app_store_button

google_play_button

DK - Details page - Device banner - 894x1036

Lyt når som helst, hvor som helst 

N2K Networks

The daily cybersecurity news and analysis industry leaders depend on. Published each weekday, the program also includes interviews with a wide spectrum of experts from industry, academia, and research organizations all over the world.

CyberWire Daily

A watchdog challenges the Trump administration’s secret frontier AI reviews. METR discloses two cyberattacks. Leaked documents reveal a Russian cyber training pipeline. Rogue ScreenConnect clients spread malware like a worm. A breach exposes appellate court records across the U.S. and Canada. Spring Ring impersonates IT support on Microsoft Teams. Plex urges users to patch, and Cisco warns of unpatched Secure Email flaws. Our guest is Rob van der Veer, Chief AI Officer at Software Improvement Group, discussing how we are not keeping up with the AI attack surface. Robocall report cards. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today we are joined by Rob van der Veer, Chief AI Officer at Software Improvement Group, discussing how we are not keeping up with AI attack surface.

Selected Reading

Trump may be forced to reveal secret rules feds use for AI safety testing (Ars Technica)

Attacker stole a METR API key, used $600K worth of credits, and no one noticed for weeks (The Register)

2,000 Leaked Documents Reveal How Russia Turns Engineering Students Into GRU Cyber Operators (Security Affairs)

Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity (Huntress)

A breach at Thomson Reuters reached appellate courts in twelve US jurisdictions (Thenextweb)

Spring Ring Vishing Attack Uses Fake IT Calls on Microsoft Teams to Install Malware (Hackread)

Plex warns users to patch security vulnerabilities immediately (Bleeping Computer)

Cisco Warns of Unpatched Secure Email Flaws, Patches Critical Switch Vulnerabilities (SecurityWeek)

The FCC wants consumers to rate their telecom’s anti-robocall protections (CyberScoop)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show. 

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Who’s watching the AI watchers?

Nexus sells driver’s license scans on the dark web. OpenAI says its models have reached a “Critical” capability threshold. International law enforcement disrupts a decades-old botnet. AI hallucinations fuel “slop squatting.” Plus, urgent patches for Cleo Harmony and Virtualizor, a Texas healthcare breach, and a Russian national accused of targeting thousands of freelancers with remote-access malware. Maria Varmazis shares the latest space-cyber news. Our guest is Rob Allen, Chief Product Officer at Threat Locker, talking about protecting against AI in the workplace. AI threatens the government’s bug supply.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

On today’s Industry Voices we are joined by Rob Allen, Chief Product Officer at Threat Locker, talking about protecting against AI in the workplace. If you enjoyed this conversation, be sure to check out the full interview here. 

Selected Reading

FBI Probes Service Selling 153M+ Drivers Licenses (Krebs on Security)

OpenAI’s Astra Becomes First Model to Cross Critical Cybersecurity Threshold (SecurityWeek)

Sality botnet infrastructure dismantled in joint global takedown (Bleeping Computer)

Crooks Are Learning to Love AI Hallucinations (IEEE Spectrum)

MSSA Reference Architecture 2.0 (Mobile Satellite Services Association (MSSA))

Exploit Published for Fresh Cleo Harmony Vulnerability (SecurityWeek)

Malicious Virtualizor Update Served via BGP Hijacking (SecurityWeek)

Nutex Health Says Patient Data Stolen, Hackers Threaten Leak (Infosecurity Magazine)

US charges Russian for infecting 80,000 freelancers with malware (Bleeping Computer)

How AI could make it harder for governments to use hacking tools (TechCrunch)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Drive-by data theft.

Nightmare Eclipse drops a Kaspersky zero-day. The Financial Stability Board warns frontier AI could threaten the global financial system. Anthropic says it has tightened security. CISA adopts a risk-based approach to patching. A new Windows infostealer hides in fake AI models. A critical vulnerability in JFrog Artifactory is kneedeep in active exploitation. North Korean workers are still landing U.S. jobs. A classic NSA codebreaking machine. Our guest is Heather Ceylan, CISO at Box, discussing if AI becomes agentic, governance could become a resilience issue. A robot vacuum sucks up evidence. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today on our Industry Voices, we are joined by Heather Ceylan, CISO at Box, discussing as AI becomes agentic, governance becomes a resilience issue. If you enjoyed this conversation, be sure to check out the full interview here.

Selected Reading

Chaotic Eclipse Releases Kaspersky Zero-Day HardBreacher (SecurityAffairs)

Financial Stability Board Sounds the Alarm Over Frontier AI Risks (Infosecurity Magazine)

Unit 42 warns AI has shifted balance of power from defenders to attackers (CyberScoop)

Improving our alignment and security practices (Anthropic)

CISA vulnerability directive designed to ‘buy back time’ against hackers (Federal News Network)

RevStealer malware spread through fake Claude Opus 5 download (SC Media)

Critical JFrog Artifactory Vulnerability Reportedly Exploited in the Wild (SecurityWeek)

North Korea-linked IT Workers Are Getting Hired Inside Western Companies (SecurityAffairs)

IBM Built the Cold War's Most Powerful Code Breaker for the NSA (IEEE Spectrum)

Man uses robot vacuum to covertly record his wife's affair, wins divorce settlement but gets sentenced to prison for making an illegal recording — Husband lands behind bars after counter-suit over privacy rights (Tom's Hardware)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Nightmare on Windows 11.

Could an AI kill switch create more problems than it solves? A critical Rails flaw is under active attack. Malicious browser extensions steal cryptocurrency. Fire Ant targets trusted network infrastructure. Claude Code gets tricked into running attacker-controlled code. MyChart phishing scams spread malware. Two alleged sextortionists face U.S. charges. A former DIA insider walks into an FBI sting. Monday business briefing. Our guest is Tim Starks from CyberScoop discussing a controversial retail security bill. Getting local with Nigerian scammers.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today we are joined by Tim Starks from CyberScoop as he is discussing a controversial retail security bill.

Selected Reading

The AI Kill Switch Act is repeating the Clipper Chip’s mistakes (CyberScoop)

Critical Ruby on Rails Vulnerability in Attackers' Crosshairs (SecurityWeek)

Chrome Web Store extensions caught stealing crypto, browser data (Bleeping Computer)

China-linked Fire Ant Hides Inside Trusted Infrastructure (SecurityAffairs)

Researcher shows how Claude Code can be tricked simply by asking it to summarize a website (The Register)

Fake MyChart emails can show alarming test results, trick patients into installing malware (WMAR)

Nigerians extradited to US for sextortion, deaths of two teens (Bleeping Computer)

US government snitch-finder pleads guilty to leaking state secrets to foreign spies (The Register)

AI safety and security company Alice raises $140 million. (N2K Pro Business Briefing)

How Cyber Sleuths Tracked a Nigerian Scammer to His Doorstep (404 media)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show. 

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Let’s kill the kill switch.

In this episode, Maria Varmazis and Dave Bittner from N2K Cyberwire get back together to discuss the evolution of advanced persistent threats (APTs), threat actor landscape, attribution changes, and the future of cyber espionage over the past decade. Join Dave and Maria as they explore how geopolitical factors, organizational professionalism, and emerging technologies like AI are shaping cybersecurity threats. 

Together, they talk about: 

 The shift in attribution practices over the last 10 years.

 The role of nation states and organized crime in cyber threats.

 The impact of AI and emerging technologies on cyber warfare.

 The challenges of naming and shaming threat groups.

 The professionalization and organizational evolution of APT groups.

CyberWire Daily at 10: A decade of emerging threat actors and APTs. [Special Edition]

Today we are joined by Crystal Morin, Senior Cybersecurity Strategist, and Michael Clark, Senior Director of Threat Research, at Sysdig, sharing their work on "LLMjacking evolved: Attackers are using stolen AI compute to build offensive agentic tools." The Sysdig Threat Research Team observed an attacker abusing an exposed, unauthenticated Ollama server as the “brain” for an automated offensive security tool. 

The AI-powered framework can fingerprint services, identify vulnerabilities, craft exploits, extract credentials, and orchestrate attacks toward command execution, with researchers capturing the tool while it was still under active development. The activity highlights how LLMjacking is evolving from simply stealing AI compute for profit into using stolen model capacity to build increasingly autonomous offensive capabilities.

The research and executive brief can be found here:

 LLMjacking evolved: Attackers are using stolen AI compute to build offensive agentic tools

Who let the AI hack? [Research Saturday]

A judge rules the Trump administration illegally labeled Anthropic a national security risk. The White House moves to keep foreign technology out of U.S. power systems. OpenAI rallies a global cyber defense push as its own AI agents exploit a Linux vulnerability. Researchers uncover a new speculative-execution attack and hidden implants in Chinese-made routers. A fake voicemail campaign slips past email defenses. PaperCut faces an exploited zero-day. And ServiceNow patches three maximum-severity flaws in its AI Platform. Maria Varmazis and I look back at a decade of emerging threat actors and APTs. NSA sends out a covert save-the-date.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today, as we continue celebrating the CyberWire Daily’s 10th anniversary, Maria Varmazis and Dave Bittner look back at a decade of emerging threat actors and APTs. Enjoyed the conversation? Be sure to tune in Sunday for a special edition featuring the full discussion. 

Selected Reading

Trump Administration’s Blacklisting of Anthropic Was Illegal, Judge Rules (The New York Times)

White House bans foreign-made equipment for power generation over cyber backdoor concerns (The Record)

Tech, Cybersecurity Giants Unite Behind OpenAI-Led Cyber Defense Pledge (SecurityWeek)

A call for collective action on cyber defense (OpenAI)

New type of attack can slip past the defenses in your computer’s processor (MIT News)

Fake Voicemail SVG Attachments Fuel Large-Scale Phishing Campaign (Infosecurity Magazine)

OpenAI Agents Exploited Linux Kernel Flaw on Company’s Own Systems (SecurityWeek)

Hundreds of AI agents went rogue in OpenAI’s Hugging Face hack (POLITICO) 

PaperCut Releases Emergency Patch for Exploited Zero-Day (SecurityWeek)

ServiceNow warns of three max severity security vulnerabilities (Bleeping Computer)

Chinese Implants in the Supply Chain (VulnCheck)

Exclusive: NSA to host a hacker reunion in bid to rebuild secretive unit (The Record)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

The blacklist boomerang.

Meta settles. Australian police arrest two alleged TeamPCP members. The White House moves to shore up water utility cybersecurity. ATF reports a major cyber incident. The Navy tells sailors to lock down social media. The FBI warns of a prolific Chinese hacking operation. Bill Gates sounds the alarm on AI. A purported think tank tries to influence chatbot answers. And attackers focus less on individual vulnerabilities and more on the vendors behind them. Our guest is Tim Springston, Principal Product Manager at Semperis, on achieving hybrid identity resilience in the age of agentic AI. Meta pumps the brakes on going AI native. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

On today’s industry voices segment, we are joined by Tim Springston, Principal Product Manager at Semperis, discussing how to achieve hybrid identity resilience in the age of agentic AI. If you enjoyed this conversation, check out the full interview here. 

Selected Reading

Meta agrees to pay $18 billion to settle US lawsuits over children's social media addiction (Reuters)

Two Alleged ‘TeamPCP’ Hackers Arrested in Australia (Krebs on Security)

White House to unveil program to protect water systems against hackers (POLITICO)

DOJ firearms agency says hackers breached system containing investigation targets (The Record)

US Navy tells sailors and their families: scrub your social media, enemies are watching (Bitdefender)

Chinese Hacker Group QTFY Uses Custom-Built Platforms to Target US Infrastructure, FBI Warns (Infosecurity Magazine)

Bill Gates diagnoses problems with AI, but an expert questions his prescription (ABC News)

Fake US thinktank set up and funded by Israel sought to game AI for propaganda (The Guardian)

SentinelOne and Tenable Find Cyber Attackers Routinely Target Edge-Device Vendor Ecosystems Rather Than Individual Vulnerabilities (SentinelOne)

AI agents meant to replace Meta workers made “large-scale, disruptive actions” (Ars Technica)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show. 

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Meta gets a Meta-sized bill.

The U.S. disrupts a Chinese hacking operation blamed for intrusions at several sensitive government agencies. CISA says more than 100 water systems were targeted in July. Attackers exploit a critical Gitea flaw, while malicious pages masquerade as Cloudflare verification screens. Cyber insurance claims get costlier, and AI agents break out of their sandboxes. Boston Scientific battles a cyber incident. Plus, a new standard tracks AI agent activity, criminals target stolen iPhones, and an alleged money mule is charged in a $7.5 million scam. Our guest is Stephen Hilt, Sr. Threat Researcher at TrendAI, on the risks facing data centers. Some breach data doesn’t quite measure up.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

On today’s Industry Voices, we are joined by Stephen Hilt, Sr. Threat Researcher at TrendAI discussing the cybersecurity risks facing data centers and the thousands of internet-exposed industrial control systems that could leave them vulnerable to attack. And if you enjoyed this conversation, be sure to check out the full interview here. 

If you’d like to hear more on this topic from TrendAI, you can check out this recent episode of the AI Security Brief podcast that focuses on data center security. Guest Mark Houpt, CISO at DataBank, joined hosts Johnny Hand and Dustin Childs to explain why securing the AI era starts with protecting the physical data centers that power it—and why proven security fundamentals still matter against rapidly evolving threats. AI Security Brief podcast publishes every other Thursday on the N2K CyberWire network. Subscribe today!

Selected Reading

China-sponsored hacking platforms seized by US, Justice Department says (Reuters) 

CISA: Over 100 Internet-Exposed Water Systems Targeted in July Cyberattacks (SecurityWeek)

Hackers now exploit critical Gitea flaw in code injection attacks (Bleeping Computer)

Hackers abuse npm mirrors to host phishing redirect pages (Bleeping Computer)

Average Cyber Insurance Losses Increase Despite Fewer Claims (Infosecurity Magazine)

VMs won't contain cyber-capable agents (Trail of Bits)

Boston Scientific hit by cyberattack, global operations affected (Reuters)

Linux Foundation Introduces TRACE Standard for AI Runtime Evidence (Infosecurity Magazine)

AnonyMousKIT PhaaS uses voice AI agents to phish iPhone passcodes (Bleeping Computer)

Indian man who fled US arrested on charges he helped scammers siphon $7.5 million from the elderly (The Record)

Trump signs memo to help drastically boost US commercial space launches (Reuters) 

A Cautionary Tale About Data Breach Claims, Verification and Carhartt (Troy Hunt)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

The feds flip the script.

Lawmakers request an investigation into cuts at CISA. Threat actors actively exploit a Zimbra Collaboration Suite vulnerability. A Chinese AI lab preps release of a powerful open-weight model. A new phishing toolkit deploys attacker-controlled passkeys. Using audio hardware to fingerprint browsers. A DDoS attack knocks Norwegian government services offline. CISA orders patching of a critical Oracle vulnerability. Taiwanese prosecutors charge nine people over the alleged illegal export of high-end AI servers to mainland China. Operation Jackal IV cracks down on West African cybercrime networks. On our Industry Voices segment, Christy Wyatt, CEO from Absolute Security, discusses "Cyber Resilience: The Emerging Category." AI music hits a sour note down under.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today on our Industry Voices segment, we are joined by Christy Wyatt, CEO from Absolute Security, discussing "Cyber Resilience: The Emerging Category." If you enjoyed this conversation, be sure to check out the full interview here. 

Selected Reading

Lawmakers call for investigation into impact of CISA staffing cuts (The Record)

Hackers breached over 270 Zimbra servers in ongoing attacks (Bleeping Computer)

By Opening a Model, a Chinese A.I. Lab May Test the World’s Cybersecurity (NY Times)

iAuthFlow v2: The $10,000 Phishing Toolkit That Survives Your Password Reset (SecurityAffairs)

AliExpress was silently running audio in your browser to fingerprint and track your device (TechSpot)

Large DDoS attack knocks Norwegian public services offline (The Record)

U.S. CISA adds maximum-severity Oracle flaw to its Known Exploited Vulnerabilities catalog (SecurityAffairs)

Taiwan Charges 9 Over Illegal AI Server Exports to China, Including Nvidia and Super Micro Staff (SecurityWeek)

Police arrests dozens of suspects in global cybercrime crackdown (Bleeping Computer)

Songs created by AI banned from Australia's music charts (BBC News)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

CISA is running on empty.

Today we are joined by Brian Hussey, SVP of Howler Cell Threat Services at Cyderes, discussing their work on "Bad Ads, Worse Binaries: Fake Claude Code Installer Drops Infostealer." Howler Cell identified an SEO poisoning campaign targeting people searching for Claude Code installation guides, using a fake Anthropic page and a ClickFix lure to trick victims into running a malicious MSHTA command. 

The attack uses a six-stage, largely fileless chain that employs an MP3/HTA polyglot, PowerShell obfuscation, AMSI bypasses, per-victim infrastructure, and in-memory execution to evade detection. The final payload is a .NET infostealer that steals credentials, while Anthropic and the legitimate Claude Code installation process were not compromised.

The research and executive brief can be found here:

 Bad Ads, Worse Binaries: Fake Claude Code Installer Drops Infostealer

A little help from your search engine. [Research Saturday]

Lyt når som helst, hvor som helst

Other podcasts you might like ...