CyberWire Daily

Latest Episodes:

Blizzard warning: Amazon freezes midnight hack. Sep 02, 2025

Show notes

Researchers disrupt a cyber campaign by Russia’s Midnight Blizzard. The Salesloft Drift breach continues to ripple outward. WhatsApp patches a critical flaw in its iOS and Mac apps. A fake PDF editing tool delivers the TamperChef infostealer. A hacker finds crash data Tesla claimed not to have. Spain cancels a €10 million contract with Huawei. A fraudster bilks Baltimore for over $1.5 million. We’ve got a breakdown of the latest Business news. In our Threat Vector segment, ⁠Michael Sikorski⁠ and guest ⁠Thomas P. Bossert explore the path from policy and national security strategy to building operational cyber defense. We preview our spicy new episode of Only Malware in the Building.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.
Threat Vector Segment

In our Threat Vector segment, host David Moulton hands the mic over to ⁠Michael Sikorski⁠ and guest ⁠Thomas P. Bossert⁠, President of Trinity Cyber and former Homeland Security Advisor. They explore the path from policy and national security strategy to building operational cyber defense. Listen to the full conversation here and find new episodes of⁠ Threat Vector⁠ each Thursday on the N2K CyberWire network and in your favorite podcast app.
CyberWire Guest

Today, our podcast producer Liz Stokes speaks with N2K Director of Enterprise Content Strategy Ma'ayan Plaut about our spicy new episode of Only Malware in the Building. You can find the audio version of Only Malware episode here, but we recommend you view the episode for added enjoyment!

Selected Reading

Amazon disrupts Russian APT29 hackers targeting Microsoft 365 (Bleeping Computer)

The Ongoing Fallout from a Breach at AI Chatbot Maker Salesloft (Krebs on Security)

Zscaler swiftly mitigates a security incident impacting Salesloft Drift (Zscaler)

WhatsApp fixes 'zero-click' bug used to hack Apple users with spyware (TechCrunch)

TamperedChef infostealer delivered through fraudulent PDF Editor (Bleeping Computer)

Heimdal Investigation: European Organizations Hit by PDF Editor Malware Campaign (Heimdal Security)

Tesla said it didn’t have critical data in a fatal crash. Then a hacker found it. (The Washington Post)

Spanish government cancels €10m contract using Huawei equipment (The Record)

Scammer steals $1.5 million from Baltimore by spoofing city vendor (The Record)

N2K Pro Business Briefing update (N2K Networks)
Taco Bell rethinks AI drive-through after man orders 18,000 waters (BBC)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Hot sauce and hot takes: An Only Malware in the Building special. [OMITB] Sep 02, 2025

Show notes

Welcome in! You’ve entered, Only Malware in the Building — but this time, it’s not just another episode. This is a special edition you won’t want to miss.

For the first time, our hosts are together in-studio — and they’re turning up the heat. Literally. Join ⁠⁠⁠⁠⁠⁠Selena Larson⁠⁠⁠⁠⁠⁠, ⁠⁠⁠⁠⁠⁠Proofpoint⁠⁠⁠⁠⁠⁠ intelligence analyst and host of their podcast ⁠⁠⁠⁠⁠⁠DISCARDED⁠, along with ⁠⁠⁠⁠⁠⁠N2K Networks⁠⁠⁠⁠⁠⁠ ⁠⁠⁠⁠⁠⁠Dave Bittner⁠⁠⁠⁠⁠⁠ and ⁠⁠⁠⁠⁠Keith Mularski⁠⁠⁠⁠⁠, former FBI cybercrime investigator and now Chief Global Ambassador at ⁠⁠⁠⁠⁠Qintel⁠⁠⁠⁠⁠⁠⁠⁠⁠, as they take on a fiery hot wings challenge while answering personal questions about themselves, their careers, and the stories that shaped them. Think you’ve seen them tackle malware mysteries before? Wait until you see them sweat.

This one’s too good for audio alone — you’ll want to watch the full ⁠video⁠ edition to catch every spicy reaction, every laugh, and maybe even a few tears.

So grab your milk, get ready to feel the burn, and come join us for this special hot take on Only Malware in the Building.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Live from Black Hat: Ransomware, Responsible Disclosure, and the Rise of AI [Microsoft Threat Intelligence Podcast] Sep 01, 2025

Show notes

While our team is observing the Labor Day holiday in the US, we hope you will enjoy this episode of The Microsoft Threat Intelligence Podcast . New episodes airs on the N2K CyberWIre network every other Wednesday.

In this episode of the Microsoft Threat Intelligence Podcast, host⁠ ⁠⁠Sherrod DeGrippo is live from Black Hat 2025 with a special lineup of Microsoft security leaders and researchers.

First, Sherrod sits down with Tom Gallagher, VP of Engineering and head of the Microsoft Security Response Center (MSRC). Tom shares how his team works with researchers worldwide, why responsible disclosure matters, and how programs like Zero Day Quest (ZDQ) are shaping the future of vulnerability research in cloud and AI security. He also announced the next iteration of ZTQ with $5 million up for grabs.

Next, Sherrod is joined by Eric Baller (Senior Security Researcher) and Eric Olson (Principal Security Researcher) to unpack the fast-changing ransomware landscape. From dwell time collapsing from weeks to minutes, to the growing role of access brokers, they explore how attackers operate as organized ecosystems and how defenders can respond.

Finally, Sherrod welcomes Travis Schack (Principal Security Researcher) alongside Eric Olson to examine the mechanics of social engineering. They discuss how attackers exploit urgency, trust, and human curiosity, why AI is supercharging phishing campaigns, and how defenders can fight back with both training and technology.

In this episode you’ll learn:

How MSRC partners with researchers across 59 countries to protect customers
Why Zero Day Quest is accelerating vulnerability discovery in cloud and AI
How ransomware dwell times have shrunk from days to under an hour

Resources:

Related Microsoft Podcasts:

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Get the latest threat intelligence insights and guidance at Microsoft Security Insider

The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.

Learn more about your ad choices. Visit megaphone.fm/adchoices

The labor behind the labor. [Special Edition] Sep 01, 2025

Show notes

This Labor Day, we’re celebrating more than just a holiday. Join us in celebrating not just the work, but the people who make it possible — the labor behind the labor.We’re honoring the people who bring their creativity, dedication, and passion to every corner of N2K. The work you hear, read, and see from us doesn’t happen by accident. It’s the result of talented colleagues who pour themselves into their craft, often in ways that don’t always get the spotlight. From shaping sound and refining scripts to building certification content and producing video, their labor is the heartbeat of what we do.In this special edition, host Ma’ayan Plaut introduces you to some of the voices behind the scenes: Elliott, whose audio artistry makes every show sing; Ethan, whose sharp analysis bridges policy and practice; Alice, whose storytelling brings energy and curiosity to the space industry; George and Ann, who create and refine the certification content that keeps us at the forefront of technology; and Sarelle, whose video production brings our stories to life. Together, they embody the care and creativity that define N2K.And if you’d like to see the labor behind the labor, we’ve also put together a ⁠⁠video⁠⁠ companion to this project — giving you another way to meet the team and experience their work in action. Be sure to check it out!

Learn more about your ad choices. Visit megaphone.fm/adchoices

Marina Ciavatta: Going after the human error. [Social engineer] [Career Notes] Aug 31, 2025

Show notes

Please enjoy this encore of Career Notes.

Social engineer and CEO of Hekate, Marina Ciavatta, shares her story of how people think her job is a la Mission Impossible coming from the ceiling with a rope and stealing stuff in the dead of the night. Marina does physical pentesting. Starting with an unused degree in journalism, Marina turned her talent for writing into a job as a content producer for a technology company and this appealed to her self-proclaimed nerdism. She fell in love with hacking and got into pentesting thanks to a friend. Marina recommends those interested in physical pentesting "try to find other social engineers to mingle. It's in the name. We are social creatures." We thank Marina for sharing her story with us.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Cracks in the wall. [Research Saturday] Aug 30, 2025

Show notes

This week, we are joined by Jamie Levy, Director of Adversary Tactics at Huntress, who is discussing their work on "Active Exploitation of SonicWall VPNs." Huntress has released an urgent threat advisory on active exploitation of SonicWall VPNs, with attackers bypassing MFA, pivoting to domain controllers, and ultimately deploying Akira ransomware. The campaigns involve techniques such as disabling defenses, clearing logs, credential theft, and Bring Your Own Vulnerable Driver (BYOVD) attacks with legitimate Windows drivers.

