microsoft MFA protections. Researchers identify Nova, a sophisticated variant of the Snake Keylogger malware. Adobe addresses critical vulnerabilities across their product line. Chinese law enforcement has been using spyware to collect data from Android devices since 2017. A new report highlights the gaps in hardware and firmware security management. A Krispy Kreme cyberattack creates a sticky situation. N2K’s Executive Editor Brandon Karpf speaks with guest Mike Silverman, Chief Strategy and Innovation Officer at the FS-ISAC discussing cryptographic agility. Do Not Track bids a fond farewell. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Today, N2K’s Executive Editor Brandon Karpf speaks with guest Mike Silverman, Chief Strategy and Innovation Officer at the FS-ISAC discussing cryptographic agility. You can learn more in their new white paper "Building Cryptographic Agility in the Financial Sector." We will share the extended version of this conversation over our winter break. Stay tuned. 

ChatGPT Down Globally, Services Restored After Hours Of Outage (Cyber Security News)

Facebook, Instagram and other Meta apps go down due to 'technical issue' (CNBC)

Unfinished business for Trump: Ending the Cyber Command and NSA 'dual hat' (The Record)

Apache issues patches for critical Struts 2 RCE bug (The Register)

Microsoft MFA Bypassed via AuthQuake Attack (SecurityWeek)

Nova Keylogger – A Snake Malware Steal Credentials and Capture Screenshorts From Windows (Cyber Security News)

Adobe releases December 2024 patches for flaws in multiple products, including critical (Beyond Machines)

Mobile Surveillance Tool EagleMsgSpy Used by Chinese Law Enforcement (SecurityWeek)

Three-Quarters of Security Leaders Admit Gaps in Hardware Knowledge (Infosecurity Magazine)

Krispy Kreme cyberattack impacts online orders and operations (Bleeping Computer)

Firefox, one of the first “Do Not Track” supporters, no longer offers it (Ars Technica) 

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Microsoft confirms a critical Windows zero-day vulnerability. Global law enforcement agencies dismantle 27 DDoS platforms. Researchers compromise memory in AMD virtual machines. Ivanti reports multiple critical vulnerabilities in its Cloud Services Application. Group-IB researchers expose a sophisticated global phishing campaign. A zero-day vulnerability in Cleo’s managed file transfer software is under active exploitation. The U.S. sanctions a Chinese firm for a 2020 firewall exploit. Congress looks to require the FCC to regulate telecom cybersecurity. Our guest is Malachi Walker, Security Strategist at DomainTools, discussing their role in ODNI's newly established Sentinel Horizon Program. SpartanWarriorz dodge a Telegram crackdown. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Our guest is Malachi Walker, Security Strategist at DomainTools, about their role in ODNI's newly established Sentinel Horizon Program.

New Windows 0Day Attack Confirmed—Homeland Security Says Update Now (Forbes)

Microsoft Fixes 71 CVEs Including Actively Exploited Zero-Day (Infosecurity Magazine)

Atlassian, Splunk Patch High-Severity Vulnerabilities (SecurityWeek)

Chrome Security Update, Patch for 3 High-severity Vulnerabilities (Cyber Security News)

ICS Patch Tuesday: Security Advisories Released by Siemens, Schneider, CISA, Others (SecurityWeek)

Operation PowerOFF Takes Down DDoS Boosters (Infosecurity Magazine)

AMD Chip VM Memory Protections Broken by BadRAM (Security Boulevard)

Three more vulns spotted in Ivanti CSA, all critical, one 10/10 (The Register)

Global Ongoing Phishing Campaign Targets Employees Across 12 Industries (Hackread)

New Cleo zero-day RCE flaw exploited in data theft attacks (Bleeping Computer) 

US Sanctions Chinese Firm at Center of Global Firewall Hack (Infosecurity Magazine)

Wyden legislation would mandate FCC cybersecurity rules for telecoms (CyberScoop)

Scam Kit Maker Rebuilding Business After Telegram Channel Shut Down (Security Boulevard) 

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Researchers uncover a large-scale hacking operation tied to the infamous ShinyHunters. A Dell Power Manager vulnerability lets attackers execute malicious code. TikTok requests a federal court injunction to delay a U.S. ban. Radiant Capital attributed a $50 million cryptocurrency heist to North Korea. Japanese firms report ransomware attacks affecting their U.S. subsidiaries. WhatsApp’s “ViewOnce” feature faces continued scrutiny. SpyLoan malware targets Android users through deceptive loan apps. A major Romanian electricity distributor is investigating an ongoing ransomware attack. A critical flaw in OpenWrt Sysupgrade has been fixed. Contenders for top cyber roles in the next Trump administration visit Mar-a-Lago. On our Industry Voices segment, Jason Lamar, Cobalt’s Senior Vice President of Product, joins us to share insights on offensive security: staying ahead of cyber threats. Google’s new quantum chip promises scaling without failing. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

On our Industry Voices segment, Jason Lamar, Cobalt’s Senior Vice President of Product, joins us to share insights on offensive security: staying ahead of cyber threats. Check out Cobalt’s GigaOm Radar Report for PTaaS 2024 to learn more. 

ShinyHunters, Nemesis Linked to Hacks After Leaking Their AWS S3 Bucket (Hackread)

Dell Power Manager Vulnerability Let Attackers Execute Malicious Code (Cyber Security News)

TikTok Asks Court To Suspend Ban Ahead of Supreme Court Appeal (The Information)

Radiant links $50 million crypto heist to North Korean hackers (Bleeping Computer)

US subsidiaries of Japanese water treatment company, green tea maker hit with ransomware (The Record)

WhatsApp View Once Vulnerability Let Attackers Bypass The Privacy Feature (Cyber Security News)

SpyLoan Malware: A Growing Threat to Android Users (Security Boulevard)

Romanian energy supplier Electrica hit by ransomware attack (Bleeping Computer)

OpenWrt Sysupgrade flaw let hackers push malicious firmware images (Bleeping Computer)

Homeland Security veteran to be interviewed for Trump administration cyber role (The Record)

Google claims ‘breakthrough’ with new quantum chip (Silicon Republic)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

A critical zero-day is confirmed by a Japanese router maker. Romania annuls the first round of its 2024 presidential election over concerns of Russian interference. A sophisticated malware campaign targets macOS users. Mandiant uncovers a method to bypass browser isolation using QR codes. Belgian and Dutch authorities arrest eight individuals linked to online fraud schemes. A medical device company discloses a ransomware attack. A community hospital in Massachusetts confirms a ransomware attack affecting over three hundred thousand. The Termite ransomware gang claims responsibility for the attack on Blue Yonder. Synology patches multiple vulnerabilities in its Router Manager (SRM) software. The head of U.S. Cyber Command outlines the challenges of keeping decision makers up to date. Our guest is Anna Pobletts, Head of Passwordless at 1Password, discussing the state of passkeys and what she sees on the road to a truly passwordless future. Robot rats join the mischief. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Our guest is Anna Pobletts, Head of Passwordless at 1Password, discussing the state of passkeys and what she sees on the road to a truly passwordless future. 

I-O Data Confirms Zero-Day Attacks on Routers, Full Patches Pending (SecurityWeek)

Romania’s top court annuls presidential election result (CNN)

MacOS Passwords Alert—New Malware Targets Keychain, Chrome, Brave, Opera (Forbes)

QR codes bypass browser isolation for malicious C2 communication (Bleeping Computer)

Eight Suspected Phishers Arrested in Belgium, Netherlands (SecurityWeek)

Medical Device Maker Artivion Scrambling to Restore Systems After Ransomware Attack (SecurityWeek)

Anna Jaques Hospital ransomware breach exposed data of 300K patients (Bleeping Computer)

Blue Yonder SaaS giant breached by Termite ransomware gang (Bleeping Computer)

Synology Router Vulnerabilities Let Attackers Inject Arbitrary Web Script (Cyber Security News)

Cyber Command Chief Discusses Challenges of Getting Intel to Users (Defense.gov)

Robot Rodents: How AI Learned To Squeak And Play (Hackaday)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

CEO and Founder of Votiro Aviv Grafi shares his story from serving as a member of the IDF's intelligence forces to leading his own venture. Aviv says his service in the IDF shaped a lot of his thinking and problem solving. Following his military service, Aviv worked to gain more real world and business experience. Starting his own business as a pentester was where the seeds for what would become Votiro would form. Aviv talks about the roller coaster that you experience when starting your own venture and offers some advice. And, we thank Aviv for sharing his story with us.

