The CyberWire Daily

Operation Endgame dismantles cybercriminal infrastructure. DOGE’s use of the Grok AI chatbot raises ethical and privacy concerns. Malware on the npm registry uses malicious packages to quietly gather intelligence on developer environments. Researchers link Careto malware to the Spanish government. Exploring proactive operations via letters of marque. Hackers hesitate to attend the HOPE conference over travel concerns. Our guest is Jeffrey Wheatman, Cyber Risk Expert at Black Kite, warning us to "Beware the silent breach." AI threatens to spill secrets to save itself.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

On today’s Industry Voices, we were joined at the RSAC Conference by Jeffrey Wheatman, Cyber Risk Expert at Black Kite, as he is sharing his thoughts on "Beware the silent breach." Listen to Jeffery’s interview here.
Selected Reading

Operation ENDGAME strikes again: the ransomware kill chain broken at its source (Europol)

Russian developer of Qakbot malware indicted by US for global ransomware campaign (CNews)

Russian hackers target US and allies to disrupt Ukraine aid, warns NSA (CNews)

Exclusive: Musk’s DOGE expanding his Grok AI in U.S. government, raising conflict concerns (Reuters)

60 malicious npm packages caught mapping developer networks (Developer Tech)

Mysterious hacking group Careto was run by the Spanish government, sources say (TechCrunch)

An 18th-century war power resurfaces in cyber policy talks (Next Gov)

Hacker Conference HOPE Says U.S. Immigration Crackdown Caused Massive Crash in Ticket Sales (404 Media)

Anthropic's new AI model turns to blackmail when engineers try to take it offline (TechCrunch)

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

A joint operation takes down Lumma infrastructure. The FTC finalizes a security settlement with GoDaddy. The Telemessage breach compromised far more U.S. officials than initially known. Twin hackers allegedly breach a major federal software provider from the inside. U.S. telecom providers fail to notify the Senate when law enforcement agencies request data from Senate-issued devices.DragonForce makes its mark on the ransomware front. A data leak threatens survivors of domestic abuse in the UK. Lexmark discloses a critical vulnerability affecting over 120 printer models. Our guest is David Holmes, CTO for Application Security at Imperva, with insights into the role of AI in bot attacks. Scammers ship stolen cash in Squishmallows.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today’s guest is David Holmes, CTO for Application Security at Imperva, a Thales company, who is sharing some insights into the role of AI in bot attacks.

Selected Reading

Lumma infostealer’s infrastructure seized during US, EU, Microsoft operation (the Record)

FTC finalizes order requiring GoDaddy to secure hosting services (Bleeping Computer)

Exclusive: Hacker who breached communications app used by Trump aide stole data from across US government (Reuters)

By Default, Signal Doesn't Recall (Signal)

Hack of Contractor Was at Root of Massive Federal Data Breach (Bloomberg)

Phone companies failed to warn senators about surveillance, Wyden says - Live Updates (POLITICO)

DragonForce targets rivals in a play for dominance (Sophos News)

‘Deep concern’ for domestic abuse survivors as cybercriminals expected to publish confidential refuge addresses (The Record)

Lexmark reporting remote code execution flaw affecting over 120 Printer Models (Beyond Machines)

DOJ charges 12 more in $263 million crypto fraud takedown where money was hidden in squishmallow stuffed animals (Bitdefender)

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

A joint advisory warns of Fancy Bear targeting Western logistics and technology firms. A nonprofit hospital network in Ohio suffers a disruptive ransomware attack. The Consumer Financial Protection Bureau (CFPB) drops plans to subject data brokers to tighter regulations. KrebsOnSecurity and Google block a record breaking DDoS attack. A phishing campaign rerouted employee paychecks. Atlassian patches multiple high-severity vulnerabilities. A Wisconsin telecom provider confirms a cyberattack caused a week-long outage.  VMware issues a Security Advisory addressing multiple high-risk vulnerabilities.  Prosecutors say a 19-year-old student from Massachusetts will plead guilty to hacking PowerSchool. Our guest is Rob Allen, Chief Product Officer at ThreatLocker, discussing deliberate simplicity of fundamental controls around zero trust. Oversharing your call location data.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

On our Industry Voices segment, today we are joined by Rob Allen, Chief Product Officer at ThreatLocker from RSAC 2025. Rob is discussing the deliberate simplicity of fundamental controls around zero trust. Token theft and phishing attacks bypass traditional MFA protections, letting attackers impersonate users and access critical SaaS platforms — without needing passwords. Listen to Rob’s interview here.

Learn more from the ThreatLocker team here.

Selected Reading

Russian GRU Targeting Western Logistics Entities and Technology Companies ( CISA)

Ransomware attack disrupts Kettering Health Network in Ohio (Beyond Machines)

America’s CFPB bins proposed data broker crackdown (The Register)

Krebs on Security hit by 'test run' DDoS attack that peaked at 6.3 terabits of data per second (Metacurity)

SEO poisoning campaign swipes direct deposits from employees (SC Media)

Atlassian Warns of Multiple High-Severity Vulnerabilities Hits Data Center Server (Cybersecurity News)

Cellcom Service Disruption Caused by Cyberattack (SecurityWeek)

VMware releases patches for security flaws in multiple virtualization products (Beyond Machines)

Massachusetts man will plead guilty in PowerSchool hack case (CyberScoop)

O2 VoLTE: locating any customer with a phone call  (Mast Database)

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

President Trump signs the Take It Down Act into law. A UK grocer logistics firm gets hit by ransomware. Researchers discover trojanized versions of the KeePass password manager. Researchers from CISA and NIST promote a new metric to better predict actively exploited software flaws. A new campaign uses SEO poisoning to deliver Bumblebee malware. A sophisticated phishing campaign is impersonating Zoom meeting invites to steal user credentials. CISA has added six actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog. A bipartisan bill aims to strengthen the shrinking federal cybersecurity workforce. Our guest is Chris Novak, Vice President of Global Cybersecurity Solutions at Verizon, sharing insights on their 2025 DBIR. DOGE downsizes, and the UAE recruits.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today we are joined by Chris Novak, Vice President of Global Cybersecurity Solutions at Verizon, sharing insights on their 2025 Data Breach Investigations Report (DBIR).
Selected Reading

Trump signs the Take It Down Act into law |(The Verge)

Supplier to Tesco, Aldi and Lidl hit with ransomware (Computing)

Fake KeePass password manager leads to ESXi ransomware attack (Bleeping Computer)

Vulnerability Exploitation Probability Metric Proposed by NIST, CISA Researchers (Security Week)

Threat Actors Deliver Bumblebee Malware Poisoning Bing SEO (Cybersecurity News)

New Phishing Attack Poses as Zoom Meeting Invites to Steal Login Credentials (GB Hackers)

CISA Adds Six Known Exploited Vulnerabilities to Catalog (CISA)

Federal cyber workforce training institute eyed in bipartisan House bill (CyberScoop)

UAE Recruiting US Personnel Displaced by DOGE to Work on AI for its Military (Zetter Sero Day)

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

The UK’s Ministry of Justice suffers a major breach. Mozilla patches two critical JavaScript engine flaws in Firefox. Over 200,000 patients of a Georgia-based health clinic see their sensitive data exposed. Researchers track increased malicious targeting of iOS devices. A popular printer brand serves up malware. PupkinStealer targets Windows systems. An Alabama man gets 14 months in prison for a sim-swap attack on the SEC. Our guest is Ian Tien, CEO at Mattermost, sharing insights on enhancing cybersecurity through effective collaboration. Ethical Hackers win the day at Pwn2Own Berlin. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

On today’s Industry Voices segment, we are joined by Ian Tien, CEO at Mattermost at RSAC 2025, who is sharing insights on enhancing cybersecurity through effective collaboration. Check out Ian’s blog on “What’s Next for Cybersecurity Teams? AI, Automation & Real-Time Workflows.” Listen to Ian’s interview here.

Selected Reading

Hackers steal 'significant amount of personal data' from Ministry of Justice in brazen cyber-attack (Daily Mail Online)

M&S and Co-Op: BBC reporter on talking to the hackers (BBC)

210K American clinics‘ patients had their financial data leaked (Cybernews)

480,000 Catholic Health Patients Impacted by Serviceaide Data Leak (SecurityWeek)

Over 40,000 iOS Apps Found Exploiting Private Entitlements, Zimperium (Hackread)

This printer company served you malware for months and dismissed it as false positives (Neowin)

Hack of SEC social media account earns 14-month prison sentence for Alabama man (The Record)

Hackers Earn Over $1 Million at Pwn2Own Berlin 2025 (SecurityWeek)

Share your feedback.

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Please enjoy this encore of Career Notes.

Host of the CyberWire Podcast, Dave Bittner, wanted to work with the Muppets, so naturally he landed in cybersecurity. Dave and his Cookie Monster puppet spent much of his childhood putting on shows for his parents friends. During one of those performances, he was discovered and got his start at the local PBS station. A radio, television and film major in college, Dave owned his own company and as the most tech-savvy member of the group, handled that side of things. Dave notes his cybersecurity challenges back then consisted of maybe a corrupt floppy disk. It wasn't until he joined the CyberWIre that cybersecurity became Dave's focus. A former boss showed him how to lead a team and treat everyone with kindness regardless of their role. We thank Dave for sharing his story with us.

Learn more about your ad choices. Visit megaphone.fm/adchoices

This week, Dave speaks with Max Gannon of Cofense Intelligence to dive into his team's research on "The Rise of Precision-Validated Credential Theft: A New Challenge for Defenders."

Threat actors continuously develop new tactics, techniques, and procedures (TTPs) to bypass existing defenses. When defenders identify these methods and implement countermeasures, attackers adapt or create more sophisticated approaches.

This research explores how cybercriminals are leveling up their credential phishing tactics using Precision-Validated Phishing, a technique that leverages real-time email validation to ensure only high-value targets receive the phishing attempt.

The research can be found here:

Learn more about your ad choices. Visit megaphone.fm/adchoices

NATO hosts the world’s largest cyber defense exercise. The DOJ charges a dozen people in a racketeering conspiracy involving the theft of over $230 million in cryptocurrency. Japan has enacted a new Active Cyberdefense Law. Lawmakers push to reauthorize the Cybersecurity Information Sharing Act. Two critical Ivanti Endpoint Manager Mobile vulnerabilities are under active exploitation. Hackers use a new fileless technique to deploy Remcos RAT. The NSA’s Director of Cybersecurity hangs up their hat. Our guest is Christopher Cleary, VP of ManTech's Global Cyber Practice, discussing the cyber battlespace of the future. Coinbase flips the script on an extortion attempt. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Joining us on our Industry Voices segment, Christopher Cleary, VP of ManTech's Global Cyber Practice, talks about the battlespace of the future. If you would like to hear the full-length interview between Christopher and Dave, listen here. Learn more about ManTech’s cybersecurity work here. 

Selected Reading

NATO's Locked Shields Reflects Cyber Defense Growth  (SecurityWeek)

US charges 12 more suspects linked to $230 million crypto theft (Bleeping Computer)

Japan enacts new Active Cyberdefense Law allowing for offensive cyber operations (The Record)

Lawmakers push for reauthorization of cyber information sharing bill as deadline looms (The Record)

Ban sales of gear from China’s TP-Link, Republican lawmakers tell Trump administration (The Record)

Scammers are deepfaking voices of senior US government officials, warns FBI (The Register)

Multiple Ivanti Endpoint Mobile Manager Vulnerabilities Allows Remote Code Execution (Cyber Security News)

Updated Remcos RAT deployed in fileless intrusion (SC Media)

NSA cyber director Luber to retire at month’s end (The Record)

Coinbase offers $20 million bounty after extortion attempt with stolen data (The Record)

Share your feedback.

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Google issues an emergency patch for a high-severity Chrome browser flaw. Researchers bypass BitLocker encryption in minutes. A massive Chinese-language black market has shut down. The CFPB cancels plans to curb the sale of personal information by data brokers. A cyberespionage campaign called Operation RoundPress targets vulnerable webmail servers. Google warns that Scattered Spider is now targeting U.S. retail companies. The largest steelmaker in the U.S. shut down operations following a cybersecurity incident. Our guest is Devin Ertel, Chief Information Security Officer at Menlo Security, discussing redefining enterprise security. The long and the short of layoffs.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

On our Industry Voices segment and direct from RSAC 2025, our guest is Devin Ertel, Chief Information Security Officer at Menlo Security, discussing redefining enterprise security. Listen to Devin's interview here.

Selected Reading

Google fixes high severity Chrome flaw with public exploit (Bleeping Computer)

BitLocker Encryption Bypassed in Minutes Using Bitpixie Vulnerability: PoC Released (Cyber Security News)

The Internet’s Biggest-Ever Black Market Just Shut Down Amid a Telegram Purge (WIRED) 

German operation shuts down crypto mixer eXch, seizes millions in assets (The Record)

CFPB Quietly Kills Rule to Shield Americans From Data Brokers (WIRED)

EU ruling: tracking-based advertising by Google, Microsoft, Amazon, X, across Europe has no legal basis (Irish Council for Civil Liberties)

Operation RoundPress targeting high-value webmail servers (We Live Security)

Google says hackers that hit UK retailers now targeting American stores (Reuters)

Cybersecurity incident forces largest US steelmaker to take some operations offline (The Record)

Infosec Layoffs Aren't the Bargain Boards May Think (Dark Reading) 

Share your feedback.

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

A busy Patch Tuesday. Investigators discover undocumented communications devices inside Chinese-made power inverters. A newly discovered Branch Privilege Injection flaw affects Intel CPUs. A UK retailer may claim up to £100mn from its cyber insurers after a major cyberattack.  A Kosovo national has been extradited to the U.S. for allegedly running an illegal online marketplace. CISA will continue alerts on its website following industry backlash. On our Industry Voices segment, Neil Hare-Brown, CEO at STORM Guidance, discusses Cyber Incident Response (CIR) retainer service provision. Shoring up the future of the CVE program.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

On today’s Industry Voices segment, we are joined by Neil Hare-Brown, CEO at STORM Guidance, discussing Cyber Incident Response (CIR) retainer service provision. You can learn more here. 

Selected Reading

Microsoft Patch Tuesday security updates for May 2025 fixed 5 actively exploited zero-days (Security Affairs)

SAP patches second zero-day flaw exploited in recent attacks (Bleeping Computer) 

Ivanti fixes EPMM zero-days chained in code execution attacks (Bleeping Computer) 

Fortinet fixes critical zero-day exploited in FortiVoice attacks (Bleeping Computer) 

Vulnerabilities Patched by Juniper, VMware and Zoom (SecurityWeek)

ICS Patch Tuesday: Vulnerabilities Addressed by Siemens, Schneider, Phoenix Contact (SecurityWeek)

Adobe Patches Big Batch of Critical-Severity Software Flaws (SecurityWeek)

Ghost in the machine? Rogue communication devices found in Chinese inverters (Reuters)

New Intel CPU flaws leak sensitive data from privileged memory (Bleeping Computer) 

M&S cyber insurance payout to be worth up to £100mn (Financial Times)

US extradites Kosovo national charged in operating illegal online marketplace (The Record)

CISA Planned to Kill .Gov Alerts. Then It Reversed Course. (Data BreachToday)

CVE Foundation eyes year-end launch following 11th-hour rescue of MITRE program (CyberScoop)

Share your feedback.

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices