CyberWire Daily

Epizódok

• 
  Play to win, pay to lose. [Research Saturday] 03.10.2026 23p

  Today we are joined by Jean-Pierre Mouton, Senior Threat Intelligence Consultant at GuidePoint Security, discussing their work on "How Play Achieves Encryption." Play ransomware, also known as PlayCrypt, continues to target organizations across multiple sectors using a consistent double-extortion playbook that combines data theft with widespread encryption. A recent investigation details how the group gained access through a SonicWall VPN, moved laterally using tools such as Mimikatz and PsExec, exfiltrated sensitive data, and used the victim’s own SentinelOne uninstallation utility to disable endpoint protection. The findings highlight several behavioral indicators defenders can monitor, including tool staging through SYSVOL and SystemBC for command and control, event log clearing, and suspicious WinSCP activity. The research and executive brief can be found here: ⁠⁠⁠⁠How Play Achieves Encryption Learn more about your ad choices. Visit megaphone.fm/adchoices
• 
  A rough week for safety. 02.10.2026 31p

  OpenAI fires safety researchers for mishandling sensitive information. CISA looks to secure the next 250. Dell patches six critical flaws, while attackers exploit a FortiMail zero-day. Warlock ransomware expands its reach, and Star Blizzard scales up its phishing. Researchers map maritime GPS spoofing. An alleged Iranian hacker is extradited to the U.S., and law enforcement takes down KillSec. Our guests are John Kindervag and Dr. Chase Cunningham, discussing their new book "Cyber Resilience at Machine Speed: The Zero Trust Model for the AI Era". Clippy’s back, and this time he wants your wallet.  Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guest Today we are joined by John Kindervag, along with Dr. Chase Cunningham, discussing their book "Cyber Resilience at Machine Speed: The Zero Trust Model for the AI Era". Selected Reading Disinformation, Defense and Democracy: A Look as This Year’s Election Security (Security Magazine) CISA launches ‘Securing the Next 250’ campaign to strengthen critical infrastructure cybersecurity and resilience (Industrial Cyber) Dell asks admins to patch max severity CSM flaws as soon as possible (Bleeping Computer) Fortinet warns of critical FortiMail flaw exploited in zero-day attacks (Bleeping Computer) Chinese ransomware group Warlock targets Spanish- and Portuguese-speaking countries (SC Media) Russian FSB-linked hackers scale up phishing attacks against Ukraine supporters (The Record) 367,000-Ship Study Finds Global GPS Spoofing, Red Sea Activity Before Grounding (Hackread) In Rare Move, Alleged Iranian State Hacker Extradited to US (SecurityWeek) Police Target KillSec Ransomware Group with Arrests and Seizures (Infosecurity Magazine) Crypto Scammers Hijack Microsoft's Official X Account  (SecurityWeek) Share your feedback. What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show. Want to hear your company in the show? N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices
• 
  The Pentagon’s roll call. 01.10.2026 26p

  A Pentagon breach exposes data on millions. ShinyHunters goes dark. MI5 warns universities about Chinese espionage. AI agents find creative ways around their guardrails. A fake Zoom installer delivers macOS malware. Cisco patches an actively exploited SD-WAN flaw. OpenAI disrupts a “distillation attack.” Cyber Command confronts operator burnout. Treasury targets alleged ATM jackpotters. Our guest is Etay Maor, Vice President of Threat Intelligence at Cato Networks, with a reminder that your network isn't a recycling bin. Prophecy as a service. Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guest Today we are joined by Etay Maor, Vice President of Threat Intelligence at Cato Networks, sharing his views on how your network isn't a recycling bin. Selected Reading Hackers stole millions of US military personnel records during months-long data breach (TechCrunch) ShinyHunters website goes offline after FBI deadline expires (Reuters) MI5 Warns Over 100 Academics Helped China's Espionage Plans (Infosecurity Magazine) Rogue Agents Investigation (Asymmetric Security) CloudSyncD: macOS backdoor hidden in a fake Zoom installer (Jamf) Cisco Patches Exploited Catalyst SD-WAN Zero-Day Vulnerability (SecurityWeek) Irony alert: OpenAI whines that Chinese model stole its special IP that it stole from everybody else (The Register) After reports on suicide deaths, Pentagon puts Cyber Command on notice (The Record) Treasury Blacklists Most-Wanted ATM Malware Developer and His Network (SecurityWeek) Chatbots as oracles: How AI is giving new life to the ancient practice of seeking answers from inscrutable sources (The Conversation) Share your feedback. What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show. Want to hear your company in the show? N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices
• 
  The guardrails go to court. 30.09.2026 32p