In this special edition podcast, N2K's Executive Editor Brandon Karpf talks with author, CEO and cybersecurity advisor Dr. Bilyana Lilly about her new novel "Digital Mindhunters."

In a high-stakes game of espionage and deception, a female analyst uncovers Russia's plot to wield artificial intelligence, espionage, and disinformation as weapons of chaos against the United States. As she races against time to thwart an assassination plot, she finds herself entangled in a web of international intrigue and discovers a parallel threat from a Chinese spy network aiming to steal data, manipulate American voters, and harness technology to dismantle the very foundations of U.S. democracy. In a world where lies are a weapon and trust is a luxury, she navigates the treacherous worlds of arms dealers, hackers, and spies to protect her country.

Dr. Bilyana Lilly is a cybersecurity and information warfare expert. She advises senior executives in the private and public sector on how to mitigate cybersecurity risk across their enterprises. Dr. Lilly serves on the Advisory Boards of the venture capital firm Night Dragon and the cybersecurity firm RunSafe Security. She chairs the Democratic Resilience Track of the Warsaw Security Forum and is an adjunct senior advisor for critical infrastructure and resilience at the Institute for Security and Technology. Her previous roles include a manager at Deloitte's Financial Cybersecurity Practice and a fellow at the RAND Corporation. Dr. Lilly holds a PhD in policy analysis and cyber security, and three master's degrees, including an honors degree from Oxford University. Her book "Russian Information Warfare" became a bestseller and is on display at the Pentagon. Dr. Lilly is a mentor and a speaker at RSA, DefCon, CyCon, and the Executive Women's Forum. She has been denounced by Russia's Ministry of Foreign Affairs and called cyber expert by Tom Hanks.

Shawn Kanady, Global Director of Trustwave SpiderLabs, to discuss their work on "Pronsis Loader: A JPHP-Driven Malware Diverging from D3F@ck Loader." Trustwave SpiderLabs has uncovered Pronsis Loader, a new malware variant using the rare programming language JPHP and stealthy installation tactics to evade detection.

The malware is capable of delivering high-risk payloads like Lumma Stealer and Latrodectus, posing a significant threat. Researchers highlight its unique capabilities and infrastructure, offering insights for bolstering cybersecurity defenses.

The research can be found here:

• Pronsis Loader: A JPHP-Driven Malware Diverging from D3F@ck Loader

Researchers uncover a critical Windows zero-day.  An alleged Ukrainian cyberattack targets one of Russia’s largest banks. Russian group BlueAlpha exploits CloudFlare services. Microsoft flags Chinese hacking group Storm-0227 for targeting critical infrastructure and U.S. government agencies. SonicWall patches high-severity vulnerabilities in its secure access gateway. Atrium Health reports a data breach affecting over half a million individuals. Rockwell Automation discloses four critical vulnerabilities in its Arena software. U.S. authorities arrest an alleged member of the Scattered Spider gang. Our guest is Hugh Thompson, RSAC program committee chair, discussing the 2025 Innovation Sandbox Contest and its new investment component. C3PO gets caught in the crypto mines. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Joining Dave today is Hugh Thompson, RSAC program committee chair, discussing the 2025 Innovation Sandbox Contest and its new investment component. Read more details in the press release. 

New Windows 7 To 11 Warning As Zero-Day With No Official Fix Confirmed (Forbes)

Russian users report Gazprombank outages amid alleged Ukrainian cyberattack (The Record)

BlueAlpha Russian hackers caught abusing CloudFlare services (SC Media)

U.S. org suffered four month intrusion by Chinese hackers (Bleeping Computer)

Microsoft: Another Chinese cyberspy crew targeting US critical orgs 'as of yesterday' (The Register)

SonicWall Patches 6 Vulnerabilities in Secure Access Gateway (SecurityWeek)

Mitel MiCollab zero-day and PoC exploit unveiled (Help Net Security)

Atrium Health Data Breach Impacts 585,000 People (SecurityWeek)

Rockwell Automation Vulnerabilities Let Attackers Execute Remote Code (Cyber Security News)

US arrests Scattered Spider suspect linked to telecom hacks  (Bleeping Computer)

Nebraska Man pleads guilty to $3.5 million cryptojacking scheme (Bleeping Computer)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Europol dismantles the Manson cybercrime market. Operation Destabilise stops two major Russian-speaking money laundering networks. New details emerge on China’s attacks on U.S. telecoms. Black Lotus Labs uncovers a covert campaign by the Russian-based threat actor “Secret Blizzard”. Cisco issues patches for a high impact bootloader vulnerability. Trend Micro researchers uncovered Earth Minotaur targeting Tibetan and Uyghur communities. Payroll Pirates target HR payroll systems to redirect employee funds .Pegasus spyware may be more prevalent than previously believed. Our guest today is Jon France, CISO at ISC2, with insights from the ISC2 2024 Workforce Study. How businesses can lose customers one tip at a time. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Our guest today is Jon France, CISO at ISC2, sharing the ISC2 2024 Workforce Study. You can read the press release about the report here and dig into the details of the report itself here. 

50 Servers Linked to Cybercrime Marketplace and Phishing Sites Seized by Law Enforcement (SecurityWeek)

UK’s NCA Disrupts Multibillion-Dollar Russian Money Launderers (Infosecurity Magazine)

The White House reveals at least 8 U.S. telecom firms impacted by China’s Salt Typhoon cyberattack (Fast Company)

Senators implore Department of Defense to expand the use of Matrix (Element)

Snowblind: The Invisible Hand of Secret Blizzard (Lumen)

Frequent freeloader part I: Secret Blizzard compromising Storm-0156 infrastructure for espionage (Microsoft Security)

Russian Hackers Exploit Rival Attackers’ Infrastructure for Espionage (Infosecurity Magazine)

Bootloader Vulnerability Impacts Over 100 Cisco Switches (SecurityWeek)

MOONSHINE Exploit Kit and DarkNimbus Backdoor Enabling Earth Minotaur’s Multi-Platform Attacks (Trend Micro)

Hunting Payroll Pirates: Silent Push Tracks HR Redirect Phishing Scam (Silent Push)

iVerify Mobile Threat Investigation Uncovers New Pegasus Samples (iVerify)

How a Russian man’s harrowing tale shows the physical dangers of spyware (CyberScoop)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

International law enforcement takes down the MATRIX messaging platform. SailPoint discloses a critical vulnerability in its IdentityIQ platform. A Solana library has been backdoored. SolarWinds discloses a critical vulnerability in its Platform product. Researchers identify 16 zero-day vulnerabilities in Fuji Electric’s remote monitoring software. Cisco urges users to patch a decade-old vulnerability. CISA warns of active exploitation of Zyxel firewall devices. A critical XSS vulnerability has been identified in MobSF. Google’s December 2024 Android security update addresses 14 high-severity vulnerabilities. The Federal Trade Commission settles with data brokers over alleged consent violations. On today’s CertByte segment, Chris Hare and Dan Neville break down a question targeting the A+ Core (220-1101) Exam 1 certification. A vodka company gets iced by ransomware.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Welcome to CertByte! On this bi-weekly segment hosted by Chris Hare, a content developer and project management specialist at N2K, we share practice questions from N2K’s suite of industry-leading certification resources, and a study tip to help you achieve the professional certifications you need to fast-track your career growth in IT, cyber security, or project management.

This week, Chris is joined by Dan Neville breaking down a question targeting the A+ Core (220-1101) Exam 1 certification. Today’s question comes from N2K’s CompTIA® A+ Core Exam 1 Practice Test (Core Exam 2 Practice Test is also available on our site).

Have a question that you’d like to see covered? Email us at certbyte@n2k.com. Check out N2K’s full exam prep library of certification practice tests, practice labs, and training courses by visiting our website at n2k.com/certify.

Please note: The questions and answers provided here and on our site are not actual current or prior questions and answers from these certification publishers or providers.

Additional sources: www.comptia.org

International Operation Dismantles MATRIX: A Sophisticated Encrypted Messaging Service (SOCRadar)

German Police Shutter Country’s Largest Dark Web Market (Infosecurity Magazine)

10/10 directory traversal bug hits SailPoint's IdentityIQ (The Register)

Solana Web3.js Library Backdoored in Supply Chain Attack (SecurityWeek)

SolarWinds Platform XSS Vulnerability Let Attackers Inject Malicious Code (Cyber Security News)

16 Zero-Days Uncovered in Fuji Electric Monitoring Software (GovInfo Security)

Cisco Urges Immediate Patch for Decade-Old WebVPN Vulnerability (Hackread)

VulnerabilitiesCISA Warns of Zyxel Firewall Vulnerability Exploited in Attacks (SecurityWeek)

U.S. CISA adds ProjectSend, North Grid Proself, and Zyxel firewalls bugs to its Known Exploited Vulnerabilities catalog (SecurityAffairs)

MobSF XSS Vulnerability Let Attackers Inject Malicious Scripts (GB Hacker)

Android's December 2024 Security Update Patches 14 Vulnerabilities (SecurityWeek)

FTC accuses data brokers of improperly selling location info (The Register)

Vodka Giant Stoli Files for Bankruptcy After Ransomware Attack (Infosecurity Magazine)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

More than 760,000 see their personal data exposed on the BreachForums cybercrime forum. The new head of the UK’s NCSC warns against underestimating growing cyber threats. The Consumer Financial Protection Bureau (CFPB) looks to prevent data brokers from selling Americans’ personal and financial information. A U.S. government and energy sector contractor discloses a ransomware attack. The “smoked ham” Windows backdoor is being actively deployed. A new report warns of overreliance on Chinese-made LIDAR technology. SmokeLoader malware targets companies in Taiwan. NIST proposes new password guidelines. South Korean police make arrests over 240,000 satellite receivers with built-in DDoS attack capabilities. On our Threat Vector segment, we preview this week’s episode where host David Moulton goes Behind the Scenes with Palo Alto Networks CIO and CISO. ChatGPT has a Voldemort moment. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

On our Threat Vector segment, we preview this week’s episode where host David Moulton goes “Behind the Scenes with Palo Alto Networks CIO and CISO Securing Business Success with Frictionless Cybersecurity.” Meerah Rajavel, CIO of Palo Alto Networks, and Niall Browne, CISO of the organization, join David to discuss the importance of aligning IT strategy with cybersecurity. You can catch new episodes of Threat Vector every Thursday here and on your favorite podcast app. 

760,000 Employee Records From Several Major Firms Leaked Online (SecurityWeek)

UK cyber chief warns country is ‘widely underestimating’ risks from cyberattacks (The Record)

US agency proposes new rule blocking data brokers from selling Americans' sensitive personal data (TechCrunch)

US government contractor ENGlobal says operations are ‘limited’ following cyberattack (TechCrunch)

New Windows Backdoor Security Warning For Bing, Dropbox, Google Users (Forbes)

Chinese LIDAR Dominance a Cybersecurity Threat, Warns Think Tank (Infosecurity Magazine)

SmokeLoader Attack Targets Companies in Taiwan (FortiGuard Labs) 

Korea arrests CEO for adding DDoS feature to satellite receivers (Bleeping Computer)

Do Your Passwords Meet the Proposed New Federal Guidelines? (Wall Street Journal)

These names cause ChatGPT to break, and it's due to AI hallucinations ( TechSpot)  

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

A major cybercrime crackdown by Interpol nabs hundreds of suspects and millions in stolen funds. Zabbix has disclosed a critical SQL injection vulnerability. A novel phishing campaign exploits Microsoft Word’s file recovery feature. Researchers track the Rockstar 2FA phishing toolkit. Critical vulnerabilities are found in Advantech’s industrial wireless access points.  North Korea’s Kimsuky hacking group shifts their tactics. The U.N. forms an advisory body to address growing threats to critical undersea cable infrastructure.The U.K. is laser-focused on AI security research. Russian authorities arrest the Wazawaka ransomware affiliate. Our guest is Marshall Heilman, CEO of DTEX Systems, sharing his experience with a nation-state actor's attempt to gain employment at his company. OpenAI opens the door for encrudification. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Our guest is Marshall Heilman, CEO of DTEX Systems, discussing how HR can spot fake IT workers and sharing their own experience with a nation-state actor's attempt to gain employment at his company. You can read DTEX Systems findings here. 

Global Police Arrest 5500 in $400m Cyber-Fraud Crackdown (Infosecurity Magazine)

Critical Vulnerability Found in Zabbix Network Monitoring Tool (SecurityWeek)

Novel phishing campaign uses corrupted Word documents to evade security (Bleeping Computer)

"Rockstar 2FA" Phishing-as-a-Service Steals Microsoft 365 Credentials Via AiTM Attacks (Cyber Security News) 

Warning: Patch Advantech Industrial Wireless Access Points (GovInfo Security)

North Korean Hacking Group Launches Undected Malwareless URL Phishing Attacks (Cyber Security News)

UN, international orgs create advisory body for submarine cables after incidents (The Record)

U.K. launches AI security lab to combat nation-state cyber threats (SC Media)

Ransomware suspect Wazawaka reportedly arrested by Russia (SC World)

OpenAI explores advertising as it steps up revenue drive (Financial Times) 

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Please enjoy this encore episode, where we are joined by Chief Technology Officer and Senior Vice President, Engineering for Digital Guardian Debra Danielson, as she shares her career journey. From aspirations of becoming an astronaut studying mechanical and aerospace engineering, Finding her first job at a local software company that turned into a long term commitment after it was acquired by another firm. Debra mentions that when she was heads-down programming, there were many women in the field and when she emerged from the cube to take on management and leadership positions, the ratio of women had dropped dramatically. She noted at this time that it took a lot of energy to be different. Debra shared that each time she had challenges in her career, she learned from them. She offers advice of taking risks earlier in your career as you don't know what it could lead to. And, we thank Debra for sharing her story with us.

Please enjoy this encore episode:

Noah Pack, a SANS Internet Storm Center Intern, sits down to discuss research on "What happens when you accidentally leak your AWS API keys?" This research is a guest diary from Noah and shares a project he worked on after seeing an online video of someone who created a python script that emailed colleges asking for free swag to be shipped to him.

The research states "In this article, I will share some research, resources, and real-world data related to leaked AWS API keys." In this research, Noah shares what he learned while implementing his experiment.

The research can be found here:

• What happens when you accidentally leak your AWS API keys? [Guest Diary]

T-Minus Space Daily Podcast Host Maria Varmazis was asked to host a fireside chat with Sci-Fi legend Ronald D. Moore at the Beyond Earth Symposium in Washington DC.  Ronald D. Moore is an American screenwriter and television producer. He is best known for his work on Star Trek, the re-imagined Battlestar Galactica and For All Mankind TV series.

Check out the full conversation on our YouTube Page here!

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our weekly intelligence roundup, Signals and Space, and you’ll never miss a beat. And be sure to follow T-Minus on LinkedIn and Instagram.

We want to hear from you! Please complete our 4 question survey. It’ll help us get better and deliver you the most mission-critical space intel every day.

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at space@n2k.com to request more info.

Please send your pitch to space-editor@n2k.com and include your name, affiliation, and topic proposal.

T-Minus is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Please enjoy this encore episode:

On this Solution Spotlight, guest Lee Parrish, author and CISO at Newell Brands, joins N2K President Simone Petrella to discuss his book "The Shortest Hour: An Applied Approach to Boardroom Governance of Cyber Security" and security relationship management.

Blue Yonder continues to grapple with ransomware attack. AI-powered scams surge this shopping season. Gaming engine exploited to deliver malware. Chinese hackers ride the router wave. TikTok’s beauty filter ban. Redefining cybersecurity education for the future. On our Industry Voices segment, Dave sits down with Damon Fleury, SpyCloud’s Chief Product Officer to discuss defending against what criminals know about you and the role of holistic digital identity in cyber defense. And when do cyber criminals start their holiday scheming?

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Today on our Industry Voices segment, guest Damon Fleury, SpyCloud’s Chief Product Officer, joins Dave to discuss defending against what criminals know about you and the role of holistic digital identity in cyber defense.

Kevin Beaumont (@GossiTheDog) on Mastodon (Mastodon)

Advanced Cyberthreats Targeting Holiday Shoppers (FortiGuard Labs) 

Black Friday Gets a Fakeover: Fake Stores Spike 110% by Using LLMs this Holiday Shopping Season (Netcraft)

The Exploitation of Gaming Engines: A New Dimension in Cybercrime (Check Point Software) 

T-Mobile Engineers Spotted Hackers Running Commands on Routers (Bloomberg Law)  

TikTok will block beauty filters for teens over mental health concerns (The Verge)

Australia passes bill banning social media for children under 16 (The Washington Post)

CISA debuts new cybersecurity training platform (Federal News Network) 

African cybercrime crackdown culminates in 1,006 captured and cuffed (The Record)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Smashing cybercrime syndicates. CyberVolk goes global. Tech troubles mostly resolved. A malware web weaved by Salt Typhoon targets global sectors. Love at first exploit. Ransomware attack on Blue Yonder brews trouble. Google faces a UK court battle. Lateral moves and lost data. I sit down with Clemence Poirer, Senior Cyberdefense Researcher at the Center for Security Studies (CSS) at ETH Zurich | Space Cybersecurity to discuss cybersecurity attacks in space. And finally, a Cybersecurity sales pitch goes rogue.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Today’s guest, Clemence Poirier, Senior Cyberdefense Researcher at the Center for Security Studies (CSS) at ETH Zurich, recently spoke with T-Minus Space Daily podcast host Maria Varmazis about cybersecurity attacks in space. Read the case study: Hacking the Cosmos: Cyber operations against the space sector. A case study from the war in Ukraine.

Bangkok busts SMS Blaster sending 1 million scam texts from a van (Bleeping Computer)

Police bust two Chinese syndicates (Bangkok Post)

'CyberVolk' hacktivists use ransomware in support of Russian interests (The Record) 

Microsoft says massive Outlook and Teams outage is mostly resolved (CNN) 

British hospital group declares ‘major incident’ following cyberattack (The Record) 

NHS declares major cyber incident for third time this year (The Register)

Game of Emperor: Unveiling Long Term Earth Estries Cyber Intrusions (Trend Micro)

RomCom exploits Firefox and Windows zero days in the wild

Starbucks, Grocery Stores Hit by Blue Yonder Ransomware Attack (SecurityWeek)

Google hit with £7B claim over search engine dominance (The Register)

CISA Details Red Team Assessment including TTPs & network defense (GB Hackers)

DOJ: Man hacked networks to pitch cybersecurity services (Bleeping Computer)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

APT28 uses a novel technique to breach organizations via nearby WiFi networks. Your Apple ID is (not) suspended. UK highlighting Russian threats at NATO Cyber Defence Conference. US senators request an audit of TSA's facial recognition technology. Supply chain software company sustains ransomware attack. Critical QNAP vulnerability could allow remote code execution. Outdated Avast Anti-Rootkit driver exploited. No more internet rabbit holes for China. Guest Lesley Carhart from Dragos on "The Shifting Landscape of OT Incident Response." Stop & Shop turns cyber oops into coffee and cookies.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Our guest is ​​Lesley Carhart, Technical Director at Dragos, speaking with Dave Bittner about "The Shifting Landscape of OT Incident Response." You can find the blog here.

Russian Cyberspies Hacked Building Across Street From Target for Wi-Fi Attack (SecurityWeek)

The Nearest Neighbor Attack: How A Russian APT Weaponized Nearby Wi-Fi Networks for Covert Access (Volexity)

New Warning For 2 Billion iPhone, iPad, Mac Users—Your Apple ID Is Suspended (Forbes)

Russia plotting to use AI to enhance cyber-attacks against UK, minister will warn (The Guardian) 

Britain, NATO must stay ahead in 'new AI arms race', says UK minister (Reuters) 

Senators call for audit of TSA’s facial recognition tech as use expands in airports (The Record) 

Blue Yonder ransomware attack disrupts supply chains across UK and US (Tech Monitor)

Critical QNAP Vulnerability Let Attackers Execute Remote Code (Cyber Security News)

Malware campaign abused flawed Avast Anti-Rootkit driver (Security Affairs)

When Guardians Become Predators: How Malware Corrupts the Protectors (Trellix report) 

Imagine a land where algorithms don't ruin the Internet (The Register)

Stop & Shop recovers from 'cybersecurity issue,' will give out free food, coffee (WTNH)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Enjoy this encore episode where we are joined by Co-founder and Chief Strategy Officer for Corelight Greg Bell, as he describes the twists and turns of his career bringing him back to his childhood joy of computers. Working in a myriad of fields from human rights to Hollywood to writing a history of conspiracy belief before pivoting back to technology. Focusing on the relationships within the open source community, Greg works to change and improve the world through his mission-based organization. For those looking to begin their career in cyber, Greg offers that great mentorship and working for great organizations where you can soak in the culture are really important. And, we thank Greg for sharing his story with us.

This week, we are joined by Ami Luttwak, Co-Founder and CTO from Wiz, sharing their work on "Wiz Research Finds Critical NVIDIA AI Vulnerability Affecting Containers Using NVIDIA GPUs, Including Over 35 percent of Cloud Environments." A critical vulnerability in the NVIDIA Container Toolkit, widely used for GPU access in AI workloads, could allow attackers to escape containers and gain full access to host environments, jeopardizing sensitive data.

Wiz estimates that at least 33% of cloud environments are affected and urges immediate updates to NVIDIA's patched version. This discovery highlights the broader issue of young, under-secured codebases in AI tools, emphasizing the need for stronger security measures and collaboration.

The research can be found here:

• Wiz Research Finds Critical NVIDIA AI Vulnerability Affecting Containers Using NVIDIA GPUs, Including Over 35% of Cloud Environments

META details its efforts against pig butchering. The Salt Typhoon attack on major U.S. telecoms sparks interest from Congress.  Microsoft dismantles 240 domains linked to the ONNX phishing-as-a-service platform. A major U.S. gambling and lottery provider suffers a cyberattack. Hackers exploit newly patched zero-days in Palo Alto Networks firewalls. Researchers say Fortinet VPN servers lack sufficient logging. A pilot program looks to improve security for small U.S. water utilities. Bitdefender warns of scammers using Black Friday-themed spam emails. Our guest is DataDome’s CEO and Co-founder, Benjamin Fabre, discussing how "Fake Accounts Threaten Black Friday Gaming Sales." A fond farewell for a true cyber innovator. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

In advance of Black Friday shopping next week, our guest is  DataDome’s CEO and Co-founder, Benjamin Fabre discussing their team's work on "Fake Accounts Threaten Black Friday Gaming Sales." 

Meta cracks down on millions of accounts it tied to pig-butchering scams (CyberScoop)

China’s Hacking Reached Deep Into U.S. Telecoms (New York Times)

FCC leaders skirt call for wiretap security reform, hope to ‘go deeper’ on telecom breach briefings (NextGov)

Microsoft disrupts ONNX phishing-as-a-service infrastructure (Bleeping Computer)

Gambling and lottery giant disrupted by cyberattack, working to bring systems back online (The Record)

Over 2,000 Palo Alto firewalls hacked using recently patched bugs (Bleeping Computer)

Fortinet VPN design flaw hides successful brute-force attacks (Bleeping Computer)

First Water Utilities Take Volunteer Cyber Help (The University of Chicago Harris School of Public Policy)

Three-Quarters of Black Friday Spam Emails Identified as Scams (Infosecurity Magazine)

Thomas E. Kurtz, a Creator of BASIC Computer Language, Dies at 96 (New York Times)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

The feds take down the PopeyeTools cybercrime market. Five alleged Scattered Spider members have been charged.  CISA warns of critical vulnerabilities in VMware’s vCenter Server. Global AI experts convene to discuss safety. MITRE updates its list of Top 25 Most Dangerous Software Weaknesses. US and Australian agencies warn critical infrastructure organizations about evolving tactics by the BianLian ransomware group. A new report looks at rising threats to the U.S. manufacturing industry. Researchers at ESET uncover the WolfsBane Linux backdoor. A pair of malicious Python packages impersonating ChatGPT went undetected for over a year. A data breach at a French hospital compromised the medical records of 750,000 patients. On our Industry Voices segment, guest Avihai Ben-Yossef, Cymulate’s Co-Founder and CTO, joins us to discuss "The Evolution and Outlook of Exposure Management." AI Pimping is the scourge of Instagram. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

On our Industry Voices segment, guest Avihai Ben-Yossef, Cymulate’s Co-Founder and CTO, joins us to discuss "The Evolution and Outlook of Exposure Management."

• Security Validation Essentials
• Hertz Israel Reduced Cyber Risk by 81% within 4 Months with Cymulate
• SecOps Roundtable: Security Validation and the Path to Exposure Management
• Double Agent: Exploiting Pass-through Authentication Credential Validation in Azure AD

US seizes PopeyeTools cybercrime marketplace, charges administrators (Bleeping Computer)

Five Charged in Scattered Spider Case (Infosecurity Magazine)

CISA Warns of VMware VCenter Vulnerabilities Actively Exploited in Attacks (Cyber Security News)

US Gathers Allies to Talk AI Safety as Trump’s Vow to Undo Biden’s AI Policy Overshadows Their Work (SecurityWeek)

MITRE Updates List of 25 Most Dangerous Software Vulnerabilities (SecurityWeek)

BianLian Ransomware Group Adopts New Tactics, Posing Significant Risk (Infosecurity Magazine)

Manufacturing Sector Under Siege: Industry Faces Wave of Advanced Email Attacks (Abnormal Security)

Gelsemium APT Hackers Attacking Linux Servers With New WolfsBane Malware (Cyber Security News)

Two PyPi Malicious Package Mimic ChatGPT & Claude Steals Developers Data (GB Hackers)

Cyberattack at French hospital exposes health data of 750,000 patients (Bleeping Computer)

Inside the Booming 'AI Pimping' Industry (404 Media)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

A WIRED investigation uncovers the ease of tracking U.S. military personnel. Apple releases emergency security updates to address actively exploited vulnerabilities. Latino teenagers and LGBTQ individuals are receiving disturbing text messages spreading false threats. Crowdstrike says Liminal Panda is responsible for telecom intrusions. Oracle patches a high-severity zero-day vulnerability. Trend Micro has disclosed a critical vulnerability in its Deep Security 20 Agent software. A rural hospital in Oklahoma suffers a ransomware attack. A leading fintech firm is investigating a security breach in its file transfer platform. Researchers deploy Mantis against malicious LLMs.  Ben Yelin from the University of Maryland Center for Health and Homeland Security discusses AI’s bias in the resume screening process. Tracking down a lost Lambo. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Today, we have Ben Yelin, Program Director, Public Policy & External Affairs at the University of Maryland Center for Health and Homeland Security and our Caveat podcast co-host, discussing AI’s racial and gender bias in the resume screening process. You can read about it here.

Anyone Can Buy Data Tracking US Soldiers and Spies to Nuclear Vaults and Brothels in Germany (WIRED)

GAO recommends new agency to streamline how US government protects citizens’ data (The Record)

Apple Issues Emergency Security Update for Actively Exploited Flaws (Infosecurity Magazine)

Texts threatening deportation and 're-education' for gays stoke both fear and defiance (NBC News)

Chinese APT Group Targets Telecom Firms Linked to BRI (Infosecurity Magazine)

Oracle Patches Exploited Agile PLM Zero-Day (SecurityWeek)

Trend Micro Deep Security Vulnerability Let Attackers Execute Remote Code (Cyber Security News)

Oklahoma Hospital Says Ransomware Hack Hits 133,000 People (GovInfo Security)

Fintech Giant Finastra Investigating Data Breach (Krebs on Security)

AI About-Face: 'Mantis' Turns LLM Attackers Into Prey (Dark Reading)

Hackers Steal MLB Star Kris Bryant’s $200K Lamborghini By Rerouting Delivery (Carscoops)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Pundits predict Trump will overhaul U.S. cybersecurity policy. Experts examine escalating cybersecurity threats facing the U.S. energy sector. Palo Alto Networks patches a pair of zero-days. Akira and SafePay ransomware groups claim dozens of new victims. A major pharmacy group is pressured to pay a $1.3 million ransomware installment. Threat actors are exploiting Spotify playlists and podcasts. An alleged Phobos ransomware admin has been extradited to the U.S. Rapper “Razzlekhan” gets 18 months in prison for her part in the Bitfinex cryptocurrency hack. On today’s Threat Vector, David Moulton speaks with Assaf Dahan, Director of Threat Research at Palo Alto Networks’ Cortex team, about the rising cyber threat from North Korea.  Swiss scammers send snail mail. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

On this segment of Threat Vector, host David Moulton speaks with Assaf Dahan, Director of Threat Research at Palo Alto Networks’ Cortex team, about the rising cyber threat from North Korea. To hear the full conversation between David and Assaf, listen to Cyber Espionage and Financial Crime: North Korea’s Double Threat, and catch new episodes of Threat Vector every Thursday on your favorite podcast app! 

More Spyware, Fewer Rules: What Trump’s Return Means for US Cybersecurity (WIRED)

How to remove the cybersecurity gridlock from the nation's energy lifelines (CyberScoop)

Palo Alto Patches Firewall Zero-Day Exploited in Operation Lunar Peek (SecurityWeek)

SafePay ransomware: Obscure group uses LockBit builder, claims 22 victims (SC Media)

Akira Ransomware Drops 30 Victims on Leak Site in One Day (SecurityWeek)

Gang Shaking Down Pharmacy Group for Second Ransom Payment (GovInfo Security)

Spotify abused to promote pirated software and game cheats (Bleeping Computer)

Suspected Phobos Ransomware Admin Extradited to US (Infosecurity Magazine)

Heather ‘Razzlekhan’ Morgan sentenced to 18 months in prison, ending Bitfinex saga (The Record)

Now Hackers Are Using Snail Mail In Cyber Attacks—Here’s How (Forbes) 

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

CISA’s Director Easterly plans to step down in the coming year. DHS issues recommendations for AI in critical infrastructure.Palo Alto Networks confirms active exploitation of a critical zero-day vulnerability in its firewalls. Threat actors exploit Microsoft’s 365 Admin Portal to send sextortion emails. A China-based APT targets a zero-day in Fortinet’s Windows VPN. The EPA reports on vulnerabilities in drinking water systems. A critical authentication bypass vulnerability affects a popular WordPress plugin. Researchers track a rise in the ClickFix social engineering technique. An 18 year old faces up to twenty years behind bars for swatting. Our guest is  Rob Boyce, Global Lead, Cyber Resilience at Accenture, discussing SIM swapping services targeting telcos. Nuisance calls are in decline. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Today, we are joined by Rob Boyce, Global Lead, Cyber Resilience at Accenture, discussing SIM swapping services targeting telcos.

