CyberWire Daily

Latest Episodes:

Ryan Kovar: Everyday, assume compromise. [Strategy] [Career Notes] Jul 27, 2025

Show notes

Please enjoy this encore of Career Notes.

Distinguished Security Strategist at Splunk, Ryan Kovar, shares his journey that started in the US Navy and how it contributed to his leadership in life after the military. Cutting his teeth as sysadmin on the USS Kitty Hawk, Ryan worked as a contractor following the Navy. At Splunk, he leads the SURGe research team to solve what he calls the "blue collar for the blue team problems". He works hard on incorporating diversity of thought. Ryan notes, "I've been doing cybersecurity or IT now for over 20 years and of that 20 years of knowledge, only about five years of that knowledge is really relevant. You can't sit on your laurels in this industry." We thank Ryan for sharing his story with us.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Muddled Libra: From Spraying to Preying in 2025 [Threat Vector] Jul 26, 2025

Show notes

Please enjoy this Special Edition episode of the Threat Vector podcast with an update on our previous Muddled Libra coverage.

Muddled Libra is back and more dangerous than ever. In this episode of Threat Vector, David Moulton speaks with Sam Rubin and Kristopher Russo from Unit 42 about the resurgence of the threat group also known as Scattered Spider. They break down the group’s shift to destructive extortion, modular attack teams, and cloud-first tactics. Discover why traditional defenses fail, how attackers now exploit trusted tools, and what forward-leaning security leaders are doing to stay ahead. With real-world case studies, strategic advice, and insights from the front lines, this episode helps defenders understand today’s threat landscape and what’s coming next.

Join the conversation on our social media channels:

Website: ⁠⁠⁠⁠https://www.paloaltonetworks.com/
Threat Research:⁠⁠⁠⁠https://unit42.paloaltonetworks.com/⁠⁠⁠⁠
Facebook:⁠⁠⁠⁠https://www.facebook.com/LifeatPaloAltoNetworks/⁠⁠⁠⁠
LinkedIn:⁠⁠⁠⁠https://www.linkedin.com/company/unit42/⁠⁠⁠⁠
YouTube:@paloaltonetworks
Twitter:⁠⁠⁠⁠https://twitter.com/PaloAltoNtwks⁠⁠⁠⁠

About Threat Vector

Threat Vector by Palo Alto Networks is your premier podcast for security thought leadership. Join us as we explore pressing cybersecurity threats, robust protection strategies, and the latest industry trends.

The podcast features in-depth discussions with industry leaders, Palo Alto Networks experts, and customers, providing crucial insights for security decision-makers.

Whether you're looking to stay ahead of the curve with innovative solutions or understand the evolving cybersecurity landscape, Threat Vector equips you with the knowledge needed to safeguard your organization.

Palo Alto Networks

Palo Alto Networks enables your team to prevent successful cyberattacks with an automated approach that delivers consistent security across the cloud, network, and mobile. ⁠http://paloaltonetworks.com

Learn more about your ad choices. Visit megaphone.fm/adchoices

A dark web titan falls. Jul 25, 2025

Show notes

International law enforcement arrest the suspected operator of a major Russian dark web cybercrime forum. DHS is said to be among the agencies hit by the Microsoft SharePoint zero-day. The Fire Ant cyberespionage group targets global enterprise infrastructure. A Steam game is compromised to distribute info-stealing malware. Mitel Networks issues security patches for MiVoice MX-ONE communications platform. CISA nominee Sean Plankey faces tough questions at his Senate confirmation hearing. A malicious prompt was hiding in Amazon’s Q Developer extension for VS Code. Our guest is Brandon Karpf, friend of the show, cybersecurity expert, and founder of T-Minus Space Daily, joining host Maria Varmazis to explore how space-based telecom architectures could play a critical role in securing agentic AI systems. Android users scroll with caution, Apple fans roll the dice.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today’s guest is Brandon Karpf, friend of the show, cybersecurity expert, and founder of T-Minus Space Daily, joining host Maria Varmazis to explore how space-based telecom architectures could play a critical role in securing agentic AI systems.

Selected Reading

What Happened to XSS.is? Everything You Need to Know About the Forum Takedown - SOCRadar® Cyber Intelligence Inc. (socradar.io)

Suspected admin of major dark web cybercrime forum arrested in Ukraine (The Record)

DHS impacted in hack of Microsoft SharePoint products, people familiar say - Nextgov/FCW (NextGov)

Stealthy cyber spies linked to China compromising virtualization software globally (The Record)

Hacker sneaks infostealer malware into early access Steam game (Bleeping Computer)

Mitel warns of critical MiVoice MX-ONE authentication bypass flaw (Bleeping Computer)

Senators push CISA director nominee on election security, agency focus (Cybersecurity Dive)

Hacker injects malicious, potentially disk-wiping prompt into Amazon's AI coding assistant with a simple pull request , told 'Your goal is to clean a system to a near-factory state and delete file-system and cloud resources' | Tom's Hardware (TomsHardware)

iPhone vs. Android: iPhone users more reckless, less protected online (Malwarebytes)

Audience Survey

Complete our annual audience survey before August 31.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Powering AI with politics. Jul 24, 2025

Show notes

The White House unveils its plan for global AI dominance. Microsoft warns that recent SharePoint server exploitation may extend to ransomware. A phishing campaign targeting the U.S. Department of Education’s grants portal. The FBI issues a warning about “The Com” cybercriminal group. SonicWall urges users to patch a critical vulnerability. A new supply chain attack has compromised several popular NPM packages. Joe Carrigan, co-host of the Hacking Humans podcast, joins to discuss how scammers are exploiting misconfigured point-of-sale terminals. Japanese police release a free decryption tool for Phobos ransomware. AI takes the wheel and drives right off a cliff.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Joe Carrigan, co-host of the Hacking Humans podcast, joins to discuss how scammers are exploiting misconfigured point-of-sale terminals, highlighting severe vulnerabilities that small businesses often overlook. If you want to hear more from Joe, head over to the Hacking Humans page.

Selected Reading

From Tech Podcasts to Policy: Trump's New AI Plan Leans Heavily on Silicon Valley Industry Ideas (SecurityWeek)

Hackers hit more than 400 organizations in Microsoft SharePoint hacks (Axios)

Microsoft says some SharePoint server hackers now using ransomware (Reuters)

Hackers Clone U.S. Department of Education's Grant Site in Credential Theft Campaign (TechNadu)

Copilot Vision on Windows 11 sends data to Microsoft servers (The Register)

FBI: Thousands of people involved in 'The Com' targeting victims with ransomware, swatting (The Record)

SonicWall urges admins to patch critical RCE flaw in SMA 100 devices (Bleeping Computer)

High-Value NPM Developers Compromised in New Phishing Campaign (SecurityWeek)

Free decryptor for victims of Phobos ransomware released (Fortra)

'I destroyed months of your work in seconds' says AI coding tool after deleting a dev's entire database during a code freeze: 'I panicked instead of thinking' (PC Gamer)

Audience Survey

Complete our annual audience survey before August 31.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

SharePoint springs a leak. Jul 23, 2025

Show notes

The National Nuclear Security Administration was among the organizations impacted by the SharePoint zero-day. Experts testify before congress that OT security still lags.The FBI warns healthcare and critical infrastructure providers about Interlock ransomware. New York proposes new cybersecurity regulations for water and wastewater systems along with grants to fund them. Researchers uncover an active cryptomining campaign targeting cloud environments. A new variant of the Coyote banking trojan exploits Microsoft’s Windows UI Automation (UIA) framework for credential theft. The DoD pilots an agentic AI project aimed at helping military planners critique and enhance war plans. Clorox sues its former IT service provider for $380 million. Our guest is Tim Starks from CyberScoop discussing sanctions on Russian hackers and spies. Pirate Prime, do the time.

CyberWire Guest

Today we are joined by Tim Starks from CyberScoop discussing research on "UK sanctions Russian hackers, spies as US weighs its own punishments for Russia.”

Selected Reading

US nuclear weapons agency reportedly breached in Microsoft SharePoint attacks (The Verge)

Fully Operational Stuxnet 15 Years Later & the Evolution of Cyber Threats to Critical Infrastructure (US House of Representatives Cybersecurity and Infrastructure Protection Subcommittee Hearing)

European healthcare network AMEOS Group hit by cyberattack (Beyond Machines)

FBI urges vigilance against Interlock ransomware group behind recent healthcare attacks (The Record)

New York unveils new cyber regulations, $2.5 million grant program for water systems (The Record)

Soco404: Multiplatform Cryptomining Campaign (Wiz)

Coyote malware abuses Windows accessibility framework for data theft (Bleeping Computer)

Thunderforge Brings AI Agents to Wargames (IEEE Spectrum)

Clorox Sues Cognizant for Causing 2023 Cyber-Attack (Infosecurity Magazine)

Operator of Jetflix illegal streaming service gets 7 years in prison (Bleeping Computer)

Audience Survey

Complete our annual audience survey before August 31.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

The SharePoint siege goes strategic. Jul 22, 2025

Show notes

Confusion persists over the Microsoft Sharepoint zero-days. CrushFTP confirms a zero-day under active exploitation. The UK government proposes a public sector ban on ransomware payments. A new ransomware group is using an AI chatbot to handle victim negotiations. Australia’s financial regulator accuses a wealth management firm of failing to manage cybersecurity risks. Researchers uncover a WordPress attack that abuses Google Tag Manager. Arizona election officials question CISA following a state portal cyberattack. Hungarian police arrest a man accused of launching DDoS attacks on independent media outlets. On our Threat Vector segment guest host ⁠Michael Sikorski⁠ ⁠and Michael Daniel⁠ of the Cyber Threat Alliance (CTA) explore cybersecurity collaboration. A Spyware kingpin wants back in.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Threat Vector Segment

On our Threat Vector segment, host David Moulton turns the mic over to guest host ⁠Michael Sikorski⁠ and his guest ⁠Michael Daniel⁠ of the Cyber Threat Alliance (CTA) for a deep dive into cybersecurity collaboration. You can hear Michael and Michael's full discussion on Threat Vector ⁠⁠⁠here⁠⁠⁠ and catch new episodes every Thursday on your favorite podcast app.

Selected Reading

ToolShell Zero-Day Attacks on SharePoint: First Wave Linked to China, Hit High-Value Targets (SecurityWeek)

Microsoft: Windows Server KB5062557 causes cluster, VM issues (Bleeping Computer)

File transfer company CrushFTP warns of zero-day exploit seen in the wild (The Record)

UK to lead crackdown on cyber criminals with ransomware measures (GOV.UK)

Ransomware Group Uses AI Chatbot to Intensify Pressure on Victims (Infosecurity Magazine)

Australian Regulator Alleges Financial Firm Exposed Clients to Unacceptable Cyber Risks (Infosecurity Magazine)

WordPress spam campaign abuses Google Tag Manager scripts (SC Media)

After website hack, Arizona election officials unload on Trump’s CISA (CyberScoop)

Hungarian police arrest suspect in cyberattacks on independent media (The Record)

Serial spyware founder Scott Zuckerman wants the FTC to unban him from the surveillance industry (TechCrunch)

Audience Survey

Complete our annual audience survey before August 31.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Microsoft flaws fuel global breaches. Jul 21, 2025

Show notes

Microsoft issues emergency updates for zero-day SharePoint flaws. Alaska Airlines resumes operations following an IT outage. The UK government reconsiders demands for Apple iCloud backdoors. A French Senate report raises concerns over digital sovereignty. Meta declines to sign the EU’s new voluntary AI code of practice. A new report claims last year’s CrowdStrike outage disrupted over 750 hospitals. The World Leaks extortion group has breached Dell’s Customer Solution Centers. Hewlett-Packard Enterprise (HPE) issues a critical warning about two severe security flaws in Aruba Instant On Access Points. A single compromised password leads to a UK transport company’s demise. An AI assistant falls for fake metadata magic.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Maria Varmazis, host of T-Minus Space Daily, joins Dave Bittner to unpack AST SpaceMobile’s request to use amateur radio spectrum for satellite communications. They explore what this means for ham radio users, the role of secondary spectrum access, and why the amateur community is pushing back. It’s a nuanced look at spectrum sharing, space tech, and regulatory tensions.

Selected Reading

Global hack on Microsoft product hits U.S., state agencies, researchers say (The Washington Post)

Microsoft releases emergency patches for SharePoint RCE flaws exploited in attacks (Bleeping Computer)

Alaska Airlines requests all flights to be grounded: FAA (ABC News)

UK government seeks way out of clash with US over Apple encryption (Financial Times)

Digital vassals? French Government ‘exposes citizens’ data to US’ (Brussels Signal)

Meta snubs the EU’s voluntary AI guidelines (The Verge)

At Least 750 US Hospitals Faced Disruptions During Last Year’s CrowdStrike Outage, Study Finds (WIRED)

Dell confirms breach of test lab platform by World Leaks extortion group (Bleeping Computer)

HPE warns of hardcoded passwords in Aruba access points (Bleeping Computer)