  AI companies sign a voluntary accord aimed at addressing safety concerns. Cybercriminals abuse the CustomGPT feature as part of a ClickFix campaign. The FBI is urging members of ShinyHunters to come forward. A fraud campaign turns stolen credentials into job scams. Maria Varmazis joins us for her space cyber story. The WaterISAC confronts persistent weaknesses. AI gives SOC teams more time at the expense of training. Two U.S. Air Force members get federal prison time over a business email compromise scheme. Our guest is Dan Ohlemeier, Senior Solutions Architect for Ready1 at Semperis, discussing crisis orchestration. That is one big pile of technical debt. Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guest On today’s Industry Voices we are joined by Dan Ohlemeier, Senior Solutions Architect for Ready1 at Semperis, discussing crisis orchestration: the unsung hero of successful cyber incident response. If you enjoyed this conversation, tune into the full interview here. Selected Reading Trump says top tech firms have signed accord to 'self-police' AI development (NPR) OpenAI Ignored Employees’ Warnings About Safely Testing A.I. Models (The New York Times) OpenAI Gets Sued Over the Hugging Face Hack (WIRED) Attackers Combine ChatGPT Feature Abuse With ClickFix to Deliver Trojan Malware (Infosecurity Magazine) ShinyHunters Defiant After FBI Calls on Members to Come Forward (SecurityWeek) From EDU Account Takeover to Job Scam Abuse: West African Fraud Actors Target Universities (Proofpoint) SpaceX's Starship returns early to Earth after reaching orbit for the first time (AP News)  WaterISAC reckons with range of threats after summer of cyberattacks (CyberScoop) AI Boosts SOC Analyst Capacity but Limits Skill Development (Infosecurity Magazine) US Air Force members given over 6 years in prison for cyber theft of more than $2 million (The Record) AI Finds a Way: The Jurassic Park Problem (Securonix) Share your feedback. What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show. Want to hear your company in the show? N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices
• 
  Astra, la vista, baby. 29.09.2026 26p

  OpenAI holds back its newest model over safety concerns. Kiteworks lifts its precautionary shutdown. Apple patches an exploited zero-day. Japanese rail operators disclose cyberattacks. An Anthropic authentication flaw opens the door to account takeover. Thousands of Supabase databases leak data. NeedyMantis targets telecoms and governments. A Vietnamese national faces charges in a multimillion-dollar crypto laundering scheme. James Winebrenner, CEO of Elisity, is sharing barriers to compliance and challenges for manufacturers as the EU Cyber Resilience Act is implemented. If you’re hoping for credit, be careful what you share. Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guest James Winebrenner, CEO of Elisity, is sharing barriers to compliance and challenges for manufacturers as the EU Cyber Resilience Act (EU CRA) is implemented. Selected Reading OpenAI Says It Will Not Release Newest Astra A.I. Model Over Safety Concerns (The New York Times) Florida asks for order to halt ChatGPT development (Axios) Kiteworks Urges Customers to Restart Systems After Shutdown Notice (Infosecurity Magazine) Apple patches CoreGraphics zero-day flaw exploited in attacks (Bleeping Computer) Japanese Railway Operators Hit with Weekend Cyber Attacks (Infosecurity Magazine) Cycode Uncovers Account Takeover in Anthropic's MCP Python SDK (Cycode) Everything Everywhere: Systemic Data Exposure in Supabase Apps (UpGuard) Daemon Tools Hackers' NeedyMantis Malware Dissected by Microsoft (SecurityWeek) Vietnamese man charged in $16 million 'pig butchering' crypto scam (Bleeping Computer) Did Anthropic’s A.I. Really Make a Scientific Discovery on Its Own? (The New York Times) Share your feedback. What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show. Want to hear your company in the show? N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices
• 
  The AI hotline. 28.09.2026 23p

  The U.S. and China agree on an AI safety channel. Some states say CISA’s election security plan comes too late. Citrix patches critical zero-days under active exploitation. AI agents probed government websites in unexpected and concerning ways. ShinyHunters launches a new campaign against Oracle PeopleSoft customers. A New Mexico jury finds Meta misled state residents. Business briefing. Tim Starks from CyberScoop shares insights on multiple issues facing CISA. Who’s ready for algorithmic holiday shopping?  Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guest Today we are joined by Tim Starks from CyberScoop who is sharing insights on multiple issues facing CISA. Selected Reading China and US Agree to Establish AI Safety Channel and Continue Trade and Military Talks (SecurityWeek) 40 days to midterms, election officials say new US cyber plan comes too late (TwinCities Pioneer Press) Citrix Patches Critical Zero Days Under Active Exploitation (Infosecurity Magazine) OpenAI’s A.I. Went Rogue and Meddled With U.S. Government Websites (The New York Times) OpenAI, Anthropic CEOs called to appear at Australian AI probe (Reuters) Top AI companies probing tens of thousands of security incidents (Axios) Google Warns of ShinyHunters' Fresh Oracle PeopleSoft Campaign (SecurityWeek) Meta misled users about Facebook data practices, New Mexico jury finds (Reuters) Cyera has secured a $400 million Series G extension from Goldman Sachs. (N2K Pro Business Briefing) Consumer AI use a boon for the holidays as AI traffic doubles (Yahoo Finance) Share your feedback. What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show. Want to hear your company in the show? N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices
• 
  The Insider You Built with author Camille Stewart Gloster. [Special Edition] 27.09.2026 21p

  On this special edition podcast, N2K CyberWire's Dave Bittner spoke with Camille Stewart Gloster⁠. Camille is the author of The Insider You Built: How Organizations Stay in Control of Autonomous AI Agents, and founder of⁠ CAS Strategies⁠. Dave and Camille discuss her new book and the broader questions it raises about AI agents. Listen in as Camille Stewart Gloster discusses the implications of autonomous AI agents, focusing on authority, accountability, and risk management in organizations. She emphasizes the importance of understanding and controlling AI behavior to maximize value and mitigate risks. You can learn more about "The Insider You Built” ⁠here⁠. Learn more about your ad choices. Visit megaphone.fm/adchoices
• 
  Space cybersecurity starts on the ground. [T-Minus: Space-Cyber Briefing] 27.09.2026 21p

  Though spacecraft are important, space cybersecurity extends well beyond these assets touching ground stations, mission-control assets, and other critical components. Host Maria Varmazis speaks with Milenk Starcevic, cybersecurity lead at Vision Space, and Andrzej “Andy” Olchawa, a space-focused offensive security professional, about the broader space cybersecurity attack surface. By considering all aspects of a space mission, both in orbit and on the ground, cybersecurity professionals can better understand where vulnerabilities exist and what measures can be taken to reduce risk. Like what you heard? Be sure to subscribe to our free Signals and Space Briefing⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, our Sunday newsletter covering the intersection of cybersecurity and space. Subscribe at: ⁠⁠⁠⁠⁠⁠⁠⁠https://thecyberwire.com/newsletters/signals-and-space⁠⁠⁠⁠⁠⁠⁠⁠ Is there a topic or person you’d like to hear on our show? You can send your questions and feedback to ⁠⁠⁠⁠⁠⁠⁠⁠[email protected]⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠. You can also fill our our audience survey: ⁠⁠⁠⁠⁠⁠⁠⁠https://www.surveymonkey.com/r/NJYCN2P ⁠⁠⁠⁠⁠⁠⁠⁠ T-Minus: Space-Cyber Briefing is a production of N2K CyberWire. ⁠⁠⁠⁠⁠⁠⁠⁠N2K⁠⁠⁠⁠⁠⁠⁠⁠ is your nexus for discovery and connection for people, technology, and ideas shaping the future of secure innovation. Learn how at ⁠⁠⁠⁠⁠⁠⁠⁠n2k.com⁠⁠⁠⁠⁠⁠⁠⁠. Learn more about your ad choices. Visit megaphone.fm/adchoices
• 
  An apple a day, a phish away. [Research Saturday] 26.09.2026 24p

  Today we are joined by Ensar Seker, VP of Research and CISO at SOCRadar, discussing their work on "Exposing AnonyMousKIT: AI-Powered PhaaS Supply Chain." An investigation into AnonyMousKIT reveals an AI-powered Phishing-as-a-Service platform designed to steal Apple credentials and disable Activation Lock on stolen devices. The platform uses email, SMS, WhatsApp, and AI-driven voice calls to impersonate Apple Support, with researchers uncovering a broader ecosystem spanning 506 domains, 168 storefront brands, and 30 backend installations. Despite its sophisticated social-engineering capabilities, basic coding flaws exposed extensive operational logs and revealed the shared infrastructure, developer activity, and reseller network behind the criminal operation. The research and executive brief can be found here: ⁠Exposing AnonyMousKIT: AI-Powered PhaaS Supply Chain Learn more about your ad choices. Visit megaphone.fm/adchoices
• 
  Shut it down before they do. 25.09.2026 27p

  Kiteworks urges customers pull the plug on vulnerable servers. CISA lays out its election security plan. Known vulnerabilities linger unpatched. Big AI labs consider a new standards body. Questions surround claims of an OpenAI Medicare hack. File notifications become a privacy leak. SectopRAT hides in audio software. A new Android banking trojan takes control. An attacker puts open-source AI agents to work hacking hundreds of organizations. A Rydox cybercrime marketplace operator pleads guilty. Our guest is Todd Thorsen, CISO of CrashPlan, with ways to prepare for and react to critical infrastructure campaigns. Americans give AI the side-eye. Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guest Todd Thorsen, CISO of CrashPlan, discusses ways to prepare for and react to critical infrastructure campaigns, and how AI is contributing to a bigger and more disruptive attack surface. Selected Reading Imminent Zero-Day Attack: KiteWorks Urges Customers to Shut Down Servers (Heise) CISA Election Security Plan Flags Patching Barriers, Voter Database Attacks (SecurityWeek) Only 26% of Detected CISA Known Exploited Vulnerabilities Were Fully Remediated (Hackread) Google, OpenAI, Anthropic Plan Frontier AI Standards Body (GovInfo Security) Doubts grow over claims OpenAI agent hacked Australian Medicare portal (The Record) Windows, Linux, Android File Notification Systems Leak User Activity (SecurityWeek) SectopRAT Abuses Legitimate Audio Software Files to Steal PC Data (Hackread) RemControl Banking Trojan Gives Attackers Remote Control of Android Devices (Infosecurity Magazine) Crook used three open source agents to break into a Fortune 500 hospitality company, a major US airline and 25+ other orgs (The Register) Kosovar Owner of Rydox Marketplace Pleads Guilty in US Court (SecurityWeek) Americans Fear AI Will Make the World Worse, Love It Anyway (404 Media) Share your feedback. What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show. Want to hear your company in the show? N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices
• 
  No factoring necessary. 24.09.2026 27p

  Researchers find a new way to weaken RSA. ShinyHunters allegedly exposes sensitive FBI details. CISA and the FBI warn of third-party ICS risks. An OpenAI agent hacks an Australian government portal. SolarWinds patches critical flaws. A placeholder domain delivers ClickFix. Digital forensics executives face charges over alleged Russian ties. ENISA maps Europe’s cyber threats. The U.S. and China have very different ideas about AI safety. Our guest is Kurt Dusek, Technical Product Advisor at Appdome, sharing thoughts on segregation of duties and AI agents. Women in tech have their say.  Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guest Today we are joined by Kurt Dusek, Technical Product Advisor at Appdome, sharing thoughts on "Segregation of duties was built for humans. What happens when the workers are AI agents?" Selected Reading There's a new way to break RSA that's faster than anything we've seen before (Ars Technica) Stolen FBI data reveals employees’ roles in intelligence and surveillance (Nextgov/FCW) CISA, FBI warn critical infrastructure operators of third-party ICS risks, urge least privilege and remote access controls (Industrial Cyber) OpenAI Agent Hacks Australian Medicare Portal (Infosecurity Magazine) SolarWinds Patches Critical RCE Flaws in Observability Self-Hosted (SecurityWeek) Placeholder domain used in dev docs now serves ClickFix attacks (Bleeping Computer) Phone Hacking Software Firm Hid Russian Ownership, Say Feds (GovInfo Security) Exploring the evolution of the cyber threat landscape: How dependencies weaken our digital resilience (ENISA) Opinion | The U.S. and China Are Far Apart on A.I. Safety (The New York Times) We Surveyed 634 Women Who Work in Tech. They Let Loose (WIRED) Share your feedback. What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show. Want to hear your company in the show? N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices
• 
  The hunters go after the bureau. 23.09.2026 28p

  ShinyHunters claims to have breached FBI systems. CLOSEDQUORUM malware delegates command-and-control decisions to commercial LLMs. An IT error erases 11 years of hospital maternity data. F5 patches a critical BIG-IP APM zero-day. Ransomware activity remains high. Microsoft disrupts the EvilTokens cybercrime platform. Researchers turn Claude Code’s normal workflow against itself. Pundits propose an AI Assurance Compact. A Ryuk ransomware gang member gets two years prison time. Our guest is Jen Sovada, General Manager of Public Sector at Claroty, on Project Watershed 250 and the challenges facing U.S. water utilities. Meta’s Muse mettles with messages. Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guest Today we are joined by Jen Sovada, General Manager, Public Sector at Claroty, on what Project Watershed 250 can reveal about the cybersecurity challenges facing U.S. water utilities. Selected Reading ‘We Hacked the FBI:’ Hackers Say They Have Data on All FBI Employees (404 Media) The Closed Quorum: Inside the first reported autonomous AI C2 implant (Cisco Talos) IT mistake erases 11 years of viewing history for hospitals’ maternity records (Ars Technica) F5 patches BIG-IP APM zero-day flaw exploited in RCE attacks (Bleeping Computer) UK launches its first 'space squadron' to counter hostile threats (The National) Ransomware Attacks Reach Record High for 2026 (Infosecurity Magazine) Disrupting EvilTokens: The AI Chatbot Built for Cybercrime (Microsoft On the Issues) Fable to Haiku: How a Malicious Repo Tricked Claude Code Into Running Malware (Straiker) The President has called for AI leadership. Here’s the mission (CyberScoop) Ryuk ransomware member sentenced to 24 months in prison (Bleeping Computer) Meta’s New Muse AI Agent Read My Private Messages. I Never Asked It To (Inc.) Share your feedback. What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show. Want to hear your company in the show? N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices
• 
  Storm clouds over the waterworks. 22.09.2026 27p

  CISA rides out a Cyber Storm. The EU struggles to share cyber threat information. Nightmare Eclipse drops another Defender zero-day. TASK#STOMP steals business documents. North Korean operatives fake their way through job interviews. A genetics lab pays $700,000 over a phishing breach. A zero-day in Meta’s Muse AI assistant opens the door to privilege hijacking. Marc Woolward, Senior Advisor to Humanix and former CTO for Goldman Sachs, discussing social engineering and vishing attacks. Infiltrating Team PCP. Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guest Today we are joined by Marc Woolward, former CTO for Goldman Sachs and Senior Advisor to Humanix, discussing social engineering/vishing attacks and how ShinyHunters continues to use this method on other industries. Selected Reading CISA’s Cyber Storm X tests cybersecurity preparedness across transportation, water and wastewater sectors (Industrial Cyber) Another worry for water systems: infostealer exposure (CyberScoop) Poor data sharing undermining EU cyber defences, auditors say (Reuters) New TASK#STOMP Windows Backdoor Enables Continuous Document Theft (Hackread) New Windows Defender zero-day blocks Microsoft antivirus updates (Bleeping Computer) Japan Dismantles First North Korean Laptop Farm as US and Allies Detail Wider Scheme (SecurityWeek) Ambry Genetics Pays $700K HIPAA Fine in Phishing Breach (GovInfo Security) Meta Muse AI app flaw lets local malware redirect dictation traffic (The Register) An Undercover Google Analyst Infiltrated a Notorious Supply-Chain Hacking Gang (WIRED) Share your feedback. What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show. Want to hear your company in the show? N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices
• 
  A very real-world AI test. 21.09.2026 29p

  Google confirms unauthorized access by Gemini. AI’s growing power outpaces its defenses. Hackers target Colorado water utilities. Georgia weighs voting-system security. ShinyHunters hijacks Clop’s leak site. FamousSparrow spies across Latin America. CrowdSec loses source code. New npm malware slips past supply-chain defenses. Monday business briefing. Our guest is Matt Fredrikson, CEO of Gray Swan AI, discussing OpenAI's Astra. A new app warns Glassholes to ZuckOff.  Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guest Today we are joined by Matt Fredrikson, Carnegie Mellon University Associate Professor and CEO of Gray Swan AI, discussing OpenAI's Astra and real industry risks. Selected Reading Google says Gemini breached three companies during security test (The Record) Hackers who broke into OpenAI warn the AI industry has a security problem (Washington Post) Colorado Water Utilities Hit by Cyberattacks Targeting OT Systems (Security Week) Lawmakers mull cybersecurity concerns as they prepare for overhaul of Georgia’s voting system (Cobb Courier) Clop gets a taste of its own medicine after ShinyHunters hijack leak site (The Register) China-Linked FamousSparrow Deploys SparroWocky Backdoor in Latin America (Hackread) CrowdSec Confirms Source Code Stolen in Supply Chain Attack (Security Week) Malicious npm packages evade install-script defenses at runtime (Bleeping Computer) Physical AI security company Exein lands $270 million. (N2K Networks) ZuckOff Is a Free App That Sees Meta Glasses Before They See You (WIRED) Share your feedback. What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show. Want to hear your company in the show? N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices
• 
  CyberWire Daily at 10: Critical infrastructure attacks over the last 10 years. [Special Edition] 20.09.2026 43p

  In this Special Edition episode, Maria Varmazis⁠ and ⁠Dave Bittner⁠ from N2K Cyberwire get back together to reflect on the past decade of critical infrastructure attacks, evolving threats, and lessons learned from incidents like the Ukraine power grid attack and Colonial Pipeline ransomware. They discuss how these events have shaped current cybersecurity practices and the importance of resilience and preparedness. Join Maria and Dave as they discuss: The critical infrastructure evolution over the past 10 years. Notable cyber attacks including the Ukraine power grid, NotPetya, and the Colonial Pipeline. The shift from traditional ransomware attacks to attacks on infrastructure. The emergence of space and satellite communications as targets. Lessons learned and the future outlook for cybersecurity resilience. Learn more about your ad choices. Visit megaphone.fm/adchoices
• 
  Defending Space as Critical Infrastructure. [T-Minus: Space-Cyber Briefing] 20.09.2026 26p

  Space infrastructure has become an increasingly important part of everyday life, which has also made it an increasingly attractive target for exploitation. Host Maria Varmazis and Sean MacKirdy, Area Vice President for the National Security vertical at Elastic Government Solutions, sit down to discuss how space stakeholders need to reevaluate their approach to securing space systems. As space systems continue to grow more important, malicious actors are going to look to target them more often. By adopting a stronger universal framework and a consistent way to interpret data across all spacecraft, space cybersecurity practitioners will be able to standardize their practices and create more effective and timely responses. Key Sources: SPARTA v4.0 Maria Varmazis interviews Brandon Bailey about Space Attack Research and Tactic Analysis, or SPARTA matrix. Like what you heard? Be sure to subscribe to our free Signals and Space Briefing⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, our Sunday newsletter covering the intersection of cybersecurity and space. Subscribe at: ⁠⁠⁠⁠⁠⁠⁠https://thecyberwire.com/newsletters/signals-and-space⁠⁠⁠⁠⁠⁠⁠ Is there a topic or person you’d like to hear on our show? You can send your questions and feedback to ⁠⁠⁠⁠⁠⁠⁠[email protected]⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠. You can also fill our our audience survey: ⁠⁠⁠⁠⁠⁠⁠https://www.surveymonkey.com/r/NJYCN2P ⁠⁠⁠⁠⁠⁠⁠ T-Minus: Space-Cyber Briefing is a production of N2K CyberWire. ⁠⁠⁠⁠⁠⁠⁠N2K⁠⁠⁠⁠⁠⁠⁠ is your nexus for discovery and connection for people, technology, and ideas shaping the future of secure innovation. Learn how at ⁠⁠⁠⁠⁠⁠⁠n2k.com⁠⁠⁠⁠⁠⁠⁠. Learn more about your ad choices. Visit megaphone.fm/adchoices
• 
  All about that proxy. [Research Saturday] 19.09.2026 25p

  Today we are joined by Dr. Renée Burton, VP of Threat Intelligence at Infoblox, discussing their work on Lurking Lizard, "Fake Installers, Fake Reviews, Fake Services – Real Proxies, Real." The research uncovers Lurking Lizard, a threat actor that has operated since at least 2022 by using fake software installers, VPNs, and lookalike domains to secretly turn victims’ devices into residential proxy nodes. Researchers identified more than 230 related domains and connected seemingly separate campaigns—including fake 7-Zip, downloader tools, and WireVPN—through shared infrastructure, tracking URLs, deployment patterns, and APIs. The investigation suggests the actor runs an end-to-end proxy operation, recruiting compromised devices and then monetizing their bandwidth through proxy services and fake review sites, with WireVPN appearing to be the latest evolution of the campaign. The research and executive brief can be found here: Fake Installers, Fake Reviews, Fake Services - Real Proxies, Real Victims Learn more about your ad choices. Visit megaphone.fm/adchoices
• 
  The Cisco root route. 18.09.2026 28p

  Cisco patches a maximum-severity vulnerability in its Identity Services Engine. Court documents describe AI as “an astonishing theft of unprecedented proportions.” Researchers chain vulnerabilities to take over employee ChatGPT accounts. Microsoft and Check Point patch vulnerabilities. Manufacturing remains ransomware’s favorite target. Hackers compromise a Japanese image-sharing service. The Settra ransomware group leverages remote management software. An Australian think-tank warns of Chinese AI-enabled surveillance in Venezuela. Maria Varmazis joins me for a look back at ten years of critical infrastructure exploits. Everything you wanted to know about AI but were afraid to prompt. Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guest Dave Bittner and Maria Varmazis reflect on the past decade of critical infrastructure attacks, looking at major incidents like the Ukraine power grid attack and Colonial Pipeline and the lessons they’ve taught the industry about resilience and preparedness. If you enjoyed this conversation, be sure to tune in this Sunday for a special edition of the show, where Dave and Maria continue the conversation. Selected Reading Cisco drops another exploited zero-day, this time a perfect 10 (The Register) ‘Doom Loop’: OpenAI and Microsoft Admits LLMs Are Destroying the Web and Built on Theft (404 Media) AI-Built Exploit and Sign-In Flaw Opened Path to Internal OpenAI Code (SecurityWeek) Microsoft Patches 18 Vulnerabilities in AI, Cloud Products (SecurityWeek) New Check Point flaw lets hackers execute code with root privileges (Bleeping Computer) Manufacturing Accounts for 22% of all Ransomware Victims (Infosecurity Magazine) 23 Million User Records Compromised in Gyazo Data Breach (SecurityWeek) Ready, Settra, Go: New Settra Ransomware Variant Deploys MeshAgent RMM (Huntress) USA’s Venezuela takeover comes with bonus exposure to Chinese AI surveillance tech (The Register) Will A.I. Kill Us? Can It Hack My Bank Account? Your A.I. Questions Answered (New York Times) Share your feedback. What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show. Want to hear your company in the show? N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices
• 
  AI is calling the shots. 17.09.2026 29p

  AI goes to war. Iranian strikes leave AWS data unrecoverable. OpenAI discloses more model misbehavior. Researchers uncover 16 Wireshark vulnerabilities. TrustSink turns Entra authentication into a password trap. RatHat raids Android credentials. The FBI takes down a DDoS-for-hire service. A data broker loses its domains. U.S. Cyber Command names a new AI chief. Ethan Cook is joining Dave Bittner and Ben Yelin to discuss the industry-proposed and administration-opposed AI slowdown. CISA’s field of schemes.  Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guest Today, Ethan Cook, N2K’s lead analyst, joins Dave Bittner and Ben Yelin for a discussion about the industry-proposed and administration-opposed AI slowdown, exploring the policy debate and what it could mean for the future of AI. If you enjoyed this conversation, be sure to check out the full interview on Caveat here. Selected Reading The era of AI warfare has arrived (Financial Times) Iran strikes on Amazon data centers caused permanent loss of customer data (Ars Technica) OpenAI Discloses Six New Incidents of ‘Concerning' A.I. Behavior (The New York Times) AISLE Discovers 16 CVEs in Wireshark, the World’s Most Popular Network Protocol Analyzer (AISLE) TrustSink: How a Rogue External MFA Provider Steals Passwords (Varonis) RatHat: AI-Powered Mobile Threat is Here for Your Credentials & Bank Accounts (Zimperium) US takes down NightmareStresser DDoS-for-hire platform (Bleeping Computer) Data Broker Radaris Loses Domains in Privacy Fight (Krebs on Security) Former NGA Executive Ronzelle Green Named USCYBERCOM Chief AI Officer (ExecutiveGov) CISA releases Cyber Decoys guide detailing tripwires, honeytokens to strengthen critical infrastructure detection and response (Industrial Cyber) Share your feedback. What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show. Want to hear your company in the show? N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices
• 
  Cybercrime finds its sea legs. 16.09.2026 29p

  Officials investigate suspected cyberattacks on U.S.-bound oil tankers. Iranian operators deploy Chosen Brick surveillance malware. Ukraine cracks down on scam call centers. Researchers uncover two TP-Link camera zero-days. Maria Varmazis looks at weapons in space. CenterPoint Energy reports a data breach. Spain records its first breach caused by an autonomous AI agent. PhantomRaven targets developers through malicious npm packages. Illicit casinos provide cover for cybercrime. A New York healthcare provider exposes patient data. Our guest is Chad Thunberg, CISO at Yubico, on how real crypto-agility still needs a hardware root of trust. Hackers do a little Flock picking. Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guest Today Chad Thunberg, CISO at Yubico, discusses how software-only encryption is only half the answer: real crypto-agility still needs a hardware root of trust, not just a software patch. Selected Reading Coast Guard, FBI investigating after 2 oil tankers bound for US hit with cyberattacks (ABC News) US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware (SecurityWeek) Ukraine moves to crack down on scam call centers after corruption scandal (The Record) Zero-Day Flaw in TP-Link Cameras Enables Covert Eavesdropping (Infosecurity Magazine) CenterPoint Energy Discloses Data Breach Following Dark Web Claims of 7.5 Million Records Stolen (Beyond Machines) Spain gets its first taste of AI-aided cyber attack (The Register) PhantomRaven: An LLM-Generated Information Stealer Developed for Bug Bounty Hunting (CrowdStrike) How Money Laundering, Scams, and Espionage Hide in a Web Full of Casino Garbage (Infoblox) 280,000 Impacted by Premier Medical Group Data Breach (SecurityWeek) Meink: Space Force has deployed space control weapons to orbit (DefenseScoop) Hackers Got Inside a Flock Camera. Its Data Shows How the System Really Works (WIRED) Share your feedback. What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show. Want to hear your company in the show? N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices