App Store

Google Play

DK - Details page - Device banner - 894x1036

Nyd den ubegrænsede adgang til tusindvis af spændende e- og lydbøger - helt gratis

Lyt når som helst, hvor som helst 

N2K Networks

The daily cybersecurity news and analysis industry leaders depend on. Published each weekday, the program also includes interviews with a wide spectrum of experts from industry, academia, and research organizations all over the world.

CyberWire Daily

Please enjoy this encore of Career Notes. 

Senior Vice President and Executive in Residence with Rapid7 and Chairman for Cyversity, Julian Waits, grew up in the era of the Justice League and Superman and it shaped his career. Julian always wanted to do something where he could find a way to help society to basically help others. Starting out as a Baptist minister with aspirations of being a professional musician, Julian found it more practical to take some technology classes and practice his saxophone when he had time. His first tech job was at Texaco where he worked on early networks and moved into systems engineering at Compaq. Julian notes his ADD made coding less attractive than talking with others to solve problems and Compaq provided him with opportunities to pivot. Searching out diversity, Julian moved to DC, and had his first taste of startups. He now describes himself as a serial entrepreneur. We thank Julian for sharing his story with us.
Learn more about your ad choices. Visit megaphone.fm/adchoices

Julian Waits: Find a way to help society. [Serial Entrepreneur] [Career Notes]

This week, we are joined by Dr. Renée Burton, VP of Infoblox Threat Intel, who is discussing their work on VexTrio, a notorious traffic distribution system (TDS) involved in digital fraud. The VexTrio investigation uncovers a massive global ad fraud and scam operation powered by just 250 virtual machines, tying it directly to named individuals and shell companies across Europe. 

The research exposes VexTrio’s full criminal supply chain—including fake apps, dating scams, affiliate networks, and payment processors—alongside a powerful CDN infrastructure ranked among the world’s top 10k domains. It also calls on the adtech industry to take accountability for enabling and sustaining such widespread abuse.

Complete our annual ⁠⁠⁠⁠audience survey⁠⁠⁠⁠ before August 31.

The research can be found here:

 
⁠VexTrio’s Origin Story : From Spam to Scam to Adtech

Learn more about your ad choices. Visit megaphone.fm/adchoices

Beyond the smoke screen. [Research Saturday]

The FTC warns one country’s “online safety” may be another’s “censorship.” A new bipartisan bill aims to reduce barriers to federal cyber jobs. MURKY PANDA targets government, technology, academia, legal, and professional services in North America. MITRE updates their hardware weaknesses list. Customs and Border Protection conducts a record number of device searches at U.S. borders. A recent hoax exposes weaknesses in the cybersecurity community’s verification methods. A Houston man gets four years in prison for sabotaging his employer’s computer systems. A Florida-based provider of sleep apnea equipment suffers a data breach. Interpol dismantles a vast cybercriminal network spanning Africa. Brandon Karpf shares his experience with fake North Korean job applicants. Being a smooth-talking English speaker can land you a gig in the cybercrime underworld. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today we are joined by Brandon Karpf, friend of the show discussing his experience with fake North Korean job applicants. You can also hear more from Brandon on our show T-Minus Daily, where he’s a regular guest on a monthly space segment—catch his latest episode this Monday!

Selected Reading

US warns tech companies against complying with European and British ‘censorship’ laws (The Record)

House lawmakers take aim at education requirements for federal cyber jobs (CyberScoop)

MURKY PANDA: Trusted-Relationship Cloud Threat (CrowdStrike)

MITRE Updates List of Most Common Hardware Weaknesses (SecurityWeek)

Phone Searches at the US Border Hit a Record High (WIRED)

The Cybersecurity Community's Wake-Up Call: A Fake Reward and Its Lessons (The DefendOps Diaries)

Chinese national who sabotaged Ohio company’s systems handed four-year jail stint (The Record)

CPAP Medical Data Breach Impacts 90,000 People (SecurityWeek)

Interpol-Led African Cybercrime Crackdown Leads to 1209 Arrests (Infosecurity Magazine)

'Impersonation as a service' next big thing in cybercrime (The Register)

Audience Survey

Complete our annual audience survey before August 31.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.
Learn more about your ad choices. Visit megaphone.fm/adchoices

A free speech showdown.

Zero-day clickjacking flaws affect major password managers. The FBI warns that Russian state-backed hackers are exploiting a long-known Cisco flaw. Apple releases emergency patches for a zero-day flaw in the Image I/O framework. Home Depot faces a proposed class action lawsuit accusing it of secretly using facial recognition at self-checkout kiosks. A VPN browser extension has been exposed for secretly spying on users. Browser fingerprinting overtakes cookies as the dominant method of online tracking. Agentic AI browsers prove easily scammed. A Scattered Spider member earns 10 years in federal prison. Ron Zayas, CEO of Ironwall by Incogni, to discuss the massive data sharing and privacy risks in the leading Buy Now Pay Later apps. An Australian bank’s AI cutbacks are put on permanent hold.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today we are joined by Ron Zayas, CEO of Ironwall by Incogni, to discuss the massive data sharing and privacy risks in the leading Buy Now Pay Later apps. Tune in to hear the full conversation on Caveat.

Selected Reading

Researcher Exposes Zero-Day Clickjacking Vulnerabilities in Major Password Managers (Socket)

FBI warns of Russian hackers exploiting 7-year-old Cisco flaw (Bleeping Computer)

Apple fixes new zero-day flaw exploited in targeted attacks (Bleeping Computer)

Home Depot Sued for 'Secretly' Using Facial Recognition Technology on Self-Checkout Cameras (PetaPixel)

SpyVPN: The Google-Featured VPN That Secretly Captures Your Screen (Koi Blog)

Beyond cookies: browser fingerprinting in 2025 (PITG Network)

"Scamlexity": When Agentic AI Browsers Get Scammed (Guardio)

SIM-Swapper, Scattered Spider Hacker Gets 10 Years (Krebs on Security)

Commonwealth Bank backtracks on AI job cuts, apologises for 'error' as call volumes rise (ABC News)

Audience Survey

Complete our annual audience survey before August 31.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.
Learn more about your ad choices. Visit megaphone.fm/adchoices

Behind the lock lies a flaw.

Microsoft releases emergency out-of-band (OOB) Windows updates. Trump targets NSA’s leading AI and cyber expert in clearance revocations. A breach may have compromised the privacy of Ohio medical marijuana patients. Cybercriminals exploit an AI website builder to rapidly create phishing sites. Warlock ransomware operators target Microsoft’s SharePoint ToolShell vulnerability. Google and Mozilla patch Chrome and Firefox. European officials report two cyber incidents targeting water infrastructure. A federal appeals court has upheld fines against T-Mobile and Sprint for illegally selling customer location data. Authorities dismantle DDoS powerhouse Rapper Bot. On our Industry Voices segment, we are joined by Matt Radolec, VP - Incident Response, Cloud Operations, and Sales Engineering at Varonis, speaking about ShinyHunters and the problems with securing Salesforce. Microsoft Copilot gets creative with compliance. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

On our Industry Voices segment, we are joined by Matt Radolec, VP - Incident Response, Cloud Operations, and Sales Engineering at Varonis, who is speaking about ShinyHunters and the problems with securing Salesforce. You can hear more from Matt here.

Selected Reading

Microsoft releases emergency updates to fix Windows recovery (Bleeping Computer)

Trump Revokes Security Clearances of 37 Former and Current Officials (The New York Times)

Highly Sensitive Medical Cannabis Patient Data Exposed by Unsecured Database (WIRED)

AI Website Builder Lovable Abused for Phishing and Malware Scams (Hackread)

Warlock Ransomware Hitting Victims Globally Through SharePoint ToolShell Exploit (InfoSecurity Magazine)

High-Severity Vulnerabilities Patched in Chrome, Firefox (SecurityWeek)

Russia-linked European attacks renew concerns over water cybersecurity (CSO Online)

T-Mobile claimed selling location data without consent is legal, judges disagree (Ars Technica)

Officials gain control of Rapper Bot DDoS botnet, charge lead developer and administrator (CyberScoop)

Copilot Broke Your Audit Log, but Microsoft Won’t Tell You (Pistachio Blog)

Audience Survey

Complete our annual audience survey before August 31.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.
Learn more about your ad choices. Visit megaphone.fm/adchoices

Undoing the undo bug.

A researcher uncovers vulnerabilities across Intel’s internal websites that exposed sensitive employee and supplier data. The Kimsuky group (APT43) targets South Korean diplomatic missions. A new DDoS vulnerability bypasses the 2023 “Rapid Reset” fix. Drug development firm Inotiv reports a ransomware attack to the SEC. The UK drops their demand that Apple provide access to encrypted iCloud accounts. Hackers disguise the PipeMagic backdoor as a fake ChatGPT desktop app. The source code for a powerful Android banking trojan was leaked online. A Nebraska man is sentenced to prison for defrauding cloud providers to mine nearly $1 million in cryptocurrency. On this week’s Threat Vector, David Moulton speaks with Liz Pinder and Patrick Bayle for a no holds barred look at context switching in the SOC. A UK police force fails to call for backup.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Threat Vector

Security analysts are drowning in tools, alerts, and tabs. On today's Threat Vector segment from Palo Alto Networks, we offer a snapshot from host⁠ David Moulton⁠'s conversation with⁠ Liz Pinder⁠ and⁠ Patrick Bayle⁠⁠. Together they take a no holds barred look at context switching in the SOC, what it costs, why it's getting worse, and how smarter design can fix it. You can listen to David, Patrick, and Liz's conversation⁠ here⁠. It’s a must-listen for anyone building or managing a modern SOC. New episodes of⁠ Threat Vector⁠ drop each Thursday on the N2K CyberWire network and in your favorite podcast app.

Selected Reading

Intel data breach: employee data could be accessed via API (Techzine Global)

North Korean Kimsuky Hackers Use GitHub to Target Foreign Embassies with XenoRAT Malware (GB Hackers)

Internet-wide Vulnerability Enables Giant DDoS Attacks (Dark Reading)

Drug development company Inotiv reports ransomware attack to SEC (The Record)

UK ‘agrees to drop’ demand over Apple iCloud encryption, US intelligence head claims (The Record)

Ransomware gang masking PipeMagic backdoor as ChatGPT desktop app: Microsoft (The Record)

ERMAC Android malware source code leak exposes banking trojan infrastructure (Bleeping Computer)

Nebraska man gets 1 year in prison for $3.5M cryptojacking scheme (Bleeping Computer)

South Yorkshire Police Deletes 96,000 Pieces of Digital Evidence (Infosecurity Magazine) 

Audience Survey

Complete our annual audience survey before August 31.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.
Learn more about your ad choices. Visit megaphone.fm/adchoices

Inside Intel’s internal web maze.

HR software giant Workday discloses a data breach. Researchers uncover a zero-day in Elastic’s EDR software. Ghost-tapping is an emerging fraud technique where cybercriminals use NFC relay attacks to exploit stolen payment card data. Germany may be on a path to ban ad blockers. A security researcher documents multiple serious flaws in McDonald’s systems. There’s a new open-source framework for testing 5G security flaws. New York’s Attorney General sues the banks behind Zelle over fraud allegations. The DOJ charges the alleged Zeppelin ransomware operator and seizes over $2.8 million in cryptocurrency. Tim Starks from CyberScoop discusses the overlooked changes that two Trump executive orders could bring to cybersecurity. Bots build their own echo chambers.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.CyberWire Guest

Today we have Tim Starks from CyberScoop discussing the overlooked changes that two Trump executive orders could bring to cybersecurity.

Selected Reading

HR giant Workday discloses data breach after Salesforce attack (Bleeping Computer)

Researchers report zero-day vulnerability in Elastic Endpoint Detection and Respons Driver that enables system compromise (Beyond Machines)

Ghost-Tapping and the Chinese Cybercriminal Retail Fraud Ecosystem (Recorded Future)

Is Germany on the Brink of Banning Ad Blockers? User Freedom, Privacy, and Security Is At Risk. (Open Policy & Advocacy)

How I Hacked McDonald's (Their Security Contact Was Harder to Find Than Their Secret Sauce Recipe) (bobdahacker)

Boffins say tool can sniff 5G traffic, launch 'attacks' without using rogue base stations (The Register)

New York claims Zelle’s shoddy security enabled a billion dollars in scams (The Verge)

US Seizes $2.8 Million From Zeppelin Ransomware Operator (SecurityWeek)

Researchers Made a Social Media Platform Where Every User Was AI. The Bots Ended Up at War (Gizmodo)

Audience Survey

Complete our annual audience survey before August 31.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.
Learn more about your ad choices. Visit megaphone.fm/adchoices

Workday’s bad day.

Bob Rudis, VP Data Science from GreyNoise, is sharing some insights into their work on "Early Warning Signals: When Attacker Behavior Precedes New Vulnerabilities." New research reveals a striking trend: in 80% of cases, spikes in malicious activity against enterprise edge technologies like VPNs and firewalls occurred weeks before related CVEs were disclosed. 

The report breaks down this “6-week critical window,” highlighting which vendors show the strongest early-warning patterns and offering tactical steps defenders can take when suspicious spikes emerge. These findings reveal how early attacker activity can be transformed into actionable intelligence, enabling defenders to anticipate and neutralize threats before vulnerabilities are publicly disclosed.

Complete our annual ⁠⁠⁠audience survey⁠⁠⁠ before August 31.

The research can be found here:

 Early Warning Signals: When Attacker Behavior Precedes New Vulnerabilities

Learn more about your ad choices. Visit megaphone.fm/adchoices

The CVE countdown clock. [Research Saturday]

Please enjoy this encore of Career Notes.

Head of Cyber Governance with Red Sift, Dr. Rois Ni Thuama shares the circuitous route of her career into cyber governance. She notes the route "looks really clean, but actually it was a bit more Jeremy Bearimy." While at Trinity College, Rois was moved to be part of history unfolding in South Africa and pause her studies. While there, she began making music videos and wildlife documentaries. Upon her return to London, Rois started working in corporate governance and risk at a music technology startup. This ignited her enthusiasm for startups. She now works in a company with several coworkers from that tech startup doing cyber governance. Rois advises law students of many ways into the industry including doing coding, learning risk management, and understanding privacy legislation, and then "just get into the game." We thank Rois for sharing her story. 
Learn more about your ad choices. Visit megaphone.fm/adchoices

Dr. Rois Ni Thuama: Get into the game. [Cyber governance] [Career Notes]

Plex urges users to immediately update their Media Server due to an undisclosed security flaw. Cisco warns of a critical remote code execution flaw in their Secure Firewall Management Center software.Rockwell Automation discloses multiple critical and high-severity flaws. Hackers breached a Canadian House of Commons database. Active law enforcement and government email accounts are sold online for as little as $40. Telecom giant Colt Technology Services suffers a cyber incident disrupting its customer portal. Taiwan launches new measures to boost hospital cybersecurity after ransomware attacks. NIST has released a concept paper proposing control overlays for securing AI systems. A date with an AI chatbot ends in tragedy. Our guest is Randall Degges, Snyk's Head of Developer and Security Relations, to discuss how underqualified or outsourced coding support can open doors for nation-state threats. Dutch speed cameras are stuck in a cyber-induced siesta.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today we are joined by Randall Degges, Snyk's Head of Developer and Security Relations, to discuss how underqualified or outsourced coding support can open doors for nation-state threats.

Selected Reading

Plex warns users to patch security vulnerability immediately (Bleeping Computer)

Cisco Discloses Critical RCE Flaw in Firewall Management Software (Infosecurity Magazine)

Critical Flaws Patched in Rockwell FactoryTalk, Micro800, ControlLogix Products (SecurityWeek)

CISA Releases Thirty-Two Industrial Control Systems Advisories (CISA.gov)

Hackers Breach Canadian Government Via Microsoft Exploit (Bank Infosecurity)

Compromised Government and Police Email Accounts on the Dark Web (Abnormal.AI)

Telco giant Colt suffers attack, takes systems offline (The Register)

Taiwan announces measures to protect hospitals from hackers (Focus Taiwan)

New NIST Concept Paper Outlines AI-Specific Cybersecurity Framework (Hack Read)

A flirty Meta AI bot invited a retiree to meet. He never made it home. (Reuters)

Dutch prosecution service attack keeps speed cameras offline (The Register)

Audience Survey

Complete our annual audience survey before August 31.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.
Learn more about your ad choices. Visit megaphone.fm/adchoices

Media server mayday.

LOBSHOT is a cryptowallet stealer abusing Google Ads. Coronation phishbait. A known CCTV vulnerability is currently being exploited. T-Mobile discloses another, smaller data breach. New Magecart exploits. Preliminary lessons from cyber operations during Russia's war. Rob Boyce from Accenture shares insights from RSA Conference. Our special guest is NSA Director of Cybersecurity Rob Joyce. And Europol announces a major dark web market takedown.

For links to all of today's stories check out our CyberWire daily news briefing:
https://thecyberwire.com/newsletters/daily-briefing/12/84

Selected reading.
New LOBSHOT malware gives hackers hidden VNC access to Windows devices (BleepingComputer)
New 'Lobshot' hVNC Malware Used by Russian Cybercriminals (SecurityWeek)
Elastic Security Labs discovers the LOBSHOT malware (Elastic Blog)
Researchers see surge in scam websites linked to coronation (Computer Weekly) 
TBK DVR Authentication Bypass Attack (FortiGuard) 
T-Mobile discloses second data breach since the start of 2023 (BleepingComputer) 
T-Mobile discloses 2nd data breach of 2023, this one leaking account PINs and more (Ars Technica) 
T-Mobile Announces Another Data Breach (CNET)
Magecart threat actor rolls out convincing modal forms (Malwarebytes)
Cyber lessons from Ukraine: Prepare for prolonged conflict, not a knockout blow (Breaking Defense)
288 dark web vendors arrested in major marketplace seizure (Europol)
Learn more about your ad choices. Visit megaphone.fm/adchoices

N2K Networks, Inc.

From cryptostealers to CCTV exploits, from Magecart enhancements to coronation phishbait, cybercriminals have been active. (But so have law enforcement agencies.)

From cryptostealers to CCTV exploits, from Magecart enhancements to coronation phishbait, cybercriminals have been active. (But so have law enforcement agencies.)

Lyt når som helst, hvor som helst

Other podcasts you might like ...