The CyberWire Daily

Please enjoy this encore episode:

On this Solution Spotlight, guest Lee Parrish, author and CISO at Newell Brands, joins N2K President Simone Petrella to discuss his book "The Shortest Hour: An Applied Approach to Boardroom Governance of Cyber Security" and security relationship management.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Blue Yonder continues to grapple with ransomware attack. AI-powered scams surge this shopping season. Gaming engine exploited to deliver malware. Chinese hackers ride the router wave. TikTok’s beauty filter ban. Redefining cybersecurity education for the future. On our Industry Voices segment, Dave sits down with Damon Fleury, SpyCloud’s Chief Product Officer to discuss defending against what criminals know about you and the role of holistic digital identity in cyber defense. And when do cyber criminals start their holiday scheming?

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Today on our Industry Voices segment, guest Damon Fleury, SpyCloud’s Chief Product Officer, joins Dave to discuss defending against what criminals know about you and the role of holistic digital identity in cyber defense.

Kevin Beaumont (@GossiTheDog) on Mastodon (Mastodon)

Advanced Cyberthreats Targeting Holiday Shoppers (FortiGuard Labs) 

Black Friday Gets a Fakeover: Fake Stores Spike 110% by Using LLMs this Holiday Shopping Season (Netcraft)

The Exploitation of Gaming Engines: A New Dimension in Cybercrime (Check Point Software) 

T-Mobile Engineers Spotted Hackers Running Commands on Routers (Bloomberg Law)  

TikTok will block beauty filters for teens over mental health concerns (The Verge)

Australia passes bill banning social media for children under 16 (The Washington Post)

CISA debuts new cybersecurity training platform (Federal News Network) 

African cybercrime crackdown culminates in 1,006 captured and cuffed (The Record)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Smashing cybercrime syndicates. CyberVolk goes global. Tech troubles mostly resolved. A malware web weaved by Salt Typhoon targets global sectors. Love at first exploit. Ransomware attack on Blue Yonder brews trouble. Google faces a UK court battle. Lateral moves and lost data. I sit down with Clemence Poirer, Senior Cyberdefense Researcher at the Center for Security Studies (CSS) at ETH Zurich | Space Cybersecurity to discuss cybersecurity attacks in space. And finally, a Cybersecurity sales pitch goes rogue.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Today’s guest, Clemence Poirier, Senior Cyberdefense Researcher at the Center for Security Studies (CSS) at ETH Zurich, recently spoke with T-Minus Space Daily podcast host Maria Varmazis about cybersecurity attacks in space. Read the case study: Hacking the Cosmos: Cyber operations against the space sector. A case study from the war in Ukraine.

Bangkok busts SMS Blaster sending 1 million scam texts from a van (Bleeping Computer)

Police bust two Chinese syndicates (Bangkok Post)

'CyberVolk' hacktivists use ransomware in support of Russian interests (The Record) 

Microsoft says massive Outlook and Teams outage is mostly resolved (CNN) 

British hospital group declares ‘major incident’ following cyberattack (The Record) 

NHS declares major cyber incident for third time this year (The Register)

Game of Emperor: Unveiling Long Term Earth Estries Cyber Intrusions (Trend Micro)

RomCom exploits Firefox and Windows zero days in the wild

Starbucks, Grocery Stores Hit by Blue Yonder Ransomware Attack (SecurityWeek)

Google hit with £7B claim over search engine dominance (The Register)

CISA Details Red Team Assessment including TTPs & network defense (GB Hackers)

DOJ: Man hacked networks to pitch cybersecurity services (Bleeping Computer)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

APT28 uses a novel technique to breach organizations via nearby WiFi networks. Your Apple ID is (not) suspended. UK highlighting Russian threats at NATO Cyber Defence Conference. US senators request an audit of TSA's facial recognition technology. Supply chain software company sustains ransomware attack. Critical QNAP vulnerability could allow remote code execution. Outdated Avast Anti-Rootkit driver exploited. No more internet rabbit holes for China. Guest Lesley Carhart from Dragos on "The Shifting Landscape of OT Incident Response." Stop & Shop turns cyber oops into coffee and cookies.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Our guest is ​​Lesley Carhart, Technical Director at Dragos, speaking with Dave Bittner about "The Shifting Landscape of OT Incident Response." You can find the blog here.

