Cleartext

Daily cybersecurity briefing for CISOs and security leaders.

🎧 Listen to this episode

Today's episode covers 17 stories across 5 topic areas, including: Iranian hackers launching disruptive attacks at U.S. energy, water targets, feds warn; Feds quash widespread Russia-backed espionage network spanning 18,000 devices; Do Ceasefires Slow Cyberattacks? History Suggests Not.

CyberScoop · Apr 07 · Relevance: █████████░ 9/10

Why it matters to CISOs: Joint FBI/NSA/CISA advisory makes this an urgent action item for any organization with internet-exposed OT assets. The escalation tied to the U.S.-Israel-Iran conflict means critical infrastructure operators must treat this as an active, ongoing threat.

📖 Read full article

CyberScoop · Apr 07 · Relevance: █████████░ 9/10

Why it matters to CISOs: APT28's technique of modifying DNS settings on end-of-life SOHO routers to steal Microsoft auth tokens without deploying malware is a wake-up call about the risk of unmanaged network edge devices. CISOs must inventory and decommission EOL routers.

📖 Read full article

Dark Reading · Apr 09 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: Even if kinetic hostilities pause, Iranian cyber operations historically continue or even intensify. CISOs at critical infrastructure organizations should maintain heightened alert postures regardless of diplomatic signals.

📖 Read full article

CyberScoop · Apr 07 · Relevance: ██████████ 10/10

Why it matters to CISOs: Anthropic's Claude Mythos Preview represents a paradigm shift: AI that can autonomously discover and chain zero-day exploits at scale. CISOs must prepare for a world where vulnerability discovery vastly outpaces remediation capacity.

📖 Read full article

VentureBeat Security · Apr 09 · Relevance: █████████░ 9/10

Why it matters to CISOs: The quantitative benchmarks here are staggering and demand immediate strategic reassessment of patch management programs. The 'assume you are unpatched' mindset requires investment in behavioral detection, virtual patching, and breach containment.

📖 Read full article

CyberScoop · Apr 07 · Relevance: ████████░░ 8/10

Why it matters to CISOs: The FBI IC3 annual report showing a 26% jump to $20.9B in losses provides critical board-level data for justifying security budgets. The contrast with proposed CISA cuts creates an uncomfortable narrative about federal priorities.

📖 Read full article

VentureBeat Security · Apr 10 · Relevance: ████████░░ 8/10

Why it matters to CISOs: Four major RSAC keynotes independently converged on the same conclusion: zero trust must extend to AI agents. CISOs deploying agentic AI need credential isolation architectures now, before AI agents become the next major attack surface.

📖 Read full article

Cybersecurity Dive · Apr 10 · Relevance: ████████░░ 8/10

Why it matters to CISOs: A major medtech company disclosing material earnings impact from an Iran-linked wiper attack demonstrates how geopolitical cyber operations translate directly to corporate financial risk. Boards should note the materiality threshold being crossed.

📖 Read full article

Dark Reading · Apr 10 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: The Hims breach exposing deeply personal health data (weight loss, hair loss, ED treatments) illustrates the compounding reputational and extortion risk when telehealth PHI is compromised. Data classification and protection for sensitive health categories deserves renewed attention.

📖 Read full article

The Hacker News · Apr 07 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: A China-linked group deploying ransomware at 'high velocity' using both zero-day and n-day exploits blurs the line between nation-state espionage and financially motivated crime. This dual-purpose threat model complicates attribution and defense prioritization.

📖 Read full article

BleepingComputer · Apr 09 · Relevance: ██████░░░░ 6/10

Why it matters to CISOs: A ransomware attack on a healthcare IT vendor forcing offline services for patients and providers underscores third-party risk in healthcare. CISOs should evaluate resilience requirements for critical software vendors.

📖 Read full article

Cybersecurity Dive · Apr 07 · Relevance: █████████░ 9/10

Why it matters to CISOs: A $700M CISA budget cut and nearly 900 position reductions would eliminate free vulnerability scanning services and field support that many organizations rely on. CISOs, especially at smaller organizations, should plan for reduced federal cyber support.

📖 Read full article

Dark Reading · Apr 08 · Relevance: ████████░░ 8/10

Why it matters to CISOs: HackerOne pausing bounties signals a fundamental shift: when AI discovers bugs faster than humans can fix them, the entire vulnerability management ecosystem must be rethought. CISOs need to budget for remediation capacity, not just discovery.

📖 Read full article

Help Net Security · Apr 10 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: Google's DBSC in Chrome 146 directly addresses the infostealer-to-session-hijack pipeline that has driven many recent breaches. CISOs should evaluate enterprise Chrome rollout timelines and consider this a meaningful reduction in session theft risk.

📖 Read full article

BankInfoSecurity · Apr 11 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: Academic evidence that banks charge up to 10 basis points more for loans to poorly secured companies provides concrete financial language for board conversations. Security posture is now being priced into cost of capital.

📖 Read full article

The Hacker News · Apr 09 · Relevance: ████████░░ 8/10

Why it matters to CISOs: A sophisticated Adobe Reader zero-day exploited in the wild since December 2025 via weaponized PDFs is a high-priority patching item. PDFs remain ubiquitous in enterprise workflows, making this a broad-surface attack vector.

📖 Read full article

Dark Reading · Apr 06 · Relevance: ████████░░ 8/10

Why it matters to CISOs: Yet another Fortinet zero-day (CVE-2026-35616) being actively exploited continues a troubling pattern for organizations relying on Fortinet perimeter products. Emergency patching should be immediate; consider compensating controls for the ongoing Fortinet vulnerability trend.

📖 Read full article

Jordan: This week, the attack surface got smarter before the defense did. And for CISOs running critical infrastructure, that's not a philosophical observation — it's an operational emergency.

Alex: Welcome to Cleartext's Week in Review. I'm Alex Chen. If you were heads-down this week and missed the daily show, here's what mattered and what it means going into the week ahead. We had four big themes converge simultaneously — and that convergence is the story. Iranian and Russian state actors escalated against U.S. infrastructure in ways that are now showing up in corporate earnings calls. AI fundamentally broke the vulnerability management model that your entire security program is probably built on. The federal safety net is being dismantled at exactly the wrong moment. And the financial system just told your CFO that bad cybersecurity has a price tag. Let's get into it.

Jordan: Start with the geopolitical piece, because this is the most urgent. The FBI, NSA, and CISA issued a joint advisory Tuesday warning of escalated Iranian cyberattacks against U.S. energy and water infrastructure. Not hypothetical. Active, ongoing attacks in the last month, directly tied to the U.S.-Israel strikes on Iran. They identified roughly 3,900 internet-exposed Rockwell Automation PLCs sitting on U.S. networks right now. If you are responsible for any OT environment, that number should make you uncomfortable.

Alex: And then Stryker filed the earnings warning that made this concrete for every board in America. A major medtech company, hit by an Iran-linked wiper attack in March, disclosing material impact to earnings. This is what geopolitical cyber escalation looks like when it lands on a publicly traded company. It's not hypothetical risk on a risk register anymore — it's a line item on a 10-Q. Boards that were still treating nation-state cyber operations as someone else's problem need to update that mental model immediately.

Jordan: A word on the ceasefire question, because I know people are watching the diplomacy. Dark Reading ran analysis this week on whether ceasefires slow cyberattacks, and the historical answer is basically no. Iranian cyber operations are conducted by actors who may not consider themselves party to whatever diplomatic arrangement gets announced. If anything, they can intensify during negotiations as leverage. Do not let any political headline lower your operational tempo on this.

Alex: Separate from Iran, the Russia story this week was technically remarkable. Operation Masquerade — the FBI disclosed they dismantled an APT28 espionage network spanning 18,000 SOHO routers across 120 countries. The technique here is what should get your attention. Forest Blizzard wasn't deploying malware in the traditional sense. They were modifying DNS settings on end-of-life routers to intercept and steal Microsoft Office authentication tokens in transit. No malware to detect. No signature to catch. Just silent traffic manipulation on devices nobody was watching.

Jordan: This is the edge device problem in its purest form. Those 18,000 routers were largely end-of-life hardware — small office, home office gear that's sitting in branch offices, in employee home networks, in third-party environments — and they became a global intelligence collection platform. The inventory and decommission conversation for EOL network devices is not a new one, but APT28 just put a very concrete case study behind it.

Alex: Now let's talk about what I think is the most strategically significant story of the week, and honestly maybe the most significant story we've covered this year. Project Glasswing. Anthropic launched an initiative with 45-plus organizations — Apple, Google, AWS, CrowdStrike, Cisco — built around a model called Claude Mythos Preview. And the benchmark numbers are not incremental improvements. They're a category break. On SWE-bench Pro, Mythos scores 77.8 percent versus 53.4 for the previous best model. On exploit writing for Firefox, 181 successes versus 2 for the prior generation. That's a 90x improvement. And then there's the OpenBSD story.

Jordan: The OpenBSD story is the one I keep coming back to. There was a bug in OpenBSD's TCP stack. It had survived 27 years of human code review. It survived fuzzers. It sat inside one of the most deliberately hardened operating systems ever built. Two packets could crash any server running it. Mythos found it. The full discovery campaign cost about $20,000. The specific model run that surfaced the flaw cost under $50 in compute. That's the number that reframes everything.

Alex: Here's the strategic implication for CISOs. Your patch management program, your vulnerability management program, your entire remediation cadence — it was built for a world where discovery was the bottleneck. Humans finding bugs slowly, vendors patching eventually, you prioritizing the queue. That model is broken. Discovery is now cheap, fast, and AI-automated. The bottleneck is remediation. And nothing in most security programs has been rebuilt around that reality yet.

Jordan: HackerOne made that explicit this week. They actually paused bug bounties. The reason they gave was a remediation bottleneck caused by AI-automated discovery. They said it directly: bounty programs fund discovery, not fixes. And when discovery is no longer the constraint, you've got a structural gap. Organizations are now surfacing more validated vulnerabilities than their engineering teams can absorb. That's not a patch management problem. That's a resource allocation problem, and it belongs in the budget conversation.

Alex: The Adobe Reader zero-day that's been actively exploited since at least December — and the FortiClient authentication bypass that Fortinet issued an emergency patch for this week — those fit the same pattern. High-sophistication exploitation of ubiquitous software and perimeter products, at a pace that outstrips enterprise response cycles. The Fortinet vulnerability in particular continues a pattern that should make any CISO with significant Fortinet exposure ask hard questions about compensating controls, not just patch timing.

Jordan: Storm-1175 is worth a mention here too. China-linked group, deploying Medusa ransomware using zero-days and n-day exploits at what Microsoft is calling "high-velocity." The interesting thing about Storm-1175 is that it blurs the line between nation-state espionage and ransomware operations. You can't cleanly separate your APT playbook from your ransomware playbook when the same actor is doing both. That complicates how you triage and respond.

Alex: Let me turn to the governance picture, because the federal landscape shifted in a significant way this week. The Trump administration's FY2027 budget proposal would cut CISA by approximately $700 million and eliminate nearly 900 positions. Specifically on the chopping block: vulnerability scanning services and field support. For large enterprises with mature security programs, this is a data point. For mid-size organizations, regional operators, municipal utilities — organizations that were relying on CISA's free scanning and advisory services — this is a planning crisis. The budget hasn't passed, but you should not build your 2027 security roadmap assuming those services exist.

Jordan: And that backdrop makes the cybercrime loss numbers from the FBI IC3 report land harder than they otherwise would. Twenty-point-nine billion dollars in reported losses in 2025. Up 26 percent year over year. Crypto scams alone over seven billion. And the FBI is explicit that actual losses are significantly higher because a large portion of victims never report. So you've got documented losses accelerating, federal support capacity contracting, and threat actors getting AI-powered offensive capability. That's a risk environment that requires some honest conversations with boards and CFOs.

Alex: The CFO conversation got a new data point this week. Studies published in BankInfoSecurity show that U.S. banks are charging up to ten extra basis points on loans to companies with poor cybersecurity posture. For a company with meaningful debt load, that's potentially hundreds of thousands of dollars in additional financing costs annually. Security is now being priced into cost of capital. That is the language CFOs understand, and it is a legitimate and data-backed argument for security investment that doesn't rely on hypothetical breach scenarios.

Jordan: Two other things worth flagging quickly. The Hims breach — telehealth data exposing treatments for weight loss, hair loss, erectile dysfunction — this is the compounding risk problem with healthcare PHI. It's not just HIPAA liability. It's targeted extortion potential using data that is deeply personal and embarrassing. If you're in telehealth or adjacent to it, your data classification and handling for sensitive health categories needs a hard look.

Alex: And on the positive side, Chrome 146 shipped Device Bound Session Credentials — DBSC — generally available on Windows. This directly addresses the infostealer pipeline that has driven a remarkable number of recent breaches. Infostealers exfiltrate session cookies, those cookies get sold and replayed, accounts get compromised without any credential involved. DBSC binds session cookies to TPM-backed keys on the specific device. You cannot replay them from a different machine. If you're managing an enterprise Chrome rollout, this deserves attention on your deployment timeline.

Jordan: One more: AI agents and zero trust. RSAC 2026 had four separate major keynotes — Microsoft, Cisco, CrowdStrike, Splunk — all independently land on the same message: zero trust must extend to AI agents. Cisco's framing was memorable. They described AI agents as "supremely intelligent teenagers with no fear of consequence." If you are deploying agentic AI in your environment, and most enterprises are starting to, credential isolation architecture is not optional. AI agents that co-locate credentials with untrusted code are the next major attack surface. The architectures to address this exist now. Use them before you have an incident that explains why.

Alex: So what was the defining character of this week? Here's my read. This was the week where several trends that security leaders have been tracking as "emerging" became "arrived." AI-powered vulnerability discovery went from theoretical capability to documented reality with price tags attached. Iranian cyber operations went from geopolitical background noise to corporate earnings disclosures. Federal cyber support went from politically uncertain to budgetarily specific. These are no longer things to monitor. They require decisions.

Jordan: My version of that is simpler. The cost of inaction just went up across the board this week. The cost of not patching your OT perimeter, the cost of not decommissioning your EOL routers, the cost of not building remediation capacity into your security program, the cost of not extending zero trust to AI agents — every one of those went up measurably this week. The threat environment moved. The question for every CISO going into Monday is whether your program moved with it.

Alex: Going into next week: if you're a critical infrastructure operator, the Iranian advisory is an action item, not a reading item. If you have Fortinet perimeter products, emergency patch timelines apply. And if you have a board meeting in the next thirty days, the IC3 loss numbers and the cost-of-capital data are the new centerpiece of your risk narrative. Get ahead of those conversations.

Jordan: And get your OT asset inventory in front of someone who can tell you how much of it is internet-facing before someone else does it for you.

Alex: That's the week. Daily show returns Monday. We'll be watching the geopolitical situation closely as the week opens, and we have more coming on the AI vulnerability management story — it's not going away. Thanks for listening to Cleartext. Stay sharp out there.

Cleartext is an automated daily podcast for CISOs and security leaders. Generated 2026-04-11.

Sources are pulled from: CyberScoop, The Record, SecurityWeek, Krebs on Security, Dark Reading, Cybersecurity Dive, BleepingComputer, Wired, Ars Technica, TechCrunch, Help Net Security, VentureBeat, Risky Business News, The Hacker News, CISA, and BankInfoSecurity.

Daily cybersecurity briefing for CISOs and security leaders.

🎧 Listen to this episode

Today's episode covers 8 stories across 5 topic areas, including: Iranian attacks on US critical infrastructure puts 3,900 devices in crosshairs; Inside the FBI’s router takedown that cut off APT28’s ‘tremendous access’; Mythos autonomously exploited vulnerabilities that survived 27 years of human review. Security teams need a new detection playbook.

CyberScoop · Apr 09 · Relevance: █████████░ 9/10

Why it matters to CISOs: Active Iranian state-sponsored targeting of U.S. energy, water, and government OT infrastructure demands immediate exposure assessment and hardening of internet-facing industrial control systems.

📖 Read full article

CyberScoop · Apr 09 · Relevance: ████████░░ 8/10

Why it matters to CISOs: FBI's disruption of Russia's APT28 router-based infrastructure underscores how compromised edge networking devices serve as persistent footholds — CISOs should audit router firmware and access controls enterprise-wide.

📖 Read full article

VentureBeat Security · Apr 09 · Relevance: █████████░ 9/10

Why it matters to CISOs: Anthropic's Claude Mythos autonomously finding and exploiting a 27-year-old vulnerability in hardened code at under $50 per run fundamentally changes the threat model — CISOs must prepare for AI-accelerated exploit discovery becoming routine.

📖 Read full article

Help Net Security · Apr 10 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: Google's DBSC in Chrome 146 binds session cookies to specific devices, directly countering the infostealer-to-session-hijack pipeline that has driven many recent enterprise breaches — CISOs should evaluate deployment across managed fleets.

📖 Read full article

The Record (Recorded Future) · Apr 09 · Relevance: ████████░░ 8/10

Why it matters to CISOs: Supply-chain ransomware hitting a healthcare EHR vendor disrupting hospitals across an entire country highlights the catastrophic third-party risk exposure in healthcare and critical infrastructure.

📖 Read full article

BleepingComputer · Apr 09 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: A new PhaaS platform specifically targeting C-suite credentials means executive account compromise risk is rising — CISOs should review phishing-resistant MFA and executive protection controls.

📖 Read full article

The Record (Recorded Future) · Apr 09 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: Treasury extending threat intelligence sharing to digital asset firms signals regulatory convergence between traditional finance and crypto — CISOs at financial institutions should understand the broadening of sector-level threat data sharing.

📖 Read full article

The Hacker News · Apr 09 · Relevance: ████████░░ 8/10

Why it matters to CISOs: An Adobe Reader zero-day actively exploited in the wild for over four months via crafted PDFs poses significant enterprise risk given PDF's ubiquity — immediate patching and email/endpoint controls for PDF handling are critical.

📖 Read full article

Jordan: A 27-year-old bug. Sitting inside one of the most hardened codebases on the planet. Missed by every auditor, every fuzzer, every security researcher who ever looked at it. An AI found it this week for under fifty dollars.

Alex: Welcome to Cleartext. It's Friday, April 10th, 2026. I'm Alex Chen.

Jordan: And I'm Jordan Reeves.

Alex: Big week. We've got Iranian state actors targeting thousands of exposed OT devices across U.S. critical infrastructure. The FBI just detailed how they dismantled APT28's router botnet. Adobe's been sitting on a zero-day since December. A ransomware attack just paralyzed hospitals across an entire country through one software vendor. And yes — we're going to spend serious time on that AI vulnerability research story, because it changes your threat model in ways that can't be overstated. Let's get into it.

Jordan: Start with Iran, because this is operationally urgent. Censys researchers published findings this week identifying roughly 3,900 internet-exposed devices in the crosshairs of Iranian government-linked campaigns. We're talking programmable logic controllers, OT systems, industrial control infrastructure — energy, water, U.S. government facilities. This isn't opportunistic. This is deliberate pre-positioning.

Alex: The phrase "pre-positioning" is doing a lot of work there, and it should. This is the kind of activity that doesn't necessarily produce a headline today. It produces a headline when geopolitical conditions change and someone decides to pull a trigger. For CISOs in energy and utilities, this is the moment to run an aggressive exposure assessment on internet-facing OT. Not next quarter. This week.

Jordan: The question I'd be asking my team is: do we actually know what's exposed? Most OT environments have accumulation debt — devices that got internet-accessible years ago for legitimate operational reasons and never got walked back. If you don't have a current, accurate inventory with network exposure mapped, that's your first problem.

Alex: And if you're briefing your board on geopolitical risk, this is your data point. Iranian state actors, named targets, specific device categories. That's not abstract threat intelligence. That's a procurement conversation about OT segmentation and a liability conversation about what happens if one of those 3,900 devices belongs to you.

Jordan: Pivot to Russia, because the FBI gave us a rare detailed look this week at Operation Masquerade — their takedown of APT28's router-based botnet infrastructure. Brett Leatherman, the FBI's cyber chief, described the access these compromised routers provided as "tremendous." That word is doing work. What made this campaign distinctive is propagation — APT28 wasn't just using routers as proxies. They were using them as launch points to move deeper into networks.

Alex: This is the edge device problem in its sharpest form. Routers are trusted. They're rarely monitored the way endpoints are. Firmware update cadences are often terrible. And they sit at the boundary of everything. If I'm a CISO hearing this story, I'm immediately asking: what's our router firmware posture enterprise-wide, including branch offices and remote infrastructure? And when did we last audit access controls on those devices?

Jordan: The GRU doesn't get "tremendous access" from a zero-day. They get it from default credentials, unpatched firmware, and configurations that nobody has reviewed in three years. The FBI did us a favor here by being specific about the vector. Use it.

Alex: Now the story I think matters most for your long-term threat modeling. Anthropic's Mythos research. This week it became public that Claude-based AI autonomously found and developed a working exploit for a 27-year-old vulnerability in OpenBSD's TCP stack. Two packets. Any server running it crashes. This bug survived decades of human code review, professional audits, fuzzing campaigns — OpenBSD's entire reputation is built on being hardened. And an AI found it for under fifty dollars.

Jordan: The number that I keep coming back to is the Firefox comparison. Prior AI models produced two successful exploits in a controlled test. Mythos produced 181. That's not incremental improvement. That's a different category of capability. And the economics are the part that should keep you up at night. A $20,000 discovery campaign. Under $50 for the specific run that found the bug. That's accessible to nation-states, well-funded criminal organizations, and increasingly, everyone else.

Alex: The implication for CISOs is this: the assumption that "hardened, well-reviewed code is probably fine" no longer holds at the confidence level it did. The attack surface isn't just your unpatched systems. It's your patched systems with bugs that human review never found. Your vulnerability management program was built for a world where finding novel bugs was expensive and slow. That world ended this week.

Jordan: The playbook shift is real. More aggressive patching cadences on foundational infrastructure. Deeper investment in runtime protection and anomaly detection — because if exploits are being generated at scale, you need to catch them behaviorally when signatures lag. And honestly, start having the conversation with your board about AI-accelerated offensive capabilities as a standing agenda item, not a one-time briefing.

Alex: Speaking of things that have been exploited longer than they should have been — Adobe Reader. A zero-day, actively exploited in the wild via malicious PDFs since at least December 2025. The first sample hit VirusTotal in November. That's four-plus months of undetected exploitation. EXPMON describes it as highly sophisticated. The delivery artifact was named "Invoice540.pdf." Classics never die.

Jordan: PDF is the universal attack surface. It's in every enterprise. It crosses every security boundary because people send PDFs for everything. Patch Adobe Reader across your environment immediately if you haven't already. And revisit your email gateway and endpoint controls around PDF handling. Sandboxing, restrictions on PDF JavaScript — these are not new controls, but a four-month undetected zero-day is a reminder of why they matter.

Alex: ChipSoft in the Netherlands. A ransomware attack on a major Dutch healthcare EHR vendor forced the company to take down digital services used by hospitals and patients across the entire country. The Dutch national healthcare cybersecurity center issued an advisory. This is the supply-chain ransomware scenario that every healthcare CISO has modeled and hoped wouldn't happen. It happened.

Jordan: The thing about healthcare is that the third-party dependency isn't just operational — it's clinical. When the EHR goes down, patient care degrades. Decisions get made without full information. That's not an IT problem. That's a patient safety problem. And it's exactly the argument for getting your board to treat third-party risk in healthcare as a tier-one liability issue, not a vendor management checkbox.

Alex: If you haven't run a tabletop on your critical healthcare software vendors going dark, this is your forcing function. And make sure your contracts have cyber incident notification requirements with teeth.

Jordan: Two quick ones before we wrap. VENOM — a new phishing-as-a-service platform specifically designed to target C-suite Microsoft credentials. Previously undocumented. Multiple industries. The commercialization of executive-targeted phishing is accelerating. If your executives are not on phishing-resistant MFA — hardware keys, passkeys — this is the week to close that gap.

Alex: And Treasury announced this week that it's extending its cyber threat intelligence sharing program to eligible digital asset firms. Same intelligence that traditional financial institutions receive, at no cost. For CISOs at banks or financial services firms that are expanding into digital assets, this is worth your attention. The regulatory perimeter around crypto is converging with traditional finance, and the intelligence sharing infrastructure is following.

Jordan: Also — Chrome 146 shipped Device Bound Session Credentials on Windows. DBSC cryptographically binds session cookies to specific devices, which directly breaks the infostealer-to-account-takeover pipeline. Stolen cookie becomes worthless if the device it was stolen from isn't present. If you're managing Chrome across an enterprise fleet, evaluate deployment. macOS support is coming in the next release.

Alex: The theme this week, if you step back, is that the economics of attacking you are getting better for your adversaries faster than the economics of defending are getting better for you. AI-accelerated exploit discovery. Fifty-dollar bug finds. Phishing-as-a-service for C-suite targeting. Router botnets providing nation-state level persistence. The velocity is increasing.

Jordan: The response isn't panic. It's precision. Know what's exposed. Audit your edge. Get your executives on phishing-resistant auth. Treat your third-party dependencies as extensions of your own risk surface. And start building the case internally that AI in offensive security is not a future threat — it's a present one that requires budget and attention now.

Alex: That's Cleartext for Friday, April 10th. If this episode was useful, share it with someone who needs it. We'll be back Monday. Stay sharp.

Cleartext is an automated daily podcast for CISOs and security leaders. Generated 2026-04-10.

Sources are pulled from: CyberScoop, The Record, SecurityWeek, Krebs on Security, Dark Reading, Cybersecurity Dive, BleepingComputer, Wired, Ars Technica, TechCrunch, Help Net Security, VentureBeat, Risky Business News, The Hacker News, CISA, and BankInfoSecurity.

Daily cybersecurity briefing for CISOs and security leaders.

🎧 Listen to this episode

Today's episode covers 8 stories across 4 topic areas, including: Iran-linked hackers disrupt operations at US critical infrastructure sites; US operation evicts Russia from hacked SOHO routers used to breach critical infrastructure; APT28 Deploys PRISMEX Malware in Campaign Targeting Ukraine and NATO Allies.

Ars Technica Security · Apr 08 · Relevance: █████████░ 9/10

Why it matters to CISOs: Iranian threat actors causing actual operational disruption at US critical infrastructure sites represents an escalation from reconnaissance to impact—CISOs in energy, water, and industrial sectors must urgently review OT/ICS exposure and PLC hardening.

📖 Read full article

Cybersecurity Dive · Apr 08 · Relevance: █████████░ 9/10

Why it matters to CISOs: Russia's APT28 compromised thousands of end-of-life SOHO routers across 120 countries via DNS manipulation to spy on organizations—CISOs must audit their remote workforce router inventory and enforce replacement of EOL network equipment.

📖 Read full article

The Hacker News · Apr 08 · Relevance: ████████░░ 8/10

Why it matters to CISOs: A new APT28 malware suite using steganography, COM hijacking, and cloud C2 targeting NATO-aligned organizations means enterprises with government or defense ties should update threat models and detection rules immediately.

📖 Read full article

The Record (Recorded Future) · Apr 08 · Relevance: ████████░░ 8/10

Why it matters to CISOs: A 7.7 TB exfiltration of sensitive law enforcement data from a city attorney's office by the World Leaks extortion gang underscores risks of data sprawl across interconnected government systems—relevant for CISOs managing third-party data sharing with public entities.

📖 Read full article

The Record (Recorded Future) · Apr 08 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: A cyberattack severe enough to trigger National Guard deployment signals that critical local government services were completely incapacitated—a stark reminder for CISOs about incident response planning and the cascading effects of attacks on interconnected public/private systems.

📖 Read full article

BleepingComputer · Apr 08 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: Threat actors compromising BPO providers to pivot into high-value enterprise targets via Zendesk tickets highlights third-party/supply chain risk—CISOs should review access controls and data exposure through outsourced support operations.

📖 Read full article

Dark Reading · Apr 08 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: HackerOne pausing bug bounties because AI-driven discovery is overwhelming remediation capacity signals a fundamental shift in vulnerability management economics—CISOs relying on bounty programs need to rethink remediation resourcing and prioritization strategies.

📖 Read full article

The Hacker News · Apr 09 · Relevance: ████████░░ 8/10

Why it matters to CISOs: An Adobe Reader zero-day actively exploited for 4+ months via weaponized PDFs represents a major enterprise threat given the ubiquity of PDF workflows—CISOs should assess exposure, deploy compensating controls, and monitor for indicators of compromise immediately.

📖 Read full article

Jordan: Iranian hackers just moved from watching to breaking things. Operational disruption at US critical infrastructure sites. That's not espionage. That's a message.

Alex: Welcome to Cleartext. It's Thursday, April 9th, 2026. I'm Alex Chen.

Jordan: And I'm Jordan Reeves.

Alex: Today we have a loaded show. Iranian and Russian threat actors both making moves against critical infrastructure. A four-month-old Adobe zero-day that nobody caught until now. The bug bounty model showing signs of structural collapse. And two breach stories that should make every CISO rethink their data sprawl assumptions. Let's get into it.

Jordan: So let's start with Iran, because this is the one that should be keeping OT security teams up at night. CISA and the FBI issued a joint advisory yesterday following confirmed operational disruptions at US critical infrastructure sites linked to Iranian threat actors. And I want to be precise about the word "disruption" here. This is not exfiltration. This is not reconnaissance. They broke things. They targeted exposed programmable logic controllers — PLCs — and they caused actual operational impact.

Alex: The timing is not accidental. As US-Israel military coordination around Iran has intensified, we're seeing the cyber domain activated as a pressure valve. Iran has been running ICS-targeted operations for years, but what's changed is the willingness to cross the disruption threshold. That's a strategic decision, not a technical one.

Jordan: And the technical entry point is embarrassingly basic. Exposed PLCs. Internet-facing industrial controllers with default credentials or no authentication at all. If you are running OT environments and you have not done an exposure audit in the last ninety days, that audit is overdue. Shodan will tell you what Iran already knows about your network perimeter.

Alex: For CISOs in energy, water, and manufacturing — this is a board conversation, not just a security team conversation. If your OT systems are operationally connected to anything internet-adjacent, you need to be able to answer two questions in your next board meeting: what is our blast radius if a PLC is manipulated, and how fast can we detect and isolate it? If you can't answer both, that's your gap.

Jordan: Now let's stay in the geopolitical lane, because Russia had a busy week too. The FBI successfully disrupted an APT28 campaign that had compromised thousands of end-of-life SOHO routers across 120 countries. The technique here is worth understanding — this wasn't traditional malware infection in the way most people picture it. APT28 was manipulating DNS settings on these routers to silently redirect traffic and steal credentials. Clean, persistent, and almost invisible to the end user.

Alex: The word that jumps out to me is end-of-life. We talk about EOL software constantly, but EOL hardware is the blind spot. When someone's remote employee is sitting at home on a five-year-old router that hasn't seen a firmware update in two years, and that router is touching your corporate VPN — that is an attack surface your security team has essentially zero visibility into.

Jordan: And APT28 knows this. They've been running this playbook for a while. The FBI operation evicted them from these devices, but eviction is not remediation. Those routers are still end-of-life. They will be recompromised. The fix is replacement, not a one-time cleanup.

Alex: This connects directly to APT28's other headline this week. Trend Micro dropped research on a new malware suite called PRISMEX being deployed against Ukraine and NATO allies via spear-phishing. The technical sophistication here is significant — steganography to hide payloads, COM hijacking for persistence, and legitimate cloud services for command-and-control. That last piece is the hard part to defend against.

Jordan: When your C2 traffic looks like Microsoft OneDrive or Google Drive activity, traditional network detection falls apart. Your DLP sees cloud sync traffic. Your firewall sees allowed destinations. The signal is buried in noise you've already decided is legitimate. For any organization with defense, government, or NATO-adjacent contracts, update your detection rules now. PRISMEX indicators are public.

Alex: Let's move to the breach stories, because there are two this week that illustrate a theme I keep coming back to: data sprawl kills you on the timeline you didn't choose. In Los Angeles, the World Leaks extortion gang exfiltrated 7.7 terabytes of sensitive LAPD data — but the breach didn't come through LAPD systems. It came through the LA City Attorney's Office.

Jordan: This is the third-party data sharing problem at its most concrete. Law enforcement data, presumably sensitive case files, flowing into a city attorney's digital storage system, and that system had insufficient controls. The attack surface isn't just your environment. It's every environment where your data lives.

Alex: If you're a CISO managing any data sharing arrangements with public sector entities — municipalities, county systems, state agencies — this is your prompt to ask hard questions about their security posture. You probably don't have contractual leverage the way you would with a private vendor, but you have the ability to limit what data you share and how long it persists in their systems. That's your control.

Jordan: And then there's Winona County, Minnesota. Governor Walz deployed the National Guard after a cyberattack took down critical county systems. When a governor has to sign an executive order to respond to a cyberattack, that tells you the incident response capability at the local level was exhausted.

Alex: The relevance for enterprise CISOs is about cascade effects. Local government systems touch more things than people realize — permitting, utilities, emergency services, healthcare coordination. If your operations have any dependency on county or municipal systems, and many do, you need to think about what a prolonged outage of those systems means for your business continuity plan.

Jordan: Okay, let's talk about something that affects almost every enterprise on the planet. Adobe Reader. A zero-day vulnerability that has been actively exploited since at least December 2025 — possibly since November — and we're hearing about it in April 2026. Four months of exploitation window on a PDF reader that is installed on virtually every corporate endpoint.

Alex: The delivery mechanism is weaponized PDFs. Think about your email workflows for one second. Invoices. Legal documents. Vendor agreements. PDFs are trusted by default in most organizations because they have to be. That's what makes this particularly nasty.

Jordan: The exploit itself is described as highly sophisticated, which means this is not a commodity threat actor. Someone spent real resources developing this. Patch Adobe Reader immediately — Adobe has released a fix. But also check your EDR telemetry for anomalous activity originating from Acrobat processes going back to December. If you were hit, you may not know it yet.

Alex: Finally, the HackerOne story is one I think deserves more attention than it's getting. They've paused bug bounty programs because AI-automated vulnerability discovery has created a remediation bottleneck. Researchers and AI tools are finding bugs faster than engineering teams can fix them. And bounties fund discovery, not remediation.

Jordan: This is a structural problem, not a platform problem. The economics of bug bounties were built on the assumption that finding vulnerabilities was the hard part. That assumption is dead. AI killed it.

Alex: CISOs who rely heavily on bug bounty programs need to have an honest conversation with their engineering leadership about remediation capacity. If you're incentivizing the top of the funnel without investing in the bottom, you're building a backlog of known vulnerabilities that aren't being fixed. That is a liability posture problem, not just a security posture problem.

Jordan: So what's the theme this week? Because I think it's clear.

Alex: State actors are in an operational phase, not a reconnaissance phase. Iran is disrupting. Russia is harvesting. APT28 is deploying new tooling. And they're all targeting the same categories of weakness — exposed OT systems, unmanaged remote infrastructure, and trusted software delivery channels.

Jordan: The board question this quarter isn't "are we being targeted." It's "what happens when disruption hits us." Resilience planning, OT segmentation, EOL hardware replacement — these are budget conversations that need to happen now, not after an incident.

Alex: And on the AI vulnerability discovery point — the volume of known exploitable issues is about to grow dramatically. Your remediation capacity is the constraint. Start investing there.

Jordan: That's Cleartext for Thursday, April 9th. If this was useful, share it with a peer. We'll be back tomorrow.

Alex: Stay sharp.

Cleartext is an automated daily podcast for CISOs and security leaders. Generated 2026-04-09.

Sources are pulled from: CyberScoop, The Record, SecurityWeek, Krebs on Security, Dark Reading, Cybersecurity Dive, BleepingComputer, Wired, Ars Technica, TechCrunch, Help Net Security, VentureBeat, Risky Business News, The Hacker News, CISA, and BankInfoSecurity.

Daily cybersecurity briefing for CISOs and security leaders.

🎧 Listen to this episode

Today's episode covers 8 stories across 4 topic areas, including: US Critical Infrastructure Facing Iranian-Linked OT Threats; Feds quash widespread Russia-backed espionage network spanning 18,000 devices; Anthropic's Claude Mythos Finds Thousands of Zero-Day Flaws Across Major Systems.

BankInfoSecurity · Apr 08 · Relevance: █████████░ 9/10

Why it matters to CISOs: Joint FBI/NSA/CISA advisory on active Iranian exploitation of internet-facing PLCs and OT systems demands immediate review of ICS/SCADA exposure, especially for energy, water, and municipal networks.

📖 Read full article

CyberScoop · Apr 07 · Relevance: █████████░ 9/10

Why it matters to CISOs: APT28's mass hijacking of SOHO routers to steal Microsoft 365 authentication tokens without deploying malware represents a stealthy credential-theft vector that bypasses endpoint detection—CISOs should evaluate token security and conditional access policies.

📖 Read full article

The Hacker News · Apr 08 · Relevance: █████████░ 9/10

Why it matters to CISOs: Anthropic's Claude Mythos autonomously discovering and exploiting zero-days across major OS and browsers represents a paradigm shift—CISOs must plan for a world where AI dramatically compresses the vulnerability-to-exploit timeline for both attackers and defenders.

📖 Read full article

CyberScoop · Apr 07 · Relevance: ████████░░ 8/10

Why it matters to CISOs: The FBI's IC3 report showing a 26% YoY jump to $20.9B in losses provides essential board-level data for justifying security investment and quantifying the threat landscape to non-technical stakeholders.

📖 Read full article

Help Net Security · Apr 08 · Relevance: ████████░░ 8/10

Why it matters to CISOs: North Korean actors compromising npm packages downloaded 100M+ times weekly via social engineering of maintainers represents an existential software supply chain risk that demands enhanced dependency monitoring and developer security awareness.

📖 Read full article

BleepingComputer · Apr 07 · Relevance: ████████░░ 8/10

Why it matters to CISOs: This supply chain breach through a SaaS integration provider—with stolen authentication tokens enabling data theft at 12+ companies—highlights the critical need for third-party token management, SaaS security posture monitoring, and vendor access reviews.

📖 Read full article

BankInfoSecurity · Apr 08 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: A cyberattack forcing ambulance diversions and cancer treatment cancellations underscores the life-safety stakes of healthcare security and the need for robust incident response and business continuity planning.

📖 Read full article

Cybersecurity Dive · Apr 07 · Relevance: █████████░ 9/10

Why it matters to CISOs: A $700M CISA budget cut and elimination of ~900 positions could remove free vulnerability scanning and field support services that many enterprises and critical infrastructure operators depend on for baseline security hygiene.

📖 Read full article

Jordan: An AI model that autonomously discovers and exploits zero-day vulnerabilities across major operating systems and browsers. The company that built it says it's too dangerous to release publicly. And that's the good-guy version. Take a moment with that.

Alex: Welcome to Cleartext. It's Wednesday, April 8th, 2026. I'm Alex Chen.

Jordan: And I'm Jordan Reeves.

Alex: Today we've got a dense threat landscape to work through. Iranian actors actively hitting OT systems across U.S. critical infrastructure. A Russian GRU operation that stole Microsoft 365 tokens from 18,000 routers without touching a single endpoint. A supply chain attack through a SaaS integrator hitting a dozen Snowflake customers. A Massachusetts hospital diverting ambulances. And a proposed CISA budget cut that would gut the very services many of you rely on for baseline security hygiene. Plus, the FBI's 2025 cybercrime numbers are out, and they're not pretty. Let's get into it.

Jordan: Let's start with the joint advisory that dropped yesterday from CISA, FBI, NSA, and the Pentagon. Iranian-affiliated APT actors are actively exploiting internet-facing PLCs—specifically Rockwell Automation and Allen-Bradley hardware—across U.S. energy, water, and municipal networks. We're not talking about reconnaissance. These are confirmed operational disruptions. Diminished PLC functionality, manipulated display data, service interruptions.

Alex: The timing here matters as much as the targeting. U.S.-Iran geopolitical tensions are elevated, and this is the operational expression of that. For CISOs in energy, utilities, water, and municipal government, this is not a theoretical risk right now. This is the threat environment you're operating in today.

Jordan: The core problem is one we've talked about before and it never seems to get fixed: internet-facing OT. These PLCs were never designed to be exposed to the internet, and yet they are. Some because of deliberate remote access decisions, some because someone plugged something in without thinking, some because a vendor needed access and the firewall rule never got cleaned up. The attack surface is known. The problem is remediation velocity.

Alex: If you have OT in your environment—and that includes manufacturing CISOs, not just utilities—this advisory is your board-level briefing this week. Pull your ICS and SCADA exposure inventory. If you can't produce it in 24 hours, that's finding number one. Segment, monitor, and for anything internet-facing with no legitimate business justification, the answer is: take it offline.

Jordan: Pivot to Russia, because the Forest Blizzard operation is just as important and considerably more elegant from an attacker's standpoint. GRU-linked APT28 compromised over 18,000 routers across 120 countries and used them to intercept Microsoft 365 authentication tokens via DNS hijacking. No malware deployed on victim endpoints. No EDR alert. The credential theft happened upstream, in the network layer, on infrastructure you don't own.

Alex: This is the part that should keep endpoint-centric security programs up at night. If your detection strategy relies heavily on endpoint telemetry, you have a visibility gap that nation-state actors are actively exploiting. The FBI executed a court-authorized operation to sever U.S.-based routers from the botnet, which is good. But the broader technique is not going away.

Jordan: Your action items here are concrete. Review your conditional access policies for Microsoft 365. Token lifetime restrictions, device compliance requirements, continuous access evaluation—these are the controls that degrade the value of a stolen token. Also, this is another argument for network-level monitoring, not just endpoint. If your SOC isn't looking at DNS anomalies, you have a blind spot.

Alex: Now let's talk about the story that is genuinely paradigm-shifting, and I want to be precise about that word because I don't use it lightly. Anthropic has announced Claude Mythos, a model that can autonomously identify zero-day vulnerabilities and construct working exploits across major operating systems and browsers. They've restricted it to 45-plus organizations through a program called Project Glasswing—AWS, Apple, Broadcom, Cisco, CrowdStrike are in that consortium. And Anthropic's own characterization is that the model is too dangerous to release broadly.

Jordan: I want to sit on the threat side of this for a second, because the defensive framing is going to dominate the press coverage and it shouldn't dominate your thinking. What Anthropic is describing—autonomous zero-day discovery and working exploit generation—is a capability that adversary nation-states are also racing to develop. The gap between a controlled Glasswing rollout and a proliferated offensive tool is not as wide as anyone would like.

Alex: From a CISO strategy standpoint, this compresses the timeline between vulnerability disclosure and weaponization in a way that breaks the assumptions underneath most patch management programs. If AI can go from "this is an interesting code pattern" to "here is a working exploit" in hours instead of weeks, then your 30-day patching SLA for critical vulnerabilities is already obsolete. The programs that survive this transition are the ones that can move in days, with automated patching pipelines and rigorous asset inventory so you actually know what you're running.

Jordan: And the flip side—which is the genuine promise of Glasswing—is that defenders with access to these tools can find and remediate vulnerabilities faster than attackers can exploit them. That's the race. The question is whether the defensive consortium stays ahead of proliferation.

Alex: Let's run through the supply chain stories together because they're thematically linked. First, the Snowflake customer breach. A SaaS integration provider was compromised, authentication tokens were stolen, and attackers used those tokens to access Snowflake environments at over a dozen companies. No malware, no brute force—just valid tokens used from unexpected places.

Jordan: This is the 2024 Snowflake campaign pattern repeating itself with a twist. Last time it was customer credential hygiene. This time it's third-party integrator hygiene. Every SaaS vendor in your ecosystem that has persistent authentication into your cloud data environment is an extension of your attack surface. If you haven't audited those OAuth grants and token permissions in the last 90 days, that audit just became urgent.

Alex: And connected to that—the North Korea npm story. DPRK actors spent weeks social engineering an Axios maintainer through a fake Slack workspace and a fabricated Microsoft Teams call, got him to install a RAT, and injected malware into packages downloaded 100 million times per week. OpenSSF has issued an advisory warning that other maintainers are being targeted with identical tactics.

Jordan: The sophistication of the social engineering here is notable. This wasn't a phishing email. This was weeks of relationship building, a cloned company identity, a live video call. The patience and investment is consistent with state-level resourcing. And the target selection is smart—a widely-used open source package is a force multiplier that any supply chain team should be modeling.

Alex: The healthcare hit in Massachusetts can't go unaddressed, even briefly. Signature Healthcare is diverting ambulances, canceling cancer treatments, and running on downtime procedures after a cyberattack took their EHR systems offline. For healthcare CISOs listening, this is your board conversation. Life-safety consequences are now a standard feature of healthcare cyber incidents, and your incident response plan needs to account for clinical continuity, not just IT recovery.

Jordan: And your regulators know it too. The liability exposure from a patient harm event tied to a cyber incident is a different category of risk than a data breach fine.

Alex: Okay—the FBI IC3 numbers. Twenty-point-nine billion dollars in U.S. cybercrime losses in 2025. Up 26 percent year over year. Investment fraud, BEC, and data breaches drove the bulk of it. And the FBI explicitly flags that actual losses are substantially higher due to underreporting.

Jordan: The number that matters for your board deck is that 26 percent growth rate. Cyber losses are compounding. If your security budget isn't growing at a comparable rate, you are losing ground in real terms. This report is your external validation for that conversation.

Alex: Now let's talk about CISA, because this is the story with the longest tail. The Trump administration's FY2027 budget proposal cuts CISA by approximately 700 million dollars and eliminates nearly 900 positions. Specifically targeted: vulnerability scanning services and field support for critical infrastructure operators.

Jordan: I'll be direct. CISA's free vulnerability scanning has been a meaningful resource for a lot of organizations that don't have the internal capacity to replicate it—municipalities, water utilities, smaller healthcare systems. Cutting it doesn't make those vulnerabilities disappear. It just removes one layer of detection. For the Iranian PLC story we opened with, the timing of this proposed cut is genuinely terrible.

Alex: For CISOs in regulated sectors who have depended on CISA field support for incident response and exercises, you need to start identifying private-sector alternatives now. Don't wait to see how the budget negotiations land. The planning assumption should be reduced federal support, and your resilience posture needs to account for that.

Jordan: The week's theme is pretty clear: the infrastructure of U.S. cyber defense is under simultaneous pressure from multiple directions. Nation-state actors are hitting OT and cloud credentials at scale. AI is compressing attack timelines. Supply chains are being weaponized with patience and precision. And the federal backstop that critical infrastructure operators have relied on is getting smaller.

Alex: What to watch: how quickly the Glasswing consortium actually deploys Claude Mythos defensively and whether any findings come out publicly. Also watch the CISA budget fight—this is going to be a major fault line in the security community over the next several months. And if you're in energy or utilities, watch for follow-on advisories to the Iranian PLC alert. These campaigns tend to escalate before they de-escalate.

Jordan: And patch your internet-facing OT. Every time we say it, someone hears it for the first time.

Alex: That's Cleartext for Wednesday, April 8th. If you found this useful, share it with a peer who needs it. We're back tomorrow with whatever the threat landscape decides to hand us, which lately has been plenty.

Jordan: Stay clear.

Cleartext is an automated daily podcast for CISOs and security leaders. Generated 2026-04-08.

Sources are pulled from: CyberScoop, The Record, SecurityWeek, Krebs on Security, Dark Reading, Cybersecurity Dive, BleepingComputer, Wired, Ars Technica, TechCrunch, Help Net Security, VentureBeat, Risky Business News, The Hacker News, CISA, and BankInfoSecurity.

Daily cybersecurity briefing for CISOs and security leaders.

🎧 Listen to this episode

Today's episode covers 8 stories across 5 topic areas, including: China-Linked Storm-1175 Exploits Zero-Days to Rapidly Deploy Medusa Ransomware; German police unmask two suspects linked to REvil ransomware gang; Iran-Linked Password-Spraying Campaign Targets 300+ Israeli Microsoft 365 Organizations.

The Hacker News · Apr 07 · Relevance: █████████░ 9/10

Why it matters to CISOs: A China-nexus group deploying ransomware within 24 hours of initial access using zero-days represents a significant escalation in the blending of nation-state capabilities with financially motivated attacks, requiring CISOs to reassess dwell-time assumptions and detection timelines.

📖 Read full article

The Record (Recorded Future) · Apr 06 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: Identification of REvil/GandCrab leadership demonstrates maturing international law enforcement cooperation against ransomware operators, relevant for CISOs tracking deterrence effectiveness and threat actor attribution in incident response and insurance negotiations.

📖 Read full article

The Hacker News · Apr 06 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: This campaign demonstrates how geopolitical conflict drives targeted identity-based attacks at scale against cloud environments; CISOs with Middle East operations or exposure should review M365 conditional access policies and MFA enforcement.

📖 Read full article

Infosecurity Magazine · Apr 07 · Relevance: ████████░░ 8/10

Why it matters to CISOs: The FBI IC3 annual report is a key benchmark CISOs use for board-level risk communication; the $17.6B figure — with crypto scams at $7B and AI-enabled fraud rising — supports budget justification for anti-fraud, BEC, and AI-threat programs.

📖 Read full article

BankInfoSecurity · Apr 07 · Relevance: █████████░ 9/10

Why it matters to CISOs: A $707M cut to CISA would significantly reduce federal cyber coordination, threat intelligence sharing, and critical infrastructure defense programs that enterprise security teams rely on for situational awareness and incident response support.

📖 Read full article

BankInfoSecurity · Apr 07 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: Censys is a core attack surface management and internet intelligence tool used by many enterprise security teams; a $70M raise signals continued investment in a platform CISOs depend on for external exposure visibility.

📖 Read full article

CyberScoop · Apr 06 · Relevance: █████████░ 9/10

Why it matters to CISOs: FortiClient EMS is widely deployed for endpoint management across enterprises; an actively exploited authentication bypass zero-day with only a hotfix available and CISA ordering federal agencies to patch by Friday makes this an immediate action item for any Fortinet shop.

📖 Read full article

BleepingComputer · Apr 06 · Relevance: ████████░░ 8/10

Why it matters to CISOs: An unpatched Windows privilege escalation zero-day with public exploit code affecting SYSTEM-level access across enterprise Windows estates demands immediate defensive measures and compensating controls while awaiting a Microsoft patch.

📖 Read full article

Jordan: A China-linked threat actor just collapsed your dwell-time assumptions. Nation-state speed, ransomware payload, zero-day entry point — and they're done in under 24 hours. If your detection and response model is still built around days or weeks, today's show is for you.

Alex: This is Cleartext, Tuesday April 7th, 2026. I'm Alex Chen.

Jordan: And I'm Jordan Reeves. Today we're covering the Storm-1175 escalation and what it means for every CISO who thought nation-state and ransomware were separate threat models. We've also got a critical Fortinet zero-day with a CISA Friday deadline, a leaked Windows exploit that's now public, the FBI's annual cyber fraud report with a number your board will want to see, and a proposed $707 million cut to CISA that, frankly, has worse timing than almost anything I can remember. Let's get into it.

Alex: Start with Storm-1175, Jordan, because this one reframes a fundamental assumption.

Jordan: It does. Microsoft's attribution here is significant — this is a China-nexus group operationally linked to Medusa ransomware deployment. And the detail that matters most isn't the zero-days, it's the clock. Initial access to ransomware detonation in under 24 hours. That is not a criminal gang with limited resources fumbling through a network. That is disciplined, pre-planned execution with nation-state tradecraft behind it.

Alex: And this is the blending problem we've been watching develop for a couple of years, but this is a step-change. Historically, you could draw a rough line — espionage actors move slow, stay quiet, prioritize persistence. Ransomware actors move fast and loud. Storm-1175 is doing both. They're using zero-days and N-days against internet-facing perimeter systems, which tells you they have a solid vulnerability research or acquisition pipeline, and then they're pivoting immediately to financial disruption.

Jordan: The geopolitical read here is that this gives China deniability on the financial motivation side while still degrading targets. It's coercive without being overtly attributable as state action. Whether the ransomware proceeds are funding operations or just muddying attribution — maybe both — the net effect for a CISO is the same. You have an adversary with nation-state capabilities operating at ransomware group speed.

Alex: So the board question becomes: what is your mean time to detect on your internet-facing assets, and is it measured in hours or days? Because if your SOC is tuned to catch something over a 72-hour window, Storm-1175 is already gone. This is the argument for continuous exposure management, for zero-trust segmentation that limits blast radius even when they're already in, and for automated detection that doesn't wait for a human analyst to connect the dots at 2 a.m.

Jordan: And frankly, this is also why the Censys raise we'll mention later is not just a funding story. Attack surface visibility on internet-facing systems isn't optional anymore. If Storm-1175 can find your exposed assets faster than your team can, that's the gap.

Alex: Speaking of infrastructure — Fortinet. CVE-2026-35616. Jordan, walk us through it.

Jordan: FortiClient EMS, authentication bypass, unauthenticated remote code execution. It's in CISA's Known Exploited Vulnerabilities catalog as of this week, and federal agencies have a patch deadline of Friday. The problem is there's no full patch yet — only an emergency hotfix from Fortinet. So you're being asked to deploy a hotfix on a product that's already being actively exploited, while the real fix is still in the oven.

Alex: If you run FortiClient EMS — and a significant percentage of this audience does — this is a P1 this week. Apply the hotfix now, accept the risk of an interim fix rather than the risk of unmitigated RCE. Review your network segmentation around EMS infrastructure, and flag this for your board if it's in scope for your critical systems. Don't wait for Friday if you haven't started already.

Jordan: And pair that with the other story from this week — BlueHammer. A disgruntled researcher privately reported a Windows privilege escalation zero-day to Microsoft, didn't get the response they wanted, and published the exploit code publicly. Now anyone can grab it. It grants SYSTEM-level access.

Alex: The researcher's grievance is almost irrelevant at this point — the code is out. What matters is that you now have an unpatched Windows privilege escalation with public exploit code circulating. Compensating controls while you wait for Microsoft: enforce least privilege rigorously, monitor for anomalous privilege escalation events, prioritize EDR coverage on endpoints where this would cause the most damage. It's a nuisance if you're hardened. It's catastrophic if you're not.

Jordan: Shifting gears — FBI IC3 annual report. $17.6 billion in cyber fraud losses in 2025. That's the headline number.

Alex: And it's the number you bring to your next board meeting. Crypto scams account for over $7 billion of that. AI-enabled fraud is flagged as a rising threat category. The 85% stat is the one I'd highlight for board conversations — 85% of all fraud losses tracked by IC3 are now cyber-enabled. That's not a niche problem anymore, that's the dominant fraud vector across the economy.

Jordan: The BEC line items are still significant. And the AI angle matters because we're starting to see fraud that defeats voice verification and identity confirmation workflows that were considered solid two years ago. If your financial controls or vendor payment processes rely on voice confirmation or email approval chains, those need a second look.

Alex: Now to the story that has the biggest long-term structural implications for this community: the proposed $707 million cut to CISA in the FY2027 budget.

Jordan: I'll be direct. The timing is extraordinary. We're covering a China-nexus ransomware group using zero-days at nation-state speed in the same episode where we're discussing gutting the federal agency responsible for critical infrastructure cyber defense and threat intelligence sharing. CISA's budget proposal would reduce staffing, cut contractor support, and narrow the agency's mission to federal networks and critical infrastructure — which means the coordination, threat intel sharing, and incident response support that enterprise security teams have relied on starts to go away.

Alex: Here's what this means practically. The information sharing pipelines — the sector-specific advisories, the joint advisories with NSA and FBI, the JCDC coordination — all of that depends on CISA's capacity. If that capacity shrinks significantly, the private sector absorbs the intelligence gap. Either you're funding your own threat intelligence at a higher level, leaning harder on commercial vendors, or you're operating with less context about the threat environment.

Jordan: For CISOs with critical infrastructure responsibilities — energy, finance, healthcare, water — this is a direct operational risk. The sector-specific CISA coordination programs are some of the most practically useful government-industry touchpoints that exist. Losing them is not a symbolic concern, it's a capability gap.

Alex: And if you're going to your board or CFO to justify threat intelligence spending, the IC3 report and this CISA development are your one-two punch. The threat environment is escalating and the federal backstop is contracting. That's a gap your budget needs to close.

Jordan: Briefly on Censys — $70 million raise to expand AI-driven attack surface management and internet infrastructure intelligence. The CEO's framing was direct: faster attacks require automated defenses built on high-quality, real-time global data. That's a legitimate thesis right now.

Alex: If you're using Censys, it's a validation that the platform's getting more investment. If you're not, given what we discussed with Storm-1175 and the speed of perimeter exploitation, external attack surface management is a conversation worth having this quarter.

Alex: On the law enforcement side — quick note on the German BKA identifying two REvil and GandCrab leaders, including UNKN. Both Russian nationals. This matters less as a deterrence win and more as a signal of how good international law enforcement attribution has gotten. For incident response and insurance negotiations, attribution is increasingly something you can reference with specificity.

Jordan: Let's close with the week's theme. What we're watching is a compression of assumptions — about dwell time, about the nation-state versus criminal divide, about the federal support structure we've built policy around for a decade. Storm-1175 compresses your detection window. The CISA cuts compress the federal safety net. Public zero-days compress your patch window. Everything that used to give defenders breathing room is getting shorter.

Alex: The strategic implication is that resilience architecture — not just detection — has to carry more weight. Your ability to contain, isolate, and recover fast matters more when the attacker is faster and the support structure is thinner. That's the planning conversation to have in the next 90 days.

Jordan: And practically, before you close this episode: FortiClient EMS hotfix, BlueHammer compensating controls, CISA funding impact assessment on your intel sourcing, and a dwell-time review on your internet-facing detection coverage.

Alex: That's Cleartext for Tuesday, April 7th. If this was useful, share it with a peer who needs the context. We'll be back tomorrow. Stay sharp.

Cleartext is an automated daily podcast for CISOs and security leaders. Generated 2026-04-07.

Sources are pulled from: CyberScoop, The Record, SecurityWeek, Krebs on Security, Dark Reading, Cybersecurity Dive, BleepingComputer, Wired, Ars Technica, TechCrunch, Help Net Security, VentureBeat, Risky Business News, The Hacker News, CISA, and BankInfoSecurity.

Daily cybersecurity briefing for CISOs and security leaders.

🎧 Listen to this episode

Today's episode covers 17 stories across 5 topic areas, including: Risky Bulletin: Iranian password sprays came first, then came the missiles; Medtech giant Stryker says it’s back up after Iranian cyberattack; China-Linked TA416 Targets European Governments with PlugX and OAuth-Based Phishing.

Risky Business News · Apr 01 · Relevance: ████████░░ 8/10

Why it matters to CISOs: Iran's cyber operations are now explicitly synchronized with kinetic military strikes — password spraying preceded missile attacks, establishing a new paradigm where cyber activity serves as a direct indicator of physical threat escalation.

📖 Read full article

CyberScoop · Apr 02 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: A major medical device manufacturer was hit with a wiper attack by an Iranian hacktivist group — healthcare and critical infrastructure CISOs need to update threat models to account for Iran's expanded targeting of US companies.

📖 Read full article

The Hacker News · Apr 03 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: TA416's return to targeting European governments after a two-year pause signals a shift in Chinese intelligence priorities — CISOs at organizations with European government or diplomatic relationships should review OAuth-based authentication flows.

📖 Read full article

The Record (Recorded Future) · Apr 03 · Relevance: ██████░░░░ 6/10

Why it matters to CISOs: Active exploitation of a TrueConf zero-day in government networks highlights the persistent risk of video conferencing software as an attack surface — audit all conferencing tools for patch status and integrity verification.

📖 Read full article

The Record (Recorded Future) · Apr 03 · Relevance: ██████░░░░ 6/10

Why it matters to CISOs: CERT-UA's warning that Russian attackers are checking if old access, credentials, and unpatched vulnerabilities still work is a reminder that post-incident remediation must be thorough — assume adversaries will return.

📖 Read full article

CyberScoop · Apr 02 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: Akira's sub-one-hour dwell time from initial access to encryption collapses the window for detection and response — SOC teams need to validate that automated detection and containment can operate at machine speed.

📖 Read full article

Ars Technica Security · Mar 31 · Relevance: ██████░░░░ 6/10

Why it matters to CISOs: New research showing quantum computers need far fewer resources to break elliptic curve cryptography accelerates the timeline for post-quantum migration — CISOs should ensure PQC transition roadmaps are active, not just planned.

📖 Read full article

The Hacker News · Apr 03 · Relevance: ██████████ 10/10

Why it matters to CISOs: The Axios npm package is present in ~80% of cloud environments with 100M+ weekly downloads — this DPRK-attributed supply chain compromise demands immediate audit of JavaScript dependencies and review of maintainer token hygiene across your organization.

📖 Read full article

Help Net Security · Apr 03 · Relevance: █████████░ 9/10

Why it matters to CISOs: The EU Commission breach — 340 GB of data from 30+ Union entities — demonstrates how a single compromised open-source security tool (Trivy) in the CI/CD pipeline can cascade to catastrophic data exposure at sovereign scale.

📖 Read full article

BankInfoSecurity · Apr 04 · Relevance: █████████░ 9/10

Why it matters to CISOs: The LiteLLM compromise — the most widely used open-source LLM proxy — reportedly hit 36% of cloud environments and led to credential harvesting at scale, forcing Meta to pause work with Mercor. Any enterprise using LLM proxy layers needs to audit immediately.

📖 Read full article

Dark Reading · Apr 03 · Relevance: ████████░░ 8/10

Why it matters to CISOs: TeamPCP has emerged as the week's most consequential threat actor — their supply chain attacks on LiteLLM, Trivy, and cloud/SaaS instances create a tangled attribution picture as ShinyHunters and Lapsus$ get involved, complicating incident response.

📖 Read full article

The Hacker News · Apr 03 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: North Korea's $285M theft from Drift via a novel 'durable nonce' attack on governance structures shows DPRK operators are innovating rapidly — any organization with on-chain treasury or governance mechanisms needs to reassess administrative privilege models.

📖 Read full article

CyberScoop · Apr 03 · Relevance: █████████░ 9/10

Why it matters to CISOs: Further CISA budget cuts could significantly reduce federal cyber threat intelligence sharing, vulnerability coordination, and incident response support that enterprise security teams rely on — plan for reduced government support.

📖 Read full article

VentureBeat Security · Mar 30 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: RSAC 2026 showed the industry racing to secure AI agents but critical gaps remain in behavioral baselines, runtime telemetry, and identity — CISOs need to plan for agent governance now before production deployments outrun security controls.

📖 Read full article

VentureBeat Security · Apr 02 · Relevance: ████████░░ 8/10

Why it matters to CISOs: The accidental exposure of 512,000 lines of Claude Code source — including the complete permission model and 44 unreleased feature flags — has been weaponized by threat actors distributing malware via fake GitHub repos, creating a template for future AI tool compromises.

📖 Read full article

VentureBeat Security · Mar 31 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: The OpenClaw compromise — where an AI agent's autonomous privileges were sold on BreachForums for $25K — is a wake-up call for CISOs that zero trust principles are being abandoned wholesale for AI agent deployments.

📖 Read full article

The Hacker News · Apr 01 · Relevance: ██████░░░░ 6/10

Why it matters to CISOs: An actively exploited Chrome zero-day in WebGPU (Dawn) affects every Chrome-based browser in the enterprise — ensure browser patching policies can push updates within hours, not days.

📖 Read full article

Jordan: This week, the supply chain became a weapon of mass compromise. Not metaphorically. Literally. Three separate attacks on open-source tooling — an npm package used by eighty percent of cloud environments, a security scanner baked into CI/CD pipelines everywhere, and the most popular LLM proxy in the Python ecosystem — all traced back to a single threat actor cluster. If you only understand one thing about this week, understand that.

Alex: Welcome back to Cleartext. It's Saturday, April 4th, 2026. I'm Alex Chen. If this week buried you — and honestly, it should have — this is where you catch up. Here's what mattered and what it means going into next week. We've got four major themes. First, TeamPCP and the supply chain catastrophe that touched the European Commission, Meta, and tens of thousands of cloud environments. Second, the geopolitical dimension — Iran is now explicitly synchronizing cyber operations with kinetic strikes, and that changes the threat model. Third, the speed problem — Akira ransomware can encrypt your environment in under an hour, and we need to talk about what that actually requires of your SOC. And fourth, the governance picture — CISA is getting gutted again, and RSAC reminded us that AI agents are sprinting past our controls. A lot of ground to cover. Let's go.

Jordan: So TeamPCP. Let's start there because this is the story of the week. This group — and we're still piecing together exactly who they are, which is part of the problem — hit three targets that sit inside the development and security toolchain of virtually every enterprise on the planet. They compromised Trivy, which is the open-source container vulnerability scanner that lives inside CI/CD pipelines. They compromised LiteLLM, which is the most widely deployed open-source proxy for LLM APIs in the Python ecosystem. And separately — though potentially connected — North Korean group UNC1069 socially engineered the lead maintainer of Axios, which has over a hundred million weekly npm downloads and sits inside roughly eighty percent of cloud environments. Three hours. That's how long the poisoned Axios versions were live before detection. Huntress caught first infections within eighty-nine seconds of the malicious push. The speed of detection was impressive. The blast radius was still enormous.

Alex: And let's be clear about what the Trivy compromise actually produced, because it's not just an abstract supply chain story. CERT-EU confirmed this week that the European Commission was breached via that Trivy attack. Three hundred and forty gigabytes of data. Thirty-plus EU entities. Names, usernames, emails — the kind of data that fuels spearphishing at sovereign scale. ShinyHunters leaked it publicly. Lapsus$ is also taking credit. You've got attribution confusion layered on top of a catastrophic disclosure. For CISOs at organizations with any European government or institutional relationships, that dataset is now in adversary hands and being operationalized.

Jordan: The LiteLLM piece is the one that's going to keep giving. Mercor confirmed this week that they were hit via the LiteLLM compromise. Meta paused its relationship with Mercor immediately. That's a significant business consequence. But the broader issue is that LiteLLM is the abstraction layer sitting between enterprise applications and every major LLM API. If you've deployed anything in the AI stack in the last eighteen months, there's a meaningful probability LiteLLM is in that chain. The researchers are estimating thirty-six percent of cloud environments. And the visibility problem is severe — most organizations don't have telemetry on what their AI gateway layer is doing at runtime.

Alex: Which connects directly to what came out of RSAC this week. Five agent identity frameworks launched in one week — CrowdStrike, Cisco, Palo Alto, others all shipping frameworks for securing AI agents. And CrowdStrike disclosed two Fortune 50 production incidents involving compromised AI agents. Two. At Fortune 50 companies. And yet only five percent of enterprises have AI agents in production despite eighty-five percent running pilots. The governance gap is already present even at low penetration. What happens when that five percent becomes fifty? The OpenClaw story captures this perfectly — a UK CEO's AI assistant with root shell access got listed on BreachForums for twenty-five thousand dollars. An unauthenticated admin vulnerability, five hundred thousand exposed instances, no enterprise kill switch. That's not a vulnerability story. That's a governance failure story. We handed an AI agent privileges we would never give a junior employee and then did no monitoring.

Jordan: Let me shift to the geopolitical picture because there's something genuinely new here that deserves its own conversation. Iranian password-spraying campaigns against Israeli targets directly preceded physical missile strikes. This is documented. This is a first. Cyber operations have historically been run in parallel with kinetic activity or as a substitute for it. What we're seeing now is explicit sequencing — cyber as a precursor, as a preparation layer for physical escalation. The Stryker wiper attack by Handala fits this pattern. A major US medical device manufacturer gets wiped. Operations are restored three weeks later, which means three weeks of degraded medical device supply chain during a period of active conflict. And Iran is also reportedly targeting Middle Eastern city governments specifically to degrade emergency response capabilities during missile strikes. That is not hacktivism. That is warfare.

Alex: For CISOs in healthcare, critical infrastructure, and defense industrial base — and honestly for any CISO whose organization has Middle East exposure — this changes your threat model. Iran has historically been a tier-two threat to most US enterprises. The Stryker attack suggests that's no longer the right framing. Handala is operating with a level of capability and targeting intentionality that reflects state direction, not just ideological motivation. Add that to the TA416 activity out of China — they went quiet for two years on European government targets and came back this week with PlugX and OAuth-based phishing. The timing of that return is not coincidental. European governments are under simultaneous pressure from multiple state actors right now. And TrueConf, the video conferencing platform — CISA gave federal agencies two weeks to patch a zero-day being actively exploited by Chinese actors against Southeast Asian governments. Video conferencing remains one of the most under-audited surfaces in the enterprise stack.

Jordan: The Russia piece this week was quieter but worth flagging. CERT-UA issued a warning that Russian actors are systematically going back to previously breached infrastructure and checking whether access still works. Testing old credentials. Checking whether patched vulnerabilities were actually remediated. This is methodical reconstitution of attack infrastructure. For any organization that had a Russia-linked incident in the last three years — and that's a lot of organizations — your post-incident remediation needs to be treated as an active question, not a closed file.

Alex: Now let's talk about speed, because the Akira data this week is operationally significant. Under one hour from initial access to full encryption. Halcyon confirmed this. And Akira is being deliberate about it — they're also investing heavily in working decryptors, specifically to build a reputation for paying out so victims actually pay the ransom. This is a professionalized operation optimizing for both speed and conversion rate. The implication for your SOC is stark: if your detection-to-response workflow takes more than thirty minutes, you are not operating at the speed required to stop Akira. Automated containment isn't a nice-to-have anymore. It's a prerequisite.

Jordan: On the quantum front — and I know some CISOs tune this out as a long-term problem — new research this week is compressing the timeline again. Specifically for elliptic curve cryptography. ECC is in your TLS, your SSH, your code signing. The resource requirements to break it are lower than previously modeled. I'm not saying Q Day is next year. I'm saying if your PQC migration roadmap says you'll start planning in 2028, that's now a board-level risk you need to revisit.

Alex: And the Claude Code leak deserves a mention because the weaponization speed was remarkable. Anthropic accidentally shipped five hundred and twelve thousand lines of unobfuscated TypeScript in an npm package. The source code included their complete permission model and forty-four unreleased feature flags. Within hours, threat actors had stood up fake GitHub repos distributing the Vidar infostealer disguised as an unlocked version of Claude Code. Any developer curious enough to look for the leaked source became a target. If you have developers using AI coding tools — and you do — this is a social engineering vector you need to brief your teams on this week.

Jordan: So let's step back. What was this week?

Alex: This week was the moment the software supply chain threat went from theoretical to undeniable. We've talked about SolarWinds, we've talked about XZ Utils, we've talked about the theoretical risk of open-source tooling as an attack surface. This week, a single threat actor cluster compromised three pillars of modern development and security infrastructure simultaneously. And the consequences cascaded to the European Commission, to Meta's vendor relationships, to tens of thousands of cloud environments. The toolchain is the attack surface now. Not just an attack surface — the attack surface.

Jordan: And CISA's budget is being cut again. Hundreds of millions more, proposed this week, on top of previous reductions. At the exact moment when federal threat intelligence sharing, vulnerability coordination, and incident response support are most needed. The government safety net for enterprise security is getting thinner. Which means if you've been relying on CISA advisories and KEV catalog updates as a meaningful input to your vulnerability management program, you need to be building redundancy into that intelligence pipeline now. Commercial sources, ISACs, peer networks. The cavalry is getting defunded.

Alex: Going into next week, here's the action list. Audit your JavaScript dependencies for Axios exposure and check npm token hygiene across your development org. If you're running Trivy in CI/CD, verify your pipeline integrity and check CERT-EU's indicators. If LiteLLM is in your AI stack, treat it as a compromised component until you've validated your version and runtime behavior. Brief your developers on the Claude Code infostealer campaign. Review your AI agent deployments against a zero-trust privilege model. And if you haven't had a frank conversation with your board about the geopolitical threat environment — Iran targeting US critical infrastructure, China resuming European government operations — this week's news gives you everything you need to have that conversation.

Jordan: It was a heavy week. Unfortunately, next week will probably be heavier.

Alex: That's Cleartext for the week ending April 4th, 2026. The daily show is back Monday. If you found this useful, share it with a peer who's trying to stay current. We'll be here. Stay sharp.

Cleartext is an automated daily podcast for CISOs and security leaders. Generated 2026-04-04.

Sources are pulled from: CyberScoop, The Record, SecurityWeek, Krebs on Security, Dark Reading, Cybersecurity Dive, BleepingComputer, Wired, Ars Technica, TechCrunch, Help Net Security, VentureBeat, Risky Business News, The Hacker News, CISA, and BankInfoSecurity.

Daily cybersecurity briefing for CISOs and security leaders.

🎧 Listen to this episode

Today's episode covers 8 stories across 4 topic areas, including: Medtech giant Stryker says it’s back up after Iranian cyberattack; House Dems decry confirmed ICE usage of Paragon spyware; Software supply chain hacks trigger wave of intrusions, data theft.

CyberScoop · Apr 02 · Relevance: ████████░░ 8/10

Why it matters to CISOs: An Iranian hacktivist group deploying wiper malware against a major medtech company signals escalating nation-state targeting of healthcare supply chain companies, requiring CISOs in that sector to reassess geopolitical threat models.

📖 Read full article

CyberScoop · Apr 02 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: Confirmed US government procurement and use of commercial spyware raises the stakes for enterprise mobile security, especially for organizations whose executives or employees might be targeted as persons of interest.

📖 Read full article

Help Net Security · Apr 02 · Relevance: █████████░ 9/10

Why it matters to CISOs: Google researchers warning that hundreds of thousands of stolen secrets are circulating from coordinated supply chain attacks (Axios, Trivy, LiteLLM, KICS, Telnyx) signals an unprecedented wave of downstream compromise risk that every enterprise must assess immediately.

📖 Read full article

CyberScoop · Apr 02 · Relevance: ████████░░ 8/10

Why it matters to CISOs: Sub-one-hour ransomware dwell times from a major group like Akira fundamentally challenge detection-and-response assumptions; CISOs must validate that their IR playbooks and automated containment can operate within minutes, not hours.

📖 Read full article

Help Net Security · Apr 03 · Relevance: █████████░ 9/10

Why it matters to CISOs: A supply chain compromise of a widely-used open-source security tool (Trivy) leading to a breach of EU institutional cloud infrastructure underscores that your security toolchain itself is an attack surface requiring continuous validation.

📖 Read full article

The Hacker News · Apr 03 · Relevance: █████████░ 9/10

Why it matters to CISOs: The Axios npm package is used across virtually every enterprise JavaScript stack; a confirmed North Korean social engineering compromise of its maintainer means CISOs must audit dependencies and rotate any secrets potentially exposed through this package.

📖 Read full article

BankInfoSecurity · Apr 03 · Relevance: ████████░░ 8/10

Why it matters to CISOs: A confirmed 'major' hack of an FBI system, alongside breaches at Lloyds (450K affected) and the Dutch Treasury, signals that even the most hardened targets are being compromised—reinforcing the need for assume-breach postures.

📖 Read full article

BankInfoSecurity · Apr 03 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: A $50M raise for an AI-driven identity governance platform reflects market recognition that identity remains the primary attack vector and that existing IAM/IGA tools aren't keeping pace with AI agent proliferation.

📖 Read full article

Jordan: A trusted open-source security scanner becomes the weapon. A North Korean social engineering operation compromises one of the most downloaded JavaScript libraries on earth. And the European Commission loses 340 gigabytes of data because of it. That's where we are on Friday, April 3rd, 2026. This is Cleartext.

Alex: Welcome back. I'm Alex Chen. Jordan Reeves is with me as always. If this week felt like a stress test for every assumption you've built your security program on, you're not wrong. Supply chain attacks are cascading into real-world breaches at institutional scale. Iranian hackers are wiping medtech infrastructure. Akira ransomware is encrypting your environment before your SOC finishes its first cup of coffee. We're going to get into all of it—the Stryker attack, the Axios compromise, the European Commission breach, a confirmed FBI system hack, and a few other things that should be on your radar going into the weekend. Let's get into it.

Jordan: Let's start where the week's gravity is pulling us—supply chain. Because what looked like a collection of separate incidents is resolving into something much more coherent and much more alarming. Google's researchers are now warning that hundreds of thousands of stolen secrets could be circulating from coordinated attacks hitting Axios, Trivy, LiteLLM, KICS, and Telnyx. We're not talking about isolated opportunistic hits. We're talking about a coordinated campaign targeting the infrastructure developers trust implicitly.

Alex: And the Axios story is the one that every CISO with a JavaScript-heavy stack needs to stop on. UNC1069—North Korean threat actors—didn't find a zero-day. They socially engineered a human being. The maintainer of one of the most widely used HTTP client libraries in the ecosystem. They approached him posing as a company founder, built trust, and then used that access to compromise the package. This is a nation-state investing in the long game of developer trust networks.

Jordan: The technical vector here is almost secondary. The real story is the attack surface: open-source maintainers who are often individuals, often underfunded, and absolutely not trained to recognize a tailored North Korean influence operation. Jason Saayman, the Axios maintainer, said the social engineering was crafted specifically to him. That's not a phishing blast. That's intelligence work.

Alex: So the immediate action items here are not abstract. If your environment uses Axios—and it almost certainly does—you need to audit your dependency versions, check your SBOM, and assume any secrets that passed through that package during the compromise window may be circulating. Same applies to Trivy users, which brings us directly to the European Commission.

Jordan: CERT-EU has confirmed that ShinyHunters, operating as part of TeamPCP, breached cloud infrastructure underpinning websites across thirty-plus EU entities via the compromised Trivy supply chain. Three hundred forty gigabytes exfiltrated. Names, usernames, email addresses, personal data across the bloc. And here's what keeps me focused on this one—Trivy is a security scanning tool. Its entire job is to find vulnerabilities. The attackers compromised the thing you use to check for compromise.

Alex: That's the sentence I want every board member to sit with. Your security toolchain is an attack surface. Your scanners, your monitoring agents, your pipeline integrations—all of it requires the same scrutiny you apply to your production applications. If you haven't done a trust audit of your DevSecOps tooling, that's not a theoretical gap anymore. It's a documented, exploited vector at institutional scale.

Jordan: Now let's shift gears to Stryker—because this one hits differently in terms of threat actor motivation. The Handala group, Iranian-linked, claimed responsibility for a wiper attack against one of the world's largest medical technology companies. Not ransomware. A wiper. The goal wasn't money. It was destruction.

Alex: Three weeks to recover. Think about what that means operationally for a medtech company. These are not systems running e-commerce transactions. This is infrastructure that connects to hospitals, to surgical equipment supply chains, to clinical environments. The decision Stryker's leadership had to make about what to communicate to healthcare customers during that three-week window—that's a board-level crisis, not a security team problem.

Jordan: Handala has been increasingly active and increasingly sophisticated. This is part of a broader Iranian strategic posture that targets companies with perceived connections to Western or Israeli interests. CISOs in the healthcare and medtech space specifically need to update their geopolitical threat models. If you've been treating Iranian threat actors as primarily a financial sector concern, this week tells you that's outdated.

Alex: And let me add the regulatory dimension. For healthcare companies under HIPAA and increasingly under NIS2 if you have EU operations, a three-week recovery from a wiper event is going to draw scrutiny. Regulators don't just care about data exposure—they care about operational resilience. Your incident response plan and your recovery time objectives need to be defensible to a regulator, not just functional in a tabletop.

Jordan: From one speed problem to another. Halcyon's research on Akira ransomware. Sub-one-hour dwell time from initial access to full encryption. That number breaks most detection-and-response assumptions that exist in enterprise security programs today. The industry has been building IR playbooks around hours of dwell time. That window is gone.

Alex: The practical implication is that your automated containment has to fire before a human analyst has fully assessed the alert. That's uncomfortable for a lot of organizations, because automated response carries its own risks—false positives, business disruption. But you have to make that tradeoff decision now, explicitly, before Akira makes it for you. And the detail about Akira investing in functional decryptors matters too—it tells you this group is running a professional operation optimized for payment. They want your money, not your headlines.

Jordan: Quick note on the breach roundup this week, because the context matters more than any single item. Federal authorities confirmed a major hack of an FBI system. Lloyds had 450,000 individuals exposed. The Dutch Treasury was breached. A Citrix flaw is being actively exploited. What's the connective tissue? Even the hardest targets are falling. If you're still running a prevention-dominant security model, these are your weekly data points that the assume-breach posture isn't paranoia—it's just accurate.

Alex: And on the Paragon spyware confirmation—ICE has now officially acknowledged purchasing and deploying Paragon's capability. Congressional Democrats are pushing back, but the capability exists and is being used domestically. For CISOs, especially those in industries with politically sensitive profiles or organizations whose executives travel internationally or deal with immigration policy, enterprise mobile security needs to be evaluated in this context. Commercial spyware is no longer a foreign government problem. It's a domestic procurement reality.

Jordan: Thirty seconds on Linx—fifty million dollars raised for an AI-driven identity governance platform. The market signal is clear: identity remains the primary attack vector, and the proliferation of AI agents is creating governance gaps that legacy IGA tools weren't designed to handle. If your identity program doesn't have a strategy for non-human identities and AI agents, that's now a funded, competitive space. Worth a look.

Alex: Let's land the week. Jordan, what's the theme you're carrying into next week?

Jordan: The weaponization of trust. Not vulnerability exploitation—trust exploitation. Maintainers, open-source tools, security scanners. The entire software supply chain runs on chains of trust that were never designed to be adversarially stress-tested by nation-states. We're watching that assumption collapse in real time.

Alex: My takeaway for the board conversation next week is simple: the perimeter of your organization now extends to every developer whose code you've ever pulled from a public registry, and every security tool you've ever integrated into your pipeline. That's your attack surface. The week's events are a forcing function to go have that conversation and get the resources to address it seriously.

Jordan: Quantify it, prioritize it, and don't wait for the next Trivy.

Alex: That's Cleartext for Friday, April 3rd, 2026. If you found this useful, share it with a peer who needs it. We're back Monday. Stay sharp.

Cleartext is an automated daily podcast for CISOs and security leaders. Generated 2026-04-03.

Sources are pulled from: CyberScoop, The Record, SecurityWeek, Krebs on Security, Dark Reading, Cybersecurity Dive, BleepingComputer, Wired, Ars Technica, TechCrunch, Help Net Security, VentureBeat, Risky Business News, The Hacker News, CISA, and BankInfoSecurity.

Daily cybersecurity briefing for CISOs and security leaders.

🎧 Listen to this episode

Today's episode covers 9 stories across 5 topic areas, including: European-Chinese geopolitical issues drive renewed cyberespionage campaign; Iran-linked actors target Middle Eastern city governments to undermine missile-strike responses; Hackers slipped a trojan into the code library behind most of the internet. Your team is probably affected.

CyberScoop · Apr 01 · Relevance: ████████░░ 8/10

Why it matters to CISOs: TA416's return to targeting European governments signals that organizations with European government relationships, defense ties, or policy influence should elevate their threat posture against Chinese APT tradecraft.

📖 Read full article

Cybersecurity Dive · Apr 01 · Relevance: ████████░░ 8/10

Why it matters to CISOs: Iran coupling kinetic military operations with cyber operations against civilian government infrastructure demonstrates the escalating convergence of physical and digital warfare — a strategic concern for any organization operating in contested regions.

📖 Read full article

VentureBeat Security · Apr 01 · Relevance: ██████████ 10/10

Why it matters to CISOs: Axios is present in ~80% of cloud environments with 100M+ weekly downloads — this supply chain compromise demands immediate audit of build pipelines, dependency locks, and artifact integrity checks across every engineering team.

📖 Read full article

VentureBeat Security · Apr 01 · Relevance: ████████░░ 8/10

Why it matters to CISOs: The full exposure of Claude Code's permission model, security validators, and unreleased feature flags gives adversaries a roadmap to bypass AI coding agent controls — any enterprise using AI coding assistants needs to reassess trust assumptions immediately.

📖 Read full article

Cybersecurity Dive · Apr 01 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: A major publicly traded company facing weeks of recovery with ongoing operational disruption to orders and shipping illustrates the business continuity stakes of ransomware-style attacks — useful for board-level discussions on resilience investment.

📖 Read full article

BankInfoSecurity · Apr 02 · Relevance: ████████░░ 8/10

Why it matters to CISOs: Directly addresses the personal liability trend reshaping CISO employment contracts, D&O insurance needs, and reporting structures — existential career risk for every CISO in the audience.

📖 Read full article

BankInfoSecurity · Apr 02 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: HHS restructuring cyber oversight signals shifting federal governance models that will affect compliance expectations, grant-funded health IT programs, and how healthcare CISOs interact with federal regulators.

📖 Read full article

BankInfoSecurity · Apr 02 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: As AI-generated code proliferates in enterprise development, Qodo's $70M raise signals growing market demand for automated code governance — a capability CISOs will need to integrate into AppSec programs.

📖 Read full article

Help Net Security · Apr 02 · Relevance: ████████░░ 8/10

Why it matters to CISOs: This attack weaponizes a trusted update mechanism in air-gapped/LAN-only conferencing software used by government and critical infrastructure — a reminder that even 'isolated' enterprise tools can become initial access vectors via supply chain compromise.

📖 Read full article

Jordan: Someone poisoned axios last night. If you don't know what axios is, ask your engineering team — and then ask them whether they audited their builds this morning. Eighty percent of cloud environments. North Korean fingerprints. A three-hour window that Huntress says was enough to compromise at least 135 systems in the first minute and a half. That's your cold open.

Alex: It's Thursday, April 2nd, 2026. You're listening to Cleartext. I'm Alex Chen, joined as always by Jordan Reeves. Today's episode is dense. We've got a major supply chain compromise that your AppSec team needs to be working right now, a source code leak from Anthropic that hands adversaries a blueprint for bypassing AI coding agent controls, Hasbro confirming operational disruption from a cyberattack, TA416 back targeting European governments, Iran coupling missile strikes with password-spraying campaigns, a zero-day in conferencing software hitting government networks through its own update mechanism, and a governance story that every CISO in this audience needs to hear about personal liability. Let's get into it.

Jordan: Let's start with axios because this one isn't theoretical. Attackers stole a long-lived npm access token from the lead maintainer of axios — the most widely used HTTP client library in JavaScript — and used it to publish two poisoned versions carrying a cross-platform RAT. macOS, Windows, Linux, all covered. The packages were live for roughly three hours before removal. Huntress confirmed 135 compromised systems within 89 seconds of publication. Wiz says axios is present in approximately 80 percent of cloud and code environments. Attribution points to UNC1069, which is a North Korean cluster. This is not a niche dependency someone snuck in. This is the plumbing.

Alex: And the operational question isn't whether you were exposed — it's whether you know. If you don't have artifact integrity verification, if your build pipelines are pulling from npm without locked digests, if you don't have visibility into what your CI/CD environments are executing, you are answering that question blind. The immediate actions are straightforward even if the execution isn't: audit your dependency locks, check your build logs for axios versions 1.8.3 and 1.8.4 specifically, and treat any system that ran a build in that three-hour window as potentially compromised until you can prove otherwise. The deeper issue is the long-lived token. That's a credential hygiene failure that became a supply chain event at internet scale. Your board doesn't need to understand npm to understand that sentence.

Jordan: Connected to this is the Anthropic Claude Code leak, and I want to be precise about what happened because the implications are different from a typical breach. Anthropic accidentally shipped a 59.8 megabyte source map file inside version 2.1.88 of the Claude Code npm package. That exposed 512,000 lines of unobfuscated TypeScript — the complete permission model, every bash security validator, 44 unreleased feature flags. Mirror repositories spread across GitHub within hours. Containment has effectively failed.

Alex: The risk model here shifts immediately. If you're running AI coding agents in your development environment — and most enterprises now are — you have to assume that the trust boundaries you thought existed in those tools have been publicly mapped by adversaries. The permission model is now documented. The validators are now documented. That's not a reason to pull the plug on AI-assisted development, but it is a reason to do a hard review of what those agents can access, what they can execute, and what human review checkpoints you actually have in place versus what you assumed were in place. The gap between policy and implementation just got a lot more dangerous to ignore.

Jordan: Before we move to the geopolitical layer, Hasbro. Major publicly traded company, cyberattack detected March 28th, proactively took systems offline, recovery expected to take several weeks, order processing and shipping disrupted, data exfiltration still being assessed. The forensic story isn't complete yet, but the operational story is already telling. Weeks of recovery. Revenue-affecting disruption. Public disclosure obligation.

Alex: What's useful about Hasbro for a board conversation is the sequencing. They detected it, they made the call to take systems offline proactively — that's the right call — and they're still looking at weeks of recovery. That's not a failure of detection. That's the reality of remediation at scale. If your board thinks fast detection means fast recovery, Hasbro is a useful data point to correct that assumption. Resilience investment and recovery planning are not the same line item as detection investment, and both matter.

Jordan: Now the geopolitical picture. Two stories that tell a coherent story about state actors using cyber as a direct complement to political and military objectives. First: TA416 is back. This is a Chinese state-backed group that Proofpoint tracks, and they've resumed cyberespionage operations targeting European governments after what appears to have been a deliberate multi-year pause. High confidence attribution. The driver is the shift in European-Chinese relations — trade friction, Taiwan policy divergence, EU regulatory pressure on Chinese tech. When geopolitics moves, the targeting lists move with it.

Alex: The practical implication for this audience is about adjacency. You may not be a European government, but if your organization has relationships with European government clients, European defense contractors, European policy institutions, or if you're an NGO doing policy work — you are now adjacent to a targeting set that just got reactivated. Chinese APT tradecraft in this context tends to be patient, credential-focused, and very good at living off the land. If you haven't revisited your threat model against that tradecraft recently, this is the prompt.

Jordan: The second geopolitical story is Iran, and this one is strategically significant. Iran-linked actors are running password-spraying campaigns against Middle Eastern city government systems with a specific operational goal: degrade municipal response capabilities during and after missile strikes. That's not opportunistic. That's coordinated. Cyber and kinetic, synchronized.

Alex: For most CISOs in this audience, the direct operational exposure here is limited. But the strategic lesson is not. We have now documented, attributed cases of a nation-state using cyberattacks to suppress emergency response to physical attacks. If you have any presence in contested regions — operations, facilities, third-party relationships — the threat model now explicitly includes physical-digital coordination. That conversation belongs in your crisis planning, not just your security program.

Jordan: One more before governance. The TrueConf zero-day. CVE-2026-3502. China-nexus attackers exploited a vulnerability in TrueConf — a videoconferencing platform specifically designed to run on private LANs without internet access — and turned its own trusted update mechanism into a malware delivery vector across Southeast Asian government networks. Check Point has the research. The attack chain is elegant and straightforward: compromise the update process, let the legitimate software distribute the payload to every connected endpoint.

Alex: The line I want to highlight is "designed without internet access." Organizations choose tools like TrueConf precisely because the isolation feels like security. The lesson is that isolation is a threat surface reduction strategy, not a trust establishment strategy. If your update mechanism trusts a signature without additional integrity controls, isolation doesn't protect you from a compromised update. Audit your air-gapped and LAN-only tools with the same rigor you'd apply to anything internet-facing.

Jordan: Governance. The BankInfoSecurity piece on CISO liability is worth reading in full, but here's the operational summary: regulators are pursuing personal accountability for CISOs after major breaches. That trend is changing how security leaders communicate risk — and not for the better. When personal liability is on the table, the rational response is to document defensively, hedge language, and avoid the kind of direct risk communication that actually helps boards make decisions. The piece notes this is making the role less attractive to experienced practitioners. Both of those downstream effects are bad for the industry.

Alex: I'll be direct about this because it's personal for a lot of people in this audience. If you don't have D&O coverage that explicitly covers your security decisions, you need to fix that today. If your employment contract doesn't specify what decisions are yours versus the CEO's or board's to make, that ambiguity is your liability. And if your reporting structure puts you in a position where you're accountable for outcomes you don't have authority to control — that's a governance failure your company needs to own, not a risk you should absorb personally. Document everything. Get counsel. Don't wait for a breach to find out where the lines are.

Jordan: Brief note on HHS. They're moving cybersecurity, cloud, and AI oversight back under the CIO office, reversing Biden-era changes. For healthcare CISOs, this is a compliance posture story. Federal regulatory touchpoints are shifting. If your team has existing relationships or reporting flows tied to the previous structure, map those now before something falls through a bureaucratic gap during a reorganization.

Alex: And Qodo raising $70 million to govern AI-generated code at scale. The signal here is market validation. AI-generated code is proliferating faster than the governance frameworks to manage it. If you don't have AI code governance in your AppSec program yet, you're already behind, and the capital flowing into this space tells you it's not optional much longer.

Jordan: The theme this week, if you want to call it one, is trust infrastructure. The axios attack exploited trusted package delivery. The TrueConf attack exploited trusted software updates. The Claude Code leak exposes the internals of trusted AI tooling. TA416 targets trusted government relationships. Every vector this week runs through something that was trusted.

Alex: And that's not a coincidence. Sophisticated actors, state-backed or otherwise, have understood for years that perimeter attacks are expensive and trust attacks are cheap. The asymmetry is the point. Your zero-trust architecture work, your supply chain integrity controls, your software bill of materials discipline — that's not hygiene work. That's the strategic response to the actual threat model. If you're having trouble making that case to your CFO, this week's news cycle is your presentation.

Jordan: Watch for more axios attribution detail over the next 48 hours. The UNC1069 link is assessed with moderate confidence right now and I expect that picture to sharpen.

Alex: That's Cleartext for Thursday, April 2nd. If this episode was useful, share it with someone who needed it. We're back tomorrow. Stay sharp.

Cleartext is an automated daily podcast for CISOs and security leaders. Generated 2026-04-02.

Sources are pulled from: CyberScoop, The Record, SecurityWeek, Krebs on Security, Dark Reading, Cybersecurity Dive, BleepingComputer, Wired, Ars Technica, TechCrunch, Help Net Security, VentureBeat, Risky Business News, The Hacker News, CISA, and BankInfoSecurity.

Daily cybersecurity briefing for CISOs and security leaders.

🎧 Listen to this episode

Today's episode covers 9 stories across 6 topic areas, including: Google Attributes Axios npm Supply Chain Attack to North Korean Group UNC1069; Risky Bulletin: Iranian password sprays came first, then came the missiles; Iran Deploys 'Pseudo-Ransomware,' Revives Pay2Key Operations.

The Hacker News · Apr 01 · Relevance: █████████░ 9/10

Why it matters to CISOs: A North Korean group compromised axios, which sits in ~80% of cloud environments with 100M+ weekly downloads — CISOs need immediate inventory of affected builds and credential rotation for any systems that pulled poisoned versions.

📖 Read full article

Risky Business News · Apr 01 · Relevance: ████████░░ 8/10

Why it matters to CISOs: Iran's cyber operations are now directly preceding kinetic military action against Israel, signaling that enterprises in allied nations should treat Iranian password spraying as a leading indicator of escalation requiring immediate defensive posture changes.

📖 Read full article

Dark Reading · Mar 31 · Relevance: ████████░░ 8/10

Why it matters to CISOs: Iranian APTs are disguising destructive attacks as ransomware to target US organizations — CISOs need to ensure incident response plans account for state-sponsored wipers masquerading as financially motivated ransomware.

📖 Read full article

Cybersecurity Dive · Mar 31 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: The US government's absence from RSAC signals a weakening public-private partnership at a time when CISOs depend on federal threat intelligence sharing and coordinated defense — this has strategic implications for incident response and information sharing programs.

📖 Read full article

BleepingComputer · Mar 31 · Relevance: ████████░░ 8/10

Why it matters to CISOs: Cisco's own dev environment was breached through a supply chain attack on Trivy, demonstrating cascading risk from open-source tool compromises — CISOs must evaluate their own exposure to Trivy and review downstream credential hygiene.

📖 Read full article

TechCrunch Security · Mar 31 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: CareCloud serves 45,000+ providers covering millions of patients — any organization using CareCloud EHR needs to assess exposure and prepare for potential breach notification obligations under HIPAA.

📖 Read full article

BankInfoSecurity · Apr 01 · Relevance: ████████░░ 8/10

Why it matters to CISOs: Directly addresses the evolving personal liability exposure CISOs face post-breach, impacting how security leaders negotiate employment terms, D&O coverage, and board reporting structures.

📖 Read full article

BankInfoSecurity · Apr 01 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: A $250M Series B for an AI SOC platform signals massive market conviction that autonomous detection and response is maturing — CISOs evaluating SOC modernization should track this category closely as it reshapes staffing and vendor decisions.

📖 Read full article

The Record (Recorded Future) · Mar 31 · Relevance: ████████░░ 8/10

Why it matters to CISOs: A CVSS 9.3 Citrix NetScaler vulnerability with an emergency CISA patching deadline means any enterprise running NetScaler needs to treat this as a drop-everything priority — Citrix remains one of the most targeted enterprise edge devices.

📖 Read full article

Jordan: A North Korean threat actor just poisoned axios — one hundred million downloads a week, present in eighty percent of cloud environments — and the malicious versions were live for three hours. Huntress confirmed a hundred and thirty-five compromised systems within eighty-nine seconds of the story dropping. If you haven't pulled your axios build inventory this morning, that's where this conversation starts.

Alex: Welcome to Cleartext. It's Wednesday, April 1st, 2026. I'm Alex Chen.

Jordan: And I'm Jordan Reeves. No April Fools — every story today is real, and most of them are going to require action on your part before end of day.

Alex: Here's what we're covering: North Korea's supply chain move against axios and what it means for your cloud posture. Iran is blurring the line between cyber operations and kinetic warfare — and blurring the line between ransomware and wiper attacks. Cisco got hit through its own dev tooling. CareCloud is a healthcare sector problem that has HIPAA breach notification written all over it. CISA just issued an emergency directive on a Citrix NetScaler vulnerability with a 9.3 CVSS score. The CISO liability conversation is heating up again. And we'll talk about what it means that the U.S. government didn't show up to RSAC. Let's get into it.

Jordan: The axios story is the one that should be commanding your morning. Google's Threat Intelligence Group formally attributed the npm supply chain compromise to UNC1069 — a North Korean cluster that GTIG characterizes as financially motivated. The poisoned versions were live for roughly three hours. That's a narrow window, but axios moves so fast that Huntress confirmed over a hundred and thirty-five compromised systems less than ninety seconds after publication. The vector here is the same playbook North Korea has been running against the developer ecosystem — get into the package, ride the CI/CD pipeline, harvest credentials from cloud environments. The difference is the blast radius. Axios isn't a niche library. It is the fabric of modern web application development.

Alex: And that's the business problem. When you're talking about a package present in eighty percent of cloud environments, you're not having a security conversation anymore — you're having a business continuity conversation. The first call this morning for a lot of CISOs should be to their engineering leads: which builds pulled axios during that three-hour window? What credentials were accessible in those environments? What secrets management practices were in place? If you have any uncertainty about those answers, credential rotation isn't optional — it's the floor. And your board needs to understand that supply chain risk at this scale is no longer theoretical. It's a quarterly operational reality.

Jordan: Let's stay in the geopolitical lane because Iran is giving us two separate but related stories that are worth reading together. The first is the pattern that Risky Business News surfaced today: Iranian password spraying campaigns against Israeli organizations directly preceded physical missile strikes. That is cyber as a kinetic precursor, not as a standalone operation. The second story is the revival of Pay2Key — Iranian APTs are deploying what looks like ransomware but functions as a destructive wiper. The ransom demand is cover. The real objective is destruction.

Alex: The implication for CISOs outside the immediate conflict zone is significant. If you're a U.S. enterprise with operations in the Middle East — or if Iran has threatened, as reported today, to target U.S. tech firms operating in that region — you need to treat Iranian password spray activity as a threat intelligence signal with escalatory potential, not just a credential hygiene problem. And the pseudo-ransomware point is critical for incident response planning. If your IR playbook assumes financial motivation when you see ransomware indicators, you may mis-triage a state-sponsored destructive attack. The initial containment decisions are different. The evidence preservation decisions are different. The regulatory notification timeline may be different. Update the playbook.

Jordan: Iran threatening to bomb U.S. tech firms in the Middle East and simultaneously running destructive malware campaigns that masquerade as ransomware — that is a threat actor operating with political cover and deniability at the same time. The blurring is intentional. It complicates attribution. It complicates the legal and insurance response. It's designed to.

Alex: Now let's talk about Cisco, because this one hits close to home for a lot of practitioners. Cisco's internal development environment was breached using credentials stolen in the Trivy supply chain attack. Source code belonging to Cisco and its customers was exfiltrated. The important word there is "customers." Trivy, for those who don't have it top of mind, is an open-source vulnerability scanner. It's security tooling. The lesson is brutal: the tools you use to secure your environment expand your attack surface if they're compromised. If Trivy is in your pipeline — and for many enterprises it is — you need to audit what credentials that tooling had access to, and you need to do that today.

Jordan: The cascading nature of supply chain attacks is the operational problem that doesn't get enough board-level airtime. It's not one compromised package. It's Trivy credentials becoming a vector into Cisco's dev environment, which then exposes customer source code. Each hop amplifies the damage. The original compromise may be far removed from where the material loss actually occurs.

Alex: Moving to healthcare — CareCloud confirmed that hackers accessed a repository of patient medical records in March. CareCloud serves over forty-five thousand healthcare providers covering millions of patients. If your organization is a CareCloud customer, you have a HIPAA breach notification obligation assessment to complete, and the clock is running. HIPAA requires notification within sixty days of discovering a breach. If CareCloud has notified you as a business associate, your legal and compliance teams need to be in the room now. If you haven't heard from them yet, reach out proactively. Don't wait for the letter.

Jordan: Quick one on Citrix — CISA issued an emergency directive requiring federal agencies to patch a NetScaler vulnerability by Thursday. CVSS 9.3. The bug allows attackers to craft requests that disclose sensitive information. Citrix edge devices have been primary targets for nation-state and criminal actors for the better part of three years. If you're running NetScaler, this isn't a "schedule it for the next patch window" situation. The federal deadline is tomorrow. Treat it as yours too.

Alex: Now — the CISO liability story from BankInfoSecurity today is one I want to spend a moment on because it speaks directly to everyone listening. The piece lays out how rising regulatory accountability is reshaping the role — not just the personal legal exposure, but the downstream effect on how CISOs communicate risk. When you know you can be personally named in an SEC enforcement action or a DOJ investigation, the incentives around board reporting shift. There's a real risk that CISOs start softening the message to reduce personal exposure. That's catastrophic for security culture.

Jordan: The talent implications are real too. Experienced practitioners are evaluating whether the personal liability profile of this role is worth it. That is not a hypothetical — that is a conversation happening in every executive recruiting process right now.

Alex: If you're in contract negotiations or renewal discussions, D&O coverage language matters. Indemnification clauses matter. Your reporting structure matters — whether you have a direct line to the board or are filtered through a CIO who owns the risk narrative. These are not HR details. They're legal and strategic decisions.

Jordan: Brief note on the RSAC absence — the Trump administration chose not to attend the world's largest cybersecurity conference. The public-private partnership model that built CISA's threat intelligence sharing programs, that made sector-specific ISACs functional, that enabled coordinated response during major incidents — that model depends on government showing up. When they don't, the signal to allies and to the private sector is not subtle.

Alex: For CISOs, the practical implication is this: don't assume federal threat intelligence pipelines will be as robust or as timely going forward. Diversify your intel sources. Lean into industry ISACs and commercial threat intelligence. The operational relationships you've built with FBI field offices and CISA regional advisors are worth maintaining — but don't make them your primary dependency.

Jordan: On the funding side — Tenex raised two hundred and fifty million in a Series B for its AI-driven SOC platform. The thesis is autonomous detection and response with human oversight reserved for complex threats. Two-fifty at Series B is a significant market signal. The AI SOC category is moving from pilot to production conversation for a lot of enterprises.

Alex: If you're in a SOC modernization cycle or evaluating MSSP contracts, this category deserves a structured evaluation. The staffing economics and the dwell time reduction claims are both compelling on paper. Validate them against your environment before you sign anything.

Jordan: Looking at the week as a whole, the theme is convergence. Supply chain risk converging with nation-state objectives. Cyber operations converging with kinetic military action. Destructive attacks converging with ransomware tradecraft. The clean categorical boundaries that organized our defenses — nation-state versus criminal, espionage versus destruction, IT versus OT — are dissolving. That has real implications for how you build detection, how you draft IR playbooks, and how you present risk to your board.

Alex: The board conversation has to evolve with it. Threat actors aren't respecting the org chart of your risk framework, and your reporting shouldn't either. The axios story alone is a case for revisiting software supply chain as a board-level agenda item — not as a technology appendix, but as a strategic risk with direct revenue and liability implications.

Jordan: The three action items leaving this episode: one, axios build inventory and credential rotation if you have any exposure to the poisoned window. Two, Citrix NetScaler patch — treat Thursday as your deadline, not just the federal government's. Three, if Trivy is in your pipeline, audit its credential access scope today.

Alex: That's Cleartext for Wednesday, April 1st. We'll be back tomorrow. If this was useful, share it with a peer who needs it. Stay sharp.

Cleartext is an automated daily podcast for CISOs and security leaders. Generated 2026-04-01.

Sources are pulled from: CyberScoop, The Record, SecurityWeek, Krebs on Security, Dark Reading, Cybersecurity Dive, BleepingComputer, Wired, Ars Technica, TechCrunch, Help Net Security, VentureBeat, Risky Business News, The Hacker News, CISA, and BankInfoSecurity.

Daily cybersecurity briefing for CISOs and security leaders.

🎧 Listen to this episode

Today's episode covers 9 stories across 5 topic areas, including: Iranian Cyberthreats Test US Infrastructure Defenses; ‘Missed opportunity’: US government’s absence from RSAC Conference leaves stark void; Axios npm packages backdoored in supply chain attack.

BankInfoSecurity · Mar 31 · Relevance: ████████░░ 8/10

Why it matters to CISOs: Iranian-linked groups prepositioning in US critical infrastructure signals elevated risk for enterprises in water, energy, and adjacent sectors. CISOs should review threat intelligence feeds and validate detection coverage for known Iranian TTPs.

📖 Read full article

Cybersecurity Dive · Mar 31 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: The absence of federal participation at RSAC signals a potential weakening of public-private cybersecurity partnerships that enterprise security leaders have relied on for threat intelligence sharing and coordinated defense.

📖 Read full article

Help Net Security · Mar 31 · Relevance: █████████░ 9/10

Why it matters to CISOs: Axios is one of the most widely used JavaScript libraries in enterprise applications. CISOs need to immediately verify whether compromised versions (1.14.1, 0.30.4) are present in any builds and assess software supply chain controls.

📖 Read full article

Cybersecurity Dive · Mar 30 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: A 20-day recovery timeline at a major medtech manufacturer underscores the operational resilience challenge CISOs face, particularly the cascading business impact of cyberattacks on manufacturing, supply chain, and order fulfillment.

📖 Read full article

The Record (Recorded Future) · Mar 30 · Relevance: ████████░░ 8/10

Why it matters to CISOs: A $36M GDPR fine against Intesa Sanpaolo for inadequate technical and organizational security measures reinforces that regulators are imposing material financial penalties, making data protection investment a board-level financial risk discussion.

📖 Read full article

BankInfoSecurity · Mar 31 · Relevance: ████████░░ 8/10

Why it matters to CISOs: Directly addresses the growing personal liability trend facing CISOs post-breach, affecting talent retention, risk reporting practices, and the structural positioning of the security function within the enterprise.

📖 Read full article

BankInfoSecurity · Mar 31 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: Non-human identity management is an emerging gap as enterprises deploy AI agents at scale. This $120M raise signals market validation of the agentic identity governance category that CISOs will need to address.

📖 Read full article

BleepingComputer · Mar 30 · Relevance: █████████░ 9/10

Why it matters to CISOs: Active exploitation of Citrix NetScaler ADC/Gateway (CVE-2026-3055) with comparisons to the devastating 2023 CitrixBleed campaign demands immediate patching action and network forensics to check for compromise.

📖 Read full article

BleepingComputer · Mar 30 · Relevance: █████████░ 9/10

Why it matters to CISOs: F5 BIG-IP is ubiquitous in enterprise environments. Reclassification from DoS to critical RCE with active webshell deployment means CISOs must treat this as an emergency patching event and conduct IOC sweeps on all BIG-IP APM instances.

📖 Read full article

Jordan: Someone backdoored Axios. Not a niche library. Not a package you've never heard of. Axios — downloaded hundreds of millions of times, sitting inside enterprise applications across every industry. Versions 1.14.1 and 0.30.4. If you haven't checked your builds yet, that is the first call you make after this episode.

Alex: It's Tuesday, March 31st, 2026. You're listening to Cleartext. I'm Alex Chen.

Jordan: And I'm Jordan Reeves.

Alex: Today we have a dense one. Two critical vulnerabilities under active exploitation — Citrix and F5 — that both warrant emergency response. A major supply chain compromise in one of the most widely deployed JavaScript libraries on the planet. Iranian threat actors prepositioning in U.S. critical infrastructure. A $36 million GDPR fine that should be in front of every board's audit committee. And a conversation about CISO personal liability that hits close to home for a lot of people listening. Let's get into it.

Jordan: Let's start with the supply chain story because the blast radius here is significant. On March 30th, an attacker compromised the GitHub and npm accounts of the primary Axios developer. They published backdoored versions — 1.14.1 and 0.30.4 — that pull in a malicious dependency called plain-crypto-js, which drops RATs on Windows, macOS, and Linux. Cross-platform. Automated. This isn't a proof of concept. It's a full exploitation chain.

Alex: The reason this is a nine out of ten story is Axios's ubiquity. This is not a corner-case dependency. It's a default HTTP client in a massive percentage of enterprise JavaScript applications, internal tools, CI/CD pipelines, customer-facing products. The attack surface is enormous and the detection window was short.

Jordan: The immediate action is straightforward: inventory your builds, check your lock files, confirm which versions you're running. But the harder conversation is the one your engineering leadership doesn't want to have — which is that you probably don't have a complete, real-time picture of your transitive dependencies. Most organizations don't. This attack didn't exploit a zero-day in your code. It exploited your trust in an open-source maintainer's account security.

Alex: And that's the supply chain problem in a sentence. You inherit the security posture of every developer whose package you consume. So the board question becomes: what is your software composition analysis coverage, and when did you last validate it end to end?

Jordan: Now let's talk about the two vulnerabilities, because both are actively exploited and both require action this week. CVE-2026-3055, the Citrix NetScaler flaw. CISA has already ordered federal agencies to patch by Thursday. Researchers are drawing direct comparisons to CitrixBleed in 2023, which was one of the most broadly exploited vulnerabilities of that year. The attack extracts sensitive data from ADC and Gateway appliances.

Alex: If you lived through CitrixBleed, you know what that comparison means. It means threat actors are already tooled up. It means the exploitation curve is steep. The standard advice applies: patch immediately, but also run forensics. Don't assume that patching closes the window on a compromise that may already have occurred.

Jordan: Right alongside it — CVE-2025-53521 in F5 BIG-IP. This one was originally disclosed in October as a high-severity denial-of-service vulnerability. It has been reclassified to critical remote code execution, and attackers are actively deploying webshells on unpatched devices. The NCSC has urged immediate action. The reclassification is the key detail here — your team may have triaged this at a lower priority level based on the original disclosure. That calculus has changed completely.

Alex: Both of these are infrastructure-layer vulnerabilities in products that sit at critical control points — network access, load balancing, gateway functions. A webshell on your BIG-IP is a persistent foothold with significant lateral movement potential. This is emergency patching territory, and your SOC needs to be running IOC sweeps on every BIG-IP APM instance in your environment today.

Jordan: Now to the geopolitical layer, and this one has legs. Iranian-linked groups are actively targeting U.S. water systems with what analysts are describing as prepositioned access — meaning they're not necessarily there to cause immediate damage, they're there to be ready. The concern is rapid activation if the geopolitical situation escalates.

Alex: The term prepositioning is doing a lot of work here, and CISOs should understand what it means operationally. This isn't opportunistic scanning. It's deliberate, patient implantation of access that can be weaponized on a timeline that someone else controls. The threat isn't theoretical — it's the difference between a breach you're responding to and a kinetic moment you're not prepared for.

Jordan: The sectors most directly in the crosshairs are water, energy, and adjacent critical infrastructure. But if your organization has any dependencies on municipal water systems, regional energy providers, or industrial supply chains, you have downstream exposure. This is a moment to revisit your third-party risk framework with infrastructure dependencies specifically in mind. And if you're not already subscribed to CISA's critical infrastructure threat feeds, there's no good reason not to be.

Alex: Which connects to our second geopolitical story, because the irony is sharp. The Trump administration chose not to attend RSAC this year — the world's largest cybersecurity conference — at precisely the moment when public-private threat intelligence sharing matters most. Multiple experts are calling it a missed opportunity. I'd call it a structural signal.

Jordan: The intelligence sharing mechanisms that enterprise security teams have relied on — the ISACs, the CISA advisories, the coordinated disclosure pipelines — those don't disappear overnight, but they atrophy when the federal government stops showing up. For CISOs, the practical implication is that you may need to lean harder on commercial threat intelligence and industry peer networks to fill gaps that were previously covered by government partnerships.

Alex: That's a budget conversation and a vendor conversation. File it accordingly.

Jordan: Let's talk about Stryker. Twenty days to restore most manufacturing operations after a March 11 cyberattack. Ordering and shipping disrupted. Significant supply chain dependencies affected. They're a major medtech manufacturer, so the downstream implications include hospitals and surgical supply chains.

Alex: The twenty-day number is what boards need to internalize. Not as a data point about Stryker specifically, but as a reference case for what operational recovery actually looks like in a manufacturing environment. Tabletop exercises that assume a week-long recovery are not calibrated to reality. If you are a CISO at a manufacturer, or if manufacturing is anywhere in your supply chain, your resilience planning should be built around a multi-week disruption scenario, not a multi-day one.

Jordan: Now to governance, and two stories that belong in the same conversation. Italy's data protection authority fined Intesa Sanpaolo — one of Europe's largest banks — $36 million for serious shortcomings in personal data security. Inadequate technical and organizational measures. That language is deliberate and it's GDPR language. This is one of the largest GDPR fines against a financial institution to date.

Alex: The signal for CISOs here is straightforward: regulators have moved past warnings. They're issuing material fines, and they're doing it against well-resourced institutions who presumably had security programs in place. Inadequate technical and organizational measures is a phrase your board's audit committee should be evaluating against your own posture right now. This is exactly the kind of third-party reference point that makes the security investment conversation easier.

Jordan: And that connects directly to the liability piece. BankInfoSecurity ran an analysis today on the growing trend of regulators pursuing personal accountability for CISOs after major breaches. The thesis is that rising personal liability is changing how security leaders report risk — and not for the better. When CISOs are personally exposed, the incentive to surface uncomfortable risk to boards starts to compete with the incentive for self-preservation.

Alex: I'll be direct about this one because it affects everyone listening. The personal liability trend is real. The SolarWinds case, what happened to the Uber CISO — these weren't aberrations. They're shaping the role. And the downstream effect is exactly what that analysis describes: experienced practitioners are walking away, and those who stay are structuring their risk reporting to create documentation trails rather than genuine dialogue. That is bad for organizations and it's bad for the profession.

Jordan: The structural fix requires boards to stop treating the CISO as the designated fall guy and start treating security as a shared governance responsibility. That's a conversation for the general counsel's office, the board, and the CEO — not just the CISO.

Alex: Brief note on the funding side: Oasis Security raised $120 million Series B for non-human identity and AI agent governance. The category is called agentic identity. If your organization is deploying AI agents at scale — and most enterprises are starting to — those agents are acquiring credentials, making API calls, accessing data stores. They are identities, and they are almost certainly outside your current IAM governance framework. Watch this space. The investment validates the problem is real.

Jordan: So what's the theme of the week?

Alex: It's trust degradation across multiple vectors simultaneously. Supply chain trust — Axios. Infrastructure trust — Citrix, F5. Government partnership trust — the RSAC absence. Regulatory trust — the GDPR fine, the liability conversation. These aren't separate stories. They're a composite picture of an environment where the assumptions that enterprise security programs were built on are being stress-tested all at once.

Jordan: The organizations that navigate this period well are going to be the ones that treat threat intelligence as infrastructure, not a line item. That invest in supply chain visibility before the incident. That build board relationships based on honest risk dialogue rather than managed reassurance.

Alex: That's the work. Thanks for listening to Cleartext. If today's episode was useful, share it with a peer. We'll be back tomorrow.

Jordan: Stay sharp.

Cleartext is an automated daily podcast for CISOs and security leaders. Generated 2026-03-31.

Sources are pulled from: CyberScoop, The Record, SecurityWeek, Krebs on Security, Dark Reading, Cybersecurity Dive, BleepingComputer, Wired, Ars Technica, TechCrunch, Help Net Security, VentureBeat, Risky Business News, The Hacker News, CISA, and BankInfoSecurity.