CyberWire Daily

CISA orders patching of TrueConf Server vulnerabilities. LockBit threatens release of stolen banking data. Researchers disclose a critical type confusion vulnerability in a Node.js library. A new Agent Tesla v4 campaign introduces enhanced evasion techniques. A novel malware delivery technique abuses FTP server banners to hide commands. Apple patches a critical image-processing flaw. A North Korean software supply chain attack targets the Rust ecosystem. Latvian officials resign following a major data breach. Defense contractors are confident in compliance, less so in their ability to prove it. Our guest is Patrick Coughlin, Co-Founder and CEO of Savi Security. discussing the free utility he’s developed to protect the sandwich generation from AI-driven scams. When it comes to cyber extortion, who you gonna call?

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Joining us today is Patrick Coughlin, Co-Founder and CEO of Savi Security. Patrick discusses protecting the sandwich generation from AI-driven scams and Scamwise, their free utility built with this purpose in mind. Learn more about Scamwise, a free public utility tool to help consumers quickly determine whether a suspicious message, call, or email is likely a scam, and download Savi’s app.

Selected Reading

CISA orders feds to patch actively exploited TrueConf Server flaws (Bleeping Computer)

US Bank investigates LockBit's claims as ransomware crims set pay-or-leak deadline (The Register)

Critical Isolated-vm Vulnerability Leads to RCE on Host (SecurityWeek)

New Agent Tesla Malware Variant Boosts Evasion Capabilities (Infosecurity Magazine)

Hackers abuse FTP server banners to deliver new Windows malware (Bleeping Computer)

Apple plugs image-processing hole ripe for spyware abuse (The Register)

North Korean Hackers Tied to Rust Supply Chain Attack (Infosecurity Magazine)

Latvian officials resign after cyberattack exposes data on 1.2 million people (The Record)

Contractors' CMMC Confidence Rises as Ability to Prove It Falls Behind (SecurityWeek)

Ransomware crook poses as recovery firm to steal payments from fellow extortionists (The Register)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Federal agencies warn of an active campaign targeting critical infrastructure. Citrix races to patch critical NetScaler flaws. More than 50,000 exposed Stripe API keys raise fraud concerns. Black Hat and DEF CON attendees are targeted in a new social engineering campaign. Atlassian, Splunk, and Cisco fix hundreds of vulnerabilities. A new Android banking trojan adds an unusual twist. A healthcare breach impacts 3.8 million people. SilkParasite expands cyberespionage in Central Asia. And CISA eyes a major overhaul of federal cyber software procurement. Our guest is Chris Wallis, founder and CEO of Intruder, on how AI agents killed the annual pentest and are reshaping exposure management. AI powered robots find bananas quite appealing.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

On our Industry Voices segment, Intruder’s Founder and CEO Chris Wallis joined Dave at Black Hat to discuss why the annual pentest Is dead and how AI agents are reshaping exposure management. If you enjoyed this conversation, be sure to check out the full interview here.

Selected Reading

NSA, FBI warns of hackers using AI-generated tools in attacks on critical infrastructure technology (The Record)

Citrix urges admins to patch new NetScaler flaws as soon as possible (Bleeping Computer)

50,000 Stripe Secrets Leaked in Public Code (SecurityAffairs)

Black Hat/DEF CON attendees targeted in malware scheme with Google Doc lure (SC World)

Atlassian, Splunk Patch Dozens of Critical, High-Severity Vulnerabilities (SecurityWeek)

Cisco Patches Critical Crosswork, Secure Workload Vulnerabilities (SecurityWeek)

New Manic Android malware can exfiltrate data through nearby devices (Bleeping Computer)

EHR Vendor Notifying 3.8 Million Patients of Data Theft Hack (GovInfo Security)

SilkParasite: Tracking a China-Nexus APT Across Central Asia (Bitdefender)

CISA contemplates whether to hire security software buying help (Washington Technology)

I Saw the Future of AI in a Robot That Can Learn on the Spot (WIRED)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Medusa’s reach grows. Cl0p expands its victim list. The DOJ charges 17 alleged Iranian hackers. CISA sounds the alarm on four exploited vulnerabilities. TWINLOOT hides in plain sight inside Microsoft 365. Maria Varmazis shares the latest from the space-cyber realm as Ukraine strikes Russia’s satellite nerve center. The FDA considers guardrails for AI medical devices. Expired credit cards get an unexpected second life. A disgruntled contractor heads to prison. Dave Bittner sits down with Brian Vecci, Field CTO at Varonis, at Black Hat USA to discuss how AI is calling your security bluff. Highway hijinks meet high-tech hardware.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

At Black Hat USA, Dave Bittner sat down with Brian Vecci, Field CTO at Varonis, as they discussed how AI is calling your security bluff. If you enjoyed this conversation, be sure to check out the full interview here.

Selected Reading

CISA: Medusa ransomware hit over 500 critical infrastructure orgs (Bleeping Computer)

US charges Iranians for sprawling hacking campaign on government agencies, universities (The Record)

Cl0p Ransomware Group Names Over 40 Victims of PTC Windchill Campaign (SecurityWeek)

CISA Urges Immediate Patching of Exploited Microsoft, VMware, Apple Vulnerabilities (SecurityWeek)

New TWINLOOT Malware Steals Windows Passwords Via Fake Lock Screen (Hackread)

Ukraine says it hit Russian rocket centre linked to Starlink-style network (CNBC)

FDA Weighing Possible Regs for GenAI Medical Devices (GovInfo Security)

Expired credit cards revived by researchers to make unauthorized payments (The Register)

Prison for data analyst who tried to extort $2.5 million from his employer (Bitdefender)

‘The Worst I’ve Ever Seen’: Cargo Thefts Have Turned Violent in Pursuit of AI Hardware (WIRED)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

A fake consultancy fronts an alleged Chinese spy campaign. Meta heads to court over claims it hooked young users. Researchers crack the mystery behind the French EncroChat hack. CISA warns ransomware gangs are exploiting a Windows flaw. Meet C2Looper, a new Rust-based backdoor. A critical WordPress plugin bug threatens hundreds of thousands of sites. MessiahGPT brings generative AI to cybercrime. A lender discloses a breach affecting 1.2 million people. A Ukrainian developer stands trial in Switzerland over alleged ransomware ties. Our guest is Ev Kontsevoy, CEO at Teleport, discussing how AI agents have nondeterministic behavior. The psychology of the endless scroll.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

On today’s Industry Voices, we are joined by Ev Kontsevoy, CEO at Teleport, discussing how AI agents have nondeterministic behavior. If you enjoyed this conversation, check out the full interview here.

Selected Reading

A fake website and a deluge of CVs: the Australian firm embroiled in an FBI probe into alleged Chinese espionage (The Guardian)

States Seek $200 Billion From Meta Over Child Social Media Addiction Claims (The New York Times)

Revealed: Cyber spies used malware from GitHub to hack EncroChat cryptophone network (Computer Weekly)

CISA: Windows Task Host flaw now exploited by ransomware gangs (Bleeping Computer)

C2Looper Backdoor Uses GitHub for C2 (ThreatLabz)

300,000 WordPress Sites Potentially Exposed to Hacking Due to Form Plugin Flaw (SecurityWeek)

MessiahGPT Criminal AI Service Advertised on BreachForums (HackRead)

Heights Finance Data Breach Impacts at Least 1.2 Million Individuals (SecurityWeek)

Ukrainian software developer faces 12 years in Swiss ransomware trial (The Record from Recorded Future News)

Why Can't We Stop Scrolling? (Psychology Today)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Internal policy conflicts hamper U.S. military AI leadership. Clop claims GE, Philips and Shell. Attackers actively probe internet-facing GeoServer instances. “The Hatman” offers millions of alleged employee records for sale. ETSI begins the approval process for European cyber standards. Microsoft is still working on a patch for the ShieldBreak vulnerability. Autonomous AI systems create CPU bottlenecks. Monday business briefing. Our guest is Nick Warner, CEO at Neo.ai, on the shifting landscape around AI and agentic security. AI agents kneecap each other with self-replicating malware.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

On today’s Industry Voices segment, we are joined by Nick Warner, Neo.ai's CEO, discussing the shifting landscape around AI and agentic security. If you enjoyed this conversation, be sure to check out the full interview here.

Selected Reading

The U.S. Military Wants A.I. Dominance. Feuds and China May Thwart It. (The New York Times)

Philips and GE investigating Clop ransomware data theft claims (Bleeping Computer)

Attackers Probe Critical GeoServer SQL Injection Vulnerability (Hack Read)

Crook hawks millions of records allegedly plundered from corporate Azure tenants (The Register)

ETSI Proposes 17 Cybersecurity Standards to Support EU CRA (Infosecurity Magazine)

Microsoft working on Defender patch for ShieldBreak zero-day (Bleeping Computer)

Agentic AI Crunch Creates CPU Comeback (IEEE Spectrum)

Corma raises $60 million in seed funding. (N2K)

Conflicting Test Goals Pushed Claude Agents to Deploy Self-Replicating Malware (SecurityWeek)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.