CyberWire Daily

Latest Episodes:

When "out of the box" becomes "out of control." May 29, 2025

Show notes

Children’s DNA in criminal databases. ASUS routers get an unwanted houseguest. New APT41 malware uses Google Calendar for command-and-control. Interlock ransomware gang deploys new Trojan. Estonia issues arrest warrant for suspect in massive pharmacy breach. The enemy within the endpoint. New England hospitals disrupted by cyberattack. Tim Starks from CyberScoop is discussing ‘Whatever we did was not enough’: How Salt Typhoon slipped through the government’s blind spots. And Victoria’s Secrets are leaked.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today we have Tim Starks from CyberScoop discussing ‘Whatever we did was not enough’: How Salt Typhoon slipped through the government’s blind spots.

Selected Reading

The US Is Storing Migrant Children’s DNA in a Criminal Database (WIRED)

GreyNoise Discovers Stealthy Backdoor Campaign Affecting Thousands of ASUS Routers (GreyNoise)

Mark Your Calendar: APT41 Innovative Tactics (Google Threat Intelligence Group)

Interlock ransomware gang deploys new NodeSnake RAT on universities (BleepingComputer)

Estonia issues arrest warrant for Moroccan wanted for major pharmacy data breach (The Record)

Israeli company Syngia thwarts North Korean cyberattack (The Jerusalem Post)

St. Joseph Hospital owner says company targeted in cybersecurity incident (WMUR)

Victoria’s Secret Website Taken Offline After Cybersecurity Breach (GB Hackers)

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Fingers point east. May 28, 2025

Show notes

The Czech Republic accuses Chinese state-backed hackers of cyber-espionage. CISA’s leaders head for the exits. Cybercriminals are using fake AI video generator websites to spread malware. A stealthy phishing campaign delivers the Remcos RAT via DBatLoader. A fake Bitdefender website spreads malware targeting financial data. Medusa ransomware claims to have breached global real estate firm RE/MAX. An Iranian national faces up to 30 years in prison for ransomware targeting US cities. Our guest is Tony Velleca, CyberProof's CEO, discussing exposure management and a more risk-focused approach to prioritize threats. Mind reading for fun and profit.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

On today’s Industry Voices segment, at the 2025 RSA Conference we were joined by Tony Velleca, CyberProof's CEO, who is discussing exposure management and moving towards a more risk-focused approach to prioritize threats. Listen to Tony’s interview here.

Selected Reading

Chinese spies blamed for attempted hack on Czech government network (The Record)

CISA loses nearly all top officials as purge continues- (Cybersecurity Dive)

Google warns of Vietnam-based hackers using bogus AI video generators to spread malware (The Record)

Chrome 137, Firefox 139 Patch High-Severity Vulnerabilities (SecurityWeek)

New Phishing Campaign Uses DBatLoader to Drop Remcos RAT: What Analysts Need to Know (Hack Read)

Hackers Mimic Popular Antivirus Site to Deliver VenomRAT & Steal Finance Data (Cybersecurity News)

RE/MAX deals with alleged 150GB data theft: Medusa ransomware demands $200K (Cyber News)

CISA Releases ICS Advisories Covering Vulnerabilities & Exploits (Cybersecurity News)

Iranian pleads guilty to launching Baltimore ransomware attack, faces 30 years behind bars (The Record)

Neural Privacy Under Threat: The Battle for Neural Data (tsaaro consulting)

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

BEAR-ly washed and dangerous. May 27, 2025

Show notes

“Laundry Bear” airs dirty cyber linen in the Netherlands. AI coding agents are tricked by malicious prompts in a Github MCP vulnerability.Tenable patches critical flaws in Network Monitor on Windows. MathWorks confirms ransomware behind MATLAB outage. Feds audit NVD over vulnerability backlog. FBI warns law firms of evolving Silent Ransom Group tactics. Chinese hackers exploit Cityworks flaw to breach US municipal networks. Everest Ransomware Group leaks Coca-Cola employee data. Nova Scotia Power hit by ransomware. On today’s Threat Vector, ⁠David Moulton⁠ speaks with ⁠his Palo Alto Networks colleagues Tanya Shastri⁠ and ⁠Navneet Singh about a strategy for secure AI by design. CIA’s secret spy site was… a Star Wars fan page?

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Threat Vector

In this segment of Threat Vector, host ⁠David Moulton⁠ speaks with ⁠Tanya Shastri⁠, SVP of Product Management, and ⁠Navneet Singh⁠, VP of Marketing - Network Security, at Palo Alto Networks. They explore what it means to adopt a secure AI by design strategy, giving employees the freedom to innovate with generative AI while maintaining control and reducing risk. You can hear their full discussion on Threat Vector ⁠here⁠ and catch new episodes every Thursday on your favorite podcast app.

Selected Reading

Dutch intelligence unmasks previously unknown Russian hacking group 'Laundry Bear' (The Record)

GitHub MCP Server Vulnerability Let Attackers Access Private Repositories (Cybersecurity News)

Tenable Network Monitor Vulnerabilities Let Attackers Escalate Privileges (Cybersecurity News)

Ransomware attack on MATLAB dev MathWorks – licensing center still locked down (The Register)

US Government Launches Audit of NIST’s National Vulnerability Database (Infosecurity Magazine)

Law Firms Warned of Silent Ransom Group Attacks (SecurityWeek)

Chinese Hackers Exploit Cityworks Flaw to Target US Local Governments (Infosecurity Magazine)

Everest Ransomware Leaks Coca-Cola Employee Data Online (Hackread)

Nova Scotia Power Suffers Ransomware Attack; 280,000 Customers' Data Compromised (GB Hackers)

The CIA Secretly Ran a Star Wars Fan Site (404 Media)

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Hugh Thompson on Building the RSA Conference [Afternoon Cyber Tea] May 26, 2025

Show notes

While our team is observing Memorial Day in the United States, please enjoy this episode from the N2K CyberWire network partner, Microsoft Security. You can hear new episodes of Ann Johnson's Afternoon Cyber Tea podcast every other Tuesday.

Dr. Hugh Thompson, Executive Chairman of RSA Conference and Managing Partner at Crosspoint Capital joins Ann on this week's episode of Afternoon Cyber Tea. They discuss what goes into planning the world’s largest cybersecurity conference—from theme selection to llama-related surprises on the expo floor—and how the RSA community continues to evolve. Hugh also shares how his background in applied math led him from academia to cybersecurity, his thoughts on the human element in security, and what keeps him optimistic about the future of the industry.

Resources:

View Hugh Thompson on LinkedIn

View Ann Johnson on LinkedIn

Related Microsoft Podcasts:

Microsoft Threat Intelligence Podcast

The BlueHat Podcast

Uncovering Hidden Risks

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Afternoon Cyber Tea with Ann Johnson is produced by Microsoft and distributed as part of N2K media network.

Learn more about your ad choices. Visit megaphone.fm/adchoices

AWS in Orbit: Automated Satellite Management. [T-Minus Space] May 26, 2025

Show notes

While our team is observing Memorial Day in the United States, please enjoy this episode from our team from T-Minus Space Daily recorded recently at Space Symposium.

You can learn more about AWS in Orbit at space.n2k.com/aws.

Our guests on this episode are Dax Garner, CTO at Cognitive Space and Ed Meletyan, AWS Sr Solutions Architect.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Be sure to follow T-Minus on LinkedIn and Instagram.

Selected Reading

AWS Aerospace and Satellite

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at space@n2k.com to request more info.

Want to join us for an interview?

Please send your pitch to space-editor@n2k.com and include your name, affiliation, and topic proposal.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Pattie Dillon: Take the leap. [Anti-fraud] [Career Notes] May 25, 2025

Show notes

Please enjoy this encore of Career Notes.

Product Manager in Anti-Fraud Solutions at SpyCloud, Pattie Dillon shares her journey from raising her family to specializing in the anti-fraud space. Upon reentering the workforce, Pattie worked on identity verification and developed a system with privacy concerns in mind. She moved to work in gift cards and was exposed to money laundering. Traveling along the fraud spectrum, Pattie learned about underground data and feels that this data can be leveraged to actually prevent and fight online fraud. Pattie believes if you don't try, you'll never know. We know we appreciate Pattie sharing her story with us.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Purple teaming in the modern enterprise. [CyberWire-X] May 25, 2025

Show notes

In large enterprise software companies, Red and Blue Teams collaborate through Purple Teaming to proactively detect, respond to, and mitigate advanced threats. In this episode of CyberWire-X, N2K's Dave Bittner is joined by Adobe’sJustin Tiplitsky, Director of Red Team and Ivan Koshkin, Senior Detection Engineerto discuss how their teams work together daily to strengthen Adobe’s security ecosystem. They share real-world insights on how this essential collaboration enhances threat detection, refines security controls, and improves overall cyber resilience.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Pandas with a purpose. [Research Saturday] May 24, 2025

Show notes

This week, we are joined by Deepen Desai, Zscaler's Chief Security Officer and EVP of Cyber and AI Engineering, taking a dive deep into Mustang Panda’s latest campaign. Zscaler ThreatLabz uncovered new tools used by Mustang Panda, including the backdoors TONEINS, TONESHELL, PUBLOAD, and the proxy tool StarLoader, all delivered via phishing.

They also discovered two custom keyloggers, PAKLOG and CorKLOG, and an EDR evasion tool, SplatCloak, highlighting the group's focus on surveillance, persistence, and stealth in cyberespionage operations.4o.

The research can be found here:

Learn more about your ad choices. Visit megaphone.fm/adchoices

When malware masters meet their match. May 23, 2025

Show notes

Operation Endgame dismantles cybercriminal infrastructure. DOGE’s use of the Grok AI chatbot raises ethical and privacy concerns. Malware on the npm registry uses malicious packages to quietly gather intelligence on developer environments. Researchers link Careto malware to the Spanish government. Exploring proactive operations via letters of marque. Hackers hesitate to attend the HOPE conference over travel concerns. Our guest is Jeffrey Wheatman, Cyber Risk Expert at Black Kite, warning us to "Beware the silent breach." AI threatens to spill secrets to save itself.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

On today’s Industry Voices, we were joined at the RSAC Conference by Jeffrey Wheatman, Cyber Risk Expert at Black Kite, as he is sharing his thoughts on "Beware the silent breach." Listen to Jeffery’s interview here.
Selected Reading

Operation ENDGAME strikes again: the ransomware kill chain broken at its source (Europol)

Russian developer of Qakbot malware indicted by US for global ransomware campaign (CNews)

Russian hackers target US and allies to disrupt Ukraine aid, warns NSA (CNews)

Exclusive: Musk’s DOGE expanding his Grok AI in U.S. government, raising conflict concerns (Reuters)

60 malicious npm packages caught mapping developer networks (Developer Tech)

Mysterious hacking group Careto was run by the Spanish government, sources say (TechCrunch)

An 18th-century war power resurfaces in cyber policy talks (Next Gov)

Hacker Conference HOPE Says U.S. Immigration Crackdown Caused Massive Crash in Ticket Sales (404 Media)

Anthropic's new AI model turns to blackmail when engineers try to take it offline (TechCrunch)

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Lights out for Lumma. May 22, 2025

Show notes

A joint operation takes down Lumma infrastructure. The FTC finalizes a security settlement with GoDaddy. The Telemessage breach compromised far more U.S. officials than initially known. Twin hackers allegedly breach a major federal software provider from the inside. U.S. telecom providers fail to notify the Senate when law enforcement agencies request data from Senate-issued devices.DragonForce makes its mark on the ransomware front. A data leak threatens survivors of domestic abuse in the UK. Lexmark discloses a critical vulnerability affecting over 120 printer models. Our guest is David Holmes, CTO for Application Security at Imperva, with insights into the role of AI in bot attacks. Scammers ship stolen cash in Squishmallows.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today’s guest is David Holmes, CTO for Application Security at Imperva, a Thales company, who is sharing some insights into the role of AI in bot attacks.

Selected Reading

Lumma infostealer’s infrastructure seized during US, EU, Microsoft operation (the Record)

FTC finalizes order requiring GoDaddy to secure hosting services (Bleeping Computer)

Exclusive: Hacker who breached communications app used by Trump aide stole data from across US government (Reuters)

By Default, Signal Doesn't Recall (Signal)

Hack of Contractor Was at Root of Massive Federal Data Breach (Bloomberg)

Phone companies failed to warn senators about surveillance, Wyden says - Live Updates (POLITICO)

DragonForce targets rivals in a play for dominance (Sophos News)

‘Deep concern’ for domestic abuse survivors as cybercriminals expected to publish confidential refuge addresses (The Record)

Lexmark reporting remote code execution flaw affecting over 120 Printer Models (Beyond Machines)

DOJ charges 12 more in $263 million crypto fraud takedown where money was hidden in squishmallow stuffed animals (Bitdefender)

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Our TOPPODCAST Picks

Follow Us

Stay Connected

Related Podcasts

Links

Stay Connected