The Gate 15 Podcast Channel

Warm Start:

• That breach cost HOW MUCH? How CISOs can talk effectively about a cyber incident’s toll

• Perspective: 25 Years of Evolving Information Sharing Into Actionable Intelligence, new from IT-ISAC Director Scott Algeier.

• The Gate 15 Interview EP 56. Information Sharing, Cybersecurity Politics, Threats, and More & New Podcast – Information Sharing, Cybersecurity Politics, Threats, and More! The Gate 15 Interview will be released on all the usual channels later today. Catch this month’s special crossover episode now via the Cybersecurity Advisors Network post and on YouTube!

• Crypto ISAC at WSJ Tech Live: Exploring the Future of Blockchain & Cybersecurity

Main Topics:

• If it can happen to them, it can happen to you, part one. Managing Communications: The Trump Administration Accidentally Texted Me Its War Plans. Considerations for businesses.

• If it can happen to them, it can happen to you, part two. Phishing: A Sneaky Phish Just Grabbed my Mailchimp Mailing List.

• Some thoughts on punishment, consistency, standards, and compassion.

• White House - Achieving Efficiency Through State and Local Preparedness

o Fact Sheet: President Donald J. Trump Achieves Efficiency Through State and Local Preparedness

o Trump prioritizes infrastructure resilience against cyber attacks, rolls out National Resilience Strategy

Quick Hits:

• New Dates Added: Live Virtual Presentations on Targeted Violence Prevention. Live Virtual Presentations on Targeted Violence Prevention. The U.S. Secret Service National Threat Assessment Center (NTAC) is pleased to offer new opportunities to attend live virtual presentations on preventing targeted violence. In these presentations, our expert researchers will share findings and implications from decades of research on targeted violence and offer strategies for preventing acts of violence impacting the places where we work, learn, worship, and otherwise live our daily lives. This list of available virtual training events is regularly updated, and presentation topics change from month to month. To learn more about this series of live virtual presentations, or to register for one or more of these events, please follow the link below. Register here.

• FBI PSA - Individuals Target Tesla Vehicles and Dealerships Nationwide with Arson, Gunfire, and Vandalism

• Man drives car into protesters outside a Tesla dealership, nobody hurt, sheriff says

• Attorney General Bondi Statement on Violent Attacks Against Tesla Property

• Violent attacks on Tesla dealerships spike as Musk takes prominent role in Trump White House

• Multiple cars set on fire at Tesla service center in Las Vegas in 'targeted attack'

• Potential Terror Threat Targeted at Health Sector – AHA & Health-ISAC Joint Threat Bulletin

• FBI, healthcare agencies warn of credible threat against hospitals, after multi-city social media terror plot alert

• Exclusive: FBI scales back staffing and tracking of domestic terrorism probes

• This AP map shows sabotage across Europe that has been blamed on Russia and its proxies

• Spring Outlook: Dry in the West, milder than average in the South and East; Drought to develop or persist for Rocky Mountains, Southwest and southern Plains

• Halcyon - Last Year in Ransomware: Overview, Developments and Vulnerabilities

• Chairmen Green, Garbarino, Brecheen Conduct Oversight Of The Federal Government’s Response To China-Backed “Typhoon” Intrusions Under Previous Administration

• The Biggest Supply Chain Hack Of 2025: 6M Records Exfiltrated from Oracle Cloud affecting over 140k Tenants

• Risky Bulletin: The looming epochalypse

In this episode of The Gate 15 Interview, Andy Jabbourspeaks with John Salomon. John is an information security executive and cybersecurity expert with 25 years of in-depth, cross-cultural, international experience across multiple critical industry sectors. Learn more about John on LinkedIn.

In this episode John and Andy discuss:

·      John’s Background.

·      Information Sharing.

·      ISACs, international partnership, and political transitions.

·      Critical threats and challenges.

·      John plays 3 Questions!

·      Lots more!

Selected links:

·      Watch the episode on YouTube! Information Sharing, Cybersecurity Politics, Threats, and More

·      CyAN: New Podcast – Information Sharing, Cybersecurity Politics, Threats, and More. This post links to the YouTube and includes a timeline and links you may enjoy.

·      John Salomon

·      Cybersecurity Advisors Network - Secure in Mind on YouTube

·      CyAN’s Position on Encryption Backdoor Legislation

·      https://cybersecurityadvisors.network

In the latest episode of the Security Sprint, Dave and Andy covered the following topics:

Opening:

• White House instructs agencies to avoid firing cybersecurity staff, email says
• CISA Probationary Reinstatements
• DOGE Staffer Broke Treasury Rules Transmitting Personal Data
• China, Russia, Iran, and North Korea Intelligence Sharing

Main Topics:

Severe Weather:

• 40 dead as storms head east; fire risk remains in parts of U.S.
• ‘I’ve seen nothing like this since I was a kid’: At least 39 people have died across 7 states after powerful storm system
• Severe weather disaster: 40 dead after destructive tornadoes, wildfires and dust storms, sweep across US;
• Europe’s Winter Storms Will Get Worse as Emissions Rise, Study Says
• Ready.gov

Scams & Fraud:

• New FTC Data Show a Big Jump in Reported Losses to Fraud to $12.5 Billion in 2024
• Top scams of 2024
• FBI Warns of Fraudulent Federal Warrants in Wyoming
• Take9

Quick Hits:

• Insider Threats:

1. Texas man faces prison for activating ‘kill switch’ on former employer’s network
2. Lawsuit Alleges $12 Billion "Unicorn" Deel Cultivated Spy, Orchestrated Long-Running Trade-Secret Theft & Corporate Espionage Against Competitor
3. Flexport accuses former employees of stealing its source code to create a rival startup
4. Rethinking Insider Risk in an AI-Driven Workplace

• CISA and Partners Release Cybersecurity Advisory on Medusa Ransomware
• CISA: Medusa ransomware hit over 300 critical infrastructure orgs
• Iraqi PM says Islamic State leader for Iraq and Syria killed
• Lawmakers seek DHS records in probe of US response to Chinese cyber campaigns
• Europe's telecoms sector under increased threat from cyber spies, warns Denmark
• Risky Bulletin: GitHub supply chain attack prints everyone's secrets in build logsGitHub Actions Supply Chain Compromise: tj-actions/changed-files Action
• CAIR’s Civil Rights Report Shows Islamophobia Complaints at All-Time High, Viewpoint Discrimination Key Factor
• Trump administration weighs travel ban on dozens of countries, memo says
• Canadian Centre for Cyber Security - Mass Exploitation of Critical PHP-CGI Vulnerability (CVE-2024-4577).
• Ransomware gang creates tool to automate VPN brute-force attacks

In this week's Security Sprint, Dave and Andy covered the following topics:

Warm Opening:

• TribalHub & Tribal ISAC!
• TribalHub Annual Cybersecurity Summit Wrapup
• Cybersecurity summit discusses challenges tribes face from hacks
• Health ISAC!
• TLP White 2024 Health-ISAC Discussion Based Exercise Series After-Action Report
• How Hackers Using AI Tools Threaten the Health Sector

Blockchain & Crypto:

• Risky Biz News - Bybit hack post-mortem
• 1inch Hack Exposes $5M Flaw – Is It Time for Best Wallet Token?
• Feds Link $150M Cyberheist to 2022 LastPass Hacks
• A $1.5 Billion Hack: How the Biggest Crypto Heist in History Went Down
• Due to the termination of funding by the Department of Homeland Security, the Center for Internet Security no longer supports the EI-ISAC

Main Items:

Ransomware & Data Breaches:

• #NotRansomware: FBI Warns of Data Extortion Scam Targeting Corporate ExecutivesMail Scam Targeting Corporate Executives Claims Ties to Ransomware
• Snail Mail Fail: Fake Ransom Note Campaign Preys on Fear
• BianLian Denies Involvement in Ransom Letters: “Not Our Doing,” Group Tells SuspectFile.com
• SuspectFile.com – What is your official position regarding the physical letters sent to corporate executives in the United States claiming to be from your group?
• BianLian – We never do that. That is scam.\Sault Ste. Marie Tribe Says It Refused to Pay Cyberattackers’ Ransom
• Q4 Travelers' Cyber Threat Report: Ransomware Goes Full Scale
• Sault Tribe Chairman says tribe will not pay hacker’s ransom request (video)
• Highway Robbery 2.0: How Attackers Are Exploiting Toll Systems in Phishing Scams

Terrorism:

• Press Release - Global Terrorism Index 2025: Terrorism Spreads as Lone Wolf Attacks Dominate the West & Terrorism Trends Fueled by Sahel Conflicts, Western Lone Actor Attacks
• See Something, Say Something. 'Erratic' man at Kentucky church told police about plans to bomb major city, cops say
• Houston teen indicted for conspiring to commit murder under new terrorism law
• Plan to attack Australia synagogue faked by organized crime: police
• A boy with a loaded shotgun boarded a plane in Australia but was tackled by a former boxer
• A driver rams a car into crowd in Germany’s Mannheim, leaving 2 dead and 11 injured

Quick Hits:

• 'Five Eyes alliance' crumbling after UK, Australia, New Zealand and Canada give US cold shoulder
• FBI PSA: Beijing Leveraging Freelance Hackers and Information Security Companies to Compromise Computer Networks Worldwide
• Cisco Talos exposes Lotus Blossom cyber espionage campaigns targeting governments, telecom, media
• Chinese Nationals with Ties to the PRC Government and “APT27” Charged in a Computer Hacking Campaign for Profit, Targeting Numerous U.S. Companies, Institutions, and Municipalities
• Select Committee on the Chinese Communist Party Holds Hearing — " End the Typhoons: How to Deter Beijing’s Cyber Actions and Enhance America’s Lackluster Cyber Defenses”
• Former top NSA cyber official: Probationary firings ‘devastating’ to cyber, national security & Former intelligence officials denounce job cuts to federal cyber roles.
• Treasury Suspends Rule Requiring Disclosure Of LLCs' True Owners & Dept. of Treasury Press Release: Treasury Department Announces Suspension of Enforcement of Corporate Transparency Act Against U.S. Citizens and Domestic Reporting Companies
• Polish space agency investigates cyberattack on its systems
• Cybersecurity Job Satisfaction Plummets, Women Hit Hardest
• Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers Vulnerabilities

Andy goes solo this week, providing some initial updates relating to the ISAC community and last week’s Security Sprint focus on government transition and related concerns, then diving into a quick rundown of enduring threats and issuessecurity leaders may want to think about as part of their broader security and resilience efforts.

·      Crypto ISAC! FBI PSA - North Korea Responsible for $1.5 Billion Bybit Hack

·      Insider Threats: US intel shows Russia and China are attempting to recruit disgruntled federal employees, sources say

·      US – Russia Cyber Operations:

·    CISA on X: “CISA’s mission is to defend against all cyber threats to U.S. Critical Infrastructure, including from Russia. There has been no change in our posture. Any reporting to the contrary is fake and undermines our national security.”

·      Exclusive: Hegseth orders Cyber Command tostand down on Russia planning

·      Trump administration retreats in fight against Russian cyber threats

·      Risky Bulletin: Trump administration stops treating Russian hackers as a threat

·      Ranking Member Thompson: Trump Weakens National Security and Puts Our Critical Infrastructure at Risk as He Capitulates to Russia

Main Topics 

The Physical and Cyber Supply chain!

Manmade Threats

Terrorism

o  Minneapolis Man Arrested for Attempting toProvide Material Support to ISIS

o  One dead after car drives into crowd in German city of Mannheim

o  Tajik National Arrested in Brooklyn for Conspiring to Provide Material Support to ISIS

Protests, Anger, Targeted Threats

o  Tesla Takedown and other political protests

o  Police Investigate Shooting at InsuranceCEO's Oregon Home: Reports

o  State Accident Insurance Fund CEO targeted interrifying attack by hooded gunman at his Oregon home

o  Chairmen Gimenez, Green Introduce Bill To Address Vehicular Terrorism As Threat Grows

Weather, Climate & Environment

o  Hurricane Season is coming, and the USG may be less prepared and less able to respond

o  Wildfires scorch the Carolinas, SC Governor McMaster declares state of emergency

o  Wildfires Break Out in the Carolinas, Prompting Evacuations

o  Carolina Fire Maps Show Where Blazes Burning in North, South Carolina

Health preparedness

o  Texas measles outbreak rises to 146 cases

o  Texas Official Warns Against ‘MeaslesParties’ Amid Growing Outbreak

o  RFK Jr. urges people to get vaccinated amiddeadly Texas outbreak

o  NewsGuard: Vaccines Falsely Blamed for Measles Outbreak

Cyber Threats:

o  BEC & ransomware

o  Blended Threats: Modat - Doors Wide Open: hundreds of thousands of employees exposed & related: Over 49,000 misconfigured building access systems exposed online.

o  Critical dependencies

o  Info Ops: Russian propaganda may be flooding AI models

Quick Hits

• Take9!!! A Disney Worker Downloaded an AI Tool. It Ledto a Hack That Ruined His Life

In the 100th episode of the Security Sprint, Dave and Andy covered the following topics:

Warm Open:

·      H2OSecCon 2025 Call for Presentations Now Open

Main Topic:

DOGE, the Private Sector. Insider Threats & Info Sharing

·      DOGE Now Has Access to the Top US Cybersecurity Agency

·      DOGE employee Edward Coristine lands at CISAwith DHS email

·      ISAC chief on CISA security rollbacks: ‘The sky isn’t falling, yet.’

·      The Gate 15 Interview EP 55. Allan Liska, Ransomware Sommelier. Threats, mental health, comic books and Diet Dr. Pepper

·      Trump 2.0 Brings Cuts to Cyber, Consumer Protections

·      DOGE will use AI to assess the responsesof federal workers who were told to justify their jobs via email

·      PERSPECTIVE: Current U.S. GovernmentAdministration and the Risk of Increased Insider Threat

·      Opinion: DOGE’s US worker purge has created aspike in insider risk

Quick Hits:

·  Bybit Hack: Crypto exchange Bybit says it was hacked andlost around $1.4B

o  Risky Bulletin: North Korean hackers steal $1.5 billion from Bybit

o   Big Day for Crypto Goes South in a Hurry After a Giant Hack

o  Ethereum Developer Counters Idea Of Blockchain Rollback Amid Bybit Hack

o  Bybit’s Phantom Hacker Becomes Ethereum’s Shadow Whale by Fragmenting Fortune Across 54 Wallets

o  Bybit Hack Funds Funneled Through Meme Coins, Onchain Sleuth Reports

o  Crisis Management in $1.4 Billion Hack Sets New Industry Standard, Bybit Officials Say

o  What the Bybit Hack Means for Crypto Security and the Future of Multisig Protection

·      Stablecoin Bank Infini Earn Latest Hack Victim, Sees $49.5M USDC Flow Out to Attackers

·      Apple is removing iCloud end-to-encryption features from the UK after government compelled it to add backdoors

·      CISA and Partners Release Advisory on Ghost (Cring) Ransomware

·      Risky Bulletin: BlackBasta implodes, internal chats leak online

·      Salt Typhoon hackers exploited stolen credentials and a 7-year-old software flaw in Cisco systems

·      Terror Thwarted: Man Threatening Violent Attacks On New York Shuls Arrested In Lincoln Tunnel On Friday Evening

·      Early data show homicides dropped 16% in 2024

In this episode of The Gate 15 Interview, Andy Jabbour speaks with Allan Liska. Allan Liska, threat intelligence analyst at Recorded Future, has more than 20 years of experience in information security and has worked as both a security practitioner and an ethical hacker. Through his work at Symantec, iSIGHT Partners, FireEye, and Recorded Future, Allan has helped countless organisations improve their security posture using more effective intelligence. He is the author of “The Practice of Network Security, Building an Intelligence-Led Security Program”, “Securing NTP: A Quickstart Guide” and the co-author of “DNS Security: Defending the Domain Name System and Ransomware: Defending Against Digital Extortion.“, and “Ransomware: Understand. Prevent. Recover.” Learn more about Allan on LinkedIn.

In the discussion Allan and Andy discuss:

• Allan’s Background.
• Evolving Threats, mission creep and STDs (wait, what?)
• The ever-evolving threat of Ransomware and the value of collaboration
• Resilience: mental health, taking care of your people
• Roy Rogers, comic books and that’s before we play Three Questions!
• The enduring and expensive threat of scams (#Take9!)
• Lots more!

“Your data isn’t going to be deleted.”

Selected links:

• Recorded Future
• Green Archer

In this week's Security Sprint, Dave and Andy covered the following topics.

Warm Opening:

Quantum Computing Resources:

• ⁠Canadian Centre for Cyber Security⁠ - ⁠Preparing your organization for the quantum threat to cryptography (ITSAP.00.017)⁠
• ⁠Preparing your organization for the quantum threat to cryptography - ITSAP.00.017 (PDF, 335 KB)⁠
• ⁠FS-ISAC Releases Guidance to Help the Payment Card Industry Mitigate Risks of Quantum Computing⁠
• ⁠Joint Letter on the UK Government’s use of Investigatory Powers Act to attack End-to-End Encryption⁠
• ⁠U.K. demand for a back door to Apple data threatens Americans, lawmakers say⁠

Main Topics:

 China:

• ⁠Threat Snapshot: CCP Espionage, Repression On Us Soil Is Growing⁠;
• ⁠As USAID retreats, China pounces⁠ 
• Recorded Future - ⁠The Risk of a Taiwan Invasion Is RisingFast⁠

Hate, Extremism & Terrorism:

• ⁠Afghan held after suspected rammingattack injures 28 in Germany⁠
• ⁠Would-be Mooresville school shooter hadcollage of mass murderers, court docs reveal⁠
• ⁠Indiana teen accused of plotting Valentine’s Day school shooting was inspired by the Parkland massacre⁠
• ⁠Singapore detains teenage ‘East Asiansupremacist’ for planning attacks on Malays, Muslims⁠
• ⁠Singapore detains teen who ‘aspired’ tokill Muslims, mirroring New Zealand mosque attack⁠⁠The August 2024 Taylor Swift Vienna Concert Plot⁠.

Quick Hits

Cyber Reports:

• ⁠Storm-2372 conducts device code phishingcampaign⁠
• ⁠The BadPilot campaign: Seashell Blizzardsubgroup conducts multiyear global access operation⁠
• Google: ⁠Stand-Alone Cybercrime is a Threat toCountries' National Security⁠
• ⁠January 2025’s Most Wanted Malware: FakeUpdates Continues to Dominate⁠
• ⁠Ransomware Gangs Increasingly Prioritize Speed and Volume in Attacks⁠
• DOJ: ⁠Phobos Ransomware Affiliates Arrested inCoordinated International Disruption⁠
• ⁠Dragos Industrial Ransomware Analysis:Q4 2024⁠
• ⁠US cyber agency puts election securitystaffers who worked with the states on leave⁠
• ⁠China’s Salt Typhoon hackers continue tobreach telecom firms despite US sanctions⁠
• Blended Threats! ⁠Addressing cyber risks of smartinfrastructure, preventing catastrophic fires⁠
• ⁠Insider threats loom as Elon Musk's team gains swift government access⁠
• SecurityScorecard- ⁠A Deep Peek at DeepSeek⁠.
• ⁠New York Bans DeepSeek Over Potential Data Risks⁠

In this week's Security Sprint, Dave and Andy covered the following topics:

Warm Opening:

• In reversal, CISA workforce now permitted to take deferred resignation offer

• FS-ISAC Releases Timely Data Governance And Generative AI Guidance & read More Opportunity, Less Risk: 8 Steps to Manage Financial Services Data with GenAI.

Cyber Pipeline:

o Chairman Rreen reintroduces “Cyber PIVOTT Act,” Senator Rounds to lead companion legislation

o Lawmakers unite to push forward Cyber Force

o Gate 15’s been arguing for this since 2018… It’s Time for an FBI Cybercrime College Scholarship Program, October 14, 2018

• Blended Threats! Gate 15’s been talking about this since 2017… Unpacking the vicious cycle of climate change and digital security. Blended Threats you say…? Cyberattack on NHS causes hospitals to miss cancer care targets

Main Topics:

CISA Releases Active Assailant Emergency Action Plan Template and Instructional Guide

o Active Assailant Emergency Action Plan Template

o Instructional Guide to the CISA EAP Template

Ransomware & Data Breaches: Ransomware attackers turn to workers for data breach access

o Cyfirma: Tracking Ransomware: January 2025

o 35% Year-over-Year Decrease in Ransomware Payments, Less than Half of Recorded Incidents Resulted in Victim Payments

o Coveware: Will Law Enforcement success against ransomware continue in 2025?

o Halcyon Threat Insights 013: February 2025 Ransomware Report

Scams!Take9! Hackers Hijack JFK File Release: Malware & Phishing Surge

o Take9: Gate 15 is proud to partner with Take9! 9 SECONDS FOR A SAFER WORLD. Cyber threats are everywhere. And getting sneakier. What can you do to protect yourself, your community and our nation? Take a 9 second pause and think before you click, download, share. A short pause goes a long way.

o Threat actor claims to have breached Trump Hotels

Quick Hits:

• Trump's Gaza comments hand jihadist terrorists a 'rallying cry,' experts say

• CSI: Security Considerations for Edge Devices: Executive Guidance

• Canadian Centre for Cyber Security - Virtual private networks (ITSAP.80.101)

• UK NCSC: Network security fundamentals; How to design, use, and maintain secure networks

• National Security Presidential Memorandum/NSPM-2; Imposing Maximum Pressure on the Government of the Islamic Republic of Iran, Denying Iran All Paths to a Nuclear Weapon, and Countering Iran’s Malign Influence

Government Data Security Concerns:

o A US Treasury Threat Intelligence Analysis Designates DOGE Staff as ‘Insider Threat’

o Federal judge blocks Elon Musk’s DOGE from accessing sensitive US Treasury Department material

o Government Security Professionals Grapple with Following Procedure Amid DOGE Demands

o Teen on Musk’s DOGE Team Graduated from ‘The Com’

o As DOGE teams plug into federal networks, cybersecurity risks could be huge, experts say

o Coalition of US states to file lawsuit after Musk’s DOGE gains access to Americans’ personal data

Breaking Encryption:

o U.K. orders Apple to let it spy on users’ encrypted accounts; Secret order requires blanket access to protected cloud backups around the world, which if implemented would undermine Apple’s privacy pledge to its users.

o UK’s secret Apple iCloud backdoor order is a global emergency, say critics

DeepSeek:

o Lawmakers Push to Ban DeepSeek App From U.S. Government Devices

o Researchers say China’s DeepSeek chatbot is linked to state telecom, raising data privacy concerns

• Internet-connected cameras made in China may be used to spy on US infrastructure: DHS

• Exclusive - Chinese Spy Balloon Was Packed With American Tech; The balloon carried technology from at least five US firms.

• Hackers exploiting bug in popular Trimble Cityworks tool used by local gov’ts & Trimble Releases Security Updates to Address a Vulnerability in Cityworks Software

In this week's Security Sprint, Dave and Andy covered the following topics.

Warm Start:

(TLP:CLEAR) WaterISAC – EPA: National Security

Main Topics:

Ransomware & Data Breaches:

DeepSeek: 

Satellite images reveal China building war command center

Meta's WhatsApp says Israeli spyware company Paragon targeted scores of users.

Common Challenges in Cybercrime: 2024 Review by Eurojust and Europol.

Cybercrime websites selling hacking tools to transnational organized crime groups seized.

Europol: Law enforcement takes down two largest cybercrime forums in the world; The platforms combined had over 10 million users worldwide.

Man Arrested On Capitol Hill Said He Wanted To Kill Trump Cabinet Officials, House Speaker: Police.

Drones over NJ: Why didn’t the FAA admit they authorized the flights? Here’s what we know

FBI Springfield Advises Caution in Online Relationships.

MGM Agrees to Pay $45 Million to Settle Data-Breach Lawsuit.

Quick Hits: