Cleartext

Daily cybersecurity briefing for CISOs and security leaders.

🎧 Listen to this episode

Today's episode covers 9 stories across 6 topic areas, including: Srsly Risky Biz: The four hour cyber war on Iran; 149 Hacktivist DDoS Attacks Hit 110 Organizations in 16 Countries After Middle East Conflict; Zurich Acquires Beazley in $11 Billion Deal to Lead Cyberinsurance.

Risky Business News · Mar 05 · Relevance: █████████░ 9/10

Why it matters to CISOs: The use of cyber operations in the opening hours of the US-Israeli attack on Iran — and Iran's rapid internet blackout response — sets new precedents for how cyber fits into kinetic conflict, with direct implications for threat modeling and geopolitical risk assessments.

📖 Read full article

The Hacker News · Mar 04 · Relevance: ████████░░ 8/10

Why it matters to CISOs: Retaliatory hacktivist DDoS campaigns spanning 16 countries after the US-Israel strikes on Iran mean CISOs at global enterprises need to reassess DDoS resilience and monitor geopolitical triggers that could make their organizations targets.

📖 Read full article

SecurityWeek · Mar 04 · Relevance: █████████░ 9/10

Why it matters to CISOs: An $11B acquisition reshaping the cyber insurance market will affect policy pricing, coverage terms, and underwriting standards — CISOs who rely on cyber insurance as a risk transfer mechanism should monitor how this consolidation changes their renewal dynamics.

📖 Read full article

The Record (Recorded Future) · Mar 05 · Relevance: ████████░░ 8/10

Why it matters to CISOs: Google's annual zero-day report showing 90 exploited vulnerabilities in 2025 — with nearly half targeting enterprise infrastructure and spyware vendors and China leading attribution — provides critical data for board-level risk discussions and defensive investment prioritization.

📖 Read full article

The Hacker News · Mar 05 · Relevance: ████████░░ 8/10

Why it matters to CISOs: The Tycoon 2FA takedown disrupts a major adversary-in-the-middle phishing platform that targeted MFA-protected accounts at scale — CISOs should use this window to audit phishing-resistant authentication (FIDO2/passkeys) adoption and review incident logs for past Tycoon 2FA indicators.

📖 Read full article

SecurityWeek · Mar 04 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: LexisNexis is a major data aggregator embedded in legal, compliance, and due-diligence workflows across enterprises — a breach exposing 400,000 personal records raises immediate third-party risk concerns for CISOs whose organizations consume LexisNexis services.

📖 Read full article

VentureBeat Security · Mar 04 · Relevance: ████████░░ 8/10

Why it matters to CISOs: The federal directive to cease Anthropic usage revealed that most organizations have no inventory of where AI models sit in their workflows — CISOs must urgently build AI supply chain maps before a similar vendor disruption hits the private sector.

📖 Read full article

BankInfoSecurity · Mar 05 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: Fig Security's $30M Series A addresses a real pain point for CISOs — lack of visibility into complex SecOps pipelines where silent failures in SIEMs, data lakes, and automation tools undermine detection capabilities.

📖 Read full article

SecurityWeek · Mar 05 · Relevance: █████████░ 9/10

Why it matters to CISOs: A 23-exploit iOS kit originally wielded by Russian state actors is now proliferating into criminal campaigns including crypto theft — this represents a significant escalation in mobile threat risk for enterprises with executive and high-value targets carrying iOS devices.

📖 Read full article

Alex: It's Thursday, March 5th, 2026. This is Cleartext. I'm Alex Chen.

Jordan: And I'm Jordan Reeves. Let's get into it.

Alex: We have a packed show today. The cyber dimension of the Iran strikes is coming into sharper focus, and it's rewriting assumptions about how offensive cyber integrates into kinetic operations. We'll talk about the hacktivist wave that followed, an eleven billion dollar deal that's about to reshape cyber insurance, Google's annual zero-day report, a major phishing platform takedown, an iOS exploit kit that's jumped from Russian intelligence to criminal markets, and why the Pentagon's Anthropic cutoff should be a wake-up call for every CISO listening. Let's start where the stakes are highest.

Jordan: So Risky Business put out their analysis this morning on what they're calling the four-hour cyber war on Iran. And the framing is exactly right. Cyber operations were integral to the opening salvo of the US-Israeli strikes. They weren't a sideshow. They weren't a "nice to have." They were instrumental in the operation targeting Supreme Leader Khamenei directly. This is the clearest example we've ever seen of cyber as a first-strike enabler in a major military operation.

Alex: And what's equally significant is the Iranian response. A nationwide internet blackout within four hours. That's a defensive playbook we've theorized about but rarely seen executed at national scale under actual combat conditions.

Jordan: Right. Iran essentially pulled the plug on its own internet to limit further cyber penetration and to control the information environment. It's a blunt instrument, but it tells you something about how seriously they assessed the cyber threat in those opening hours. They were willing to accept massive economic and communications disruption to stop the bleeding.

Alex: For CISOs, the takeaway isn't about Iran specifically. It's about what this means for threat modeling. If you're operating in any sector adjacent to geopolitical friction, energy, defense, financial services, critical infrastructure, you need to update your assumptions. Cyber is now a confirmed component of opening-day military operations, not a theoretical one. Your threat models should reflect that.

Jordan: And the speed matters. Four hours from first strike to internet blackout. The decision cycles in this domain are compressing dramatically. If you're waiting for a threat intelligence briefing to tell you things have escalated, you're already behind.

Alex: Which brings us directly to story two. Within days of the strikes, 149 hacktivist DDoS attacks hit 110 organizations across 16 countries. Two groups, Keymous+ and DieNet, drove nearly 70 percent of that activity. This is the retaliatory wave that follows every major geopolitical event now. It's become predictable.

Jordan: Predictable in pattern, unpredictable in targeting. That's the problem. These groups don't follow a rational target selection process. You might be a mid-size logistics company in the Netherlands and suddenly you're on someone's hit list because of a perceived alliance. The 16-country spread tells you everything. This isn't surgical. It's scattershot.

Alex: If you're a CISO and you haven't stress-tested your DDoS resilience in the last 90 days, this is your prompt. And you should be setting up geopolitical trigger alerts with your threat intel team. When kinetic operations happen, assume the hacktivist wave is 48 to 72 hours behind.

Jordan: Shifting gears to something that's going to affect every CISO's budget conversation. Zurich acquiring Beazley for eleven billion dollars. That is a massive consolidation in cyber insurance.

Alex: This is a big deal. Beazley has been one of the most sophisticated cyber insurance underwriters in the market. They've driven a lot of the innovation in how policies are structured, how risk is assessed, how incident response is embedded into coverage. Zurich is enormous but hasn't been the cyber leader. This acquisition changes that overnight.

Jordan: So what does it mean practically?

Alex: Three things. First, market concentration. When your dominant cyber insurer gets bigger, your negotiating leverage as a policyholder potentially shrinks. Second, underwriting standards. Beazley has been aggressive about requiring specific security controls for coverage. Expect those standards to propagate across Zurich's broader book. Third, and this is the one I'd watch most closely, pricing dynamics. In the near term, consolidation usually means upward pressure on premiums as the combined entity rationalizes its portfolio.

Jordan: CISOs who've been using cyber insurance as a meaningful risk transfer mechanism need to be gaming this out now, not when their renewal comes up in Q3.

Alex: Exactly. Talk to your broker. Understand what the combined entity's appetite looks like for your sector. And if you've been deferring investments in controls that insurers care about, this is the moment where that deferred investment starts costing you real money.

Jordan: Let's talk about Google's annual zero-day report, because the numbers are sobering. Ninety zero-days actively exploited in 2025, up from 78 the year before. Nearly half targeted enterprise software and appliances. And the top attributed exploiters were commercial spyware vendors and China-linked actors.

Alex: That enterprise targeting number is the one I'd bring to the board. We've been watching zero-day exploitation shift from consumer endpoints toward enterprise infrastructure for several years now, and this data confirms the trend is accelerating. Firewalls, VPN appliances, collaboration platforms. These are the things attackers are burning zero-days on.

Jordan: And the spyware vendor angle connects directly to our next story. Google and iVerify jointly published analysis on an iOS exploit kit called Coruna. Twenty-three previously undocumented iOS exploits, originally attributed to Russian state actors, now proliferating into criminal campaigns including crypto theft.

Alex: Twenty-three undocumented exploits in a single kit. That's an extraordinary arsenal. And the proliferation pattern is what should concern every CISO. State-developed tools leaking into criminal ecosystems is not new, but the velocity is increasing and the target surface is mobile, where most enterprises have less visibility.

Jordan: If you have executives, board members, or anyone with access to sensitive data carrying iOS devices, and of course you do, this changes your mobile threat calculus. The assumption that iOS is inherently more secure than alternatives has always been relative. This kit makes it a lot less relative.

Alex: Action items here are concrete. Ensure mobile device management is enforced on every device with access to corporate resources. Push iOS updates aggressively. And if you're in a high-risk sector, look at mobile threat detection solutions. iVerify's involvement in the analysis is not coincidental. They have a product in this space.

Jordan: Now, a genuinely good news story. Europol led a coalition takedown of Tycoon 2FA, one of the largest phishing-as-a-service platforms operating. This thing was sending fraudulent emails to over 500,000 organizations monthly. Microsoft seized 330 domains. It's been active since August 2023.

Alex: Tycoon 2FA was particularly nasty because it was purpose-built for adversary-in-the-middle attacks against MFA-protected accounts. It didn't just phish credentials. It phished sessions, which means your standard MFA was not a defense.

Jordan: The takedown creates a window. Operators who relied on Tycoon 2FA are temporarily disrupted. Use this window. Audit your logs for known Tycoon 2FA indicators. And more importantly, use it as internal ammunition to accelerate your move to phishing-resistant authentication. FIDO2, passkeys. If your MFA can be proxied, it's not enough.

Alex: Agreed. This takedown is a reprieve, not a solution. The next PhaaS platform is already out there.

Jordan: Quick hit on the LexisNexis breach. Hackers leaked 2GB of files including 400,000 personal records. LexisNexis confirmed it. If your organization uses LexisNexis for due diligence, legal research, compliance workflows, this is a third-party risk event. Assess your exposure, notify your privacy team, and check whether any of your data or your customers' data could be in that dataset.

Alex: Moving to the governance story that honestly might be the most important operational lesson of the week. The Pentagon ordered all agencies to phase out Anthropic technology within six months. And it exposed something uncomfortable. Only 15 percent of CISOs surveyed said they could map their AI vendor dependencies.

Jordan: Fifteen percent. That number should embarrass this industry.

Alex: It should. And here's the thing. This isn't hypothetical risk. The government just told agencies to rip out a specific AI vendor. If that happened to your organization tomorrow, with any AI provider, could you even identify everywhere it's embedded? Not just what you procured directly, but what's running inside your vendors, your sub-vendors, your shadow SaaS platforms?

Jordan: The AI supply chain is the new shadow IT problem, except it's deeper and harder to see. These models are embedded in tools your employees adopted without a procurement process. They're in APIs your vendors call without disclosing it. The dependency graph is invisible to most organizations.

Alex: My advice: treat this as an urgent inventory exercise. Start building your AI dependency map now. Don't wait for your own Anthropic moment.

Jordan: Brief mention of Fig Security raising 30 million in Series A to address SecOps pipeline visibility. The thesis is that CISOs can't see when their SIEMs, data lakes, and automation tools are silently failing. It's a real problem. If your detection pipeline has a gap and nobody notices, you're flying blind and confident about it. Worth watching.

Alex: Let's bring it together. Jordan, what's the thread you see running through today's stories?

Jordan: The thread is dependency exposure. Whether it's dependency on internet connectivity in a warzone, dependency on a single cyber insurer, dependency on the assumption that iOS is secure, dependency on MFA that can be proxied, or dependency on AI vendors you can't even enumerate. Every one of these stories is about an organization or a nation discovering that something they relied on was more fragile than they thought.

Alex: And the CISO's job is to find those dependencies before they're tested. Map them. Stress-test them. Have a plan for when they fail. The Iran strikes showed us that at national scale. The Anthropic cutoff showed it at the vendor level. The zero-day report showed it at the technology level. The pattern is the same.

Jordan: If you do one thing this week, pick the dependency you understand the least and go pull the thread. You'll be surprised what you find.

Alex: That's our show for Thursday, March 5th. Thanks for spending your morning with us. We'll be back tomorrow with more. This is Cleartext.

Jordan: Stay sharp.

Cleartext is an automated daily podcast for CISOs and security leaders. Generated 2026-03-05.

Sources are pulled from: CyberScoop, The Record, SecurityWeek, Krebs on Security, Dark Reading, Cybersecurity Dive, BleepingComputer, Wired, Ars Technica, TechCrunch, Help Net Security, VentureBeat, Risky Business News, The Hacker News, CISA, and BankInfoSecurity.

Daily cybersecurity briefing for CISOs and security leaders.

🎧 Listen to this episode

Today's episode covers 9 stories across 6 topic areas, including: Risky Bulletin: Cyber Command conducted cyberattacks ahead of Iran strikes; Pro-Russia actors team with Iran-linked hackers in attacks; Possible U.S.-developed exploits linked to first known ‘mass’ iOS attack.

Risky Business News · Mar 03 · Relevance: █████████░ 9/10

Why it matters to CISOs: Active US cyber operations against Iran signal heightened state-level cyber conflict; CISOs in critical infrastructure and defense supply chains should elevate threat monitoring for retaliatory activity from Iranian and allied threat actors.

📖 Read full article

Cybersecurity Dive · Mar 03 · Relevance: ████████░░ 8/10

Why it matters to CISOs: The convergence of Russian and Iranian threat actors targeting US and Middle East critical infrastructure represents a new cooperative threat model that broadens the adversary capability set CISOs must defend against.

📖 Read full article

CyberScoop · Mar 03 · Relevance: ████████░░ 8/10

Why it matters to CISOs: The proliferation of a government-grade iOS exploit kit to Russian and Chinese cybercriminals represents a paradigm shift in mobile threat exposure — CISOs must reassess mobile device security postures and MDM enforcement.

📖 Read full article

The Record (Recorded Future) · Mar 04 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: The takedown of Leakbase disrupts a major marketplace for stolen credentials and exploits; CISOs should check whether their organizations' data appeared on the forum and assess credential exposure.

📖 Read full article

SecurityWeek · Mar 04 · Relevance: █████████░ 9/10

Why it matters to CISOs: This mega-deal reshapes the cyber insurance landscape; CISOs should anticipate changes in policy terms, underwriting standards, and coverage availability as the combined entity consolidates market power.

📖 Read full article

The Record (Recorded Future) · Mar 03 · Relevance: ████████░░ 8/10

Why it matters to CISOs: LexisNexis holds massive troves of legal, financial, and personal data used across enterprises; this breach underscores the risk of legacy data stores and the downstream impact on organizations relying on this data.

📖 Read full article

VentureBeat Security · Mar 04 · Relevance: █████████░ 9/10

Why it matters to CISOs: The federal ban on Anthropic technology reveals that most enterprises lack visibility into where AI models are embedded across their supply chains — a critical governance gap CISOs must address before similar mandates or incidents affect them.

📖 Read full article

BankInfoSecurity · Mar 04 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: A $34M seed round for AI governance tooling signals strong investor conviction that CISOs need dedicated platforms to manage shadow AI, MCP servers, and token-level cost controls — a rapidly growing budget category.

📖 Read full article

The Hacker News · Mar 04 · Relevance: ████████░░ 8/10

Why it matters to CISOs: VMware Aria Operations is widely deployed in enterprise environments for infrastructure monitoring; an unauthenticated RCE flaw being actively exploited demands immediate patching priority.

📖 Read full article

Alex: Welcome to Cleartext. It's Wednesday, March fourth, twenty twenty-six. I'm Alex Chen.

Jordan: And I'm Jordan Reeves. So the US government apparently built an iOS exploit kit so good that it ended up in the hands of Russian hackers and then Chinese cybercriminals, and now potentially tens of thousands of iPhones are compromised. We'll get to that. But first, we need to talk about the fact that Cyber Command went offensive against Iran before the kinetic strikes, and the alliance forming in the aftermath might be the most consequential threat development of the year so far.

Alex: Big show today. We're covering the US cyber operations against Iran and the Russia-Iran threat actor convergence that's already spinning up. That iOS exploit kit proliferation story Jordan just mentioned. A massive deal reshaping cyber insurance. The Pentagon's Anthropic ban and what it reveals about AI supply chain blindness. A LexisNexis breach. A VMware Aria flaw you need to patch today. And a startup raising thirty-four million at seed for AI governance. Let's get into it.

Jordan: So Risky Business reported Monday that Cyber Command conducted offensive cyber operations ahead of the kinetic strikes on Iran. Communications disruption, surveillance support, the kind of battlefield preparation we've theorized about for years but rarely see confirmed this quickly. What's notable is the speed of attribution. The government wanted this known.

Alex: That's the signal, right? The messaging is deliberate. It says we have these capabilities and we will use them. But for CISOs, the immediate concern isn't the US offensive posture. It's the retaliation calculus. When you punch a nation-state in cyberspace ahead of bombing them, the cyber response is guaranteed.

Jordan: And it's already materializing. Cybersecurity Dive reported that pro-Russia actors have formed a loose alliance with Iran-linked hackers, specifically targeting critical infrastructure in the US and the Middle East. This isn't theoretical. These groups are actively collaborating right now.

Alex: This is what I'd call a cooperative threat model, and it changes the math for defenders. Historically you'd profile Iranian actors and Russian actors separately. Different TTPs, different tooling, different infrastructure. Now you've got Russian operational sophistication, think access brokering, initial access tradecraft, combined with Iranian persistence and destructive intent. The capability set broadens significantly.

Jordan: Right. Iranian groups have always been willing to go destructive. Shamoon, the Albania attacks. Russian groups bring better zero-days, better infrastructure, better operational security. You fuse those two and you get something that's harder to detect and more willing to cause damage. If you're a CISO in energy, water, transportation, defense industrial base, you should be elevating your threat monitoring posture today. Not next week. Today.

Alex: And talk to your threat intel providers. Make sure they're correlating across both actor sets, not siloing them.

Jordan: Now let's connect this to the iOS story because it's actually thematically related. CyberScoop reported on what researchers are calling the Coruna exploit kit. Twenty-three exploits across five chains targeting iOS thirteen through seventeen point two point one. Google's threat analysis group found it in the wild. Here's where it gets really uncomfortable. This kit was likely originally built for the US government. It moved from a spyware vendor's customer to Russian hackers to Chinese cybercriminals. And now it's being used at mass scale. Possibly tens of thousands of devices.

Alex: This is the proliferation problem we've been warning about for years. Government-grade exploits don't stay contained. They leak, they get stolen, they get resold. And when something this sophisticated hits the criminal ecosystem, your entire mobile threat model changes overnight.

Jordan: The sophistication here is real. Five separate exploit chains means redundancy. If one gets patched, the kit pivots to another. This isn't a single vulnerability. It's a platform. And most enterprise MDM deployments aren't configured to detect exploitation at this level. They'll enforce app policies, sure. But kernel-level compromise from a chain like this? Your MDM thinks everything is fine.

Alex: So what's the action? First, enforce iOS updates aggressively. Anything below seventeen point two point two should be off your network. Second, reassess your mobile threat defense tooling. If you don't have endpoint detection on mobile devices, this is the story that justifies the budget. Third, for high-value personnel, executives, board members, anyone with access to sensitive communications, consider dedicated secure devices with restricted app installation.

Jordan: And if you're in the defense supply chain, given the Iran context we just discussed, assume you're a target for exactly this kind of capability.

Alex: Let's shift to something that'll affect every CISO's budget conversation. Zurich is acquiring Beazley for eleven billion dollars. Beazley has been one of the most sophisticated and CISO-friendly cyber insurers in the market. Zurich is a global insurance giant. This creates a dominant player in cyber insurance.

Jordan: And dominant players set terms. That's the concern.

Alex: Exactly. When the deal closes, likely second half of this year, the combined entity will have enormous market power. I'd expect tighter underwriting standards, more prescriptive security control requirements, and potentially less flexibility on policy terms. If you've enjoyed Beazley's relatively progressive approach to cyber coverage, don't assume that survives integration with Zurich's risk appetite.

Jordan: Practically speaking, if your renewal is coming up in the next twelve months, start those conversations early. Lock in terms before the new entity starts flexing.

Alex: And use this as leverage in your board conversations. The insurance market is consolidating because the risk is real and growing. That's an argument for security investment, not against it.

Jordan: Now the Pentagon story. This one is going to resonate with every CISO listening. The federal government ordered all agencies to stop using Anthropic technology with a six-month phaseout. That's a significant mandate. But VentureBeat's reporting surfaces the real problem. Only fifteen percent of CISOs surveyed said they've mapped their AI vendor dependencies.

Alex: Fifteen percent. Let that sink in. Eighty-five percent of security leaders don't know where AI models are embedded in their environments. And these dependencies cascade. Your SaaS vendor uses Anthropic for a feature. Their vendor uses it for data processing. You have no visibility into any of it.

Jordan: This is shadow IT on steroids. At least with shadow IT, someone in the organization made a conscious decision to deploy something. With AI dependencies, your vendors are embedding models into products without telling you, sometimes without even updating their own documentation.

Alex: The federal ban is the canary in the coal mine. Today it's Anthropic and government agencies. Tomorrow it could be any AI provider and any regulatory jurisdiction. If the EU decides a particular model doesn't meet AI Act requirements, and that model is buried three layers deep in your supply chain, you have a compliance problem you don't even know about.

Jordan: So the action here is straightforward but hard. You need an AI dependency map. Not just what your organization has deployed directly, but what your vendors are using. Add AI model disclosure requirements to your vendor questionnaires. Make it part of procurement. And do it now, before you're scrambling with a six-month clock like the federal agencies.

Alex: Quick hit on the LexisNexis breach. A threat actor claims to have stolen two gigabytes of data including millions of records from legacy systems. LexisNexis says it's contained.

Jordan: LexisNexis holds legal, financial, and personal data on an enormous scale. If your organization uses their services, and many do for due diligence, background checks, legal research, you should be asking them directly what data was affected and whether your organization's information was in scope. Don't wait for the notification letter.

Alex: And this is yet another legacy data story. The attackers went after old systems. The data you forgot about is the data that gets stolen.

Jordan: The Leakbase takedown is worth noting. FBI and European law enforcement took down a major forum for stolen credentials and exploit code. Good news. But CISOs should check with their threat intel teams whether their organization's credentials appeared on Leakbase before it went dark. The data that was traded there is still out in the wild.

Alex: On vulnerabilities, CISA added CVE-2026-22719 to the Known Exploited Vulnerabilities catalog. It's a command injection flaw in VMware Aria Operations, CVSS eight point one. Unauthenticated remote code execution. It's being actively exploited.

Jordan: If you run Aria Operations, and a lot of enterprises do for infrastructure monitoring, patch immediately. Unauthenticated RCE in a monitoring platform means attackers get broad visibility into your environment the moment they're in. This is a priority one.

Alex: Last item. JetStream, a startup led by an ex-CrowdStrike product leader, raised thirty-four million at seed for AI governance tooling. They're targeting shadow AI, MCP server governance, and token-level spending controls.

Jordan: Thirty-four million at seed tells you where the smart money thinks the next budget line is forming. MCP server governance is a real emerging need. If you're evaluating tools in this space, JetStream is one to watch, but the market is moving fast. Don't buy the first thing you see.

Alex: Let's talk about the emerging theme. Jordan, the thread I see running through almost every story today is the collapse of containment assumptions.

Jordan: Explain that.

Alex: Cyber weapons built for the US government end up in Chinese criminal hands. AI models embedded by vendors cascade through supply chains invisibly. Russia and Iran fuse their threat capabilities in real time. Legacy data stores you thought were dormant get breached. The assumption that anything stays contained, tools, data, threats, alliances, that assumption is broken.

Jordan: I'd agree. And the operational implication is that static security models fail faster than ever. Your threat model from January is already wrong. Your vendor risk assessment from last quarter didn't account for AI dependencies. Your mobile security posture didn't anticipate a government-grade exploit kit going mass market.

Alex: So the mandate for CISOs right now is continuous reassessment. Not annual. Not quarterly. Continuous. Map your dependencies. Pressure-test your assumptions. And assume that whatever was contained yesterday is in the wild today.

Jordan: Watch the Iran retaliation space over the next seventy-two hours. If critical infrastructure operators aren't at heightened alert, they should be.

Alex: That's our show for Wednesday, March fourth. Thanks for listening to Cleartext.

Jordan: Stay sharp out there.

Cleartext is an automated daily podcast for CISOs and security leaders. Generated 2026-03-04.

Sources are pulled from: CyberScoop, The Record, SecurityWeek, Krebs on Security, Dark Reading, Cybersecurity Dive, BleepingComputer, Wired, Ars Technica, TechCrunch, Help Net Security, VentureBeat, Risky Business News, The Hacker News, CISA, and BankInfoSecurity.

Daily cybersecurity briefing for CISOs and security leaders.

🎧 Listen to this episode

Today's episode covers 0 stories across 0 topic areas, including: .

Alex: Welcome to Cleartext. It's Tuesday, March 3rd, 2026. I'm Alex Chen.

Jordan: And I'm Jordan Reeves.

Alex: Jordan, let's just get into it because today's stack is heavy. We've got U.S. Cyber Command confirming offensive operations against Iran that directly supported kinetic strikes, downstream retaliation risks to healthcare and critical infrastructure, the FBI running its most public cyber campaign ever against Chinese threats, a new quantum research paper that's going to accelerate a lot of uncomfortable conversations, and a breach at LexisNexis that could have ripple effects across legal and compliance functions everywhere. Plus the cyber insurance market just got a massive shakeup. Let's go.

Jordan: So let's start where the stakes are highest. Over the weekend, a senior U.S. general confirmed what many suspected — Cyber Command conducted offensive operations against Iranian communications and sensor systems to set the stage for the joint U.S.-Israel bombing campaign. Iran's internet connectivity was effectively crippled during the strikes. This is not inference or speculation. This is a flag officer publicly confirming cyber operations were integral to a kinetic military campaign.

Alex: And for CISOs listening, the immediate question is: what does this mean for retaliatory risk? Because this is not just a military story. When you degrade a nation-state's communications infrastructure and eliminate its senior leadership in coordinated strikes, the response calculus changes dramatically. Iran's remaining leadership and its proxy network have limited options for conventional retaliation. Cyber is the asymmetric lever they're going to pull.

Jordan: Right. And BankInfoSecurity is already out this morning with a piece specifically flagging healthcare as a primary target for Iranian proxy retaliation. The reasoning is sound — healthcare is a high-visibility, high-impact sector with historically weaker security postures. Iranian-affiliated groups have hit it before. The expectation from threat intel analysts is DDoS, ransomware, and potentially destructive wiper attacks from sympathizer groups and proxies.

Alex: If you're a healthcare CISO, this is your moment to validate your incident response playbooks, confirm your DDoS mitigation is active, and make sure your threat detection is tuned for Iranian TTPs. But honestly, I'd extend this beyond healthcare. Financial services, energy, water utilities — anyone in critical infrastructure should be on elevated alert. The retaliatory aperture is wide when you're dealing with proxy networks.

Jordan: There's also a subtlety here that's worth naming. Cyber Command's operations were explicitly described as setting the stage for kinetic action. This is the most overt acknowledgment we've seen of cyber as a first-strike enabler in a real conflict. That changes the deterrence calculus globally. Other adversaries are watching this very carefully.

Alex: Which brings us naturally to the FBI's Winter SHIELD campaign, because while Iran is the acute threat, China remains the structural one. Brett Leatherman, the FBI's cyber chief, is running what CyberScoop is calling the bureau's most public cyber campaign ever. The emphasis is on basic security hygiene and intelligence sharing with the private sector to prepare for stepped-up Chinese threats.

Jordan: I have to say, I find this refreshing and slightly alarming in equal measure. Refreshing because the FBI is finally operationalizing threat intelligence sharing at scale rather than treating it as a classified afterthought. Alarming because when the FBI goes this public, this loud, it typically means they're seeing something in the classified space that they're trying to get ahead of without being able to say exactly what it is.

Alex: Agreed. And the hygiene emphasis is deliberate. The FBI knows that most enterprises won't be able to defend against a sophisticated Chinese APT using exotic tooling. But they also know that a shocking number of breaches still happen because of unpatched VPNs, weak MFA, and poor network segmentation. If you haven't engaged with Winter SHIELD yet, do it. The intelligence-sharing channels are genuinely useful.

Jordan: And pair that with the 6G security coalition story. The UK, US, Canada, Japan, Australia, Sweden, and Finland have formed the Global Coalition on Telecoms, unveiled at Mobile World Congress. This is about establishing security and resilience principles for 6G before China dominates the standards process the way it did with significant portions of 5G.

Alex: For CISOs, this is a long-horizon story but it matters for infrastructure planning. If your organization is making decisions about next-generation network architecture, understand that the geopolitical overlay on telecom supply chains is only going to intensify. Vendor selection is increasingly a policy compliance decision, not just a technical one.

Jordan: Let's shift to quantum. SecurityWeek is reporting on a newly announced algorithm that suggests breaking RSA and ECC encryption may require far fewer qubits than Shor's algorithm would demand. The conventional wisdom has been that we need million-qubit machines, which puts the threat comfortably in the future. This paper challenges that assumption materially.

Alex: This is one of those stories that's easy to dismiss as theoretical, and I need CISOs to resist that impulse. Even if the timeline moves from fifteen years to seven years, the migration to post-quantum cryptography is a multi-year effort for any large enterprise. You cannot start that migration three years before the deadline. The harvest-now-decrypt-later threat is already real — adversaries are collecting encrypted traffic today with the expectation of decrypting it when quantum capabilities mature. If your data has long-term sensitivity — and in regulated industries it almost certainly does — your quantum migration roadmap should already exist.

Jordan: And if it doesn't exist, today's story is the one you bring to the board to get it funded. This is no longer a research curiosity. It's a planning imperative.

Alex: Alright, let's talk about the LexisNexis breach. BleepingComputer confirmed that hackers breached LexisNexis Legal & Professional servers and accessed customer and business information. Stolen files have been leaked publicly.

Jordan: LexisNexis is embedded deeply in legal, compliance, risk, and due diligence workflows across nearly every large enterprise. This is a data aggregator breach, which means the blast radius is not limited to LexisNexis itself. If your legal team or compliance function uses LexisNexis — and statistically, they probably do — you need to assess what data you've shared with them and what exposure you may have.

Alex: The downstream regulatory and litigation implications here could be significant, particularly for organizations in financial services and healthcare that rely on LexisNexis for background checks, sanctions screening, and risk assessments. Check your vendor risk management records, notify your legal team if you haven't already, and monitor for any of your organizational data appearing in the leaked files.

Jordan: Now, one I want to spend a minute on — the CyberStrikeAI story. Threat actors have weaponized an open-source AI security testing platform to automate attacks against Fortinet FortiGate appliances across 55 countries. This is the same actor linked to earlier campaigns that breached hundreds of FortiGate firewalls. Team Cymru identified the tool through infrastructure analysis.

Alex: This is the AI-enabled attack scenario we've been warning about, arriving in a very concrete form. An open-source tool designed for legitimate security testing has been repurposed at scale to find and exploit vulnerable network perimeter devices. If you have FortiGate appliances in your environment, validate your patching status today. Not tomorrow.

Jordan: And the broader lesson is that AI is compressing the time between vulnerability disclosure and mass exploitation to almost nothing. The attacker's advantage in that window is growing, not shrinking.

Alex: Let's hit the insurance story quickly because it has real budget implications. Zurich Insurance is acquiring Beazley for $11 billion, creating a $15 billion insurance powerhouse. The transaction is explicitly driven by surging demand for cyber and technology risk coverage.

Jordan: When major insurers consolidate, CISOs should pay attention to two things. First, your policy terms and pricing may shift as the market concentrates. Second, and more importantly, the underwriting requirements that insurers impose become de facto security standards. If Zurich-Beazley decides that certain controls are prerequisites for coverage, that becomes your security baseline whether your board likes it or not.

Alex: Great point. Use this as leverage. When the insurance market is tightening and consolidating, the CISO's argument for security investment gets a powerful financial ally.

Jordan: Quick hit on law enforcement — Project Compass took down 30 alleged members of The Com, a cybercriminal collective behind social engineering and SIM-swapping attacks, with nearly 180 members identified. This is meaningful disruption of a group that's been a persistent nuisance to enterprise security teams dealing with identity-based attacks.

Alex: And Fig Security launched out of stealth with $38 million from Team8 and Ten Eleven. Their focus is finding and fixing broken security data flows across the SecOps stack. It's a narrow but real problem — if your detections aren't firing because log pipelines are broken, you have a visibility gap masquerading as security. Worth watching.

Jordan: Alright, Alex, stepping back — what's the thread this week?

Alex: The thread is convergence. Cyber operations are now openly integrated with kinetic military action. Quantum threats are converging on enterprise cryptography faster than expected. AI tools are converging offensive capability into the hands of mid-tier threat actors. And the insurance market is converging toward a smaller number of entities that will dictate security standards. For CISOs, the message is that the forces shaping your risk environment are accelerating and interconnecting in ways that make siloed responses inadequate. You need to be talking to your board not about individual threats but about the systemic acceleration of risk.

Jordan: And the Iranian retaliation question is the acute version of that. It's not a question of if, it's a question of when and where. Defensive posture should already be elevated. If it's not, today is the day.

Alex: That's our show for Tuesday, March 3rd, 2026. Cleartext is produced for CISOs and senior security leaders. If today's episode was useful, share it with your team. We're back tomorrow. Stay sharp.

Jordan: See you then.

Cleartext is an automated daily podcast for CISOs and security leaders. Generated 2026-03-03.

Sources are pulled from: CyberScoop, The Record, SecurityWeek, Krebs on Security, Dark Reading, Cybersecurity Dive, BleepingComputer, Wired, Ars Technica, TechCrunch, Help Net Security, VentureBeat, Risky Business News, The Hacker News, CISA, and BankInfoSecurity.

Daily cybersecurity briefing for CISOs and security leaders.

🎧 Listen to this episode

Today's episode covers 9 stories across 4 topic areas, including: US and Israel Launch 'Major Combat Operations' Against Iran; Western Cybersecurity Experts Brace for Iranian Reprisal; US-Israel and Iran Trade Cyberattacks: Pro-West Hacks Cause Disruption as Tehran Retaliates.

BankInfoSecurity · Mar 02 · Relevance: ██████████ 10/10

Why it matters to CISOs: Active military conflict with Iran fundamentally changes the cyber threat landscape for Western enterprises; CISOs must immediately elevate defensive postures, particularly for critical infrastructure, financial services, and energy sectors that are prime Iranian retaliation targets.

📖 Read full article

BankInfoSecurity · Mar 02 · Relevance: ██████████ 10/10

Why it matters to CISOs: Threat intelligence firms are reporting the first signs of an Iranian cyber counteroffensive; CISOs need actionable intelligence on Iranian TTPs and should be activating incident response plans and coordinating with sector ISACs immediately.

📖 Read full article

SecurityWeek · Mar 02 · Relevance: ██████████ 10/10

Why it matters to CISOs: This details the specific cyber weapons being deployed — wiper malware, DDoS, and critical infrastructure disruptions — giving CISOs concrete threat vectors to prioritize defenses against in the coming days and weeks.

📖 Read full article

SecurityWeek · Mar 02 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: Air-gapped systems are often considered the last line of defense for classified or sensitive environments; this campaign demonstrates that North Korean actors have developed sophisticated tooling to bridge air gaps, requiring CISOs to reassess assumptions about network isolation controls.

📖 Read full article

SecurityWeek · Mar 02 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: This breach stems from the 2025 Oracle E-Business Suite hacking campaign, underscoring ongoing supply chain risk from enterprise software vulnerabilities; CISOs running Oracle EBS should verify they aren't among unreported victims.

📖 Read full article

BleepingComputer · Mar 02 · Relevance: █████████░ 9/10

Why it matters to CISOs: The UK NCSC's formal advisory gives CISOs a government-backed mandate to escalate security spending and staffing; this type of national-level alert can be used to justify emergency measures to boards and executive leadership.

📖 Read full article

SecurityWeek · Mar 02 · Relevance: ████████░░ 8/10

Why it matters to CISOs: A CISA leadership change during active military conflict with Iran raises questions about continuity of federal cyber defense coordination; CISOs relying on CISA advisories, threat feeds, and JCDC coordination should monitor for any operational disruptions.

📖 Read full article

Help Net Security · Mar 02 · Relevance: ██████░░░░ 6/10

Why it matters to CISOs: Veracode's 2026 report spanning 1.6M applications provides board-ready data showing security debt is a systemic governance issue, not just a technical one — useful ammunition for CISOs seeking budget to address application security backlogs.

📖 Read full article

The Hacker News · Mar 02 · Relevance: ████████░░ 8/10

Why it matters to CISOs: A Russian state-sponsored group exploiting a high-severity Microsoft MSHTML zero-day before patch availability represents an urgent patching priority, especially given the current geopolitical climate with heightened Russian cyber operations.

📖 Read full article

Alex: It's Monday, March 2nd, 2026. This is Security Decoded. I'm Alex Chen.

Jordan: And I'm Jordan Reeves. We are at war. The United States and Israel launched major combat operations against Iran over the weekend, and the cyber dimension of this conflict is already live. If you're a CISO and you haven't elevated your defensive posture as of this morning, you are behind. This is the episode you need to listen to right now.

Alex: Jordan's not being dramatic. This is the most consequential shift in the cyber threat landscape since Russia invaded Ukraine. Today we're going wall to wall on this. We'll cover the kinetic operations and what they mean for your networks, the specific cyber weapons already in play, government advisories you can take to your board this morning, a CISA leadership change that has terrible timing, and then we'll touch on a Russian zero-day, a North Korean air-gap campaign, and a breach that traces back to Oracle EBS. Let's get into it.

Jordan: So here's what happened. President Trump announced major combat operations against Iran in coordination with Israel. The stated objective is Tehran's nuclear program. Iran has responded with missile attacks. This is not a limited strike. This is an escalating military conflict with a nation-state that has one of the most capable offensive cyber programs on the planet.

Alex: And Jordan, I want to frame this for our audience immediately. If you are in critical infrastructure, financial services, energy, water, healthcare, you are on the target list. Iran has demonstrated repeatedly, going back to the Shamoon attacks on Saudi Aramco, through the 2019 and 2020 campaigns against U.S. banks and water utilities, that cyber is their asymmetric weapon of choice when they can't match conventional military power.

Jordan: That's exactly right. And unlike Russia, which often uses cyber for espionage and strategic positioning, Iran's playbook when backed into a corner is destructive. They go for impact. They want to cause pain that's visible and that they can point to as retaliation. The intelligence community has been warning about this scenario for years, and now it's here.

Alex: Let's talk about what's already happening in cyberspace because this isn't theoretical. SecurityWeek is reporting that both sides are actively trading cyberattacks. We're seeing wiper malware, DDoS campaigns, and disruptions to critical infrastructure on both sides. The U.S. and Israel may have launched what some threat intelligence firms are calling the largest cyberattack in history against Tehran's infrastructure.

Jordan: And by Sunday, the first signs of the Iranian counter-offensive were already visible. Threat intelligence firms are tracking initial Iranian cyber operations targeting Western and allied nation infrastructure. This is moving fast. The Iranian cyber apparatus, we're talking about groups like APT33, APT34, MuddyWater, and their proxies, these aren't script kiddies. These are sophisticated operators with established access to Western networks. Some of that access may have been pre-positioned months or even years ago, waiting for exactly this kind of trigger.

Alex: So let's talk about what CISOs should be doing right now, this morning, before lunch. First, activate your incident response plans. Not review them. Activate them. Get your IR teams on heightened alert. Second, contact your sector ISAC. If you're in financial services, energy, healthcare, your ISAC should be pushing threat intelligence right now. Get on those calls. Third, review your threat intelligence feeds for Iranian TTPs. MITRE ATT&CK has extensive documentation on Iranian groups. Focus your detection engineering on those techniques today.

Jordan: I'd add a few operational items. Review your internet-facing attack surface with fresh eyes. Iranian groups love exploiting VPNs, web applications, and exposed management interfaces. Check your DNS configurations. They've used DNS hijacking extensively in past campaigns. And have a conversation with your OT teams if you have operational technology environments. Wiper malware doesn't discriminate between IT and OT once it's inside.

Alex: And this brings us to the UK's response, which I think is significant for a governance reason. The UK's National Cyber Security Centre issued a formal advisory to British organizations about heightened Iranian cyber threats tied directly to this conflict. CISOs, this is the kind of government-backed mandate you can take to your board and your CFO this morning. When a national cyber security agency issues a formal alert, that's your justification for emergency spending, extended shifts, bringing in additional IR support, whatever you need.

Jordan: This is not a drill memo. This is a wartime footing memo.

Alex: Exactly. And the NCSC advisory is actionable. It urges organizations to review and strengthen defenses immediately. If your board asks why you're requesting emergency budget, you point to a Five Eyes nation issuing a formal cyber threat warning. That conversation should be very short.

Jordan: Now here's where the timing gets uncomfortable. CISA, our own federal cybersecurity coordination agency, just went through a leadership change. Nick Andersen has been appointed acting director. The previous acting director, Madhu Gottumukkala, was reassigned within DHS. This is the third leadership transition at CISA in recent memory.

Alex: And Jordan, I have to be blunt about this. A leadership transition at CISA during the opening days of a military conflict with a top-tier cyber adversary is deeply concerning. CISA's Joint Cyber Defense Collaborative, their threat feeds, their advisories, these are critical coordination mechanisms for the private sector. Any disruption in operational tempo, even minor, comes at the worst possible time.

Jordan: CISOs should be monitoring CISA's output closely over the next few days. If you notice a drop in advisory frequency or specificity, lean harder on your commercial threat intelligence providers and your ISAC relationships. Don't assume the federal coordination layer will function at full capacity during a leadership transition in a crisis.

Alex: Good. Let's shift gears briefly, because even in a crisis, there are other threats that haven't stopped operating. Jordan, APT28.

Jordan: Yeah, so while the world is focused on Iran, Russia hasn't taken a day off. Akamai researchers have tied APT28, that's Russia's GRU military intelligence, to the exploitation of CVE-2026-21513, a high-severity vulnerability in Microsoft's MSHTML framework. CVSS 8.8. This was exploited as a zero-day before Microsoft's February Patch Tuesday. The patch is now available.

Alex: The action item here is simple. If you haven't applied the February patches, do it today. This isn't hypothetical exploitation. A nation-state actor was using this in the wild before the patch existed. And in the current environment, with Russia potentially seeing opportunity in the chaos of a new conflict, you cannot afford to leave Russian zero-days unpatched.

Jordan: Agreed. And while we're on nation-state activity, there's a North Korean campaign worth flagging. A DPRK APT has deployed new tooling specifically designed to target air-gapped systems. They're using Windows shortcut files as the initial vector, along with a new implant, loader, propagation tool, and two backdoors.

Alex: This matters for anyone who relies on air-gapped environments as a security control, defense contractors, research facilities, certain financial systems. The assumption that network isolation equals safety has been eroding for years, and this campaign is another proof point. If you have air-gapped systems, you need to be auditing what's crossing those gaps via removable media and ensuring your endpoint detection covers those environments.

Jordan: The sophistication here is notable. This isn't opportunistic. This is purpose-built tooling for bridging air gaps, which tells you the target set is high-value and the investment in development was significant.

Alex: Last story before our outlook. Madison Square Garden confirmed a data breach that was linked to the 2025 Oracle E-Business Suite hacking campaign. MSG is one of many victims in what was a broad exploitation wave targeting Oracle EBS.

Jordan: The real story here isn't MSG specifically. It's that this Oracle EBS campaign is still producing disclosed victims months later. If you're running Oracle EBS, you need to verify you weren't compromised in that wave. Don't assume that because you patched you're clean. These attackers may have established persistence before patches were applied.

Alex: And the months-long gap between the attack and the public confirmation is a governance issue. Boards are increasingly asking about breach disclosure timelines. If you're a CISO, make sure your disclosure process is documented, tested, and aligned with your legal team's guidance, especially now that regulators are paying close attention to notification timing.

Jordan: Alright, let's talk about the week ahead.

Alex: The theme this week is obvious. We are entering a period of sustained, elevated cyber risk driven by a major military conflict. This is not a one-week event. Iranian cyber retaliation will likely escalate over the coming weeks, not diminish. CISOs need to think about sustainment. You can't run your team at sprint pace for months. Think about shift rotations, mental health, and bringing in augmentation now, before fatigue sets in.

Jordan: I'd also watch for opportunistic actors. When the big nation-states are dominating headlines, criminal groups often take advantage of the noise. Ransomware operators know that security teams are distracted. Don't take your eye off the fundamentals while you're focused on the geopolitical threat.

Alex: And one more thing. This is a moment to strengthen your relationship with your board. They're reading the same headlines. They're worried. Come to them with a clear posture assessment, a concrete action plan, and specific asks. This is when CISOs earn trust that lasts for years.

Jordan: The fog of war applies to cyber just as much as kinetic operations. Expect misinformation, expect confusion, and validate before you act on unconfirmed intelligence. Stay sharp out there.

Alex: That's our show for Monday, March 2nd. This is Security Decoded. I'm Alex Chen.

Jordan: I'm Jordan Reeves. Stay safe this week. We'll be back tomorrow.

Cleartext is an automated daily podcast for CISOs and security leaders. Generated 2026-03-02.

Sources are pulled from: CyberScoop, The Record, SecurityWeek, Krebs on Security, Dark Reading, Cybersecurity Dive, BleepingComputer, Wired, Ars Technica, TechCrunch, Help Net Security, VentureBeat, Risky Business News, The Hacker News, CISA, and BankInfoSecurity.