Russian Cyberspies Hacked Building Across Street From Target for Wi-Fi Attack (SecurityWeek)

The Nearest Neighbor Attack: How A Russian APT Weaponized Nearby Wi-Fi Networks for Covert Access (Volexity)

New Warning For 2 Billion iPhone, iPad, Mac Users—Your Apple ID Is Suspended (Forbes)

Russia plotting to use AI to enhance cyber-attacks against UK, minister will warn (The Guardian) 

Britain, NATO must stay ahead in 'new AI arms race', says UK minister (Reuters) 

Senators call for audit of TSA’s facial recognition tech as use expands in airports (The Record) 

Blue Yonder ransomware attack disrupts supply chains across UK and US (Tech Monitor)

Critical QNAP Vulnerability Let Attackers Execute Remote Code (Cyber Security News)

Malware campaign abused flawed Avast Anti-Rootkit driver (Security Affairs)

When Guardians Become Predators: How Malware Corrupts the Protectors (Trellix report) 

Imagine a land where algorithms don't ruin the Internet (The Register)

Stop & Shop recovers from 'cybersecurity issue,' will give out free food, coffee (WTNH)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Rick Howard, N2K CyberWire’s Chief Analyst and Senior Fellow, turns over hosting duties to Caroline Wong, the Chief Strategy Officer at Cobalt to discuss the mechanics of writing a cybersecurity book about AI.

Ben Smith. “Security Metrics: A Beginner’s Guide” Review [Review]. Cybersecurity Canon Project.

Caroline Wong, 2011. Security Metrics, A Beginner’s Guide [Book]. Goodreads.

Rick Howard, Caroline Wong, 2022. Interview with Author and Hall of Fame winner Caroline Wong [Interview]. Cybersecurity Canon Project.

Rick Howard, 2023. Cybersecurity First Principles: A Reboot of Strategy and Tactics [Book]. Goodreads.

Rick Howard. Security Metrics, A Beginner’s Guide [Review]. Cybersecurity Canon Project.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Enjoy this encore episode where we are joined by Co-founder and Chief Strategy Officer for Corelight Greg Bell, as he describes the twists and turns of his career bringing him back to his childhood joy of computers. Working in a myriad of fields from human rights to Hollywood to writing a history of conspiracy belief before pivoting back to technology. Focusing on the relationships within the open source community, Greg works to change and improve the world through his mission-based organization. For those looking to begin their career in cyber, Greg offers that great mentorship and working for great organizations where you can soak in the culture are really important. And, we thank Greg for sharing his story with us.

Learn more about your ad choices. Visit megaphone.fm/adchoices

This week, we are joined by Ami Luttwak, Co-Founder and CTO from Wiz, sharing their work on "Wiz Research Finds Critical NVIDIA AI Vulnerability Affecting Containers Using NVIDIA GPUs, Including Over 35 percent of Cloud Environments." A critical vulnerability in the NVIDIA Container Toolkit, widely used for GPU access in AI workloads, could allow attackers to escape containers and gain full access to host environments, jeopardizing sensitive data.

Wiz estimates that at least 33% of cloud environments are affected and urges immediate updates to NVIDIA's patched version. This discovery highlights the broader issue of young, under-secured codebases in AI tools, emphasizing the need for stronger security measures and collaboration.

The research can be found here:

• Wiz Research Finds Critical NVIDIA AI Vulnerability Affecting Containers Using NVIDIA GPUs, Including Over 35% of Cloud Environments

Learn more about your ad choices. Visit megaphone.fm/adchoices

META details its efforts against pig butchering. The Salt Typhoon attack on major U.S. telecoms sparks interest from Congress.  Microsoft dismantles 240 domains linked to the ONNX phishing-as-a-service platform. A major U.S. gambling and lottery provider suffers a cyberattack. Hackers exploit newly patched zero-days in Palo Alto Networks firewalls. Researchers say Fortinet VPN servers lack sufficient logging. A pilot program looks to improve security for small U.S. water utilities. Bitdefender warns of scammers using Black Friday-themed spam emails. Our guest is DataDome’s CEO and Co-founder, Benjamin Fabre, discussing how "Fake Accounts Threaten Black Friday Gaming Sales." A fond farewell for a true cyber innovator. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

In advance of Black Friday shopping next week, our guest is  DataDome’s CEO and Co-founder, Benjamin Fabre discussing their team's work on "Fake Accounts Threaten Black Friday Gaming Sales." 

Meta cracks down on millions of accounts it tied to pig-butchering scams (CyberScoop)

China’s Hacking Reached Deep Into U.S. Telecoms (New York Times)

FCC leaders skirt call for wiretap security reform, hope to ‘go deeper’ on telecom breach briefings (NextGov)

Microsoft disrupts ONNX phishing-as-a-service infrastructure (Bleeping Computer)

Gambling and lottery giant disrupted by cyberattack, working to bring systems back online (The Record)

Over 2,000 Palo Alto firewalls hacked using recently patched bugs (Bleeping Computer)

Fortinet VPN design flaw hides successful brute-force attacks (Bleeping Computer)

First Water Utilities Take Volunteer Cyber Help (The University of Chicago Harris School of Public Policy)

Three-Quarters of Black Friday Spam Emails Identified as Scams (Infosecurity Magazine)

Thomas E. Kurtz, a Creator of BASIC Computer Language, Dies at 96 (New York Times)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

The feds take down the PopeyeTools cybercrime market. Five alleged Scattered Spider members have been charged.  CISA warns of critical vulnerabilities in VMware’s vCenter Server. Global AI experts convene to discuss safety. MITRE updates its list of Top 25 Most Dangerous Software Weaknesses. US and Australian agencies warn critical infrastructure organizations about evolving tactics by the BianLian ransomware group. A new report looks at rising threats to the U.S. manufacturing industry. Researchers at ESET uncover the WolfsBane Linux backdoor. A pair of malicious Python packages impersonating ChatGPT went undetected for over a year. A data breach at a French hospital compromised the medical records of 750,000 patients. On our Industry Voices segment, guest Avihai Ben-Yossef, Cymulate’s Co-Founder and CTO, joins us to discuss "The Evolution and Outlook of Exposure Management." AI Pimping is the scourge of Instagram. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

On our Industry Voices segment, guest Avihai Ben-Yossef, Cymulate’s Co-Founder and CTO, joins us to discuss "The Evolution and Outlook of Exposure Management."

US seizes PopeyeTools cybercrime marketplace, charges administrators (Bleeping Computer)

Five Charged in Scattered Spider Case (Infosecurity Magazine)

CISA Warns of VMware VCenter Vulnerabilities Actively Exploited in Attacks (Cyber Security News)

US Gathers Allies to Talk AI Safety as Trump’s Vow to Undo Biden’s AI Policy Overshadows Their Work (SecurityWeek)

MITRE Updates List of 25 Most Dangerous Software Vulnerabilities (SecurityWeek)

BianLian Ransomware Group Adopts New Tactics, Posing Significant Risk (Infosecurity Magazine)

Manufacturing Sector Under Siege: Industry Faces Wave of Advanced Email Attacks (Abnormal Security)

Gelsemium APT Hackers Attacking Linux Servers With New WolfsBane Malware (Cyber Security News)

Two PyPi Malicious Package Mimic ChatGPT & Claude Steals Developers Data (GB Hackers)

Cyberattack at French hospital exposes health data of 750,000 patients (Bleeping Computer)

Inside the Booming 'AI Pimping' Industry (404 Media)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

A WIRED investigation uncovers the ease of tracking U.S. military personnel. Apple releases emergency security updates to address actively exploited vulnerabilities. Latino teenagers and LGBTQ individuals are receiving disturbing text messages spreading false threats. Crowdstrike says Liminal Panda is responsible for telecom intrusions. Oracle patches a high-severity zero-day vulnerability. Trend Micro has disclosed a critical vulnerability in its Deep Security 20 Agent software. A rural hospital in Oklahoma suffers a ransomware attack. A leading fintech firm is investigating a security breach in its file transfer platform. Researchers deploy Mantis against malicious LLMs.  Ben Yelin from the University of Maryland Center for Health and Homeland Security discusses AI’s bias in the resume screening process. Tracking down a lost Lambo. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Today, we have Ben Yelin, Program Director, Public Policy & External Affairs at the University of Maryland Center for Health and Homeland Security and our Caveat podcast co-host, discussing AI’s racial and gender bias in the resume screening process. You can read about it here.

Anyone Can Buy Data Tracking US Soldiers and Spies to Nuclear Vaults and Brothels in Germany (WIRED)

GAO recommends new agency to streamline how US government protects citizens’ data (The Record)

Apple Issues Emergency Security Update for Actively Exploited Flaws (Infosecurity Magazine)

Texts threatening deportation and 're-education' for gays stoke both fear and defiance (NBC News)

Chinese APT Group Targets Telecom Firms Linked to BRI (Infosecurity Magazine)

Oracle Patches Exploited Agile PLM Zero-Day (SecurityWeek)

Trend Micro Deep Security Vulnerability Let Attackers Execute Remote Code (Cyber Security News)

Oklahoma Hospital Says Ransomware Hack Hits 133,000 People (GovInfo Security)

Fintech Giant Finastra Investigating Data Breach (Krebs on Security)

AI About-Face: 'Mantis' Turns LLM Attackers Into Prey (Dark Reading)

Hackers Steal MLB Star Kris Bryant’s $200K Lamborghini By Rerouting Delivery (Carscoops)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices