The CyberWire Daily

Patch Tuesday. An Iranian ransomware group puts a premium on U.S. and Israeli targets. Batavia spyware targets Russia’s industrial sector. HHS fines a Texas Behavioral Health firm for failed risk analysis. The Anatsa banking trojan targets financial institutions in the U.S. and Canada. Hackers abuse a legitimate commercial evasion framework to package infostealer payloads. Researchers discovered malicious browser extensions infecting over 2.3 million users. Joe Carrigan, co-host on Hacking Humans discusses phishing kits targeting CFOs. Can felines frustrate algorithms? Purr-haps…

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today we are joined by Joe Carrigan, a co-host of Hacking Humans, as he discusses phishing kits targeting CFOs.

Selected Reading

Microsoft July 2025 Patch Tuesday fixes one zero-day, 137 flaws (Bleeping Computer)

SAP Patches Critical Flaws That Could Allow Remote Code Execution, Full System Takeover (SecurityWeek)

CISA Releases One Industrial Control Systems Advisory (CISA)

Iranian ransomware group offers bigger payouts for attacks on Israel, US (The Record)

New spyware strain steals data from Russian industrial companies (The Record)

Mental Health Provider Fined $225K for Lack of Risk Analysis (BankInfo Security)

Anatsa mobile malware returns to victimize North American bank customers (The Record)

Legitimate Shellter Pen-Testing Tool Used in Malware Attacks (SecurityWeek)

Researchers Reveal 18 Malicious Chrome and Edge Extensions Disguised as Everyday Tools (Infosecurity Magazine)

Cat content disturbs AI models (Computerworld)

Audience Survey

Complete our annual audience survey before August 31.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Researchers release proof-of-concept exploits for CitrixBleed2. Grafana patches four high-severity vulnerabilities. A hacker claims to have breached Spanish telecom giant Telefónica. Italian police arrest a Chinese man wanted by U.S. authorities for alleged industrial espionage. Beware of a new ransomware group called Bert. Call of Duty goes offline after reports of RCE vulnerabilities. President Trump's spending bill allocates hundreds of millions for cybersecurity. Nearly 26 million job seekers’ resumes and personal data are leaked. CISA adds four actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog. Outsmarting AI scraper bots with math.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Threat Vector Segment

Cyber attackers are increasingly targeting the very tools developers trust—integrated development environments (IDEs), low-code platforms, and public code repositories. In this segment of Threat Vector, host ⁠David Moulton⁠ speaks with ⁠Daniel Frank⁠ and ⁠Tom Fakterman⁠ from Palo Alto Networks' threat research team about “Hunting Threats in Developer Environments.” You can hear David and Tyler's full discussion on Threat Vector ⁠⁠here⁠⁠ and catch new episodes every Thursday on your favorite podcast app.

Selected Reading

Public exploits released for Citrix Bleed 2 NetScaler flaw, patch now (Bleeping Computer)

Grafana Patches Chromium Bugs, Including Zero-Day Exploited in the Wild (SecurityWeek)

Hacker leaks Telefónica data allegedly stolen in a new breach (Bleeping Computer)

Italian police arrest Chinese national wanted by FBI for alleged industrial espionage (Reuters)

Beware of Bert: New ransomware group targets healthcare, tech firms (The Record)

Call of Duty takes PC game offline after multiple reports of RCE attacks on players (CyberScoop)

GOP domestic policy bill includes hundreds of millions for military cyber (CyberScoop)

TalentHook leaks resumes of 26 Million job seekers (Beyond Machines)

CISA Adds Four Known Exploited Vulnerabilities to Catalog (CISA)

The Open-Source Software Saving the Internet From AI Bot Scrapers (404 Media)

Audience Survey

Complete our annual audience survey before August 31.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Ingram Micro suffers a ransomware attack by the SafePay gang. Spanish police dismantle a large-scale investment fraud ring. The SatanLock ransomware group says it is shutting down. Brazilian police arrest a man accused of stealing over $100 million from the country’s banking system. Qantas confirms contact from a “potential cybercriminal” following its recent customer data breach. The XWorm RAT evolves to better evade detection. Cybercriminals ramp up fraudulent domains ahead of Amazon Prime day. Apple sues a former engineer allegedly stealing confidential data. Our guest is Rob Allen, Chief Product Officer at Threat Locker, discussing why 'Default Deny' could be the Antidote to Security Fatigue. AI image editing blurs the evidence. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

On our Industry Voices segment, we are joined by Rob Allen, Chief Product Officer at Threat Locker, discussing From Noise to Control: Why 'Default Deny' Is the Antidote to Security Fatigue. If you want to hear more from Rob or Threat Locker, you can listen to them here.

Selected Reading

Ingram Micro outage caused by SafePay ransomware attack (Bleeping Computer)

Police dismantles investment fraud ring stealing €10 million (Bleeping Computer)

SatanLock Ransomware Ends Operations, Says Stolen Data Will Be Leaked (Hackread)

Police in Brazil Arrest a Suspect Over $100M Banking Hack (SecurityWeek)

Qantas Contacted by Potential Cybercriminal Following Data Breach (Infosecurity Magazine)

Arbor Associates reports data breach exposing patient information (Beyond Machines)

XWorm RAT Deploys New Stagers and Loaders to Bypass Defenses (GB Hackers)

Amazon Prime Day 2025: Deals Await, But So Do the Cyber Criminals (Check Point)

Apple Accuses Ex-Engineer Of Stealing Vision Pro Secrets, Silently Accepting Job At Snap Inc., And Covering His Tracks By Wiping Data From Work Laptop (WCCF TECH)

Cops Use ChatGPT to Edit Drugs Bust Photo, Goes Horribly Wrong (PetaPixel)

Audience Survey

Complete our annual audience survey before August 31.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Please enjoy this encore of Career Notes.

Ground Labs' Head of Engineering, Swati Shekhar, shares her circuitous route from and back to engineering. Always being interested in leveraging the tools available to solve problems, Swati talks about how she found her place in engineering. She mentions how she had her first real experience with a computer when she was 17 in her first year at college. Aside from being one of 30 young women in a sea of 500 young men there, Swati described it as a "good culture shock because anything that takes you out of your comfort zone actually makes you learn and grow." She notes that challenges experienced in life increase your risk appetite so significantly. Swati advises those looking to make a job change to be certain of what is attracting them and to be yourself. We thank Swati for sharing her story with us.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Please enjoy this encore of Research Saturday.

This week we are joined by ⁠⁠Silas Cutler⁠⁠, Principal Security Researcher at ⁠⁠Censys⁠⁠, asking the important question of "Will the Real Volt Typhoon Please Stand Up?" The FBI's disruption of the KV Botnet in December 2023, attributed to the Chinese threat group Volt Typhoon, targeted infected systems but did not affect the botnet's control infrastructure.

Despite law enforcement efforts and technical exposure, the botnet's infrastructure has remained largely stable, with only changes in hosting providers, raising questions about whether another party operates the botnet. Censys scanning data from 2024 shows a shift in the botnet's control servers, indicating a response to disruption attempts, while the botnet's operators have shown limited efforts to obscure their infrastructure.

The research can be found here:

Learn more about your ad choices. Visit megaphone.fm/adchoices

Please enjoy this encore from our T-Minus Space Daily segment Deep Space.

Parker Wishik⁠ from ⁠The Aerospace Corporation⁠ explores how experts are turning data into decisions in the space industry on the latest Nexus segment. Parker is joined by⁠ Jackie Barbieri⁠, Founder and CEO of ⁠Whitespace⁠, and Dr. Steve Lewis, Leader of The Aerospace Corporations’s ⁠SPEAR team⁠.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Be sure to follow T-Minus on ⁠LinkedIn⁠ and ⁠Instagram⁠.

Selected Reading

⁠Aerospace Advances Massless Payloads for Space Missions⁠ 

⁠Aerospace Experts Are Turning Data into Decisions⁠

⁠Aerospace recently assembled a team of highly skilled scientists and engineers who play a critical role in addressing national and global disruptions in GPS and other radio frequency spectrums.⁠

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our ⁠media kit⁠. Contact us at ⁠[email protected]⁠ to request more info.

Want to join us for an interview?

Please send your pitch to ⁠[email protected]⁠ and include your name, affiliation, and topic proposal.

T-Minus is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

While the N2K CyberWire team is observing Independence Day in the US, we thought you'd enjoy this episode of Threat Vector from our podcast network. Listen in and bust those cyber myths.

In this episode of Threat Vector, David Moulton talks with Lisa Plaggemier, Executive Director of the National Cybersecurity Alliance. Lisa shares insights from this year’s “Oh Behave!” report and dives into why cybersecurity habits remain unchanged—even when we know better. From password reuse to misunderstood AI risks, Lisa explains how emotion, storytelling, and system design all play a role in protecting users. Learn why secure-by-design is the future, how storytelling can reshape behavior, and why facts alone won’t change minds. This episode is a must-listen for CISOs, security leaders, and anyone working to reduce human risk at scale.

Resources:

Join the conversation on our social media channels:

About Threat Vector

Threat Vector by Palo Alto Networks is your premier podcast for security thought leadership. Join us as we explore pressing cybersecurity threats, robust protection strategies, and the latest industry trends.

The podcast features in-depth discussions with industry leaders, Palo Alto Networks experts, and customers, providing crucial insights for security decision-makers.

Whether you're looking to stay ahead of the curve with innovative solutions or understand the evolving cybersecurity landscape, Threat Vector equips you with the knowledge needed to safeguard your organization.

Palo Alto Networks

Palo Alto Networks enables your team to prevent successful cyberattacks with an automated approach that delivers consistent security across the cloud, network, and mobile.⁠⁠⁠ ⁠http://paloaltonetworks.com⁠

Learn more about your ad choices. Visit megaphone.fm/adchoices

Sudo patch your Linux systems. Cisco has removed a critical backdoor account that gave remote attackers root privileges. The Hunters International ransomware group rebrands and closes up shop. The Centers for Medicare and Medicaid Services (CMS) notifies 103,000 people that their personal data was compromised. NimDoor is a sophisticated North Korean cyber campaign targeting macOS. Researchers uncover a massive phishing campaign using thousands of fake retail websites. The FBI’s top cyber official says Salt Typhoon is largely contained. Microsoft tells customers to ignore Windows Firewall error warnings. A California jury orders Google to pay $314 million for collecting Android user data without consent. Ben Yelin shares insights from this year’s Supreme Court session. Ransomware negotiations with a side of side hustle.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today our guest is Ben Yelin from UMD CHHS, who is sharing a wrap up of this year’s Supreme Court session. If you want to hear more from Ben, head on over to the Caveat podcast, where he is co-host with Dave as they discuss all things law and privacy. 

Selected Reading

Linux Users Urged to Patch Critical Sudo CVE (Infosecurity Magazine)

Cisco warns that Unified CM has hardcoded root SSH credentials (Bleeping Computer)

Hunters International ransomware shuts down after World Leaks rebrand (Bleeping Computer)

Feds Notify 103,000 Medicare Beneficiaries of Scam, Breach (Data Breach Today)

N Korean Hackers Drop NimDoor macOS Malware Via Fake Zoom Updates (Hackread)

China-linked hackers spoof big-name brand websites to steal shoppers' payment info (The Record)

Top FBI cyber official: Salt Typhoon ‘largely contained’ in telecom networks (CyberScoop)

Microsoft asks users to ignore Windows Firewall config errors (Bleeping Computer)

California jury orders Google to pay $314 million over data transfers from Android phones (The Record)

US Probes Whether Negotiator Took Slice of Hacker Payments (Bloomberg)

Audience Survey

Complete our annual audience survey before August 31.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

French authorities report multiple entities targeted by access brokers. A ransomware group extorts a German hunger charity. AT&T combats SIM swapping and account takeover attacks. A Missouri physician group suffers a cyber attack. Qantas doesn’t crash, but their computers do. Researchers uncover multiple critical vulnerabilities in Agorum Core Open. A student loan administrator in Virginia gets hit by the Akira ransomware group. The Feds sanction a Russian bulletproof hosting service. Johnson Controls notifies individuals of a major ransomware attack dating back to 2023. Will Markow, CEO of FourOne Insights and N2K CyberWire Senior Workforce Analyst shares the latest technology workforce trends. The ICEBlock app warms up to users.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Our guest is Will Markow, CEO of FourOne Insights and N2K CyberWire Senior Workforce Analyst, sharing the latest workforce technology trends. Will recently appeared on our CISO Perspectives podcast with host Kim Jones in the “What’s the “correct” path for entering cyber?” episode. If you are not already an N2K Pro member, you can learn more about that here. 

Got cybersecurity, IT, or project management certification goals?

For the past 25 years, N2K's practice tests have helped more than half a million professionals reach certification success. Grow your career and reach your goals faster with N2K’s full exam prep of practice tests, labs, and training courses for Microsoft, CompTIA, PMI, Amazon, and more at n2k.com/certify.

Selected Reading

French cybersecurity agency confirms government affected by Ivanti hacks (The Record)

Ransomware gang attacks German charity that feeds starving children (The Record)

AT&T deploys new account lock feature to counter SIM swapping (CyberScoop)

Cyberattack in Missouri healthcare provider Esse Health exposes data of over 263,000 patients (Beyond Machines)

Australia's Qantas says 6 million customer accounts accessed in cyber hack (Reuters)

Security Advisories on Agorum Core Open (usd)

Virginia student loan administrator Southwood Financial hit by ransomware attack (Beyond Machines)

Russian bulletproof hosting service Aeza Group sanctioned by US for ransomware work (The Record)

Johnson Controls starts notifying people affected by 2023 breach (Bleeping Computers)

ICEBlock, an app for anonymously reporting ICE sightings, goes viral overnight after Bondi criticism (TechCrunch)

Audience Survey

Complete our annual audience survey before August 31.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

The Feds shut down a covert North Korean IT operation. Google releases an emergency update to fix a new Chrome zero-day. A major U.S. trade show and event marketing firm suffers a data breach. NetScaler patches a pair of critical vulnerabilities. A sophisticated cyber attack targets The Hague. An Iran-linked hacking group threatens to release emails allegedly stolen from aides to President Trump. A ransomware attack exposes sensitive data linked to multiple Swiss federal government offices. The U.S. Treasury Department faces scrutiny after a string of cyberattacks. The FBI’s phone security tips draw fire from Senator Wyden. Tim Starks from CyberScoop describes how ubiquitous surveillance turned deadly. AI proves its pentesting prowess.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

We are joined today by Tim Starks, Senior Reporter from CyberScoop, discussing his story "Hacker helped kill FBI sources, witnesses in El Chapo case, according to watchdog report."

Selected Reading

US government takes down major North Korean 'remote IT workers' operation (TechCrunch)

Google fixes fourth actively exploited Chrome zero-day of 2025 (Bleeping Computer)

NetScaler Critical Security Updates for CVE-2025-6543 and CVE-2025-5777 (NetScaler)

International Criminal Court hit with cyber security attack (AP News)

Iran-linked hackers threaten to release Trump aides' emails (Reuters)

Swiss government data compromised in ransomware attack on health foundation Radix (Beyond Machines)

Trade show management firm Nth Degree hit by data breach, exposing sensitive data (Beyond Machines)

A Trio of US Treasury Hacks Exposes a Pattern Making Banks Nervous (Bloomberg)

Senator Chides FBI for Weak Advice on Mobile Security (Krebs on Security)

The top red teamer in the US is an AI bot (CSO Online)

Audience Survey

Complete our annual audience survey before August 31.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices