Cleartext

Daily cybersecurity briefing for CISOs and security leaders.

🎧 Listen to this episode

Today's episode covers 9 stories across 4 topic areas, including: Russian Intelligence Hacks IP Cameras to Spy on Military Logistics Across NATO States and Ukraine; Risky Bulletin: Hacker wipes Romania's entire land registry database; UAC-0145 Uses ClickFix CAPTCHAs to Infect Ukrainian Devices wih Malware.

The Hacker News · Jul 20 · Relevance: ████████░░ 8/10

Why it matters to CISOs: A formal advisory from Dutch intelligence services confirms systematic Russian exploitation of IP cameras at logistics and transport infrastructure across NATO countries, a significant escalation in physical-digital intelligence collection that enterprises supporting defense supply chains must address. CISOs at logistics, transportation, and critical infrastructure organizations should audit externally accessible camera systems and review vendor access policies immediately.

📖 Read full article

Risky Business News · Jul 20 · Relevance: ████████░░ 8/10

Why it matters to CISOs: The complete destruction of a national land registry database is a landmark destructive cyberattack against critical government infrastructure that signals threat actor willingness to permanently destroy authoritative state records — a scenario with direct implications for enterprise business continuity assumptions. CISOs should use this event to stress-test immutable backup and recovery strategies against destructive attack scenarios.

📖 Read full article

The Hacker News · Jul 19 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: Sandworm sub-cluster UAC-0145's use of ClickFix social engineering demonstrates that GRU-affiliated actors are actively refining credential-theft and malware delivery techniques that have already migrated beyond Ukraine to target Western organizations. CISOs should ensure security awareness programs address ClickFix-style CAPTCHA lures and validate endpoint controls against this delivery mechanism.

📖 Read full article

BleepingComputer · Jul 20 · Relevance: █████████░ 9/10

Why it matters to CISOs: This is the first confirmed case of an autonomous AI agent being used as an attack tool to breach production infrastructure, representing a new threat vector that security programs have not yet operationalized defenses against. Enterprises hosting models or datasets on Hugging Face must rotate credentials immediately, and security leaders should assess AI agent access controls across their own environments.

📖 Read full article

The Record (Recorded Future) · Jul 20 · Relevance: ████████░░ 8/10

Why it matters to CISOs: Craneware's breach as a critical software supplier to over 2,000 US hospitals is a high-impact third-party risk event that exposes the healthcare sector's systemic dependency on concentrated vendors. CISOs in healthcare and adjacent sectors should verify their Craneware exposure and invoke supplier breach notification clauses to obtain forensic scope details.

📖 Read full article

Infosecurity Magazine · Jul 20 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: UK law enforcement is leveraging high-profile cyber incidents to push for new legal powers — Cybercrime Risk Orders — that could impose proactive compliance obligations on organizations deemed to be at elevated risk, expanding the regulatory surface for enterprises operating in the UK. CISOs with UK footprints should monitor this legislative development as it could create mandatory pre-breach security requirements enforceable by courts.

📖 Read full article

Help Net Security · Jul 20 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: Italy's Garante fining a major telecom €1.7 million for social engineering-enabled breaches — not technical exploits — signals that European regulators will hold organizations accountable for procedural and human-factor security failures, not just technical ones. CISOs should review their social engineering controls, help desk authentication procedures, and documented security governance as audit evidence against this regulatory standard.

📖 Read full article

The Hacker News · Jul 19 · Relevance: █████████░ 9/10

Why it matters to CISOs: SonicWall SMA 1000 series VPN appliances are perimeter gateways deployed at thousands of enterprises, and pre-disclosure zero-day exploitation granting root access means organizations may already be compromised without any patch being available at time of attack. CISOs should immediately audit SMA 1000 deployments for indicators of compromise and assess network segmentation downstream of these devices.

📖 Read full article

BleepingComputer · Jul 20 · Relevance: █████████░ 9/10

Why it matters to CISOs: ServiceNow is deeply embedded in enterprise IT and security workflows at most large organizations, and active exploitation of a critical remote code execution vulnerability makes this an emergency patching priority with significant blast radius potential. CISOs should confirm patch status and verify no exploitation activity has occurred in their environments before patching.

📖 Read full article

Alex: Good Monday morning. Welcome to Cleartext for July 20th, 2026. I'm Alex Chen, alongside Jordan Reeves. We've got a dense board today. An autonomous AI agent used as an actual attack tool in the wild. Russian intelligence turning IP cameras into a continent-wide surveillance network. Romania's land registry wiped clean. Two critical zero-days under active exploitation — SonicWall and ServiceNow. A healthcare vendor breach hitting two thousand US hospitals. And European regulators fining a telco not for a technical failure, but for getting social-engineered. Plus, UK police are pushing for a new kind of preemptive legal power that could change how we think about regulatory exposure. Let's get into it.

Jordan: Let's start with the Hugging Face breach, because this one is genuinely novel. BleepingComputer confirmed over the weekend that attackers breached Hugging Face's production infrastructure using an autonomous AI agent. Not a human operator using AI-assisted tooling — an autonomous agent system that navigated the environment, found the path, and executed the breach. The entry point was a malicious dataset that abused the platform's pipeline execution environment to pivot into internal systems. Credentials and internal datasets were accessed. Hugging Face is telling all users to rotate tokens immediately.

Alex: This is the story I want every CISO reading their weekend briefing to sit with. We've been talking about AI-augmented attacks for two years now. Faster phishing, better reconnaissance, more convincing social engineering. This is categorically different. This is an autonomous system executing a multi-step intrusion chain without continuous human direction. It found the seam in the pipeline execution environment and exploited it on its own.

Jordan: And the seam it found isn't exotic. Hugging Face runs a massive model-hosting and dataset-sharing platform. Pipelines execute code. If you can inject into a pipeline — through a poisoned dataset, in this case — you're running code in a trusted context. The agent figured that out.

Alex: The immediate action for anyone using Hugging Face is obvious — rotate every token, audit your account activity, review what models and datasets you've pulled recently. But the strategic question is bigger. How many of your environments have execution contexts that an autonomous agent could discover and exploit? CI/CD pipelines, data ingestion workflows, model training jobs. If you're running AI workloads, you have attack surface you probably haven't threat-modeled for agentic exploitation.

Jordan: And I'd add — this isn't just about defending against AI agents. It's about the AI agents you're deploying internally. If you're giving autonomous systems access to your infrastructure, production credentials, internal APIs, you need to treat them like you'd treat a contractor with admin rights. Least privilege, monitoring, kill switches.

Alex: Exactly. The blast radius question works in both directions. Alright, let's pivot to the geopolitical cluster, because Moscow had a very busy week.

Jordan: Three stories, one throughline. The Dutch intelligence services — AIVD and MIVD — published a joint advisory on July 10th confirming that Russian intelligence is systematically hijacking IP cameras across multiple NATO member states and Ukraine. The targets are military transport routes, weapons shipment corridors, troop movement areas. This is physical surveillance at continental scale using commodity IoT devices.

Alex: And this is the part that should matter to the private sector. These aren't cameras on military bases. They're cameras at logistics hubs, shipping yards, rail corridors, highway interchanges. The cameras belong to private companies — freight operators, port authorities, transport providers. If you're in logistics, transportation, or anywhere in the defense supply chain, your externally accessible camera systems are now confirmed intelligence targets for a nation-state.

Jordan: The tradecraft is straightforward. Default credentials, unpatched firmware, cameras exposed directly to the internet. It's not sophisticated. It doesn't need to be. The sophistication is in the targeting and the aggregation — correlating feeds from hundreds of cameras across multiple countries to build a real-time picture of military logistics. That's an intelligence operation, not a hack.

Alex: The action here is unglamorous but essential. Audit every externally accessible camera. Change default credentials. Segment these devices off your production network. Review vendor remote access. And if you're a defense contractor or logistics provider with government contracts, expect this to show up in compliance requirements soon.

Jordan: Second in the Russia cluster — UAC-0145, which CERT-UA has formally attributed as a Sandworm sub-cluster, is using ClickFix-style fake CAPTCHA pages to trick Ukrainian targets into self-installing data-stealing malware. ClickFix is the social engineering technique where a fake CAPTCHA asks the user to paste a command into their terminal. It sounds absurd, but it works at scale.

Alex: And the critical detail is that ClickFix has already migrated beyond Ukraine. We've seen it targeting Western European organizations. GRU develops techniques in the conflict zone and then exports them. If your security awareness program doesn't specifically address ClickFix-style lures, you're behind.

Jordan: Third in this cluster, and arguably the most alarming single incident of the week — a hacker wiped Romania's entire national land registry database. The authoritative record of who owns what property in the country. Destroyed.

Alex: Let that sink in. This isn't ransomware. This isn't data exfiltration for sale. This is the destruction of an authoritative state record. Property ownership. The foundation of economic activity. If the backups aren't immutable and tested, Romania has a genuine crisis of title.

Jordan: We don't have full attribution yet, but the geopolitical context is obvious. Romania is a NATO frontline state. It's been a key transit corridor for Ukrainian military support. Whether this was Russian state action, a hacktivist proxy, or something else, the message is clear — authoritative databases are targets for destruction, not just theft.

Alex: For CISOs, the takeaway is about your own backup and recovery assumptions. If a threat actor got root on your most critical authoritative database — your ERP, your customer master, your financial ledger — and ran a destructive wipe, would you recover? Have you tested it? Are your backups truly immutable, or are they just offsite?

Jordan: Most organizations I've worked with have never tested a full destructive recovery scenario against their most critical system of record. They test backup restores, sure, but not against an adversary who had admin access and specifically targeted backup integrity. Romania just demonstrated what that failure mode looks like at national scale.

Alex: Let's move to the vulnerability block. Two critical items, both under active exploitation.

Jordan: SonicWall SMA 1000 series. Volexity discovered during an incident response engagement that a threat actor they're tracking as UTA0533 has been exploiting zero-days in these VPN appliances since at least June 22nd — almost a month before public disclosure. Exploitation grants root access. Root on your perimeter VPN appliance.

Alex: If you run SMA 1000 series, you should assume compromise until proven otherwise. Don't just patch. Hunt. Check for indicators of compromise. Assess what's downstream of that appliance. If an attacker had root on your VPN concentrator for potentially four weeks, your internal network segmentation is the only thing between you and a full domain compromise.

Jordan: Second — CVE-2026-6875 in the ServiceNow AI Platform. Critical remote code execution, now confirmed under active exploitation by the threat intelligence firm Defused. ServiceNow is in virtually every Fortune 500 company. It touches IT service management, security operations, HR workflows, procurement. The blast radius of a compromised ServiceNow instance is enormous.

Alex: This is an emergency patch. Full stop. But before you patch, verify no exploitation has already occurred. Check your ServiceNow audit logs. Look for anomalous API calls, unexpected admin actions, new integrations you didn't authorize. Patch without hunting first and you may be sealing an attacker inside.

Jordan: Two perimeter-class vulnerabilities under active exploitation simultaneously. That's a rough Monday for any SOC.

Alex: Moving to the breach space — Craneware, a healthcare software provider headquartered in Edinburgh, disclosed unauthorized access to a subset of its data environment. Employee and customer data confirmed stolen. Craneware serves more than two thousand US hospitals.

Jordan: This is a third-party risk event at scale. Two thousand hospitals. Craneware handles revenue cycle management — billing, pricing, compliance. The data they hold is sensitive. And because they're UK-listed, this is a cross-jurisdictional incident with GDPR, potential HIPAA implications, and UK regulatory exposure.

Alex: If you're a healthcare CISO, check your vendor inventory today. If Craneware is in your supply chain, invoke your breach notification clauses. Get forensic scope details. Understand what data of yours was in their environment. Don't wait for them to tell you — pull the thread yourself.

Jordan: And this is the third major healthcare vendor breach this year. The concentration risk in healthcare IT is systemic. A handful of vendors serve thousands of organizations, and when one falls, the blast radius is sector-wide.

Alex: Two governance stories to close out. Italy's Garante fined WINDTRE, one of Italy's major telecoms, 1.7 million euros for two breaches that exposed data on over 365,000 customers. The kicker — no technical vulnerabilities were exploited. Attackers posed as support technicians and social-engineered their way in. The regulator's finding was procedural failure. Help desk authentication. Access controls. Documentation.

Jordan: This is the regulatory direction across Europe. You can have perfect patch management and a state-of-the-art SOC, and still get fined because your help desk gave away the keys to someone who said the right words on the phone. Procedural controls are now a regulatory surface.

Alex: And in the UK, two senior police agency chiefs are citing the Transport for London prosecution to push for Cybercrime Risk Orders — a new legal mechanism that would give courts the power to impose proactive cybersecurity requirements on organizations assessed as high-risk. Not after a breach. Before one.

Jordan: That's a fundamental shift. Today, regulators respond after incidents. Cybercrime Risk Orders would let courts mandate specific security measures preemptively if an organization is deemed to be at elevated risk. Think of it as a restraining order for bad security hygiene.

Alex: If you have UK operations, put this on your legal team's radar now. It's early-stage, but the direction of travel is clear. Regulators and law enforcement want the authority to intervene before the breach, not just fine after it.

Jordan: Looking at the week ahead, Alex, the theme I keep coming back to is the expansion of what counts as an attack surface. IP cameras as intelligence collection platforms. AI pipeline execution environments as intrusion vectors. Autonomous agents as attack tools. Social engineering as a regulatory liability. The perimeter isn't a firewall anymore — it's everything.

Alex: Agreed. And the Romania incident adds another dimension. We've spent years focused on confidentiality — data theft, exfiltration, ransomware. Destructive attacks against authoritative records force us to think about integrity and availability in a way most organizations haven't operationalized. If your recovery strategy hasn't been tested against a determined adversary with admin access, this is the week to start that conversation.

Jordan: And for the AI agent story — I think we'll look back at the Hugging Face breach as an inflection point. The first confirmed autonomous agent intrusion. It won't be the last.

Alex: That's our show for Monday, July 20th. Show notes and links to every story we covered are at cleartext.fm. I'm Alex Chen.

Jordan: I'm Jordan Reeves. Patch ServiceNow. Hunt on your SonicWall boxes. Rotate your Hugging Face tokens. Have a good week.

Cleartext is an automated daily podcast for CISOs and security leaders. Generated 2026-07-20.

Sources are pulled from: CyberScoop, The Record, SecurityWeek, Krebs on Security, Dark Reading, Cybersecurity Dive, BleepingComputer, Wired, Ars Technica, TechCrunch, Help Net Security, VentureBeat, Risky Business News, The Hacker News, CISA, and BankInfoSecurity.

Daily cybersecurity briefing for CISOs and security leaders.

🎧 Listen to this episode

Today's episode covers 18 stories across 5 topic areas, including: Leading members of Scattered Spider sentenced in UK to 66 months in jail; Russian trio indicted for allegedly running bulletproof hosting providers that spurred cybercrime; The US government warns that Russia state hackers are coming after your router.

CyberScoop · Jul 17 · Relevance: ████████░░ 8/10

Why it matters to CISOs: The first significant prison sentences for Scattered Spider members send a deterrence signal to English-speaking cybercrime collectives and validate the UK-US law enforcement coordination model, which CISOs can reference when advocating for incident reporting and law enforcement engagement.

📖 Read full article

CyberScoop · Jul 16 · Relevance: ████████░░ 8/10

Why it matters to CISOs: The unsealed indictment of Media Land and ML.Cloud—core infrastructure providers for ransomware and cybercrime groups—disrupts a critical tier of the criminal supply chain and may degrade the reliability of attack infrastructure targeting enterprise environments.

📖 Read full article

Ars Technica Security · Jul 13 · Relevance: ████████░░ 8/10

Why it matters to CISOs: CISA's advisory on Russian APT targeting of consumer and SOHO routers as residential proxy infrastructure directly threatens enterprise perimeter defenses and VPN access controls, requiring immediate review of network edge policies and remote access assumptions.

📖 Read full article

Ars Technica Security · Jul 16 · Relevance: ████████░░ 8/10

Why it matters to CISOs: The adoption of ClickFix social engineering by Russian nation-state APTs—previously a financially-motivated criminal tool—signals a blurring of TTPs between espionage and crime groups that requires enterprise security awareness programs to evolve accordingly.

📖 Read full article

TechCrunch Security · Jul 14 · Relevance: ████████░░ 8/10

Why it matters to CISOs: Iran's exploitation of SS7/telecom protocol vulnerabilities to physically locate and target US military personnel represents a direct convergence of cyber and kinetic operations, with serious implications for mobile device security policies in high-risk operational environments.

📖 Read full article

Dark Reading · Jul 15 · Relevance: ████████░░ 8/10

Why it matters to CISOs: With credential-based attacks now the leading ransomware entry vector and MFA failing in 97% of those cases, CISOs must fundamentally reassess their identity security posture beyond checkbox MFA deployment toward phishing-resistant authentication and continuous access verification.

📖 Read full article

The Hacker News · Jul 14 · Relevance: ████████░░ 8/10

Why it matters to CISOs: A novel OAuth spoofing technique allows adversaries to silently enumerate and validate stolen Entra ID credentials without generating sign-in events, rendering SIEM-based detection blind to a critical credential validation step in cloud account takeover chains.

📖 Read full article

Infosecurity Magazine · Jul 16 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: Research demonstrating that GPT-5.5 can autonomously execute a full attack chain from a single prompt is a board-level AI risk crystallization moment, requiring CISOs to accelerate AI acceptable-use policies and red-team AI-assisted threat scenarios.

📖 Read full article

VentureBeat Security · Jul 13 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: Slopsquatting exploits AI coding assistant hallucinations to inject malicious packages into developer workflows from day one, representing a new supply chain attack vector that existing SCA and dependency-scanning tools are not designed to detect.

📖 Read full article

BleepingComputer · Jul 16 · Relevance: █████████░ 9/10

Why it matters to CISOs: A ransomware attack disrupting physical production at a $1B+ subsidiary and triggering an SEC 8-K filing illustrates the direct OT/IT convergence risk and the regulatory disclosure obligations CISOs must now manage within hours of a confirmed incident.

📖 Read full article

BleepingComputer · Jul 17 · Relevance: ████████░░ 8/10

Why it matters to CISOs: Abbott's simultaneous exposure on two fronts—a legacy system inherited from a $21B acquisition and an active extortion claim on a customer portal—highlights M&A cyber due diligence failures and the compounding risk of integrating acquired IT estates.

📖 Read full article

BleepingComputer · Jul 17 · Relevance: ████████░░ 8/10

Why it matters to CISOs: A breach via a third-party IT support ticketing system at one of the Big Four audit firms underscores supply-chain and vendor access risk, particularly relevant to any enterprise that shares sensitive data through outsourced IT support channels.

📖 Read full article

CyberScoop · Jul 14 · Relevance: █████████░ 9/10

Why it matters to CISOs: The White House's Gold Eagle program creates a new federal coordination layer for AI-discovered vulnerabilities, potentially accelerating mandatory patch timelines and changing how enterprises receive and act on government threat intelligence.

📖 Read full article

BleepingComputer · Jul 16 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: The 43-state AG coalition settlement against 23andMe establishes a precedent for coordinated state enforcement against breaches of sensitive biometric and health data, and the mandated security controls will inform expectations for any enterprise handling similar data categories.

📖 Read full article

Krebs on Security · Jul 13 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: CISA's postmortem on a contractor exposing AWS GovCloud keys in a public GitHub repo for six months—discovered by a journalist, not internal controls—provides a directly transferable case study for hardening secrets management and contractor oversight programs.

📖 Read full article

Krebs on Security · Jul 14 · Relevance: ██████████ 10/10

Why it matters to CISOs: AI-assisted vulnerability discovery has tripled Microsoft's patch volume in a single month, fundamentally breaking traditional patch triage workflows and demanding immediate reprioritization of remediation programs enterprise-wide.

📖 Read full article

The Hacker News · Jul 15 · Relevance: █████████░ 9/10

Why it matters to CISOs: Chained SonicWall SMA zero-days with a CVSS 10.0 SSRF flaw are being actively exploited by ransomware actors weeks before vendor disclosure, making any enterprise running SMA 1000 appliances an immediate priority for emergency patching or isolation.

📖 Read full article

The Hacker News · Jul 17 · Relevance: █████████░ 9/10

Why it matters to CISOs: A CVSS 9.8 SharePoint deserialization zero-day is under active exploitation with a patch not available until August, leaving FCEB agencies and enterprises with a mandatory emergency deadline and no vendor fix to deploy.

📖 Read full article

Jordan: Five hundred and seventy patches in a single Patch Tuesday. That's the number that defined this week. Not because it's a record — though it is — but because of what's behind it. AI is now discovering vulnerabilities faster than any enterprise on Earth can remediate them. And that's not a one-month anomaly. That's the new normal. Welcome to the week that broke your patch cadence.

Alex: Welcome to Cleartext. I'm Alex Chen, alongside Jordan Reeves. This is your Saturday Week in Review for the week ending July 18th, 2026. If you couldn't keep up this week, here's what mattered and what it means. We've got four big themes to walk through. First, the vulnerability avalanche — Microsoft's record patch dump, actively exploited zero-days in SonicWall and SharePoint, and what the Gold Eagle program signals about where this is all heading. Second, identity is officially the front door for ransomware, and the tools we thought were protecting it aren't. Third, law enforcement had a genuinely consequential week, from Scattered Spider sentencing to bulletproof hosting takedowns. And fourth, the geopolitical landscape got darker — Russian APTs borrowing criminal playbooks, Iran exploiting telecom protocols to locate soldiers, and AI lowering the bar for offensive operations. Let's get into it.

Jordan: So let's start with the vulnerability story because it touches everything else. Microsoft patched 570-plus CVEs on Tuesday. To put that in perspective, last month was already a record, and this nearly tripled it. Two zero-days under active exploitation. More than 60 rated critical. And Microsoft explicitly credited AI-assisted discovery for the surge. This isn't a blip. This is the leading edge of a structural shift in how vulnerabilities enter the ecosystem.

Alex: And here's the business problem. Every CISO I know has a patch cadence built around historical volume assumptions. You staff your vulnerability management team, you allocate maintenance windows, you negotiate downtime with business units — all based on a rough expectation of what's coming each month. When the number triples overnight, those assumptions collapse. You can't triple your patching capacity in a week. So now you're making harder triage decisions with less margin for error.

Jordan: Which brings us to Gold Eagle. The White House announced this clearinghouse specifically designed to coordinate AI-discovered vulnerabilities — prioritize them, route them, accelerate patches. It's already receiving intelligence. But the implementation details are thin. How does a private-sector CISO actually interface with this? What are the SLAs? Does prioritization guidance from Gold Eagle create a de facto compliance obligation? These are open questions, and they matter.

Alex: They matter a lot, because we also got two other critical vulnerabilities this week that illustrate the operational pain. SonicWall SMA 1000 — two chained zero-days, one rated CVSS 10.0, actively exploited by the Inc ransomware group. Exploitation started three weeks before SonicWall even disclosed. If you're running SMA appliances, you were already compromised before you knew you were vulnerable.

Jordan: And then SharePoint. CVE-2026-58644, CVSS 9.8, deserialization RCE, added to CISA's Known Exploited Vulnerabilities catalog with a federal remediation deadline of July 19th — which is tomorrow. The full patch doesn't arrive until August. So CISA is telling federal agencies to fix something that doesn't have a complete fix yet. That means you're looking at workarounds, network segmentation, compensating controls. It's ugly.

Alex: The through-line here is inescapable. AI is accelerating vulnerability discovery. Vendors are shipping larger patch loads. Exploitation timelines are compressing. And remediation capacity hasn't scaled to match. This is a board-level resource conversation. If your vulnerability management program was adequately funded six months ago, it probably isn't now.

Jordan: Let's pivot to identity, because the data that dropped this week was damning. Sophos published incident response analysis showing identity-based attacks — phishing, brute force, credential theft — have officially overtaken software exploits as the number one ransomware initial access vector. That's a definitive shift.

Alex: And the statistic that should keep every CISO up tonight: MFA was deployed in 97 percent of those credential-based ransomware cases. It failed in every single one. Ninety-seven percent deployment. Zero percent prevention. That is a fundamental indictment of how most organizations have implemented multi-factor authentication. We've been treating MFA as a checkbox. Push notifications, SMS codes, app-based approvals — the adversary has adapted to all of them.

Jordan: The OAuth spoofing research on Entra ID makes this even worse. At least two threat actor groups are using a technique that validates stolen credentials against Microsoft Entra without generating a sign-in event. Your SIEM doesn't see it. Your UEBA doesn't flag it. The adversary confirms your credentials are valid, and your security operations center has no idea it happened. They then move to the next stage of the attack with a verified credential set and you're still looking at a clean dashboard.

Alex: So what do you do? The answer is phishing-resistant MFA — FIDO2, hardware keys, certificate-based authentication. And continuous access verification. Not just authentication at the gate, but ongoing validation of session integrity. This is expensive. It's operationally complex. And it's now clearly necessary. If you're going to your board this quarter, this is the conversation to have. The identity perimeter is where ransomware lives now, and our current defenses aren't working.

Jordan: Let's talk about law enforcement, because this was actually a good week on that front. Two Scattered Spider leaders — Thalha Jubair and Owen Flowers, both barely out of their teens — sentenced to 66 months each at Woolwich Crown Court for the Transport for London hack. That attack took down 148 systems, forced 27,000 employees to do in-person password resets, cost 29 million pounds. The NCA credited these sentences with disrupting broader Scattered Spider operations. US authorities had previously linked Jubair to 120-plus attacks.

Alex: This matters for CISOs beyond the headlines. First, it validates the UK-US law enforcement coordination model. When your legal and executive teams push back on engaging law enforcement during an incident, you now have a concrete example of that cooperation producing real consequences. Second, the deterrence signal to English-speaking cybercrime collectives is meaningful. These aren't untouchable operators in jurisdictions beyond reach. These are kids in the UK getting real prison time.

Jordan: On the infrastructure side, DOJ unsealed the indictment of three Russian nationals running Media Land and ML.Cloud — bulletproof hosting providers that supported attacks across 21 US states, over 62 million dollars in victim losses. This targets a critical tier of the criminal supply chain. You take down the hosting layer, you degrade the reliability of attack infrastructure for every group that depended on it.

Alex: Now, will these operators be extradited from Russia? Almost certainly not. But the indictment has operational value. It constrains their movement, their financial access, their ability to operate openly. And it puts other infrastructure providers on notice.

Jordan: Now let's get into the geopolitical picture because this week was dense. CISA issued an advisory on Russian state-linked hackers compromising residential and SOHO routers to build proxy infrastructure. This is the residential proxy problem at scale. They're blending malicious traffic with legitimate residential IP ranges, which defeats geo-blocking, IP reputation scoring, and a lot of the heuristic models your SOC relies on.

Alex: If your remote access controls assume that a connection from a US residential IP is probably a legitimate employee, that assumption is now directly challenged. This requires rethinking how you validate remote sessions — device posture, behavioral analysis, not just network origin.

Jordan: Then we saw Russian APTs adopting ClickFix, a social engineering technique that was previously exclusive to financially motivated criminals. It tricks users into manually executing malicious commands by posing as a CAPTCHA or browser error fix. The fact that nation-state espionage groups are now borrowing from the criminal playbook tells you two things: the technique works, and the line between espionage and crime TTPs is effectively gone.

Alex: Which means your security awareness training needs to evolve. If you're still training employees on email phishing and suspicious attachments, you're fighting the last war. Browser-based social engineering, fake CAPTCHAs, clipboard hijacking — these are the current vectors.

Jordan: The Iran story is in a different category entirely. Iranian government actors exploited SS7-class vulnerabilities in mobile networks to geolocate US military personnel in the Middle East. This intelligence was used in the lead-up to and during active military engagements. This is cyber enabling kinetic operations. People were physically targeted based on telecom exploitation.

Alex: For defense industrial base CISOs and anyone in critical infrastructure adjacent to national security, this is a wake-up call on mobile device policies. SS7 vulnerabilities have been known for over a decade. They remain largely unpatched because telecom infrastructure modernization is slow and expensive. Your employees' phones are leaking location data to capable adversaries.

Jordan: Two more stories to hit quickly on the AI threat evolution. Researchers demonstrated GPT-5.5 executing a full cyber attack chain — recon through exploitation — from a single natural language prompt. And slopsquatting emerged as a real supply chain threat: AI coding assistants hallucinate package names, attackers register those names with malicious code, and developers install them trusting the AI's recommendation.

Alex: On the GPT-5.5 research — this is a board-level AI risk moment. The SANS Institute simultaneously flagged a major governance gap between frontline security teams and senior leadership on AI risk. If your board still thinks AI risk is theoretical, this research makes it concrete. On slopsquatting, your software composition analysis tools weren't designed for this. You need to add validation steps for any AI-recommended dependencies. It's a process change, not a tool change.

Jordan: Quickly on breaches — three significant ones. Coca-Cola's Fairlife subsidiary hit by ransomware, all US dairy production halted, SEC 8-K filed. Abbott Labs dealing with two simultaneous incidents — one in legacy systems inherited from a 21 billion dollar acquisition, one an extortion claim on a customer portal. And EY breached through a third-party support ticketing system.

Alex: The Fairlife incident is the textbook OT-IT convergence case. A billion-dollar subsidiary with physical production halted by ransomware, mandatory SEC disclosure within hours. The Abbott situation is the M&A cyber debt story — you acquire a company, you inherit its security posture, and legacy systems become your liability. And EY reminds us that Big Four firms, with all their resources, remain vulnerable through their vendor and support tiers.

Jordan: Last one — 23andMe settled with 43 state attorneys general for 18 million dollars over the 2023 genetic data breach, with mandatory security control enhancements. The multi-state AG enforcement model is now firmly established as the regulatory mechanism for sensitive data breaches.

Alex: Alright, let's step back. Jordan, what defined this week?

Jordan: Acceleration. Everything is moving faster. AI is finding vulnerabilities faster than we can patch them. Adversaries are validating credentials in ways our detection can't see. Nation-states are borrowing criminal techniques because speed and scale matter more than sophistication. The clock speed of this industry just shifted, and most security programs are still operating at last year's tempo.

Alex: I agree. And I'd add convergence. Identity and ransomware converged — identity is now the primary entry point. Cyber and kinetic operations converged in the Iran story. AI and vulnerability management converged in that 570-patch Tuesday. The boundaries we've been drawing between these domains are dissolving. For CISOs going into next week, three priorities. One, reassess your patch triage model — the old volume assumptions are gone. Two, audit your MFA deployment with brutal honesty. Three, review your M&A cyber due diligence program, because inherited technical debt is becoming one of the most predictable breach vectors we see.

Jordan: And watch that SharePoint zero-day. No full patch until August. If you're running SharePoint on-prem, your weekend just got shorter.

Alex: That's this week. The daily show returns Monday. Show notes and links to every story we covered are at cleartext.fm. Thanks for listening. Stay sharp out there.

Jordan: See you Monday.

Cleartext is an automated daily podcast for CISOs and security leaders. Generated 2026-07-18.

Sources are pulled from: CyberScoop, The Record, SecurityWeek, Krebs on Security, Dark Reading, Cybersecurity Dive, BleepingComputer, Wired, Ars Technica, TechCrunch, Help Net Security, VentureBeat, Risky Business News, The Hacker News, CISA, and BankInfoSecurity.

Daily cybersecurity briefing for CISOs and security leaders.

🎧 Listen to this episode

Today's episode covers 10 stories across 4 topic areas, including: Russian trio indicted for allegedly running bulletproof hosting providers that spurred cybercrime; Sandworm hackers have a CAPTCHA trick for Ukrainians; Now, even Russia's most elite hackers are using Clickfix to infect devices.

CyberScoop · Jul 16 · Relevance: ████████░░ 8/10

Why it matters to CISOs: US indictment of the infrastructure layer enabling ransomware and cybercrime across 21 states is a strategic disruption signal—CISOs should monitor for threat actor rehosting activity and expect potential retaliation campaigns targeting US enterprises.

📖 Read full article

The Record (Recorded Future) · Jul 16 · Relevance: ████████░░ 8/10

Why it matters to CISOs: Russia's Sandworm—a top-tier APT with a history of targeting critical infrastructure globally—is now operationalizing ClickFix-style CAPTCHA social engineering at scale, a technique that bypasses technical controls and requires updated user awareness training.

📖 Read full article

Ars Technica Security · Jul 16 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: The mainstreaming of ClickFix social engineering among nation-state APT groups means CISOs must revisit browser controls, PowerShell execution policies, and security awareness programs to account for this rapidly proliferating attack vector.

📖 Read full article

Cybersecurity Dive · Jul 16 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: Iranian state-linked and hacktivist groups actively using frontier AI tools for malware development, phishing, and ICS/OT reconnaissance raises the threat baseline for enterprises in critical infrastructure sectors and those with operations in the Middle East.

📖 Read full article

Help Net Security · Jul 17 · Relevance: █████████░ 9/10

Why it matters to CISOs: A Fortune 500 company filing an SEC 8-K over a ransomware-induced OT/production shutdown is a landmark disclosure moment that will be scrutinized by boards and regulators—CISOs should use this to stress-test their own OT/IT incident response and SEC disclosure readiness.

📖 Read full article

BleepingComputer · Jul 16 · Relevance: ████████░░ 8/10

Why it matters to CISOs: A 43-state AG coalition securing an $18M settlement over failure to protect highly sensitive genetic data sets a meaningful precedent for state-level regulatory coordination and liability exposure for any enterprise holding sensitive health or biometric data.

📖 Read full article

The Record (Recorded Future) · Jul 16 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: The UK sentencing of teenage Scattered Spider members to 5.5 years is a landmark deterrence signal for social-engineering-driven cybercrime, and reinforces to CISOs that identity-based attacks on enterprise helpdesks carry serious criminal consequences internationally.

📖 Read full article

Cybersecurity Dive · Jul 16 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: A GAO audit exposing material weaknesses in FAA and TSA aviation cybersecurity oversight signals potential regulatory tightening ahead—CISOs in aviation, aerospace, and adjacent critical infrastructure should anticipate new compliance mandates.

📖 Read full article

The Hacker News · Jul 17 · Relevance: █████████░ 9/10

Why it matters to CISOs: A CVSS 9.8 critical deserialization RCE in Microsoft SharePoint Server being actively exploited and added to KEV with a 48-hour federal patch deadline demands immediate enterprise prioritization, as SharePoint is deeply embedded in most large organizations' collaboration infrastructure.

📖 Read full article

BleepingComputer · Jul 17 · Relevance: ████████░░ 8/10

Why it matters to CISOs: Actively exploited critical vulnerabilities in Fortinet FortiSandbox—a perimeter security product present in many enterprise environments—with a 48-hour federal patch window signal urgency for any CISO running this platform.

📖 Read full article

Alex: Welcome to Cleartext for Friday, July 17th, 2026. I'm Alex Chen.

Jordan: And I'm Jordan Reeves. Let's start here: Coca-Cola filed an 8-K yesterday because ransomware shut down every Fairlife milk production line in the United States. A Fortune 500 company, SEC disclosure, physical production halted. If you're a CISO who's been trying to get your board to fund OT segmentation, your exhibit A just arrived.

Alex: That's where we're going to start today, and we've got a packed show. We'll cover that Fairlife incident and what it means for SEC disclosure playbooks, a critical SharePoint zero-day that CISA wants patched by Sunday, Fortinet flaws on the same timeline, bulletproof hosting indictments targeting the infrastructure layer of cybercrime, Sandworm adopting ClickFix social engineering, Iran using AI to sharpen its cyber playbook, the 23andMe eighteen million dollar settlement, Scattered Spider members going to prison, and a GAO report that should concern anyone in aviation. Let's get into it.

Jordan: So the Fairlife ransomware incident. The 8-K was filed July 16th. All US milk production suspended. Canadian operations apparently unaffected. Coca-Cola says product quality and safety weren't compromised, but the operational disruption is total on the US side. This is ransomware doing what ransomware does best in 2026: it doesn't just encrypt your files, it stops your factory.

Alex: And from a governance perspective, this is the SEC materiality disclosure framework working exactly as designed. Coca-Cola had to determine that a production shutdown across an entire subsidiary's US operations was material, and they disclosed within the required window. What I want every CISO listening to take from this is: do you have your materiality determination process rehearsed for an OT event? Not an IT event, an OT event. Because the calculus is different. When production stops, materiality is almost self-evident, and the clock starts immediately.

Jordan: The other angle here is supply chain. Fairlife is a major protein shake and milk brand. Retailers are going to feel this within days. If you're in consumer packaged goods, food and beverage, manufacturing, this is your threat model. Ransomware actors know that operational downtime in physical production creates enormous pressure to pay. The leverage is the production line itself.

Alex: Use this as your board conversation on Monday. Not fear-mongering, just pointing to a peer company's SEC filing and asking: are we ready for this exact scenario?

Jordan: Let's pivot to the vulnerability side, because CISOs have a very busy weekend ahead. CISA added CVE-2026-58644 to the Known Exploited Vulnerabilities catalog yesterday. This is a critical deserialization flaw in Microsoft SharePoint Server. CVSS 9.8. Active exploitation confirmed. Federal agencies have until July 19th, which is Sunday, to patch.

Alex: SharePoint Server on-premises is still deeply embedded in a lot of large enterprises. This isn't SharePoint Online, this is the on-prem footprint that many organizations haven't fully migrated away from. If you're running it, this is a drop-everything priority. Deserialization to RCE at 9.8 with active exploitation, there's no ambiguity here.

Jordan: And on the same timeline, CISA is also ordering patches for two critical Fortinet FortiSandbox vulnerabilities, also actively exploited, also due Sunday. Fortinet perimeter devices have been a persistent target for nation-state and ransomware operators. If you're running FortiSandbox, check your versions today, not Monday.

Alex: Two critical, actively exploited vulnerability sets with a forty-eight hour patch window. That's your weekend, unfortunately.

Jordan: Now let's talk about the infrastructure layer. The DOJ unsealed indictments against three Russian nationals and their entities, Media Land and ML.Cloud, for operating bulletproof hosting that enabled cyberattacks across twenty-one US states and multiple countries. Losses attributed to the cybercrime facilitated by this infrastructure exceed sixty-two million dollars.

Alex: This is strategically significant because it targets the logistical backbone, not individual threat actors. Bulletproof hosting is the real estate of cybercrime. Ransomware operators, phishing campaigns, command and control infrastructure, they all need somewhere to live. When you take down or indict the landlords, you force displacement across the entire ecosystem.

Jordan: Right, and displacement creates signal. When threat actors have to rehost, they make mistakes, they leave traces, they sometimes fragment. But it also means there's a transition period where groups may accelerate operations before they lose infrastructure, or lash out in retaliation. CISOs should be watching their threat intelligence feeds for indicators of migration and for any uptick in activity from groups that were known customers of these hosting providers.

Alex: It's also worth noting that indictments against Russian nationals are, in practice, more about disruption and deterrence than extradition. But the intelligence value of the investigation itself is enormous, and it gives law enforcement tools to seize assets and block infrastructure.

Jordan: Let's stay in Russia's orbit. Sandworm is now using ClickFix. For those who haven't tracked this, ClickFix is a social engineering technique where a target is presented with a fake CAPTCHA that instructs them to copy and paste a PowerShell command into their machine. It originated with financially motivated criminals, and now Russia's most capable APT group is deploying it against Ukrainian targets at scale.

Alex: This is a significant development because it represents a technique that bypasses almost every technical control you've deployed. The user is the execution engine. They're literally pasting malicious code into their own terminal. Endpoint detection can catch the payload after execution, but the initial compromise relies entirely on human behavior.

Jordan: And Ars Technica covered the broader trend in a companion piece. ClickFix isn't just Sandworm now. It's proliferating across the nation-state landscape precisely because it works. The technique exploits trust in CAPTCHA flows that users encounter dozens of times a week. The defense here isn't a new tool, it's updated awareness training that specifically addresses this scenario, and it's PowerShell execution policies that constrain what a standard user can run.

Alex: If your organization hasn't added ClickFix-style scenarios to your phishing simulation program, you're behind. And revisit your PowerShell constrained language mode policies. There's no reason most end users need unrestricted PowerShell execution.

Jordan: Staying on the nation-state theme, Cybersecurity Dive reported that Iran-nexus actors, both state-linked groups and affiliated hacktivists, are actively using ChatGPT and similar frontier AI tools for malware development, phishing campaign creation, and, critically, mapping industrial control system sites.

Alex: That last point is the one that should get attention. ICS and OT reconnaissance using AI tools means these groups can move faster in identifying targets and understanding industrial environments. If you're in critical infrastructure, energy, water, manufacturing, and you have any exposure to the Middle East or are in a sector Iran has historically targeted, your threat baseline just moved up.

Jordan: The broader signal is that AI is lowering the barrier to entry and accelerating the playbook for second-tier nation-state actors. Iran doesn't have Russia or China's bench depth in cyber operations, but AI is a force multiplier that narrows that gap.

Alex: Let's shift to governance. 23andMe agreed to pay eighteen million dollars to settle claims from forty-three state attorneys general over the 2023 genetic data breach. Forty-three states coordinating on a single enforcement action. That's the story within the story.

Jordan: The underlying attack was credential stuffing. Password reuse. A foundational identity hygiene failure. And it resulted in the exposure of genetic data, which is about as sensitive as data gets. The legal theory here is straightforward: you held extraordinarily sensitive data, you didn't enforce adequate authentication controls, and now forty-three states are holding you accountable.

Alex: For CISOs, the precedent is the coordinated multistate AG action. This is becoming a standard enforcement model. If you're holding biometric data, genetic data, health data, sensitive PII at scale, your regulatory exposure isn't just federal. It's fifty potential state-level actions, and they're increasingly working together. Make sure your legal and compliance teams are modeling this.

Jordan: On the criminal enforcement side, two Scattered Spider members were sentenced to five and a half years each at Woolwich Crown Court for the 2024 Transport for London hack. Owen Flowers, eighteen, and Thalha Jubair, twenty. The attack rendered a hundred and forty-eight systems inoperable and forced all twenty-seven thousand TfL employees to reset passwords in person. Cost: twenty-nine million pounds.

Alex: The sentencing is meaningful as a deterrence signal for the social-engineering-driven cybercrime model that Scattered Spider pioneered. These are young operators who targeted enterprise helpdesks with social engineering, and they're now going to prison for more than five years. The NCA also confirmed that the arrests disrupted Scattered Spider's broader operations, which is the more operationally significant outcome.

Jordan: And finally, a GAO audit found material weaknesses in both FAA and TSA cybersecurity programs for aviation. Network security gaps, oversight strategy deficiencies. When GAO publishes findings like this, Congress typically follows with new requirements.

Alex: If you're in aviation, aerospace, or adjacent critical infrastructure, start anticipating new compliance mandates. GAO reports are leading indicators of regulatory action. Don't wait for the rule to start preparing.

Jordan: So looking at the week as a whole, what's the thread?

Alex: The thread is convergence. Nation-state techniques are converging with criminal techniques. Regulatory enforcement is converging across jurisdictions. And the attack surface is converging IT and OT in ways that create physical-world consequences. The Fairlife 8-K, the ClickFix adoption by Sandworm, the multistate AG action on 23andMe, these aren't isolated events. They're all manifestations of a threat and regulatory environment that's compressing. The distance between a phishing email and a factory shutdown, between a credential stuffing attack and a forty-three state lawsuit, that distance is shrinking.

Jordan: And next week, watch for the fallout from that SharePoint zero-day. Active exploitation plus a weekend patch deadline means Monday morning is going to reveal who was ready and who wasn't.

Alex: That's our show for today. Thanks for listening to Cleartext. Show notes and links to every story we covered are at cleartext.fm. Have a good weekend, and patch your SharePoint.

Jordan: And your Fortinet. See you Monday.

Cleartext is an automated daily podcast for CISOs and security leaders. Generated 2026-07-17.

Sources are pulled from: CyberScoop, The Record, SecurityWeek, Krebs on Security, Dark Reading, Cybersecurity Dive, BleepingComputer, Wired, Ars Technica, TechCrunch, Help Net Security, VentureBeat, Risky Business News, The Hacker News, CISA, and BankInfoSecurity.

Daily cybersecurity briefing for CISOs and security leaders.

🎧 Listen to this episode

Today's episode covers 9 stories across 5 topic areas, including: US charges Russian ‘bulletproof’ web hosts over cyberattacks that netted $62M from cybercrime victims; Is 'Tech-xit' Imminent? UK Steps Up Sovereignty Push Amid AI Strife; Identity Attacks Overtake Exploits as Top Ransomware Cause.

TechCrunch Security · Jul 15 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: The unsealing of this indictment against Russian bulletproof hosting operators who enabled large-scale cybercrime confirms continued US DOJ pressure on the criminal infrastructure layer; CISOs should treat these hosting networks as ongoing threat infrastructure still in partial operation.

📖 Read full article

Dark Reading · Jul 15 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: US export restrictions on frontier AI models are accelerating European and UK digital sovereignty initiatives, which will affect enterprise AI security tooling procurement, vendor lock-in risk assessments, and compliance obligations for multinationals operating across jurisdictions.

📖 Read full article

Dark Reading · Jul 15 · Relevance: ████████░░ 8/10

Why it matters to CISOs: The finding that MFA was present in 97% of credential-based ransomware attacks yet still failed to prevent compromise should directly inform CISO board reporting and drive investment in phishing-resistant MFA, identity threat detection, and privileged access controls.

📖 Read full article

The Record (Recorded Future) · Jul 16 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: The sentencing of key Scattered Spider members marks a notable deterrence milestone for a group that successfully compromised major enterprises including MGM and Caesars; CISOs should note the social engineering and SIM-swapping TTPs used remain active across the group's broader membership.

📖 Read full article

The Record (Recorded Future) · Jul 15 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: The Nichirei Logistics attack demonstrates that third-party operational technology and logistics providers remain high-impact ransomware targets with cascading supply chain consequences, a direct concern for CISOs managing vendor risk in critical supply chains.

📖 Read full article

The Record (Recorded Future) · Jul 15 · Relevance: ████████░░ 8/10

Why it matters to CISOs: Gold Eagle represents a significant shift in how the US government will coordinate vulnerability discovery and prioritization at scale using AI, potentially reshaping patch management timelines and vendor disclosure obligations for critical infrastructure operators.

📖 Read full article

The Record (Recorded Future) · Jul 15 · Relevance: ████████░░ 8/10

Why it matters to CISOs: A 42-state AG coalition settlement sets a precedent for multi-jurisdictional accountability following a single breach, signaling that state-level enforcement will be an increasingly significant liability vector alongside federal action for organizations holding sensitive personal data.

📖 Read full article

CyberScoop · Jul 15 · Relevance: █████████░ 9/10

Why it matters to CISOs: SonicWall is pervasive in enterprise network perimeters; chained zero-days being actively exploited weeks before disclosure and patching means organizations need to audit exposure and apply patches immediately or consider compensating controls.

📖 Read full article

Cybersecurity Dive · Jul 15 · Relevance: █████████░ 9/10

Why it matters to CISOs: SharePoint is a core collaboration platform in most enterprises; active chained exploitation with no patch until August creates a material, time-bounded risk window requiring immediate mitigations or isolation decisions.

📖 Read full article

Alex: Welcome to Cleartext. It's Thursday, July 16th, 2026. I'm Alex Chen.

Jordan: And I'm Jordan Reeves. Let's get into it.

Alex: We've got a packed show today. Two actively exploited zero-day chains that need your attention this morning, SonicWall and SharePoint. A landmark identity and ransomware study that should change how you talk to your board about MFA. The White House launches Gold Eagle, an AI-powered vulnerability clearinghouse. Scattered Spider members get sentenced. A cold-chain attack in Japan takes out KFC's supply chain. The 23andMe settlement sets a new bar for state-level enforcement. And we'll touch on the UK's sovereignty push and a Russian bulletproof hosting indictment. Let's start where your SOC should be starting this morning.

Jordan: Yeah, let's lead with the two vulnerability stories because these are time-sensitive. SonicWall disclosed and patched two zero-days that attackers have been chaining together, but here's the part that matters: exploitation started approximately three weeks before the vendor disclosed. Three weeks. If you're running SonicWall on your perimeter, the question isn't whether to patch. The question is whether you're already compromised. You need to audit your exposure, apply the patches, and hunt for indicators of compromise in that three-week window. That's your priority one action item today.

Alex: And priority two isn't far behind. CISA formally warned that multiple SharePoint vulnerabilities are being chained and actively exploited. SharePoint sits at the center of collaboration infrastructure in most enterprises. The complicating factor here is there's no patch until August. So you're looking at a material exposure window where you need to make real decisions. Do you apply compensating controls? Do you isolate? Do you restrict access? This is exactly the kind of risk decision that separates mature programs from reactive ones.

Jordan: And I'll note the uncomfortable pattern: both of these are perimeter or core enterprise platforms, both involve chained exploits, and both have timing gaps that favor the attacker. This is the new normal. Vulnerability management is no longer just about patching fast. It's about assuming the window between exploitation and disclosure is getting longer, not shorter.

Alex: Which actually connects to the Gold Eagle story. The White House launched this program to use AI to accelerate vulnerability discovery, prioritization, and patching across government and critical infrastructure. The timing is notable. Microsoft just patched 570 CVEs in a single Patch Tuesday, and they attribute part of that volume to AI-assisted discovery. Gold Eagle is essentially the government's attempt to operationalize that at national scale.

Jordan: I have mixed feelings. On one hand, the intent is right. The vulnerability ecosystem is drowning in volume, and we need better signal-to-noise. AI can genuinely help with prioritization. On the other hand, if you accelerate discovery without proportionally accelerating remediation, you've just made the problem worse. You've given defenders a bigger backlog and potentially given adversaries more targets if any of this leaks or is independently discovered. The execution here will matter enormously. But for CISOs, the takeaway is straightforward: expect the volume of disclosed vulnerabilities to continue increasing. Your patch management program needs to be built for that trajectory, not for last year's volume.

Alex: Let's shift to the identity and ransomware story, because this one has direct board-level implications. Sophos published incident data showing that identity and credential-based attacks have now surpassed software exploits as the leading initial access vector for ransomware. That shift has been coming, but here's the statistic that should stop you: MFA was deployed in 97 percent of the credential-compromise incidents. Ninety-seven percent. And it still failed.

Jordan: This is the number that needs to be in your next board presentation. Not because MFA is useless, but because most organizations are still running legacy MFA, push notifications, SMS codes, time-based tokens, that are vulnerable to adversary-in-the-middle attacks, MFA fatigue, and SIM swapping. The attackers have adapted. Phishing kits now routinely include real-time proxy capabilities that intercept MFA tokens as they're entered. The control that your board thinks is protecting you is being systematically defeated.

Alex: So what's the action? First, accelerate the move to phishing-resistant MFA, FIDO2 keys, passkeys, hardware-bound credentials. Second, invest in identity threat detection and response. You need behavioral analytics on authentication patterns, impossible travel detection, token replay detection. Third, tighten privileged access controls. If an attacker gets a credential, the blast radius should be contained by just-in-time access and segmentation. This isn't a technology gap. The solutions exist. It's a deployment and prioritization gap.

Jordan: And I'd add, stop reporting MFA coverage percentage as a security metric to your board without qualifying it. Saying "we have 98 percent MFA coverage" is meaningless if 100 percent of that is push-based MFA that can be phished. The metric needs to reflect the quality of the control, not just its presence.

Alex: Speaking of social engineering, let's talk about Scattered Spider. Two leading members were sentenced to five and a half years each for the 2024 Transport for London attack, which caused an estimated 29 million pounds in damages. Guilty pleas under the Computer Misuse Act.

Jordan: Five and a half years is meaningful. For a group that hit MGM, Caesars, TfL, and a string of other major targets, this is the first real deterrence signal. But I want to be clear about the operational picture: Scattered Spider is a loosely affiliated collective. These convictions take out two individuals. The TTPs, social engineering help desks, SIM swapping, exploiting identity providers, those are still active across the broader group. The playbook hasn't been arrested, just two of the players.

Alex: And those TTPs connect directly back to the identity conversation we just had. SIM swapping defeats SMS-based MFA. Social engineering help desks defeats knowledge-based authentication. These are the same weaknesses the Sophos data is highlighting at scale.

Jordan: Exactly. Different angle, same problem.

Alex: Let's move to the Nichirei Logistics attack in Japan. Japan's largest cold-chain operator was hit by a cyberattack that disrupted food supply chains, leaving KFC restaurants short on ingredients and multiple restaurant chains struggling with deliveries.

Jordan: This is a textbook third-party OT risk scenario. Your organization might not operate cold-chain logistics, but your supply chain almost certainly depends on someone who does. The cascading impact here, from a single logistics provider to consumer-facing food shortages, is exactly the kind of scenario that CISOs managing vendor risk need to model. If your critical vendors went down for a week, do you know what breaks? Most organizations still can't answer that question with confidence.

Alex: And it reinforces that ransomware operators are deliberately targeting operational chokepoints, logistics, healthcare, utilities, because the pressure to pay is highest when real-world operations are disrupted. This is rational adversary behavior, and it should inform your third-party risk tiering.

Jordan: Let's talk about the 23andMe settlement. Eighteen million dollars across 42 state attorneys general for the 2023 breach that exposed genetic and health data.

Alex: The dollar amount is almost secondary to the precedent. A 42-state AG coalition acting in concert against a single organization for cybersecurity failings. This is the enforcement model that's scaling. Federal regulation remains fragmented, but state-level enforcement is becoming highly coordinated and effective. If you're holding sensitive personal data, particularly health or biometric data, your liability surface now includes 50 potential state-level regulators acting collectively.

Jordan: And genetic data is about as sensitive as it gets. You can change a password. You can't change your genome. The reputational and legal exposure for organizations handling this class of data is in a different category entirely. This settlement will be cited in every future state AG action involving sensitive data breaches.

Alex: Two more stories to cover. The UK sovereignty push, which Dark Reading is framing as a potential "Tech-xit." US export restrictions on frontier AI models from Anthropic and OpenAI are accelerating calls in the UK and Europe to reduce dependence on American tech. For CISOs at multinationals, this has practical implications. New data residency requirements, AI governance obligations, potential restrictions on which AI-powered security tools you can deploy where. If you're building your security architecture on US-based AI platforms, you need to be scenario-planning for a world where those platforms face access restrictions in key markets.

Jordan: And on the Russian bulletproof hosting indictment, DOJ unsealed charges against three Russian nationals and two hosting entities that enabled 62 million dollars in cybercrime. Bulletproof hosting remains the foundational infrastructure layer for ransomware, fraud, and malware distribution. The indictment is a deterrence signal, but the realistic assessment is that this infrastructure is still partially operational and the operators who haven't been charged are still in business. For threat intelligence teams, these hosting networks should remain on your watchlist as known-bad infrastructure.

Alex: Let's close with the outlook. Jordan, what's the thread you're pulling across today's stories?

Jordan: The theme is the gap between the controls we think we have and the protection they actually provide. MFA is deployed but defeated. Patches exist but arrive weeks after exploitation begins. Vendor risk programs exist but don't model cascading failures. The maturity gap in most organizations isn't in policy or tooling. It's in the honest assessment of whether those controls work against the current threat reality. CISOs who close that gap, who pressure-test their assumptions rather than report their coverage metrics, are the ones who'll be ahead of this.

Alex: I'd add that the enforcement and geopolitical landscape is forcing strategic decisions that can't be delegated. AI sovereignty, state AG coalitions, government vulnerability programs. These aren't tactical issues. They're board-level questions about where your organization operates, what data you hold, and who you depend on. The CISO role is increasingly about navigating those strategic decisions, not just running the security program.

Jordan: Agreed. Watch the SharePoint exposure window closely over the next few weeks. And if you haven't started your phishing-resistant MFA migration, today's a good day to put that business case together.

Alex: That's Cleartext for Thursday, July 16th, 2026. Show notes and links to every story we covered are at cleartext.fm. We'll be back tomorrow. Stay sharp.

Jordan: See you then.

Cleartext is an automated daily podcast for CISOs and security leaders. Generated 2026-07-16.

Sources are pulled from: CyberScoop, The Record, SecurityWeek, Krebs on Security, Dark Reading, Cybersecurity Dive, BleepingComputer, Wired, Ars Technica, TechCrunch, Help Net Security, VentureBeat, Risky Business News, The Hacker News, CISA, and BankInfoSecurity.

Daily cybersecurity briefing for CISOs and security leaders.

🎧 Listen to this episode

Today's episode covers 10 stories across 4 topic areas, including: NATO logistics, Ukrainian troops are top subjects of Russian camera hacks, advisory says; Iran abused mobile networks’ vulnerabilities to locate US military in the Middle East, report says; US unseals indictment against alleged operators of Russian bulletproof hosting service.

The Record (Recorded Future) · Jul 14 · Relevance: █████████░ 9/10

Why it matters to CISOs: Dutch intelligence confirms Russian state actors are systematically compromising internet-connected cameras across Europe to surveil NATO military logistics—a direct signal to CISOs in defense, logistics, and critical infrastructure sectors to audit physical security camera exposure.

📖 Read full article

TechCrunch Security · Jul 14 · Relevance: ████████░░ 8/10

Why it matters to CISOs: Iran's exploitation of SS7/telecom protocol weaknesses to geolocate US military personnel underscores that longstanding mobile network vulnerabilities are being weaponized in kinetic conflict contexts, with direct implications for enterprises with mobile-dependent workforces in high-risk regions.

📖 Read full article

The Record (Recorded Future) · Jul 14 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: The DOJ indictment of operators behind Media Land and ML Cloud—a St. Petersburg-based bulletproof hosting operation that enabled major ransomware gangs—signals continued US law enforcement pressure on Russian cybercriminal infrastructure and may disrupt active threat actor operations.

📖 Read full article

The Hacker News · Jul 14 · Relevance: ████████░░ 8/10

Why it matters to CISOs: A novel OAuth client ID spoofing technique allows threat actors to silently validate stolen Entra ID credentials without triggering sign-in logs—directly undermining SIEM-based detection for credential compromise in Microsoft 365 environments used by virtually every enterprise.

📖 Read full article

BleepingComputer · Jul 14 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: Progress Software's confirmation of a high-severity zero-day in ShareFile Storage Zone Controllers—which forced a four-day service shutdown—is a direct indicator event for enterprises relying on ShareFile for regulated file transfer, requiring immediate patch deployment and incident review.

📖 Read full article

CyberScoop · Jul 14 · Relevance: ████████░░ 8/10

Why it matters to CISOs: The first-ever Treasury sanction of a VPN service for enabling ransomware operations expands the compliance perimeter for enterprises—procurement and vendor risk teams must now screen anonymization infrastructure against OFAC lists, not just traditional software vendors.

📖 Read full article

CyberScoop · Jul 14 · Relevance: ████████░░ 8/10

Why it matters to CISOs: The White House's Gold Eagle initiative establishes a government-run AI threat intelligence clearinghouse that is already prioritizing vulnerability patches—CISOs should monitor whether participation or information-sharing obligations will extend to critical sectors.

📖 Read full article

Cybersecurity Dive · Jul 14 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: SANS Institute research reveals a significant disconnect between senior security leaders who believe AI governance is adequate and frontline practitioners who report major control gaps—a board-level credibility risk for CISOs who have publicly endorsed AI security investments.

📖 Read full article

The Hacker News · Jul 15 · Relevance: █████████░ 9/10

Why it matters to CISOs: Actively exploited zero-days in SonicWall SMA 1000 remote access appliances—a CVSS 10.0 SSRF enabling unauthenticated remote command execution—demand immediate emergency patching across any enterprise using these widely deployed VPN/access gateways.

📖 Read full article

Help Net Security · Jul 15 · Relevance: █████████░ 9/10

Why it matters to CISOs: Two actively exploited zero-days—one in ADFS (CVE-2026-56155) and one in SharePoint (CVE-2026-56164)—within a 570+ CVE release driven by AI-assisted vulnerability discovery signals a permanent structural shift in patch triage volume that will strain enterprise security operations teams.

📖 Read full article

Jordan: Microsoft just shipped patches for over 570 CVEs in a single Patch Tuesday. That's not a typo. Five hundred and seventy. Two of them are actively exploited zero-days. And Microsoft is crediting the volume to AI-assisted bug hunting. If you're running a SOC today, your patch triage process just became structurally inadequate. That's not hyperbole—it's math. Welcome to the new normal.

Alex: Good morning. It's Wednesday, July 15th, 2026. This is Cleartext. I'm Alex Chen, here with Jordan Reeves. We've got a packed show today. Two nation-state surveillance campaigns that should change how you think about physical security and mobile devices. A novel OAuth attack that's invisible to your SIEM. A record-shattering Patch Tuesday we just mentioned. Treasury sanctioning a VPN provider for the first time ever. Two SonicWall zero-days with a perfect CVSS 10. And a governance gap on AI that might be more dangerous than the threats AI is supposed to help you stop. Let's get into it.

Jordan: I want to start with the two nation-state stories because they share a theme that I think CISOs underweight, which is physical-world intelligence collection enabled by cyber access. Dutch intelligence confirmed yesterday that at least one Russian intelligence agency is systematically compromising internet-connected cameras across Europe. The targets are NATO logistics operations and Ukrainian military personnel. They're watching trucks move. They're watching soldiers. This is ISR—intelligence, surveillance, reconnaissance—done through commodity IoT devices.

Alex: And this is exactly the kind of threat that falls between organizational chairs. Physical security owns the cameras. IT may or may not manage the network they sit on. The CISO owns neither but is accountable when something goes wrong. If you're in defense, logistics, critical infrastructure, or frankly any sector adjacent to NATO operations in Europe, you need an inventory of every internet-exposed camera in your environment. Today.

Jordan: The uncomfortable truth is most organizations don't even know how many cameras they have, let alone whether they're exposed. These aren't sophisticated zero-day attacks. This is scanning for default credentials and unpatched firmware on devices that nobody thinks of as part of the attack surface. It's basic, it's effective, and it's happening at scale.

Alex: And then pair that with the Iran story.

Jordan: Yeah. TechCrunch reported that Iranian government operatives exploited SS7 signaling vulnerabilities—the same ones the security community has been screaming about for a decade—to geolocate US military personnel in the Middle East. And this wasn't theoretical. This was used in the lead-up to and during active military operations. They located people and then they struck.

Alex: So for the CISO audience, the takeaway here isn't just military. If you have a mobile-dependent workforce operating in high-risk regions—energy sector, diplomatic, NGO, international business—SS7 vulnerabilities are not a telecom problem you can outsource. You need to understand the exposure and have compensating controls. Secure communications platforms, location obfuscation, device policies for high-risk travel.

Jordan: These two stories together paint a picture. Nation-states are building kill chains that start with cyber access to physical sensors—cameras, cell towers—and end with real-world consequences. The convergence of cyber and physical isn't future-tense anymore.

Alex: Let's pivot to the OAuth story because this one is technically subtle but operationally devastating. Two distinct threat actor groups are using OAuth client ID spoofing to validate stolen credentials against Microsoft Entra ID without generating sign-in log events.

Jordan: Let me make sure that lands. They're checking whether your stolen passwords work, and your SIEM doesn't see it. No failed login. No successful login. No log entry. Your SOC is blind.

Alex: If you're running detection rules based on sign-in telemetry—and virtually every enterprise is—you have a gap. This isn't a theoretical bypass. It's being actively weaponized. Your identity team needs to be coordinating with your detection engineering team right now to understand what OAuth flows are visible and which ones aren't.

Jordan: And this connects to a broader concern I have about the over-reliance on Microsoft-native telemetry for detection. When your detection strategy is built entirely on the vendor's logging, the vendor's logging gaps become your blind spots. This is a case study in that.

Alex: Now let's talk about the patch avalanche. Microsoft's July Patch Tuesday: 570-plus CVEs. Two actively exploited zero-days. CVE-2026-56155, an elevation of privilege in Active Directory Federation Services. CVE-2026-56164, a SharePoint flaw that CISA has separately flagged. Both confirmed exploited in the wild.

Jordan: The volume story is what matters strategically. Microsoft is attributing this to AI-accelerated vulnerability discovery. They're finding more bugs faster with AI tooling. That's good for security long-term. But short-term, it means your patch management team just got handed three times the historical volume in a single cycle.

Alex: This is a board conversation. If your patch SLA was built around historical averages of 100 to 150 CVEs per Patch Tuesday, your process doesn't scale to 570. You either need to invest in automation, accept more risk, or fundamentally rethink how you prioritize. There's no fourth option.

Jordan: And the ADFS zero-day is particularly nasty because ADFS is still load-bearing infrastructure for federated identity in a lot of enterprises that haven't fully migrated to modern auth. If you're still running ADFS, this is your wake-up call. Actually, your wake-up call was two years ago. This is your fire alarm.

Alex: Staying on the vulnerability front—SonicWall disclosed two zero-days in SMA 1000 series appliances. CVE-2026-15409 is a CVSS 10.0. Unauthenticated server-side request forgery leading to arbitrary command execution. Both are confirmed exploited in the wild.

Jordan: CVSS 10. Unauthenticated. Remote. On a remote access appliance that by design sits at the network edge. If you have SMA 1000 in your environment and you haven't patched as of this morning, stop listening to us and go patch.

Alex: That's not a joke. This is drop-everything severity. SonicWall has released patches. Deploy them.

Jordan: Can I make a broader observation? We keep seeing these edge appliances—VPNs, secure access gateways, file transfer tools—become the primary initial access vector. SonicWall, Ivanti, Citrix, Progress. The devices we bought to secure remote access have become the front door for attackers.

Alex: Which is a perfect segue to ShareFile. Progress Software confirmed a high-severity zero-day in ShareFile Storage Zone Controllers forced a four-day service shutdown. Patches are now available. If you're running on-premises Storage Zone Controllers, you need to patch immediately and conduct an incident review for the exposure window.

Jordan: Progress Software and zero-days. Where have I heard that before? The MOVEit echoes are loud here. Any organization using ShareFile for regulated file transfer needs to treat this as a potential data exposure event, not just a patching exercise.

Alex: Let's shift to governance and enforcement. Two stories that I think are more significant than they might appear at first glance. Treasury's OFAC designated a VPN service—1VPNS, also known as First VPN Service—for providing anonymization infrastructure to ransomware gangs. This is the first time Treasury has sanctioned a VPN provider.

Jordan: First ever. That's precedent-setting. They also hit the alleged Ukrainian administrator and a Belarusian national who was selling cryptors to obfuscate ransomware. This is the US government saying that infrastructure providers are not neutral parties. If you enable ransomware operations, you're a target for sanctions.

Alex: The downstream implication for CISOs is compliance. Your procurement and vendor risk teams now need to screen anonymization and privacy infrastructure against OFAC lists. Not just your traditional software vendors. If someone in your organization is using a sanctioned VPN service—even inadvertently—that's a sanctions violation.

Jordan: And the DOJ indictment of the Media Land and ML Cloud operators fits the same pattern. Three Russian nationals charged for running a St. Petersburg-based bulletproof hosting operation that enabled over $62 million in damages. The coordinated unsealing suggests international cooperation. The enforcement tempo against Russian cybercriminal infrastructure is real and sustained.

Alex: The second governance story is the White House's Gold Eagle initiative. This is a government-run AI threat intelligence clearinghouse that's now confirmed operational. It's already receiving intelligence on AI-related vulnerabilities and prioritizing patch guidance.

Jordan: I'm cautiously interested. The concept is sound—centralized AI-specific threat intel with prioritized patching guidance. The question is execution. Will this become a meaningful intelligence source, or another government portal nobody checks?

Alex: The thing I'm watching is whether participation becomes mandatory for critical sectors. If you're in critical infrastructure, financial services, healthcare—start tracking Gold Eagle now. Don't get surprised by a compliance obligation six months from now.

Jordan: And that connects directly to the SANS Institute research on AI governance gaps. The finding that matters: senior security leaders believe AI governance is adequate, but frontline practitioners report major control gaps. That's a credibility problem.

Alex: It's a board-level credibility risk. If you've told your board that your AI security posture is mature and your own team disagrees, you have an exposure that's not just technical—it's reputational and potentially liability-creating.

Jordan: CISOs need to pressure-test their own narratives. Talk to your practitioners. If there's a gap between what you're reporting up and what's happening on the ground, fix it before someone else finds it.

Alex: Let's close with the outlook. Jordan, what's the thread you're pulling on this week?

Jordan: The theme is convergence. Physical and cyber are converging in the surveillance stories. Patch volume and AI are converging in ways that break existing processes. Sanctions and criminal enforcement are converging on infrastructure providers, not just operators. The boundaries that CISOs used to rely on to scope their responsibilities are dissolving. If your security program is still organized around traditional categories—network, endpoint, identity, physical—you're organized for a threat landscape that no longer exists.

Alex: I'd add that the detection gap theme is critical. Between the OAuth spoofing attack bypassing sign-in logs and cameras being compromised for ISR, we're seeing adversaries who understand our detection architecture better than we do. The competitive advantage right now goes to defenders who are willing to question whether their visibility is actually as good as their dashboards suggest.

Jordan: Assume gaps. Hunt for them. Don't wait for your vendor to tell you what you can't see.

Alex: That's our show for Wednesday, July 15th, 2026. Show notes and links to every story we covered are at cleartext.fm. I'm Alex Chen.

Jordan: I'm Jordan Reeves. Go patch your SonicWall.

Cleartext is an automated daily podcast for CISOs and security leaders. Generated 2026-07-15.

Sources are pulled from: CyberScoop, The Record, SecurityWeek, Krebs on Security, Dark Reading, Cybersecurity Dive, BleepingComputer, Wired, Ars Technica, TechCrunch, Help Net Security, VentureBeat, Risky Business News, The Hacker News, CISA, and BankInfoSecurity.

Daily cybersecurity briefing for CISOs and security leaders.

🎧 Listen to this episode

Today's episode covers 9 stories across 4 topic areas, including: EU sanctions Russian GRU military hackers over cyberattacks; Europe strikes out against Russia’s Turla over espionage, ‘destructive attacks’; Officials once again warn defenders that Russian hackers are targeting network devices.

BleepingComputer · Jul 13 · Relevance: ██████████ 10/10

Why it matters to CISOs: The first joint EU-UK cyber sanctions package against Russian GRU hackers signals a major escalation in Western cyber deterrence posture, with direct implications for critical infrastructure defenders and organizations operating in Europe who need to reassess their threat models.

📖 Read full article

CyberScoop · Jul 13 · Relevance: ██████████ 10/10

Why it matters to CISOs: Attribution of destructive cyberattacks on Poland's energy grid to the FSB's Turla group, combined with coordinated Western sanctions, marks a significant geopolitical escalation that enterprise CISOs in critical infrastructure sectors must factor into their threat intelligence and board communications.

📖 Read full article

CyberScoop · Jul 13 · Relevance: █████████░ 9/10

Why it matters to CISOs: A joint government advisory warning of Russian FSB exploitation of Cisco Smart Install vulnerabilities across defense, energy, finance, and healthcare sectors requires immediate action from CISOs operating in critical infrastructure to audit network device exposure.

📖 Read full article

BleepingComputer · Jul 14 · Relevance: ████████░░ 8/10

Why it matters to CISOs: OFAC's sanctioning of a VPN service provider and malware cryptor seller specifically for enabling ransomware operations signals that infrastructure enablers are now primary targets of US enforcement—CISOs should assess any third-party tools or services with potential sanctions exposure.

📖 Read full article

The Hacker News · Jul 14 · Relevance: █████████░ 9/10

Why it matters to CISOs: ShinyHunters' sustained exploitation of OAuth trust relationships in Salesforce environments—without exploiting any platform vulnerability—is a direct wake-up call for CISOs to audit third-party OAuth connections and inherited trust chains in their Salesforce deployments.

📖 Read full article

TechCrunch Security · Jul 13 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: This incident illustrates a critical gap in offboarding controls—a former employee retained access long after departure due to a system bug, highlighting the need for redundant access revocation verification especially when employees depart to competitors.

📖 Read full article

Krebs on Security · Jul 13 · Relevance: █████████░ 9/10

Why it matters to CISOs: CISA's own failure to detect dozens of leaked internal credentials—including AWS GovCloud keys—sitting in a public GitHub repo for nearly six months is a critical governance case study that every CISO should use to benchmark their own secrets management and contractor oversight programs.

📖 Read full article

Cybersecurity Dive · Jul 13 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: A newly documented obfuscation technique allowing attackers to enumerate Microsoft Entra ID users without triggering alerts requires CISOs to proactively review log configurations and detection rules across their identity infrastructure.

📖 Read full article

Infosecurity Magazine · Jul 13 · Relevance: ████████░░ 8/10

Why it matters to CISOs: Progress Software—maker of MOVEit, which was exploited in one of the largest breach campaigns in history—is now warning of an active external security threat to ShareFile's Storage Zone Controller, requiring immediate shutdown action from enterprise customers running on-premises deployments.

📖 Read full article

Alex: Welcome to Cleartext for Tuesday, July 14th, 2026. I'm Alex Chen.

Jordan: And I'm Jordan Reeves. So, Europe finally decided to name names. The EU and UK dropped the first joint cyber sanctions package yesterday, going directly after GRU operators and, perhaps more significantly, formally attributing the winter attacks on Poland's energy grid to the FSB's Turla group. If you run critical infrastructure anywhere in Europe or serve European markets, your threat model just changed.

Alex: That's where we're starting today, and there's a lot to unpack. We've got a coordinated Western sanctions package, a joint advisory on Russian exploitation of network devices, OFAC going after ransomware enablers for the first time, ShinyHunters spending a full year inside Salesforce environments without touching a single platform vulnerability, CISA's own embarrassing credential leak, and Progress Software telling customers to shut down ShareFile servers immediately. Plus Apple's offboarding controls apparently had a rather significant gap. Let's get into it.

Jordan: So let's talk about the sanctions. This isn't just another round of finger-wagging. The EU and UK coordinated simultaneously, sanctioning dozens of Russian individuals and entities. They publicly attributed specific campaigns to specific units within Russian intelligence. That's GRU for the broader European hacking operations, and FSB's Turla group specifically for the attacks on Poland's energy grid last winter. This is a deterrence posture shift, not just a diplomatic gesture.

Alex: And I think the Poland attribution is the piece that should get the most attention in the boardroom. Attributing destructive attacks on energy infrastructure to a named state intelligence unit is about as far as Western governments go short of kinetic response. For CISOs in energy, utilities, transportation, any critical infrastructure sector operating in Europe, this is the signal that says the threat is not theoretical and your government agrees.

Jordan: Right. And layered on top of that, we got the joint advisory, US authorities coordinating with international partners, specifically warning that Russian FSB actors are actively exploiting Cisco Smart Install vulnerabilities across defense, communications, energy, finance, government, and healthcare. This isn't new in concept. We've seen advisories about network device targeting before. But the timing alongside the sanctions tells you something about the intelligence community's current assessment of Russian operational tempo.

Alex: So what's the action item? If you're a CISO hearing this, the immediate move is to audit your Cisco Smart Install exposure. If you have it enabled and you're not actively using it, disable it. If you are using it, make sure it's not internet-facing and that you've applied every relevant patch. But the broader action is to revisit your network device hardening posture generally. Routers, switches, firewalls, these are the devices that attackers love because they often sit outside your EDR coverage, outside your normal logging pipeline, and they provide persistent access that survives endpoint reimaging.

Jordan: And frankly, most organizations still treat network device security as an infrastructure team problem rather than a security team problem. That gap is exactly what state actors exploit.

Alex: Staying on the sanctions theme but shifting to the US side, OFAC sanctioned a VPN service provider called First VPN Service, or 1VPNS, along with its Ukrainian administrator, specifically for providing infrastructure to ransomware groups. They also hit a Belarusian individual selling malware cryptor services. This is the first time a VPN provider has been sanctioned for ransomware enablement.

Jordan: This is significant because it signals that the US is now going after the enablement layer, not just the operators. If you're providing the infrastructure that makes ransomware possible, you are now a sanctions target. For CISOs, the practical concern is third-party risk. You need to be asking whether any of your vendors, any of your employees' tools, any shadow IT services have potential sanctions exposure. Because if your organization is transacting with a sanctioned entity, even unknowingly, that creates legal liability.

Alex: And this is a conversation your general counsel needs to be part of. Sanctions compliance isn't optional, and the scope of what constitutes a sanctionable entity in the cyber domain just expanded considerably.

Jordan: Let's shift to what I think is one of the most operationally important stories today. Microsoft published research mapping three distinct attack paths that ShinyHunters-linked actors used over the past year to compromise corporate Salesforce environments. And here's the critical detail: they didn't exploit a single Salesforce vulnerability. Not one. The entire attack surface was the OAuth trust relationships that organizations had configured between Salesforce and their third-party apps and vendors.

Alex: This is the story that should make every CISO uncomfortable, because it's not about a vendor failing you. It's about your own trust architecture failing you. When you connect a third-party app to Salesforce via OAuth, you're extending trust. And if that third party gets compromised, or if those OAuth tokens are mismanaged, the attacker inherits whatever access you granted. ShinyHunters apparently understood this better than most defenders do.

Jordan: Microsoft documented three paths. The specifics matter less than the pattern. Every one of them exploited inherited trust, the transitive trust problem that identity teams have been warning about for years. The action here is to audit every OAuth connection in your Salesforce environment. Know what apps have access, what scopes they were granted, whether those grants are still appropriate, and whether those third parties have adequate security controls. If you can't answer those questions, you have blind spots that are actively being exploited in the wild.

Alex: And this extends beyond Salesforce. Any SaaS platform with OAuth integrations has this same trust architecture. Salesforce just happens to be where ShinyHunters went hunting. The principle is universal.

Jordan: Speaking of trust architecture problems, let's talk about CISA's GitHub leak. Krebs reported that a contractor published dozens of internal CISA credentials, including AWS GovCloud keys, to a public GitHub repository. And those credentials sat there, publicly accessible, for almost six months before KrebsOnSecurity notified CISA.

Alex: Six months. The nation's cyber defense agency had live credentials exposed on a public repo for six months and didn't detect it. CISA deserves credit for publishing a formal postmortem, but this is a governance failure that every CISO should study carefully, because if CISA can miss this, so can you.

Jordan: The lessons from the postmortem are straightforward but apparently difficult to implement consistently. Secrets scanning needs to be automated and continuous, not just at commit time but across all repositories including contractor repos. Contractor oversight needs teeth. You need to know what your contractors are doing with your credentials, where they're storing them, and whether they're following your policies. And detection of credential exposure needs to be treated as a critical alerting use case, not a nice-to-have.

Alex: I'd add that this is a board-level conversation about contractor risk management. Most organizations have significant contractor populations with access to sensitive systems and credentials. If your secrets management program doesn't extend to contractors with the same rigor as employees, you have the same gap CISA had.

Jordan: Two more stories to cover. Proofpoint documented a technique for enumerating Microsoft Entra ID users without triggering standard detection. Attackers are exploiting how Entra handles certain authentication flows to identify valid accounts silently. This is pre-attack reconnaissance, the kind of thing that precedes credential stuffing or targeted phishing.

Alex: The action is to review Proofpoint's published indicators and check your Entra ID logs for signs of this enumeration technique. If your detection rules are built around standard failed authentication patterns, you may be missing this entirely. Identity infrastructure monitoring needs to evolve as fast as the evasion techniques, and right now, the attackers are ahead.

Jordan: And then there's Progress Software warning customers about what they're calling an external security threat to ShareFile's Storage Zone Controller. They're telling customers to shut down servers immediately.

Alex: If you're running ShareFile with on-premises Storage Zone Controllers, this is a drop-everything situation. Progress Software has earned a very specific reputation since the MOVEit campaign, and when they issue an urgent shutdown advisory, you take it at face value. Shut the servers down, wait for guidance, and have your incident response team review logs for any signs of compromise.

Jordan: The Apple story is worth a quick mention for the governance lesson. A former employee who left for OpenAI apparently exploited what Apple calls a rare bug to download confidential files after departure. The access should have been revoked. It wasn't, because of a system defect.

Alex: Every CISO should hear this and immediately ask: do we have redundant verification that access is actually revoked when someone leaves? Not just that the offboarding ticket was closed, but that every system, every credential, every token was actually deactivated. Because a single point of failure in your offboarding process is exactly the kind of thing that creates headlines.

Jordan: And when someone leaves for a direct competitor, the scrutiny should be even higher. That should trigger enhanced monitoring and verification as a matter of policy.

Alex: All right, let's talk about what's emerging here. The theme of the day, and frankly the theme of the quarter, is that the Western world is moving from passive cyber defense to active deterrence and enforcement. Coordinated sanctions, public attribution to specific intelligence units, OFAC going after enablement infrastructure. The policy environment is hardening rapidly.

Jordan: And that creates both protection and obligation for CISOs. Protection because these actions impose costs on adversaries and may reduce some threat volume over time. Obligation because your board is going to see these headlines and expect you to have a position on how your organization is responding to a threat environment that governments are calling serious enough to warrant sanctions and public attribution.

Alex: If you haven't updated your board briefing on the Russian cyber threat since the Ukraine invasion began, now is the time. The threat landscape has evolved. The policy landscape has evolved. Your board communication should reflect both.

Jordan: And on the operational side, the ShinyHunters Salesforce campaign and the CISA GitHub leak are both reminders that the most dangerous risks aren't exotic zero-days. They're trust relationships you've already established and credentials you've already issued. The basics still matter more than anything.

Alex: That's our show for today. Show notes and links to every story we covered are at cleartext.fm. I'm Alex Chen.

Jordan: I'm Jordan Reeves. We'll see you tomorrow.

Cleartext is an automated daily podcast for CISOs and security leaders. Generated 2026-07-14.

Sources are pulled from: CyberScoop, The Record, SecurityWeek, Krebs on Security, Dark Reading, Cybersecurity Dive, BleepingComputer, Wired, Ars Technica, TechCrunch, Help Net Security, VentureBeat, Risky Business News, The Hacker News, CISA, and BankInfoSecurity.

Daily cybersecurity briefing for CISOs and security leaders.

🎧 Listen to this episode

Today's episode covers 8 stories across 4 topic areas, including: Russia's FSB blamed for Poland grid attack as UK and EU impose first joint cyber sanctions; EU sanctions Russian GRU military hackers over cyberattacks; US and allies warn of Russian critical infrastructure attacks.

The Record (Recorded Future) · Jul 12 · Relevance: ██████████ 10/10

Why it matters to CISOs: The first joint UK-EU cyber sanctions package signals a major escalation in Western attribution and response posture toward Russian state hackers, with direct implications for critical infrastructure threat modeling and geopolitical risk assessments across energy, water, and related sectors.

📖 Read full article

BleepingComputer · Jul 13 · Relevance: █████████░ 9/10

Why it matters to CISOs: EU and UK sanctioning of GRU-linked hacking groups reinforces the attribution of state-sponsored threat actors and should prompt CISOs to reassess threat intelligence programs and escalate Russia-nexus adversary tracking within their security operations.

📖 Read full article

BleepingComputer · Jul 13 · Relevance: █████████░ 9/10

Why it matters to CISOs: A nine-nation joint advisory on Russian state hackers exploiting vulnerable routers to penetrate critical infrastructure networks is a direct call to action for CISOs to audit network edge device configurations and SNMP credential hygiene enterprise-wide.

📖 Read full article

VentureBeat Security · Jul 13 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: Slopsquatting—where attackers register fictitious package names hallucinated by LLM coding assistants—represents a novel and hard-to-detect software supply chain attack vector that CISOs must address through AI code governance policies and dependency vetting controls.

📖 Read full article

Help Net Security · Jul 13 · Relevance: ████████░░ 8/10

Why it matters to CISOs: This case establishes that insider betrayal during incident response engagements—including sharing insurance limits and negotiating positions with ransomware operators—carries serious criminal liability, and should force CISOs to scrutinize third-party IR and negotiation firm vetting and information-sharing controls.

📖 Read full article

CyberScoop · Jul 13 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: As AI coding tools accelerate software velocity, the accumulation of unreviewed, insecure AI-generated code is transitioning from a development hygiene issue to a board-level governance and liability risk that CISOs must now own and report on.

📖 Read full article

Help Net Security · Jul 13 · Relevance: █████████░ 9/10

Why it matters to CISOs: Progress Software—the vendor behind the MOVEit breach—is now responding to a credible external threat against ShareFile's on-premises Storage Zone Controllers by disabling accounts and urging server shutdowns, a crisis-level response that demands immediate inventory checks from any enterprise running ShareFile SZC deployments.

📖 Read full article

Help Net Security · Jul 13 · Relevance: ████████░░ 8/10

Why it matters to CISOs: Attackers are exploiting a gap in Microsoft Entra ID's handling of unrecognized OAuth client IDs to conduct account enumeration while evading standard sign-in telemetry, directly undermining the detection efficacy of cloud identity monitoring in Microsoft 365 environments.

📖 Read full article

Alex: Welcome to Cleartext. It's Monday, July 13th, 2026. I'm Alex Chen.

Jordan: And I'm Jordan Reeves. Let's get into it.

Alex: Jordan, quite a weekend.

Jordan: Quite a weekend. So here's where I want to start. The UK and the EU just issued their first ever joint cyber sanctions package. First ever. They named FSB Center 16, that's Russia's signals intelligence arm, for cyberattacks against Poland's energy grid and water treatment facilities. Alongside that, dozens of GRU-linked individuals and entities got sanctioned for a coordinated campaign of hacking across Europe. And then the US and eight allied nations dropped a joint advisory on Russian state hackers exploiting misconfigured routers to penetrate critical infrastructure. Three coordinated actions in essentially 48 hours. This is not routine. This is a posture shift.

Alex: Let me frame why this matters at the board level before we dig in. If you're a CISO at any organization that touches energy, water, transportation, or frankly any critical infrastructure adjacent sector, the threat model you presented to your board six months ago is now outdated. The Western alliance just made an explicit, coordinated, public statement that Russian cyber operations against civilian infrastructure are escalating in severity and that the response posture is escalating to match. That changes your risk calculus.

Jordan: Let's unpack what's actually new here. We've had Russian attribution before. We've had sanctions before. What we haven't had is the UK and EU acting jointly on cyber sanctions as a single package. Post-Brexit, these two have operated on parallel but separate tracks. The fact that they synchronized this tells you there was a political decision at the highest levels to send a unified signal. And the inclusion of both FSB and GRU operations in a single action suggests the Western intelligence community is presenting Russia's cyber apparatus as a coordinated whole, not just individual threat groups operating independently.

Alex: And for CISOs, that framing matters. When your board asks, "Are we a target?", the answer has to account for the fact that Western governments are now explicitly saying Russia is running a coordinated network of hacking groups. Not APT28 here, Sandworm there. A coordinated network. That means if you're tracking these threat actors in silos, you're likely missing the picture.

Jordan: The nine-nation joint advisory is the operational companion to the political action. And what it flags is almost embarrassingly basic. Weak SNMP credentials on network edge devices. Misconfigured routers. This is the initial access vector they're calling out. Not zero-days. Not sophisticated implants. Routers with default or weak SNMP community strings sitting on the network perimeter.

Alex: Which is exactly the kind of finding that makes CISOs uncomfortable, because it means the gap isn't in your next-gen tooling budget. It's in configuration hygiene on devices that nobody's looked at since they were racked. If you run critical infrastructure or if you supply it, Monday morning action item number one is an audit of every network edge device. SNMP credentials, firmware versions, access controls. Not next quarter. Now.

Jordan: I'll add one more layer. The geopolitical timing matters. We're in a period where NATO is actively reinforcing Eastern European defense posture. Poland has been a focal point. Targeting Polish energy and water is not random. It's coercive signaling. And if you're a CISO at a multinational with operations in Eastern Europe, or even supply chain dependencies there, you need to factor that into your continuity planning.

Alex: Good. Let's pivot to something that connects the geopolitical to the operational in a different way. Jordan, Progress Software. Again.

Jordan: Again. So the company behind the MOVEit breach, which, let's remember, compromised hundreds of organizations and tens of millions of records, is now dealing with what they're calling a credible external security threat targeting ShareFile Storage Zone Controllers. These are the on-premises, customer-managed server components. Progress sent emergency emails on July 10th, proactively disabled access to affected ShareFile accounts, and told customers to manually shut down their SZC servers pending further guidance.

Alex: Let me be direct. When a vendor proactively disables your accounts and tells you to shut down servers, that is a crisis-level response. That is not a precautionary advisory. That is a vendor telling you they believe exploitation is imminent or already occurring. If you have ShareFile SZC deployments, you should already be in incident response mode.

Jordan: What strikes me is the pattern with Progress Software. MOVEit was a managed file transfer product. ShareFile SZC is a file sharing and storage product. These are the workhorses of enterprise data movement. They sit at the intersection of sensitive data and network exposure, and they've now shown up twice as high-severity targets from the same vendor.

Alex: And the board question becomes a vendor concentration and third-party risk question. How many of your critical data flows run through Progress Software products? What's your fallback? This is the kind of scenario that tests whether your third-party risk program is a paper exercise or an operational capability.

Jordan: Shift gears. There's an interesting Entra ID story that I think a lot of SOC teams need to hear. Attackers are spoofing OAuth client IDs in authentication requests against Microsoft Entra ID. They're passing fabricated application identifiers in the client_id parameter. Entra ID logs whatever value it receives, and when the value doesn't match a known application, it creates a blind spot in the sign-in telemetry that most security teams rely on for detection.

Alex: So to be clear, the technique is being used for cloud tenant account enumeration, which is the precursor to credential stuffing and brute force. And the clever part is that by spoofing the client ID, the activity either doesn't appear in the logs your SOC is watching or it appears as noise that doesn't correlate to a known application.

Jordan: Exactly. Your detection logic that keys on application ID suddenly has a gap. If you're running detections on Entra ID sign-in logs, and most Microsoft 365 shops are, you need to evaluate whether your rules account for unrecognized or anomalous client_id values. This is a detection engineering problem, not a patching problem.

Alex: Alright, let's talk about two stories that I think are thematically linked around AI governance and trust. First, the sentencing of Angelo Martino. Former ransomware negotiator at DigitalMint. Seventy months in federal prison for sharing client confidential information, insurance policy limits, negotiating positions, internal assessments, directly with BlackCat ransomware operators. He later participated in attacks against clients.

Jordan: Seventy months. Almost six years. This is the most significant criminal case we've seen involving insider betrayal in the incident response ecosystem. And it should be deeply unsettling to every CISO who's ever brought in a third-party negotiation firm during a ransomware event.

Alex: Think about what you share with your IR and negotiation partners during a crisis. Policy limits. Board deliberations. Willingness to pay. Recovery timelines. Competitive exposure. That information is extraordinarily sensitive, and in this case it was handed directly to the adversary to maximize extraction. The vetting question here isn't just background checks on firms. It's information compartmentalization during incidents. Who has access to what? Are you sharing insurance details with negotiators who don't need them? Are you segregating legal strategy from technical response?

Jordan: And I'd argue this case should also change how you write your IR retainer agreements. Information handling, confidentiality controls, personnel vetting requirements. These need teeth now. Not boilerplate.

Alex: The second thread is slopsquatting, which is a fantastic and horrible name. The concept is straightforward. LLM coding assistants hallucinate package names that don't exist. Attackers register those hallucinated names on package repositories and populate them with malicious code. Developers using AI assistants then pull in the malicious package because the AI told them to.

Jordan: It's elegant in its simplicity. Traditional typosquatting requires you to guess what typos developers will make. Slopsquatting lets you just wait for the AI to make up a package name, register it, and let the AI do the distribution for you. The AI becomes the attack vector.

Alex: And this connects to the broader CyberScoop piece on AI-generated code as a governance problem. The argument, which I agree with, is that AI coding tools are producing security debt at a pace that outstrips review and remediation capacity. And that debt is no longer a development hygiene issue. It's a board-level governance and liability risk.

Jordan: If your developers are using Copilot or any LLM coding assistant, and statistically they almost certainly are even if you haven't formally approved it, you need dependency validation controls that specifically account for hallucinated package names. That means checking package existence and provenance before anything gets pulled into a build. And you need a governance framework that treats AI-generated code as a distinct risk category with its own review requirements.

Alex: Which brings us to the outlook. Jordan, what's the thread you're pulling on this week?

Jordan: The thread is trust boundaries under stress. Every story today is about a trust boundary that broke or is being tested. Geopolitical trust between nations driving unprecedented joint sanctions. Trust in critical infrastructure device configurations. Trust in vendor security with Progress Software. Trust in identity telemetry with the Entra ID blind spot. Trust in your incident response partners with the Martino case. Trust in your AI development tools with slopsquatting. The common theme is that assumptions about who and what you can trust are being invalidated faster than most organizations can adapt.

Alex: And I think the action item for CISOs this week is to pick two of those trust boundaries and pressure test them. Not theoretically. Operationally. Pull your router configs. Call your IR firm and ask about their personnel controls. Look at your Entra ID detection logic. Ask your engineering leadership what dependency validation looks like for AI-assisted code. Pick two, and actually test the assumption.

Jordan: Agreed. And if you're in critical infrastructure, the Russia actions aren't optional reading. Brief your board. Update your threat model. Audit your edge.

Alex: That's our show for Monday, July 13th. Show notes and links to every story we covered are at cleartext.fm. We'll be back tomorrow. Stay sharp.

Jordan: Stay sharp.

Cleartext is an automated daily podcast for CISOs and security leaders. Generated 2026-07-13.

Sources are pulled from: CyberScoop, The Record, SecurityWeek, Krebs on Security, Dark Reading, Cybersecurity Dive, BleepingComputer, Wired, Ars Technica, TechCrunch, Help Net Security, VentureBeat, Risky Business News, The Hacker News, CISA, and BankInfoSecurity.

Daily cybersecurity briefing for CISOs and security leaders.

🎧 Listen to this episode

Today's episode covers 17 stories across 5 topic areas, including: Srsly Risky Biz: US Supreme Court undermines Section 702 intel; Canadian spy agency says it hacked drug traffickers, extremists, and a ransomware gang last year; China, India ran separate spying campaigns against same Pakistani police force.

Risky Business News · Jul 09 · Relevance: ████████░░ 8/10

Why it matters to CISOs: A Supreme Court ruling that puts the EU-US Data Privacy Framework at risk could invalidate the legal basis for transatlantic data transfers, forcing CISOs at multinationals to urgently revisit data residency, SCCs, and cross-border incident sharing agreements.

📖 Read full article

TechCrunch Security · Jul 06 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: Canada's unprecedented public disclosure of offensive cyber operations against a ransomware gang signals that Five Eyes nations are moving toward active offensive disruption as a normalized policy tool — a shift that affects threat actor risk calculus and may reduce some ransomware-group operational tempo.

📖 Read full article

The Record (Recorded Future) · Jul 10 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: Simultaneous nation-state intrusions by rival APTs into the same target illustrate that shared infrastructure and geopolitically sensitive supply-chain partners can be breached by multiple adversaries concurrently — a scenario that complicates attribution and incident response for multinationals operating in contested regions.

📖 Read full article

CyberScoop · Jul 07 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: China-aligned actors exploiting Roundcube webmail in physics and engineering departments of US and Canadian universities suggests active pre-positioning for technology and research theft — organizations with academic research partnerships or alumni networks should audit their email infrastructure exposure.

📖 Read full article

Dark Reading · Jul 06 · Relevance: █████████░ 9/10

Why it matters to CISOs: The first documented end-to-end LLM-orchestrated ransomware attack marks a qualitative shift in threat actor capability that demands CISOs reassess detection dwell-time assumptions and accelerate pre-attack resilience postures.

📖 Read full article

Dark Reading · Jul 08 · Relevance: █████████░ 9/10

Why it matters to CISOs: A single threat actor using agentic AI compressed what would typically be a weeks-long cloud compromise into 72 hours, directly challenging the response window assumptions baked into most enterprise incident response plans.

📖 Read full article

Cybersecurity Dive · Jul 08 · Relevance: ████████░░ 8/10

Why it matters to CISOs: A breach at one of the world's largest cybersecurity and IT services firms — with source code, encryption keys, and client data allegedly exfiltrated — is a direct third-party risk event for any enterprise that has Accenture managing security operations, cloud environments, or sensitive development work.

📖 Read full article

The Hacker News · Jul 10 · Relevance: ████████░░ 8/10

Why it matters to CISOs: Attackers are now specifically targeting passkey enrollment flows — the very MFA upgrade organizations are deploying to replace phishable credentials — meaning CISOs cannot treat passkey adoption as a finish line without also securing the enrollment process itself.

📖 Read full article

TechCrunch Security · Jul 08 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: AssuranceAmerica's breach of 6.9 million records — achieved via a single employee compromise — is the largest known driver's license number breach of 2026 and a reminder that identity data aggregators remain high-value, under-defended targets with cascading fraud implications for individuals and insurers.

📖 Read full article

The Record (Recorded Future) · Jul 10 · Relevance: ████████░░ 8/10

Why it matters to CISOs: Dual ransomware convictions in a single week — including the unprecedented jailing of a ransomware negotiator who double-crossed his own clients — signals sustained DOJ momentum on ransomware prosecution and raises the legal risk profile for any firm that plays both sides of an extortion event.

📖 Read full article

CyberScoop · Jul 10 · Relevance: ████████░░ 8/10

Why it matters to CISOs: CISA's public forensic post-mortem on its own credential leak — revealing the agency had to build its incident playbook during the incident — is a direct object lesson for CISOs: if the nation's top cyber defense agency lacked a tested playbook, most enterprises are similarly exposed.

📖 Read full article

CyberScoop · Jul 09 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: Operation First Light's scale — 5,800 arrests, 142,000 identified victims across 97 countries — demonstrates that multilateral law enforcement is increasingly effective against the fraud and social-engineering ecosystem that feeds enterprise phishing and BEC losses.

📖 Read full article

Cybersecurity Dive · Jul 06 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: The Scattered Spider extradition — combined with court filings revealing a Windows device ID helped FBI trace a second suspect — shows law enforcement has developed repeatable forensic techniques against this group that previously seemed untouchable, relevant context for boards asking about cyber insurance and legal liability.

📖 Read full article

The Hacker News · Jul 10 · Relevance: █████████░ 9/10

Why it matters to CISOs: Progress Software's emergency directive to shut down on-premises ShareFile servers mirrors the MOVEit playbook and signals another mass-exploitation event targeting enterprise file-transfer infrastructure — immediate action required for any org running Storage Zone Controllers.

📖 Read full article

The Hacker News · Jul 09 · Relevance: ████████░░ 8/10

Why it matters to CISOs: The 'Friendly Fire' proof-of-concept shows that AI security tooling from Anthropic and OpenAI can be weaponized against the very organizations deploying them, creating a new liability surface for teams that have adopted AI-assisted code review.

📖 Read full article

Cybersecurity Dive · Jul 10 · Relevance: ████████░░ 8/10

Why it matters to CISOs: CitrixBleed2 exploitation by a known initial access broker feeding DragonForce ransomware means any organization with unpatched NetScaler appliances faces imminent ransomware risk, not just credential theft.

📖 Read full article

The Hacker News · Jul 08 · Relevance: ████████░░ 8/10

Why it matters to CISOs: CVE-2026-43499 ships by default in virtually every mainstream Linux distribution since 2011 and requires no special permissions to exploit — any enterprise running Linux servers, cloud instances, or containers must treat this as a priority patch regardless of existing compensating controls.

📖 Read full article

Jordan: If there's one sentence that captures this week, it's this: the machines are faster than your playbook. We saw the first fully autonomous LLM-driven ransomware attack, a solo operator compressing an AWS breach into 72 hours using agentic AI, and the security tools we're deploying to defend ourselves getting weaponized against us. The assumption that you have days or weeks to detect and respond is now formally obsolete.

Alex: Welcome to Cleartext. I'm Alex Chen, alongside Jordan Reeves. This is your Saturday Week in Review for the week ending July 11th, 2026. If you couldn't keep up this week, here's what mattered and what it means. We've got four big themes. First, the one Jordan just flagged — AI as an autonomous threat actor is no longer theoretical, it's operational. Second, the identity and authentication stack is under siege, and the very passkey rollouts you're investing in are being targeted. Third, the legal and enforcement landscape shifted materially, from ransomware convictions to a Supreme Court ruling that could blow up transatlantic data transfers again. And fourth, critical vulnerabilities — including a MOVEit-style déjà vu from Progress Software — that demand Monday morning action. Let's get into it.

Jordan: So let's start with the AI threat story because I think it's the most consequential development of the week, possibly of the quarter. JadePuffer. An agentic AI actor — not a human using ChatGPT to write a phishing email, but an autonomous LLM agent — exploited a Langflow vulnerability, exfiltrated data from a production database, and encrypted systems. Soup to nuts. No human operator in the loop on the attack side.

Alex: And that Langflow CVE was simultaneously added to CISA's Known Exploited Vulnerabilities catalog, which tells you this isn't one isolated incident. This is being exploited at scale. But Jordan, what makes JadePuffer different from every other AI-assisted attack we've covered?

Jordan: The word "assisted" is doing all the work there. Every previous case was a human using AI to accelerate a phase — write better phishing lures, generate polymorphic payloads, whatever. JadePuffer is the first documented case where the entire kill chain was executed by an autonomous agent. Reconnaissance, exploitation, data exfiltration, encryption. The agent made tactical decisions during the attack. That is a qualitative shift in what we're defending against.

Alex: And then layer on the Sygnia report about the lone attacker who breached an AWS environment in 72 hours using agentic AI workflows. This was a human operator, but a single individual who chained cloud misconfigurations and stolen credentials at a speed that would have taken a team weeks. Sygnia's forensic analysis confirmed the AI dramatically compressed the timeline.

Jordan: Right, so you've got two data points in the same week. One fully autonomous, one AI-augmented solo operator. Both arriving at the same conclusion: your detection-to-damage window just collapsed. If your IR plan assumes you have five to seven days of dwell time to detect lateral movement, you are working with outdated assumptions.

Alex: For the CISOs listening, the practical implication is this: pre-attack resilience is now the game. You cannot rely on detection speed alone. Immutable backups, microsegmentation, assume-breach architecture — these move from best practice to table stakes. And honestly, this needs to be a board conversation this month. The threat model has changed.

Jordan: And here's the darker twist. The Friendly Fire research from the AI Now Institute showed that Claude Code and OpenAI Codex, running autonomously, can be tricked into executing attacker-supplied code during security scans. The AI agents you're deploying to find vulnerabilities in your code can be weaponized to run the attacker's code on your infrastructure. Using the agent's own approved permissions. No privilege escalation needed.

Alex: So we're in a world where AI is simultaneously the threat actor, the attack accelerant, and a potential liability in your own defensive stack. If you've adopted AI-assisted code review, you need to audit what autonomous permissions those tools have. This week.

Jordan: And the HalluSquatting research compounds it — AI coding assistants hallucinating package names that attackers then register with malicious payloads. The attack surface of AI tooling itself is expanding faster than most security teams are tracking it.

Alex: Let's pivot to identity, because this was also a significant week on that front. The passkey enrollment phishing campaign is the one I want CISOs to really internalize.

Jordan: O-UNC-066. Tracked by Okta. They're using voice-based social engineering — vishing — to trick Microsoft 365 users into enrolling attacker-controlled passkeys in Entra. They have a panel-controlled phishing kit specifically designed to hijack the passkey enrollment flow. Think about what that means. Organizations are investing heavily in passkeys as the post-password future. And attackers are now specifically targeting the enrollment ceremony itself.

Alex: This is critical. Passkeys are genuinely more secure than passwords and legacy MFA. But the enrollment process is a moment of trust establishment, and if you don't secure that moment, you've handed the attacker a credential that's harder to revoke and harder to detect as compromised. CISOs cannot treat passkey deployment as a finish line. You need to secure the enrollment lifecycle with the same rigor you'd apply to certificate issuance.

Jordan: And this wasn't the only M365 identity attack this week. We also saw the DEBULL device-code phishing campaign and the Forg365 AI-assisted adversary-in-the-middle kit. Three separate campaigns all targeting Microsoft 365 identity in the same week. M365 identity is the dominant enterprise attack surface, full stop. The AssuranceAmerica breach reinforces this — 6.9 million records, largest driver's license number breach of the year, achieved by compromising a single employee. One person. One credential. 6.9 million records.

Alex: The common thread across all of these is that identity remains the perimeter. And every flavor of identity attack was represented this week — vishing, phishing, credential theft, enrollment hijacking. If your identity security program isn't your single largest security investment right now, you're misallocated.

Jordan: Let's move to the legal and geopolitical landscape because there were some genuinely consequential developments. The biggest one, and I think the most underappreciated story of the week, is the Supreme Court ruling that threatens Section 702 and the EU-US Data Privacy Framework.

Alex: This is a potential earthquake for any multinational. The current framework is what allows lawful transatlantic data transfers. If this ruling leads to the framework being invalidated, we're looking at Schrems III. CISOs at global companies need to be talking to their DPOs and general counsel right now about Standard Contractual Clauses, data residency architectures, and whether their cross-border incident sharing agreements survive a framework collapse.

Jordan: And the practical problem is worse than Schrems II because organizations have now built more infrastructure on the assumption that the current framework is stable. Unwinding that is harder and more expensive. I'd say probability of full invalidation is still moderate, but the downside risk is enormous. This is a scenario-plan-now situation.

Alex: On the enforcement side, the dual ransomware convictions were remarkable. Ryuk operator Vardanyan pleading guilty, facing 15 years, agreeing to $1.2 million in restitution. And then Angelo Martino — a ransomware negotiator who was feeding confidential client data to BlackCat affiliates — sentenced to 70 months.

Jordan: The Martino case is the one that should make every CISO's ears perk up. This is a person who was hired by victim organizations to negotiate on their behalf, and he was secretly feeding their data — their financial exposure, their willingness to pay, their internal communications — to the attackers. He enabled $75.3 million in extortion across five victims. Three ransomware negotiators jailed in the same week. DOJ is clearly scrutinizing the entire incident response ecosystem now.

Alex: The implication for CISOs is direct: vet your incident response partners with the same rigor you'd apply to any critical vendor. Understand their conflicts of interest. Get contractual protections around data handling during an incident. And brief your board that the IR ecosystem itself has become a risk surface.

Jordan: On the geopolitical front, Canada's CSE publicly disclosing offensive cyber operations against a ransomware gang is a notable transparency shift. Five Eyes nations are normalizing offensive disruption as a public policy tool. Combined with the Interpol operation — 5,800 arrests across 97 countries — law enforcement pressure on the cybercrime ecosystem is genuinely intensifying.

Alex: Although I'll note the Interpol operation was notably funded by the Chinese government, which adds a fascinating geopolitical layer when you consider that Chinese APTs were simultaneously running espionage operations against Pakistani police alongside Indian intelligence, and separately exploiting Roundcube webmail to target physics and engineering departments at US and Canadian universities. The geopolitical picture is, as always, complicated.

Jordan: Now let's talk vulnerabilities, because there are items here that require action Monday morning. Progress Software telling ShareFile customers to shut down their Storage Zone Controllers immediately. This is the MOVEit company. Same playbook. Credible external security threat, preemptive account disablement, emergency shutdown directive.

Alex: If you're running on-premises ShareFile Storage Zone Controllers, this should already be done. If you haven't confirmed with your team, do it before Monday. The pattern here is identical to MOVEit in 2023 — enterprise file transfer infrastructure targeted for mass exploitation. We know how this movie ends if you're slow.

Jordan: CitrixBleed2 is the other urgent one. An initial access broker has weaponized the NetScaler memory-disclosure flaw and is actively selling access to DragonForce ransomware affiliates. If you have unpatched NetScaler appliances, you don't have a vulnerability management problem. You have a ransomware problem.

Alex: And then GhostLock. CVE-2026-43499. A 15-year-old Linux kernel flaw present in every mainstream distribution since 2011. Any logged-in user can achieve full root. No special permissions required. Container escape is possible. Google paid a quarter million dollars for a related VM-escape flaw the same week. If you run Linux anywhere — servers, cloud instances, containers — this is a priority patch.

Jordan: Oh, and the Accenture breach. Source code, encryption keys, client data allegedly exfiltrated from one of the world's largest IT and security services firms. If Accenture manages any of your security operations, cloud environments, or development work, you have a third-party risk event to investigate. Coming the same week as the CISA credential leak forensic report, the theme is unmistakable: the security supply chain itself is compromised.

Alex: Which brings us to the defining characteristic of this week. Jordan, what's your take?

Jordan: This was the week the assumptions broke. The assumption that you have days to detect an intrusion — broken by agentic AI. The assumption that passkeys solve your identity problem — broken by enrollment hijacking. The assumption that your IR negotiator is on your side — broken by criminal prosecution. The assumption that your security vendor is secure — broken by Accenture and CISA. Every layer of the trust model took a hit this week.

Alex: I agree. And for CISOs going into next week, the action items are concrete. One, reassess your dwell-time assumptions in light of AI-accelerated attacks. Two, audit your passkey enrollment controls. Three, confirm ShareFile and NetScaler patching status. Four, assess your Accenture exposure if applicable. And five, get ahead of the Data Privacy Framework risk with your legal team. This is a week where waiting costs you.

Jordan: Monday morning, not Monday afternoon.

Alex: That's the Week in Review for July 11th, 2026. The daily show returns Monday with fresh coverage. Full show notes and links to every story we discussed today are at cleartext.fm. I'm Alex Chen.

Jordan: I'm Jordan Reeves. Have a good weekend. Patch something.

Cleartext is an automated daily podcast for CISOs and security leaders. Generated 2026-07-11.

Sources are pulled from: CyberScoop, The Record, SecurityWeek, Krebs on Security, Dark Reading, Cybersecurity Dive, BleepingComputer, Wired, Ars Technica, TechCrunch, Help Net Security, VentureBeat, Risky Business News, The Hacker News, CISA, and BankInfoSecurity.

Daily cybersecurity briefing for CISOs and security leaders.

🎧 Listen to this episode

Today's episode covers 9 stories across 4 topic areas, including: NSA revives 'Tailored Access Operations' name for elite hacking unit; China, India ran separate spying campaigns against same Pakistani police force; New GigaWiper Windows Backdoor Bundles Disk Wiping, Fake Ransomware, and Spyware.

The Record (Recorded Future) · Jul 09 · Relevance: ████████░░ 8/10

Why it matters to CISOs: The NSA's deliberate rebranding of its elite offensive cyber unit back to the historically significant TAO name is a public posture signal, suggesting a more assertive US offensive cyber stance that CISOs should factor into geopolitical threat modeling and potential blowback risk from adversary nations.

📖 Read full article

The Record (Recorded Future) · Jul 10 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: The simultaneous, independent compromise of the same systems by two nation-state actors illustrates how contested geopolitical terrain translates into overlapping threat actor presence on enterprise infrastructure—particularly relevant for multinationals with operations or supply chain exposure in South Asia.

📖 Read full article

The Hacker News · Jul 09 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: GigaWiper's modular design—combining disk wipers, fake ransomware, and spyware in a single operator-selectable toolkit—represents a strategic escalation in destructive malware capability that CISOs at critical infrastructure or geopolitically exposed organizations must incorporate into worst-case response planning.

📖 Read full article

Cybersecurity Dive · Jul 09 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: GuidePoint's findings that four dominant ransomware groups account for a disproportionate share of attacks, with AI automating human attacker behaviors rather than fundamentally changing them, gives CISOs a realistic threat landscape to brief boards against without overhyping AI-native threats.

📖 Read full article

The Hacker News · Jul 10 · Relevance: ████████░░ 8/10

Why it matters to CISOs: Threat actors are now specifically targeting the passkey enrollment process itself, undermining phishing-resistant MFA rollouts; CISOs accelerating Entra passkey adoption need to add enrollment verification controls and user education as a distinct attack surface.

📖 Read full article

BleepingComputer · Jul 09 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: Helix represents a new identity-focused extortion group combining vishing, device code phishing, and MFA abuse to exfiltrate SharePoint data—a direct threat to enterprises relying on Microsoft 365 as a collaboration backbone, requiring immediate review of device code flow permissions and MFA policies.

📖 Read full article

The Record (Recorded Future) · Jul 09 · Relevance: █████████░ 9/10

Why it matters to CISOs: EU legal action against Ireland, Spain, France, and the Netherlands for NIS2 non-transposition signals escalating enforcement pressure; CISOs in or operating within those jurisdictions face compounding regulatory uncertainty and must track compliance obligations that may land unevenly across markets.

📖 Read full article

CyberScoop · Jul 10 · Relevance: ████████░░ 8/10

Why it matters to CISOs: This case establishes a high-profile precedent for criminal liability arising from insider betrayal within the ransomware response supply chain, prompting CISOs to reassess vetting and oversight of third-party incident response and negotiation vendors who gain privileged access during crises.

📖 Read full article

Help Net Security · Jul 10 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: Microsoft is formally advising enterprises to compress their Windows patch deployment windows, citing AI-accelerated exploit development as shrinking the safe window between patch release and weaponization—a direct operational requirement for CISOs to bring to patch management governance conversations.

📖 Read full article

Alex: Welcome to Cleartext. It's Friday, July 10th, 2026. I'm Alex Chen.

Jordan: And I'm Jordan Reeves.

Alex: Jordan, you want to set the table for us?

Jordan: Yeah. So, the EU just took four of its own member states to court for failing to implement NIS2, the cybersecurity directive that was supposed to be law over twenty months ago. Ireland, Spain, France, the Netherlands. These aren't backwater jurisdictions. These are core EU economies. And the Commission isn't sending a polite letter anymore. They're filing in the European Court of Justice.

Alex: That's where we're starting today. We've also got the NSA bringing back the TAO name, which Jordan has feelings about. A genuinely disturbing new malware toolkit from Microsoft's threat intel team. A ransomware negotiator who went to prison for betraying his own clients. And a new wave of attacks that are specifically targeting passkey enrollment, which should worry anyone in the middle of a phishing-resistant MFA rollout. Let's get into it.

Jordan: Let's start with NIS2 because I think the CISO implications here are underappreciated. When four major member states are twenty months late transposing a directive, what you get is regulatory fragmentation. If you're a multinational operating across the EU, you don't have one cybersecurity compliance framework. You have a patchwork. Some countries have implemented, some haven't, and now there's active litigation creating even more uncertainty about timelines.

Alex: This is a board-level problem. I've been in rooms where the question is, "Are we NIS2 compliant?" And the honest answer for a lot of organizations operating in these four countries is, "We don't fully know what compliant means yet because the national transposition hasn't happened." That doesn't fly with a board. They want a yes or a no. So what do you do? You build to the directive's requirements as written and hope the national implementations don't diverge too far.

Jordan: Which is the right call, but it costs more. You're essentially over-engineering compliance in the absence of clarity. And now the Commission taking court action signals that enforcement pressure is only going up. This isn't going away quietly.

Alex: If you're a CISO in one of these jurisdictions, the action item is straightforward. Brief your legal team and your board that formal enforcement proceedings are underway. Document your compliance posture against the directive itself. And be prepared for an accelerated national implementation timeline, because court action tends to focus political attention.

Jordan: Alright, let's shift to something near and dear to my heart. The NSA has renamed its Office of Computer Network Operations back to Tailored Access Operations. TAO. For those who don't know the history, TAO was the name publicly exposed in the Snowden disclosures. It's the NSA's premier offensive hacking unit, operational since the early nineties.

Alex: And renaming it back is not nostalgia.

Jordan: No. It's a signal. You don't resurrect the most recognizable name in offensive cyber operations by accident. This is the agency telling adversaries, and frankly telling the domestic policy community, that the US is leaning into a more assertive offensive cyber posture. It's branding as strategy.

Alex: So what does this mean for CISOs?

Jordan: Two things. First, geopolitical threat modeling. When the US signals offensive escalation, adversaries respond. We should expect increased probing and retaliatory operations from the usual suspects: China, Russia, Iran. Not necessarily against the government, but against private sector targets that serve as proxies or pressure points. Second, if you're in defense industrial base, critical infrastructure, or technology sectors, your threat surface just got more interesting.

Alex: And that connects directly to our next story, which is a perfect case study in what overlapping nation-state operations actually look like on the ground. Researchers found that both Chinese and Indian state-linked threat actors independently compromised the same Pakistani police systems over a two-year period, February 2024 through April 2026. Same systems. Different campaigns. Neither apparently aware of the other.

Jordan: This is the reality of contested geopolitical terrain. When a target sits at the intersection of multiple nations' intelligence priorities, you don't get one adversary. You get several, and they stack up on the same infrastructure. For CISOs at multinationals with operations or supply chain exposure in South Asia, this is directly relevant. Your systems in those regions may already host more than one uninvited guest.

Alex: And the incident response implications are significant. When you discover a compromise, you can't assume you've found the only one. Attribution gets harder. Remediation gets more complex. You need to scope for multiple independent intrusions, not just one.

Jordan: Which is expensive and time-consuming. But it's the reality of operating in geopolitically contested environments.

Alex: Let's talk about GigaWiper, because this is a piece of malware that I think represents a meaningful escalation in destructive capability. Microsoft's threat intelligence team published analysis of a Windows backdoor that bundles three distinct destructive payloads into a single modular toolkit. Full disk wiper. Windows drive overwriter. And fake ransomware that encrypts files with a key it deliberately never saves.

Jordan: The modularity is what matters here. This isn't one tool that does one thing. It's an operator-selectable menu. The attacker gets in, assesses the situation, and picks which destruction method fits their objective. And that fake ransomware component is particularly nasty. It's designed to create false hope. The victim sees a ransom note, thinks there's a path to recovery, and wastes critical response hours pursuing a decryption key that doesn't exist.

Alex: That's time the attacker uses for lateral movement, additional exfiltration, or simply watching the chaos unfold. For CISOs at critical infrastructure organizations or anyone with geopolitical exposure, this needs to go into your worst-case tabletop scenarios. Are your response plans built for a scenario where what looks like ransomware is actually a wiper?

Jordan: And can your team distinguish between the two fast enough to make the right containment decisions? Because the playbooks are very different. If it's ransomware, you might negotiate. If it's a wiper masquerading as ransomware, every minute you spend negotiating is a minute you're not isolating.

Alex: Speaking of ransomware, let's hit the GuidePoint report quickly. Their latest findings show that despite the overall ecosystem growing, four dominant groups account for a disproportionate share of enterprise attacks. And the AI angle is more nuanced than the headlines suggest. AI is automating existing attacker behaviors, reconnaissance, lure creation, but it's not fundamentally changing the attack model.

Jordan: Which is actually useful information for CISOs. It means your existing defensive architecture is still relevant. You're not facing a paradigm shift. You're facing the same adversaries moving faster and at higher volume. And concentration matters. If four groups dominate, you can study their TTPs, map your defenses against them specifically, and brief your board with empirical data rather than vague AI fear.

Alex: Now, Microsoft picking up on that AI acceleration theme has rewritten its Windows patch deployment guidance. They're formally advising enterprises to compress deployment timelines because AI is shrinking the window between patch release and weaponized exploit.

Jordan: This is the operational consequence of what GuidePoint is describing. AI makes attackers faster at reverse-engineering patches. So the safe window between Patch Tuesday and active exploitation is narrowing. Microsoft is essentially telling you your current patch SLAs may be too slow.

Alex: For CISOs, this is a governance conversation. You need to revisit your patch management policies with your IT operations teams and formalize shorter deployment windows, at least for internet-facing and high-value assets. If your current SLA is fourteen days, that may need to come down to seven or less for critical patches. And yes, that's hard operationally. But Microsoft isn't making this recommendation casually.

Jordan: Alright, let's talk about what I think is the most operationally urgent cluster of stories this week. Two related campaigns targeting Microsoft 365 identity infrastructure. First, a threat actor tracked as O-UNC-066 is using vishing to trick users into enrolling attacker-controlled passkeys into Microsoft Entra. Second, a new group called Helix is combining vishing, device code phishing, and MFA abuse to exfiltrate data from SharePoint environments.

Alex: This is a direct attack on the thing we've been telling people to deploy. Passkeys are supposed to be the answer to phishing. They are phishing-resistant by design. But what these attackers have figured out is that the enrollment process itself is vulnerable. If you can social engineer someone into registering your passkey instead of their own, you've bypassed the protection entirely.

Jordan: And they're doing it at scale with a panel-controlled phishing kit. This isn't bespoke. It's tooled. Multiple sectors are being hit. The Helix group adds another layer by going after device code flows, which many organizations haven't locked down because they don't think of them as an attack surface.

Alex: The action items here are concrete. One, review and restrict who can enroll passkeys in Entra, and add out-of-band verification for new enrollments. Two, audit device code flow permissions and disable them where they're not operationally necessary. Three, update your user awareness training to specifically cover vishing scenarios targeting passkey enrollment. This is not generic phishing awareness. This is a specific, novel attack vector.

Jordan: And if you're in the middle of a passkey rollout, don't stop. But treat enrollment security as a first-class design requirement, not an afterthought.

Alex: Last story, and it's a striking one. Angelo Martino, a former ransomware negotiator at DigitalMint, was sentenced to seventy months in federal prison for feeding confidential client information to BlackCat ransomware affiliates. His betrayal enabled seventy-five million dollars in extortion across five US organizations. He was supposed to be helping victims. Instead, he was arming the attackers.

Jordan: This is the nightmare scenario for the incident response supply chain. During a ransomware event, you're at your most vulnerable. You're bringing in outside help, giving them privileged access to your most sensitive data, your financials, your negotiation strategy, your recovery capabilities. And this guy used all of that to help the other side.

Alex: The precedent matters. Seventy months is serious prison time. It signals that the justice system treats this kind of insider betrayal in the cyber response chain as a serious crime. But for CISOs, the lesson is about vendor risk management during crises. How well do you vet your incident response partners? Do you have contractual controls and monitoring in place for third parties who gain privileged access during an incident?

Jordan: Most organizations don't. In the heat of a crisis, you're not running background checks. You're trusting the firm's reputation. This case says that's not enough.

Alex: Alright, let's wrap with what we're watching. Jordan, what's the thread you're pulling on this week?

Jordan: Identity is the battlefield. Between the passkey enrollment attacks, Helix targeting SharePoint through MFA abuse, and the broader trend of social engineering bypassing technical controls, the message is clear. The perimeter has fully collapsed into identity. And the attackers are adapting faster than most enterprises are hardening their identity infrastructure.

Alex: I agree. And I'd add the regulatory dimension. Between NIS2 enforcement, Microsoft rewriting patch guidance, and a ransomware negotiator going to prison, the governance environment is tightening from every direction. Boards are going to be asking harder questions about compliance timelines, vendor oversight, and operational response speed. CISOs need to get ahead of those conversations, not react to them.

Jordan: And the TAO rebranding tells me the geopolitical temperature is going up, not down. Plan accordingly.

Alex: That's our show for Friday, July 10th. Show notes and links to every story we covered are at cleartext.fm. Have a good weekend. Stay sharp.

Jordan: See you Monday.

Cleartext is an automated daily podcast for CISOs and security leaders. Generated 2026-07-10.

Sources are pulled from: CyberScoop, The Record, SecurityWeek, Krebs on Security, Dark Reading, Cybersecurity Dive, BleepingComputer, Wired, Ars Technica, TechCrunch, Help Net Security, VentureBeat, Risky Business News, The Hacker News, CISA, and BankInfoSecurity.

Daily cybersecurity briefing for CISOs and security leaders.

🎧 Listen to this episode

Today's episode covers 9 stories across 4 topic areas, including: China-Linked APT Expands Proxy Network With New Malware; Accenture faces massive data breach that could put clients at risk; Lone Attacker Uses AI to Breach AWS Cloud Environment in 72 Hours.

Infosecurity Magazine · Jul 08 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: China-linked UAT-7810 is actively scaling its operational relay box (ORB) proxy network with new malware, making attribution and traffic-based detection harder — CISOs should review network egress monitoring capabilities and ensure threat intel feeds include ORB infrastructure indicators.

📖 Read full article

Cybersecurity Dive · Jul 08 · Relevance: █████████░ 9/10

Why it matters to CISOs: Accenture's role as a top-tier systems integrator and managed services provider means stolen source code and encryption keys could expose clients across industries to downstream supply chain risk — CISOs with Accenture relationships need to assess exposure immediately.

📖 Read full article

Dark Reading · Jul 08 · Relevance: ████████░░ 8/10

Why it matters to CISOs: A solo threat actor leveraging agentic AI compressed what previously required a team weeks of work into a 72-hour AWS compromise and extortion — a concrete proof point that AI is lowering the barrier to sophisticated cloud attacks that CISOs must factor into risk models.

📖 Read full article

BleepingComputer · Jul 08 · Relevance: ████████░░ 8/10

Why it matters to CISOs: The Pink extortion group's vishing campaign weaponizes the trust employees place in IT helpdesk calls to hijack M365 accounts via fake Entra passkey enrollment — CISOs rolling out passkeys as a phishing-resistant MFA upgrade must add out-of-band verification steps to counter social engineering of the enrollment process itself.

📖 Read full article

BleepingComputer · Jul 09 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: The breach of 6.9 million driver records from an insurance carrier is the largest known exposure of driver's license numbers in 2026 to date, raising third-party data aggregator risk considerations for CISOs whose employee or customer data may reside with insurance partners.

📖 Read full article

The Record (Recorded Future) · Jul 09 · Relevance: █████████░ 9/10

Why it matters to CISOs: The EU's decision to sue Ireland, Spain, France, and the Netherlands for failing to transpose NIS2 signals that enforcement is accelerating — CISOs at multinationals with EU operations must treat NIS2 compliance as urgent, not aspirational.

📖 Read full article

Risky Business News · Jul 09 · Relevance: ████████░░ 8/10

Why it matters to CISOs: A Supreme Court ruling threatening the EU-US Data Privacy Framework could again invalidate trans-Atlantic data transfer mechanisms, forcing CISOs at multinationals to revisit SCCs, data localization strategies, and legal bases for cross-border data flows.

📖 Read full article

The Record (Recorded Future) · Jul 08 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: A bipartisan, multi-state AG settlement against Block Inc. for misrepresenting Cash App's security protections as bank-equivalent reinforces that regulators will hold fintechs accountable for security marketing claims — a precedent with implications for how CISOs draft public-facing security assurances.

📖 Read full article

Dark Reading · Jul 09 · Relevance: ████████░░ 8/10

Why it matters to CISOs: GodDamn ransomware is actively exploiting a Microsoft-signed malicious kernel driver via BYOVD to kill endpoint security tools at scale — CISOs should verify their EDR vendor's kernel-level driver blocklist is current and assess exposure across Windows fleets.

📖 Read full article

Alex: Welcome to Cleartext for Thursday, July 9th, 2026. I'm Alex Chen.

Jordan: And I'm Jordan Reeves. So a solo attacker — one person — used AI to compromise an AWS environment and issue an extortion demand in 72 hours. Not a nation-state team. Not a ransomware crew with a dozen operators. One individual with agentic AI tooling. That's the story that should recalibrate how every CISO in this audience thinks about their threat model going into Q3.

Alex: We've got a packed show today. We're covering that AI-accelerated cloud breach, a potentially massive supply chain exposure from the Accenture breach, the EU taking its own member states to court over NIS2, a Supreme Court decision that could blow up transatlantic data transfers again, a clever vishing campaign weaponizing passkey enrollment, a ransomware crew using Microsoft-signed drivers to kill your EDR, and Chinese APT infrastructure scaling up. Let's get into it.

Jordan: Let's start with the Accenture breach because the blast radius on this one could be enormous. A threat actor is claiming they've stolen source code, encryption keys, and other sensitive data from Accenture. When we talk about supply chain risk, this is the scenario that keeps people up at night. Accenture isn't just a consultancy — they're embedded in the infrastructure of Fortune 500 companies across every sector. They manage environments, they hold keys, they write code that runs inside your perimeter.

Alex: And the timing matters. This was reported yesterday, July 8th. The full scope is still being assessed. But if you're a CISO and Accenture touches your environment in any meaningful way — and for a lot of our listeners, they do — you can't wait for Accenture's incident response timeline. You need to be assessing your own exposure right now. What access do they have? What credentials are shared? What code did they deliver? This is the third-party risk management conversation that boards have been hearing about in the abstract for years, and here it is in the concrete.

Jordan: The encryption keys piece is particularly concerning. If those keys are tied to production environments at client organizations, the exposure isn't hypothetical. It's active. And the challenge is, Accenture's client list is essentially a who's who of global enterprise. So even if your organization isn't directly a client, your partners and suppliers may be.

Alex: Right. If you're a CISO listening to this, two immediate actions: pull your vendor risk file on Accenture and escalate it, and make sure your SOC is monitoring for any anomalous activity in environments where Accenture has or had access. Don't wait for the notification letter.

Jordan: Now let's talk about the story I opened with. Sygnia documented this incident — a lone attacker using agentic AI workflows to chain together cloud misconfigurations and stolen credentials in an AWS environment. The entire attack cycle, from initial access to extortion demand, took 72 hours. To put that in context, comparable cloud compromises historically required a small team and took weeks.

Alex: This is the proof point a lot of us have been anticipating. We've been talking about AI-accelerated attacks in theoretical terms for two years. Now we have a documented case where AI compressed the attacker's timeline by an order of magnitude. And it wasn't a sophisticated nation-state actor — it was a single individual. That's the part that should change your risk calculus.

Jordan: What it really does is collapse the assumption that complexity equals safety. If your AWS environment has misconfigurations — and let's be honest, most do — the window between those misconfigurations being discoverable and being exploited just got dramatically shorter. Your cloud security posture management tools need to be operating in near real-time, not weekly scan cadence.

Alex: And it raises a resource asymmetry question for defenders. If one person with AI tooling can do what a team of five used to do, then our defensive automation needs to keep pace. This isn't a scare story. It's a planning input for your 2027 budget conversations.

Jordan: Let's pivot to the vishing campaign because it's clever and it's hitting right now. The Pink extortion crew is calling employees, impersonating IT helpdesk, and walking them through enrolling attacker-controlled passkeys into Microsoft Entra ID. No malware required. The victim thinks they're being a good employee following IT instructions, and they're handing over their M365 account.

Alex: This is deeply ironic because passkeys are supposed to be the phishing-resistant upgrade. And they are — against traditional phishing. But the enrollment process itself is the vulnerability here. If you can social engineer someone into registering your passkey on their account, you've bypassed the entire security model. This should be a wake-up call for any CISO in the middle of a passkey rollout.

Jordan: The fix isn't to stop rolling out passkeys. It's to add out-of-band verification to the enrollment process. A callback on a verified number. A ticket confirmation through a separate channel. Something that breaks the single-channel social engineering vector. If your enrollment process is "someone calls you and tells you to do a thing," you're exposed.

Alex: Agreed. And train your helpdesk staff that they should never be initiating unsolicited passkey enrollment calls. Make it policy, make it auditable.

Jordan: Now, governance. And today we've got two big ones. First, the EU is taking Ireland, Spain, France, and the Netherlands to court for failing to transpose NIS2 into national law. These are major economies, and they're more than 20 months late.

Alex: This is significant. The European Commission doesn't take member states to court casually. This is an escalation that signals NIS2 enforcement is no longer aspirational — it's becoming adversarial. For CISOs at multinationals with EU operations, the message is clear: even if the country you operate in hasn't formally adopted NIS2 into local law, the directive's requirements are the standard the Commission expects. You need to be building to NIS2 requirements now, not waiting for your local regulator to catch up.

Jordan: And the fact that it's Ireland and the Netherlands — two of the biggest hosting and data center jurisdictions in Europe — makes this particularly relevant for cloud-first organizations. Those are the countries where a huge amount of EU data processing happens.

Alex: The second governance story is potentially even bigger in its long-term impact. A new Supreme Court decision is putting the EU-US Data Privacy Framework at legal risk. This is the successor to Privacy Shield, which was the successor to Safe Harbor. If this framework falls, we're looking at Schrems III.

Jordan: For those keeping score at home, this would be the third time the legal basis for transatlantic data transfers gets invalidated. The Supreme Court decision threatens the adequacy determination by weakening the judicial review protections that the EU required. Section 702 collection from Europe is at the center of it — again.

Alex: If you're a CISO at a multinational, this needs to be on your legal team's radar yesterday. You should already have Standard Contractual Clauses in place as a backup, and you should be evaluating data localization options for your most sensitive EU data. We've been through this cycle twice before. The organizations that moved early came out ahead.

Jordan: And the intelligence community angle here is real. If this agreement collapses, Section 702 collection from European targets gets severely curtailed. That has downstream effects on the threat intelligence that feeds into cybersecurity defense. It's a lose-lose.

Alex: Let's touch on the Block settlement. Cash App's parent company is paying $45 million to settle multi-state AG allegations that they misrepresented Cash App's security protections as being equivalent to a bank's. This was bipartisan — attorneys general from both parties.

Jordan: The precedent here is about security marketing claims. If your public-facing materials say "bank-grade security" or "enterprise-grade protection" and your actual controls don't support that, you're exposed to regulatory action. CISOs should be reviewing any public security assurances their marketing teams have put out.

Alex: It's a good reminder that your security posture and your security messaging need to be in alignment. And that's a CISO responsibility, not just a legal or marketing one.

Jordan: Moving to vulnerabilities and active threats. GodDamn ransomware — apparently a rebrand of the Beast family, first spotted in the wild May 21st — is using a Bring Your Own Vulnerable Driver technique with a twist. The PoisonX kernel driver they're using is actually signed by Microsoft. So it's a legitimate signed driver being used to kill endpoint security software before encryption.

Alex: This is a known technique category, but the Microsoft-signed driver detail is the concern. Your EDR blocklists need to include this specific driver. If your vendor hasn't updated their kernel driver blocklist to account for PoisonX, push them on it today. This is actively hitting US companies right now.

Jordan: And more broadly, BYOVD continues to be a gap in a lot of organizations' defensive posture. Windows Defender Application Control driver blocklists exist. Microsoft's vulnerable driver blocklist exists. But they're not always enabled or current. It's worth a quick audit.

Alex: Last story. Cisco Talos has identified China-linked APT UAT-7810 expanding its Operational Relay Box proxy network with new malware. ORB networks are the infrastructure layer Chinese APTs use to obfuscate their attack origins.

Jordan: This is an infrastructure story, not an attack story, and that's what makes it important. When a Chinese APT invests in scaling its proxy infrastructure, it means they're preparing for increased operational tempo. They're building capacity. Your threat intel feeds need to include ORB network indicators, and your network egress monitoring should be tuned to detect traffic patterns consistent with proxy relay communications.

Alex: It's the kind of story that doesn't have an immediate action item beyond "stay vigilant," but it's an important signal about the threat landscape trajectory.

Jordan: So stepping back and looking at the week, Alex, I see a convergence. The Accenture breach is supply chain risk materialized. The AI-enabled cloud attack is the attacker efficiency story we've been warning about. The passkey vishing campaign shows that even our best defensive technologies have enrollment-process vulnerabilities. And the governance stories — NIS2, data transfers, the Block settlement — all point to regulators tightening the screws from every direction.

Alex: The theme I'd pull out is this: the gap between where CISOs need to be and where many organizations actually are is widening. Attackers are moving faster thanks to AI. Regulators are moving faster thanks to political pressure. And the supply chain attack surface is expanding, not contracting. If your security program is running on 2024 assumptions, you're already behind.

Jordan: And I'd add — watch the EU-US data transfer situation closely over the next 30 days. If that framework wobbles, it will consume enormous amounts of legal and compliance bandwidth at exactly the moment when operational security needs the most attention. Prioritize accordingly.

Alex: That's our show for Thursday, July 9th. Show notes and links to every story we covered today are at cleartext.fm. I'm Alex Chen.

Jordan: I'm Jordan Reeves. We'll see you tomorrow.

Cleartext is an automated daily podcast for CISOs and security leaders. Generated 2026-07-09.

Sources are pulled from: CyberScoop, The Record, SecurityWeek, Krebs on Security, Dark Reading, Cybersecurity Dive, BleepingComputer, Wired, Ars Technica, TechCrunch, Help Net Security, VentureBeat, Risky Business News, The Hacker News, CISA, and BankInfoSecurity.