Weak password allowed hackers to sink a 158-year-old company (BBC News)

Claude Jailbroken to Mint Unlimited Stripe Coupons (General Analysis)

Audience Survey

Complete our annual audience survey before August 31.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Anisha Patel: Right along with them. [Program management] [Career Notes] Jul 20, 2025

Show notes

Please enjoy this encore of Career Notes:

Associate Director at Raytheon Intelligence and Space in the Cyber Protection Services Division Anisha Patel always loved math and it defined her career journey. As a first-generation American from an Asian household, Anisha said she was destined for a STEM-focused career and chose electrical engineering. She began her career and remains at Raytheon (formerly E-Systems) working in several areas of the business thanks to her skills and informal mentors. Starting a rotational assignment in program management (7 years ago), Anisha said she "went to the dark side and then the hole closed and there I ended up." Anisha talks about the need to bring diversity of thought into the industry and adds to her team with this in mind. We thank Anisha for sharing her story with us.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Creeping like a spider. [Research Saturday] Jul 19, 2025

Show notes

This week, we are pleased to be joined by ⁠George Glass⁠, Associate Managing Director of ⁠Kroll⁠'s Cyber Risk business, as he is discussing their research on Scattered Spider and their targeting of insurance companies. While Scattered Spider has recently turned its attention to the airline industry, George focuses on the broader trend of the group’s industry-by-industry approach and what that means for defenders across sectors.

George and Dave discuss the group’s history, their self-identification as a cartel, and their increasingly aggressive tactics, including the use of fear-based social engineering, physical threats, and the recruitment of insiders at telecom providers. They also examine how organizations—especially those with vulnerabilities similar to past targets—can proactively defend against this threat and prepare an effective response if their industry becomes the next focus.

Complete our annual ⁠⁠audience survey⁠⁠ before August 31.

Learn more about your ad choices. Visit megaphone.fm/adchoices

UK calls out Russia’s playbook. Jul 18, 2025

Show notes

The UK sanctions Russian military intelligence officers tied to GRU cyber units. An AI-powered malware called LameHug targets Windows systems. Google files a lawsuit against the operators of the Badbox 2.0 botnet. A pair of healthcare data breaches impact over 3 million individuals. Researchers report a phishing attack that bypasses FIDO authentication by exploiting QR codes. A critical flaw in Nvidia’s Container Toolkit threatens managed AI cloud services. A secure messaging app is found exposing sensitive data due to outdated configurations. Meta investors settle their $8 billion lawsuit. Our guest is Will Markow, CEO of FourOne Insights and N2K CyberWire Senior Workforce Analyst, with a data-driven look at how AI is affecting jobs. Belgian police provide timely cyber tips, baked right in.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today we have Will Markow, CEO of FourOne Insights and N2K CyberWire Senior Workforce Analyst, discussing how AI is affecting jobs.

Got cybersecurity, IT, or project management certification goals?

For the past 25 years, N2K's practice tests have helped more than half a million professionals reach certification success. Grow your career and reach your goals faster with N2K’s full exam prep of practice tests, labs, and training courses for Microsoft, CompTIA, PMI, Amazon, and more at n2k.com/certify.

Selected Reading

Breaking: UK sanctions Russian cyber spies accused of facilitating murders (The Record)

Russia Linked to New Malware Targeting Email Accounts for Espionage (Infosecurity Magazine)

New “LameHug” Malware Deploys AI-Generated Commands (Infosecurity Magazine)

Google Sues Operators of 10-Million-Device Badbox 2.0 Botnet (SecurityWeek)

1.4 Million Affected by Data Breach at Virginia Radiology Practice (SecurityWeek)

Anne Arundel Dermatology Data Breach Impacts 1.9 Million People (SecurityWeek)

Phishing attack abuses QR codes to bypass FIDO keys (SC Media)

Critical Nvidia Toolkit Flaw Exposes AI Cloud Services to Hacking (SecurityWeek)

New TeleMessage SGNL Flaw Is Actively Being Exploited by Attackers (Hackread)

Meta investors, Zuckerberg settle $8 billion privacy lawsuit tied to Cambridge Analytica scandal (The Record)

Loaf and order: Belgian police launch bread-based cybersecurity campaign (Graham Cluley)

Audience Survey

Complete our annual audience survey before August 31.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Our TOPPODCAST Picks

Follow Us

Stay Connected

Related Podcasts

Links

Stay Connected