Organizations using SonicWall devices are strongly advised to disable SSL VPN access or restrict it via IP allow-listing, rotate credentials, and hunt for indicators of compromise as this remains an ongoing and evolving threat.

Complete our annual ⁠⁠⁠⁠⁠audience survey⁠⁠⁠⁠⁠ before August 31.

The research can be found here:

Huntress Threat Advisory: Active Exploitation of SonicWall VPNs

Learn more about your ad choices. Visit megaphone.fm/adchoices

Ransomware sick day. Aug 29, 2025

Show notes

A suspected ransomware attack disrupts hundreds of Swedish municipalities. Google warns Gmail users of emerging cyberattacks tied to the ShinyHunters group. A malicious supply chain attack hits the npm registry. Senators press AFLAC for answers following a data breach. Law enforcement takedowns splinter the ransomware ecosystem. The FBI and Dutch police take down a major online fakeID marketplace. Florida proposes requiring healthcare providers to strengthen data breach preparedness and reporting. Our guest is Kathleen Peters, Chief Innovation Officer at Experian North America, explaining why AI is both accelerating and mitigating fraud. An affiliate army pushes fake casinos worldwide.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today we are joined by Kathleen Peters, Chief Innovation Officer at Experian North America, who is sharing the AI paradox: why AI is both accelerating and mitigating fraud. You can learn more in Experian’s U.S. Identity & Fraud Report.

Selected Reading

Hundreds of Swedish municipalities impacted by suspected ransomware attack on IT supplier (The Record)

Google issues emergency warning for all Gmail users (Geekspin)

TransUnion Data Breach Impacts 4.4 Million (Security Week)

Npm Package Hijacked to Steal Data and Crypto via AI-Powered Malware (Infosecurity Magazine)

US Senators Call for Details of Aflac Data Breach (Bank Infosecurity)

Ransomware gang takedowns causing explosion of new, smaller groups (The Record)

FBI, Dutch cops seize fake ID marketplace, servers (The Register)

Florida Considers Rule to Improve Healthcare Data Breach Transparency (The HIPPA Journal)

Affiliates Flock to ‘Soulless’ Scam Gambling Machine (Krebs on Security)

Audience Survey

Complete our annual audience survey before August 31.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Listening in on the listeners. Aug 28, 2025

Show notes

The FBI shares revelations on Salt Typhoon’s reach. Former NSA and FBI directors sound alarm on infrastructure cybersecurity gaps. Google is launching a new cyber “disruption unit”. A new report highlights cyber risks to the maritime industry. A Pennsylvania healthcare provider suffers a data breach affecting over six hundred thousand individuals. Citrix patches a critical vulnerability under active exploitation. The U.S. sanctions a North Korean-linked fraud network. Ransomware is rapidly evolving with generative AI. Our guest is Brandon Karpf, speaking with T-Minus host Maria Varmazis connecting three seemingly disparate stories. Who needs a tutor when you’ve got root access?

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Our guest today is Brandon Karpf, friend of the show, founder of T-Minus Space Daily, and cybersecurity expert talking with T-Minus host Maria Varmazis. Brandon decided to do a stump the host play for this month's space and cybersecurity segment.

Selected Reading

Chinese Spies Hit More Than 80 Countries in ‘Salt Typhoon’ Breach, FBI Reveals (WSJ)

NSA and Others Provide Guidance to Counter China State-Sponsored Actors Targeting Critical Infrastructure Organizations (NSA)

Critical Infrastructure Leaders and Former National Security Officials Address Escalating Cyber Threats at Exclusive GCIS Security Briefing (Business Wire)

Google previews cyber ‘disruption unit’ as U.S. government, industry weigh going heavier on offense (CyberScoop)

Maritime cybersecurity is the iceberg no one sees coming (Help Net Security)

Healthcare Services Group reports data breach exposing information of over 624 K individuals (Beyond Machines)

Over 28,000 Citrix devices vulnerable to new exploited RCE flaw (Bleeping Computer)

US sanctions fraud network used by North Korean 'remote IT workers' to seek jobs and steal money (TechCrunch)

The Era of AI-Generated Ransomware Has Arrived (WIRED)

Spanish police arrest student suspected of hacking school system to change grades (The Record)

Audience Survey

Complete our annual audience survey before August 31.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Whistle-blown and wide open. Aug 27, 2025

Show notes

A whistle-blower claims DOGE uploaded a sensitive Social Security database to a vulnerable cloud server. Allies push back against North Korean IT scams. ZipLine is a sophisticated phishing campaign targeting U.S.-based manufacturing. Researchers uncover a residential proxy network operating across at least 20 U.S. states. Flock Safety license plate readers face increased scrutiny. A new report chronicles DDoS through the first half of the year. LLM guard rails fail to defend against run-on sentences. A South American APT targets the Colombian government. Our guest is Harry Thomas, Founder and CTO at Frenos, on the benefits of curated and vetted AI training data. One man’s fight against phantom jobs posts.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Our guest today is Harry Thomas, Founder and CTO at Frenos, talking about the benefits of curated and vetted AI training data. Learn more about the Frenos and N2K Networks partnership to utilize industry validated intelligence to build the first AI native OT security posture management platform.

Selected Reading

DOGE Put Critical Social Security Data at Risk, Whistle-Blower Says (The New York Times)

Governments, tech companies meet in Tokyo to share tips on fighting North Korea IT worker scheme (The Record)

ZipLine Campaign: A Sophisticated Phishing Attack Targeting US Companies (Check Point Research)

Phishing Campaign Targeting Companies via UpCrypter (FortiGuard Labs)

Belarus-Linked DSLRoot Proxy Network Deploys Hardware in U.S. Residences, Including Military Homes (Infrawatch)

CBP Had Access to More than 80,000 Flock AI Cameras Nationwide (404 Media)

Evanston shuts down license plate cameras, terminates contract with Flock Safety (Evanston Round Table)

Global DDoS attacks exceed 8M amid geopolitical tensions (Telecoms Tech News)

One long sentence is all it takes to make LLMs misbehave (The Register)

TAG-144’s Persistent Grip on South American Organizations (Recorded Future)

This tech worker was frustrated with ghost job ads. Now he’s working to pass a national law banning them (CNBC)

Audience Survey

Complete our annual audience survey before August 31.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Rolling the dice on cybersecurity. Aug 26, 2025

Show notes

A cyberattack disrupts state systems in Nevada. A China-linked threat actor targets Southeast Asian diplomats. A new attack method hides malicious prompts inside images processed by AI systems.Experts ponder preventing AI agents from going rogue. A new study finds AI is hitting entry-level jobs hardest. Michigan’s Supreme Court upholds limits on cell phone searches. Sen. Wyden accuses the judiciary of cyber negligence. CISA issues an urgent alert on a critical Git vulnerability. Hackers target Maryland’s transit services for the disabled. Our guest is Cristian Rodriguez, Field CTO for the Americas from CrowdStrike, examining the escalating three-front war in AI. A neighborhood crime reporting app gets algorithmically sketchy.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today we are joined by Cristian Rodriguez, Field CTO, Americas from CrowdStrike, as he is examining the escalating three-front war in AI.

Selected Reading

Cybercrime Government Leadership News News Briefs Recorded Future Nevada state websites, phone lines knocked offline by cyberattack (The Record)

Chinese UNC6384 Hackers Use Valid Code-Signing Certificates to Evade Detection (GB Hackers)

New AI attack hides data-theft prompts in downscaled images (Bleeping Computer)

How to stop AI agents going rogue (BBC)

AI Makes It Harder for Entry-Level Coders to Find Jobs, Study Says (Bloomberg)

Fourth Amendment Victory: Michigan Supreme Court Reins in Digital Device Fishing Expeditions (Electronic Frontier Foundation)

Wyden calls for probe of federal judiciary data breaches, accusing it of ‘negligence’ (The Record)

CISA Alerts on Git Arbitrary File Write Flaw Actively Exploited (GB Hackers)

Maryland investigating cyberattack impacting transit service for disabled people (The Record)

Citizen Is Using AI to Generate Crime Alerts With No Human Review. It’s Making a Lot of Mistakes (404 Media)

Audience Survey

Complete our annual audience survey before August 31.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Our TOPPODCAST Picks

Follow Us

Stay Connected

Related Podcasts

Links

Stay Connected