CISA Director Jen Easterly to depart on Inauguration Day (Nextgov/FCW)

DHS Releases Secure AI Framework for Critical Infrastructure (Dark Reading)

Palo Alto firewalls exploited after critical zero-day vulnerability (Cybernews)

Microsoft 365 Admin portal abused to send sextortion emails (Bleeping Computer) 

Fortinet VPN Zero-Day Exploited in Malware Attacks Remains Unpatched: Report (SecurityWeek)

300 Drinking Water Systems in US Exposed to Disruptive, Damaging Hacker Attacks (SecurityWeek)

Security plugin flaw in millions of WordPress sites gives admin access (Bleeping Computer)

Security Brief: ClickFix Social Engineering Technique Floods Threat Landscape (Proofpoint)

Teen serial swatter-for-hire busted, pleads guilty, could face 20 years (The Register)

FTC Records 50% Drop in Nuisance Calls Since 2021 (Infosecurity Magazine)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Please enjoy this encore episode where Vice President of Raytheon's Cyber Offense, Defense Expert Teresa Shea speaks of her journey from math to adapting new technologies on the cutting edge, With a love of math, Teresa was offered a scholarship by the Society of Women Engineering and decided to pursue a degree in electrical engineering. Unsurprisingly, there were few other women in her program, Teresa interned with and then proceeded to work for the National Security Agency becoming their SIGINT director. Following her government career, Teresa worked to help bring new technologies to government through her work at Raytheon. We thank Teresa for sharing her story with us.

This week we are joined by, Blake Darché, Head of Cloudforce One at Cloudflare, to discuss their work on "Unraveling SloppyLemming’s Operations Across South Asia." Cloudforce One's investigation into the advanced threat actor "SloppyLemming" reveals an extensive espionage campaign targeting South and East Asia, with a focus on Pakistan's government, defense, telecommunications, and energy sectors.

Leveraging multiple cloud service providers, SloppyLemming employs tactics like credential harvesting, malware delivery, and command-and-control (C2) operations, often relying on open-source adversary emulation tools like Cobalt Strike. Despite its activities, the actor's poor operational security (OPSEC) has allowed investigators to gain valuable insights into its infrastructure and tooling.

The research can be found here:

• Unraveling SloppyLemming’s operations across South Asia

Unredacted court filings from WhatsApp’s 2019 lawsuit against NSO Group reveal the scope of spyware infections. Glove Stealer can bypass App-Bound Encryption in Chromium-based browsers. Researchers uncover a new zero-day vulnerability in Fortinet’s FortiManager. Rapid7 detects an updated version of LodaRAT. CISA warns of active exploitation of Palo Alto Networks’ Expedition tool. Misconfigured Microsoft Power Pages accounts expose sensitive data. Iranian state hackers mimic North Koreans in fake job scams. Australia warns its critical infrastructure providers about state sponsored embedded malware. An especially cruel cybercriminal gets ten years in the slammer. Guest Ambuj Kumar, Co-founder and CEO of Simbian, joins us to discuss how AI Agents may change the cyber landscape. We’re countin’ down the top ten least secure passwords. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Guest Ambuj Kumar, Co-founder and CEO of Simbian, joins us to discuss how AI Agents are going to change the cyber landscape.

1,400 Pegasus spyware infections detailed in WhatsApp’s lawsuit filings (The Record)

Glove Stealer Malware Bypasses Chrome's App-Bound Encryption (SecurityWeek)

watchTowr Finds New Zero-Day Vulnerability in Fortinet Products ( Infosecurity Magazine)

LodaRAT: Established malware, new victim patterns (Rapid7 Blog)

CISA Warns of Two More Palo Alto Expedition Flaws Exploited in Attacks (SecurityWeek)

Microsoft Power Pages misconfigs exposing sensitive data (The Register)

Iranian Threat Actors Mimic North Korean Job Scam Techniques (BankInfo Security)

Hackers Lurking in Critical Infrastructure to Wage Attacks (BankInfo Security)

Cybercriminal devoid of boundaries gets 10-year prison sentence (The Register)

Top 200 Most Common Passwords (NordPass)

Just when you thought voting was over for this year…It’s time to vote…again!

The N2K CyberWire hosting team of Dave Bittner, Maria Varmazis, and Joseph Carrigan have been nominated for the Creator of the Year category in the Baltimore region’s 2024 Technical.ly Awards for their incredible work on the Hacking Humans podcast!

If you're a fan of Hacking Humans, we’d be thrilled to have your support! Please cast your vote here. (Make sure you select the “Baltimore” region). Thanks for your vote! Voting ends Monday, November 18th, so don't delay!

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts wit

h us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

The Feds confirm Chinese penetration of U.S. telecom wiretap systems. Anne Neuberger outlines top cybersecurity challenges facing the upcoming Trump administration. Former Air National Guardsman Jack Teixeira gets a 15-year prison sentence for leaking classified U.S. military documents. A Chinese national faces up to 20 years in prison after pleading guilty to money laundering for “pig-butchering” scams. Researchers say a popular pregnancy app has serious, unaddressed security vulnerabilities. NIST misses its deadline for clearing the NVD backlog. A B2B demand generation company confirms a leak affecting 122 million people. HHS warns healthcare organizations to be on the lookout for Godzilla. Moody’s designates the industries at highest risk of cyber attack. Guest Sarah Hutchins, Partner at Parker Poe, discusses the growing number of state data privacy laws. An AI grandma keeps scammers on the line. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Guest Sarah Hutchins, Partner at Parker Poe, discusses the growing number of state data privacy laws. You can listen to Sarah’s full conversation including litigation trends related to targeted advertising and wiretapping, and key takeaways for companies on cybersecurity practices and risk reporting on today’s Caveat episode. 

FBI confirms China-backed hackers breached US telecom giants to steal wiretap data (TechCrunch)

Top White House cyber official urges Trump to focus on ransomware, China (The Record)

Chinese national faces 20 years in US prison for laundering pig-butchering proceeds (The Record)

IT specialist Jack Teixeira jailed for 15 years after leaking classified military documents on Discord (Bitdefender)

Pregnancy Tracking App ‘What to Expect’ Refuses to Fix Issue that Allows Full Account Takeover (404 Media)

NIST Explains Why It Failed to Clear CVE Backlog (SecurityWeek)

Leaked info of 122 million linked to B2B data aggregator breach (Bleeping Computer)

Feds Warn of Godzilla Webshell Threats to Health Sector (BankInfo Security)

Industries with highest cyber risk unveiled by Moody’s Rating (SC Media)

O2 unveils Daisy, the AI granny wasting scammers’ time (Virgin Media O2) 

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Federal agencies and Five Eyes partners list the past year’s most exploited vulnerabilities. U.S. authorities hand down indictments in the Snowflake customer breach. Patch Tuesday updates. Zoom discloses multiple vulnerabilities. A China-linked hacker group has compromised Tibetan media and university websites. A cyberattack on a Dutch company affects over 2,000 U.S. grocery stores. Sheboygan suffers a ransomware attack. The White House plans to support a controversial UN cybercrime treaty. On today’s CertByte segment, N2K’s Chris Hare is joined by Dan Neville to break down a question from the CompTIA® Security+ certification Practice Test.  Bitcoin Jesus faces $48 million in tax fraud charges. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

On CertByte, host Chris Hare, content developer and project management specialist at N2K, shares practice questions and a study tip to help you achieve the professional certifications you need to fast-track your career growth in IT, cyber security, or project management.

In each segment, Chris is joined by an N2K Content Developer to help illustrate the learning. This week, Chris is joined by Dan Nevllie to break down a question targeting the CompTIA® Security+ (SY0-701) certification. Today’s question comes from N2K’s CompTIA® Security+ Practice Test.

According to CompTIA®, Security+ is "the most widely adopted ISO/ANSI-accredited early career cybersecurity certification on the market." The exam is geared towards anyone who already holds a Network+ cert, and has two years of experience in a security or a systems admin role.To learn more about this and other related topics under this objective, please refer to the following resources: CompTIA Security+ Study Guide with over 500 Practice Test Questions (Sybex Study Guide), Chapter 17: Risk Management and Privacy and CompTIA Security+ Get Certified Get Ahead: SY0-701 Study Guide Chapter 11: Implementing Policies to Mitigate Risk.

Have a question that you’d like to see covered? Email us at certbyte@n2k.com.

Please note: The questions and answers provided here and on our site are not actual current or prior questions and answers from these certification publishers or providers.

Additional sources: www.comptia.org

FBI, CISA, and NSA reveal most exploited vulnerabilities of 2023 (Bleeping Computer)

Here’s the indictment against two men allegedly responsible for Snowflake customer breach (CyberScoop)

Microsoft Patch Tuesday, November 2024 Edition (Krebs on Security)

ICS Patch Tuesday: Security Advisories Released by CISA, Schneider, Siemens, Rockwell (SecurityWeek)

Zoom App Vulnerability Let Attackers Execute Remote Code (Cyber Security News)

China-linked group hacked Tibetan media and university sites to distribute Cobalt Strike payload (The Record)

Dutch company behind Hannaford, Stop & Shop says cyber issue affecting US network (The Record)

City of Sheboygan hit by apparent ransomware attack (WPR)

Biden Administration to Support UN Cyber Treaty Despite Concerns Over Misuse (Bloomberg)

‘Bitcoin Jesus’ Fights IRS Tax Evasion Case From Spanish Island (Bloomberg)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

At the U.N. Anne Neuberger frames ransomware as a growing public health crisis. Amazon confirms a MOVEit-related data breach. SAP provides patches and mitigations for a variety of flaws. Researchers identify North Korean hackers embedding malware in macOS applications. Form I-9 Compliance reports a data breach impacting over 193,000 individuals. Hot Topic confirms a breach affecting over 54 million customers. Halliburton reports a $35 million ransomware event. Ymir ransomware follows in the footsteps of RustyStealer.  Threat actors prepare for a second Trump presidency. A Venezuelan man gets 25 years for romance scam kidnappings. Our guest is Tim Starks from CyberScoop sharing what he’s hearing from Washington insiders as they prepare for the next Trump administration. The Secret Service wonders if warrants are really required.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Our guest is Tim Starks from CyberScoop sharing what he’s hearing from Washington insiders as they prepare for the next Trump administration.

White House Slams Russia Over Ransomware's Healthcare Hits (BankInfo Security)

Amazon employee data stolen by hacker, company confirms (Silicon Republic)

SAP Patches High-Severity Vulnerability in Web Dispatcher (SecurityWeek)

North Korean-linked hackers were caught experimenting with new macOS malware (CyberScoop)

Form I-9 Compliance Data Breach Impacts Over 190,000 People (SecurityWeek)

Hot Topic Data Breach: A Massive Leak Exposes Millions of Customer Records (SOCRadar)

Energy Giant Halliburton Reveals $35m Ransomware Loss (Infosecurity Magazine)

New Ymir ransomware partners with RustyStealer in attacks (Bleeping Computer)

How Global Threat Actors May Respond to a Second Trump Term (GovInfo Security)

Man Gets 25 Years for Online Dating Hostage Scams Targeting Americans (Hackread)

'FYI. A Warrant Isn’t Needed': Secret Service Says You Agreed To Be Tracked With Location Data (404 Media)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Enjoy this special encore episode where we are joined by Chief Security Officer of Microsoft Canada Kevin Magee, he's sharing his background as a historian and how it applies to his work in cybersecurity. Likening himself to a dashing Indiana Jones, Kevin talks about how he sees history unfolding and the most interesting things right now are happening in security. Spending time tinkering with things in the university's computer room under the stairs gave way to Kevin's love affair with technology. As Chief Security Officer, Kevin says he uses an analogy: "I think we focus on the arrows, not the the archer" meaning there's too much focus on the attacks rather than the ones mounting them. As a historian and witness to our current history, Kevin sees the changes all affecting cybersecurity. We thank Kevin for sharing his story with us.

In this special edition of our podcast, Simone Petrella sits down with cybersecurity luminary Alex Stamos, Chief Information Security Officer at SentinelOne, to delve into one of the most challenging years in tech history. 2024 has seen unprecedented breaches of multinational corporations, high-stakes attacks from state actors, massive data leaks, and the largest global IT failure on record. As both a seasoned security executive and respected thought leader, Stamos offers a firsthand perspective on how the security landscape is evolving under these pressures.

In this exclusive keynote discussion, Stamos draws from his extensive experience to share hard-won lessons from the upheavals of 2024, discussing how companies can build — and rebuild — trust amidst this environment of constant threat. What new responsibilities do organizations have to their customers, employees, shareholders, and society? And what major shifts can we expect across cybersecurity and IT practices in response to these cascading challenges? Tune in for a deep dive into how security professionals are rising to meet their roles in a world brimming with motivated and capable adversaries.

Enjoy this special encore episode, where we are joined by Jon Williams from Bishop Fox, as he is sharing their research on "It’s 2024 and Over 178,000 SonicWall Firewalls are Publicly Exploitable." SonicWall published advisories for CVE-2022-22274 and CVE-2023-0656 a year apart after finding that NGFW series 6 and 7 devices are affected by two unauthenticated denial-of-service vulnerabilities.

The research states "Our research found that the two issues are fundamentally the same but exploitable at different HTTP URI paths due to reuse of a vulnerable code pattern." They also found that when they scanned SonicWall firewalls with management interfaces exposed to the internet, they found that 76% are vulnerable to one or both issues.

The research can be found here:

• It’s 2024 and Over 178,000 SonicWall Firewalls are Publicly Exploitable

CISA issues a warning about a critical security flaw in Palo Alto Networks’ Expedition tool. A federal agency urges employees to limit phone use in response to Chinese hacking. Law enforcement is perplexed by spontaneously rebooting iPhones. A key supplier for oilfields suffers a ransomware attack. Hewlett Packard Enterprise (HPE) patches multiple vulnerabilities in its Aruba Networking access points. Cybercriminals use game-related apps to distribute Winos4.0. Germany proposes legislation protecting security researchers. The TSA proposes new cybersecurity regulations for critical transportation infrastructure. Our guest is Aaron Griffin, Chief Architect from Sevco Security, sharing the discovery of a significant Apple iOS bug involving iPhone Mirroring.  AI tries to wing it in a Reddit group, but moderators put a fork in it. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Our guest is Aaron Griffin, Chief Architect from Sevco Security, sharing the discovery of a significant Apple iOS 18 and macOS Sequoia privacy bug that exposes employee personal iPhone apps and data to companies through iPhone Mirroring. Read Sevco’s blog on the topic.

CISA warns of Critical Palo Alto Networks Vulnerability Exploited in Attacks (GB Hackers)

U.S. Agency Warns Employees About Phone Use Amid Ongoing China Hack (Wall Street Journal)

Host of House panels getting briefed on major Chinese hacker telecom breaches (CyberScoop)

Police Freak Out at iPhones Mysteriously Rebooting Themselves, Locking Cops Out (404 Media)

Texas-based oilfield supplier faces disruptions following ransomware attack (The Record)

HPE Patches Critical Vulnerabilities in Aruba Access Points (SecurityWeek)

Winos4.0 hides in gaming apps to hijack Windows systems (The Register)

Germany drafts law to protect researchers who find security flaws (Bleeping Computer)

TSA proposes new cybersecurity rule for surface transportation, seeks public feedback (Industrial Cyber)

Reddit’s ‘Interesting as Fuck’ Community Rules That AI-Generated Video Is Not Interesting (404 Media)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Canada orders ByteDance to shut down local operations. Cisco releases urgent patches for multiple vulnerabilities. SteelFox malware delivers a crypto-miner and info-stealer. North Korean campaigns pursue fake jobs and remote workers. A suspected cyber intrusion disrupts Washington state court systems. Over 200,000 customers of SelectBlinds have their credit card info stolen. Cyber experts encourage congress to pursue bipartisan readiness studies despite DoD pushback. On our Industry Voices segment, we welcome guest Jeremy Huval, Chief Innovation Officer at HITRUST®,  discussing the AI explosion and the need to consider the risks before implementation. Curiosity killed the cat lover’s computer. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

On our Industry Voices segment, we welcome guest Jeremy Huval, Chief Innovation Officer at HITRUST®,  discussing the AI explosion and the need to consider the risks before implementation. Learn more about how robust your AI risk management program is here.

Canada Orders Shutdown of Local TikTok Branch Over Security Concerns (Infosecurity Magazine)

Cisco Patches Critical Vulnerability in Industrial Networking Solution (SecurityWeek)

Cisco Desk Phone Series Vulnerability Lets Remote Attacker Access Sensitive Information (GB Hackers)

‘SteelFox’ Miner and Information Stealer Bundle Emerges (SecurityWeek)

North Korean Hackers Employing New Tactic To Acquire Remote Jobs (Cyber Security News)

Outages impact Washington state courts after ‘unauthorized activity’ detected on network (The Record)

SelectBlinds says 200,000 customers impacted after hackers embed malware on site (The Record)

Congress must demand a study of America’s cyber forces (CyberScoop)

Cybercrooks target Bengal cat lovers in Australia (The Register)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Election day wrap-up. The FBI issues a warning about cybercriminals selling government email credentials. Google issues an emergency update for Chrome. An Interpol operation nets dozens of arrests and IP takedowns. Microchip Technology disclosed $21.4 million in expenses related to a cybersecurity breach. Ransomware makes a Georgia hospital revert to paper records. South Korea fines Meta $15 million over privacy violations. A cyberattack disables panic alarms on British prison vans. A small city in Kansas recovers from a devastating pig butchering scheme. Our guest today is Javed Hasan, CEO and Co-Founder of Lineaje, discussing the growing risks within open source ecosystems. Sending data down the compressed air superhighway.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Our guest today is Javed Hasan, CEO and Co-Founder of Lineaje, discussing the growing risks within open source ecosystems.

Top US cyber official says 'no evidence of malicious activity' impacting election (The Record)

FBI Warns Gmail, Outlook Users Of $100 Government Emergency Data Email Hack (Forbes)

Chrome Security Update: Patch for Multiple High Severity Vulnerabilities (Cyber Security News)

Interpol disrupts cybercrime activity on 22,000 IP addresses, arrests 41 (Bleeping Computer)

Microchip Technology Reports $21.4 Million Cost From Ransomware Attack (SecurityWeek)

Ransomware Attack Disrupts Georgia Hospital's Access to Health Records (SecurityWeek)

South Korea Fines Meta $15 Million for Illegal Data Collection on Facebook Users (CEO Today)

Cyberattack disables tracking systems and panic alarms on British prison vans (The Record)

FBI recovers just $8M after crypto scam crashes Kansas bank (The Register)

The bizarre reason pneumatic tubes are coming back (BBC Science Focus)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

On election day U.S. officials express confidence. A Virginia company is charged with violating U.S. export restrictions on technology bound for Russia. Backing up your GMail. Google mandates MFA. Google claims an AI-powered vulnerability detection breakthrough. Schneider Electric investigates a cyberattack on its internal project tracking platform. A Canadian man suspected in the Snowflake-related data breaches has been arrested. On our Threat Vector segment, David Moulton sits down with Christopher Scott, from Unit 42 to explore the essentials of crisis leadership and management.  I spy air fry?

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

In this segment of the Threat Vector podcast, host David Moulton sits down with Christopher Scott, Managing Partner at Unit 42 by Palo Alto Networks, to explore the essentials of crisis leadership and management in cybersecurity. You can hear the full discussion here and catch new episodes of Threat Vector every Thursday on your favorite podcast app. 

In final check-in before Election Day, CISA cites low-level threats, and not much else (The Record)

Joint ODNI, FBI, and CISA Statement (FBI Federal Bureau of Investigation)

Exclusive: Nakasone says all the news about influence campaigns ahead of Election Day is actually 'a sign of success' (The Record)

Virginia Company and Two Senior Executives Charged with Illegally Exporting Millions of Dollars of U.S. Technology to Russia (United States Department of Justice)

Gmail 2FA Cyber Attacks—Open Another Account Before It’s Too Late (Forbes)

Mandatory MFA is coming to Google Cloud. Here’s what you need to know (Google Cloud)

Schneider Electric says hackers accessed internal project execution tracking platform (The Record)

Google claims AI first after SQLite security bug discovered (The Register)

Suspected Snowflake Hacker Arrested in Canada (404 Media)

Is your air fryer spying on you? Concerns over ‘excessive’ surveillance in smart devices (The Guardian) 

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

The FBI flags fake videos claiming to be from the agency. Okta patches an authentication bypass vulnerability. Microsoft confirms Windows Server 2025 Blue Screen of Death issues. Scammers exploit DocuSign’s APIs to send fake invoices that bypass spam filters. Hackers use smart contracts for command and control. ICS suppliers face challenges convincing customers to secure their environments. Barracuda tracks a phishing campaign impersonating OpenAI. X-Twitter makes controversial changes to its block feature. A Nigerian man gets 26 years in prison for email fraud. On our Solution Spotlight, N2K's Simone Petrella interviews Alex Stamos, CISO at SentinelOne, at the ISC2 Security Congress 2024 about lessons learned in 2024 and what that means for 2025. For a South Dakota plastic surgeon, ransomware was just the beginning of his financial woes.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

On our Solution Spotlight, N2K's Simone Petrella interviews Alex Stamos, CISO at SentinelOne, at the ISC2 Security Congress 2024 about lessons learned in 2024 and what that means for 2025.

FBI flags false videos impersonating agency, claiming Democratic ballot fraud (CyberScoop)

Okta security bug affects those with really long usernames (The Register)

Microsoft confirms Windows Server 2025 blue screen, install issues (Bleeping Computer)

Scammers Use DocuSign API to Evade Spam Filters with Phishing Invoices (Hackread)

Supply Chain Attack Uses Smart Contracts for C2 Ops (Infosecurity Magazine)

Siemens and Rockwell Tackle Industrial Cybersecurity, but Face Customer Hesitation (SecurityWeek)

Cybercriminals impersonate OpenAI in large-scale phishing attack (Barracuda)

X updates block feature, letting blocked users see your public posts (TechCrunch)

US Sentences Nigerian to 26 Years in Prison for Stealing Millions Through Phishing (SecurityWeek)

Doctor Hit With $500K HIPAA Fine: Feds Worse Than Hacker (GovInfo Security) 

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Please enjoy this encore episode, where we are joined by VP of R&D at Arctic Wolf Networks Dinah Davis, as she shares how she arrived in the cybersecurity industry after finding her niche. Dinah recalls how at a time of indecision, a computer course at university and a job with the Canadian government helped to solidify her career direction. Dinah mentions how "security and cryptography specifically was this perfect mix of real world problem solving and mathematics and computer science all combined into one ball of happiness." Networking played a key role in Dinah's journey. She recommends that those interested in joining the field to go for what they believe in. And, we thank Dinah for sharing her story with us.