CyberWire Daily

Hugging Face reports an autonomous AI-powered breach. Ernst & Young discloses a client data breach. Attackers are actively exploiting a critical ServiceNow flaw. Ransomware gangs sharpen their tactics against law firms. Capital One open-sources an AI security tool. Text salting fools AI email filters. Hidden gambling apps slip into Apple’s App Store. And federal agents arrest a Florida man accused of spreading malware through video games. Monday business briefing. Tim Starks from CyberScoop discusses election integrity. Fake feathers lead to faulty findings.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today we are joined by Tim Starks from CyberScoop discussing election integrity and the Trump administration’s waning influence. You can read more here.

Selected Reading

AI Agents Turned Into Attackers: Hugging Face Reveals Autonomous Intrusion Campaign (Security Affairs)

Ernst & Young Data Breach Affects Personal, Financial Information (SecurityWeek)

Critical ServiceNow code execution flaw now exploited in attacks (Bleeping Computer)

How ransomware tactics against law firms are changing (Wisconsin Law Journal)

Capital One Open Sources AI-Powered ‘VulnHunter’ Security Tool (SecurityWeek)

AI spam filters are getting suckered by old-school text salting (The Register)

Investigation reveals dozens of disguised gambling apps on the App Store in Brazil (9to5Mac)

FBI Arrests Florida Man in $220,000 Steam Crypto Theft Case (Hackread)

Israeli identity management startup Oak emerges from stealth with $60 million in seed funding. (N2K Pro Business Briefing)

AI-altered images on birdwatching forums putting research at risk | AI (artificial intelligence) (The Guardian)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.
Learn more about your ad choices. Visit megaphone.fm/adchoices

As space becomes an increasingly critical part of modern infrastructure, governments are reevaluating decades of policy to ensure reliable, secure, and independent access to the systems they are increasingly relying on.

In this week’s episode, host Maria Varmazis sits down with producer Ethan Cook⁠ to explore Europe's evolving space strategy and how it is increasingly prioritizing space sovereignty. During the conversation, they examine the EU's proposed Space Act and how it aims to improve the region's space security, sustainability, and reliability for years to come.⁠⁠⁠

Key sources:

EU Space Act.

EU Space Strategy for Security and Defense.

Like what you heard? Be sure to subscribe to our free Signals and Space Briefing⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, our Sunday newsletter covering the intersection of cybersecurity and space. Subscribe at: https://thecyberwire.com/newsletters/signals-and-space

Is there a topic or person you’d like to hear on our show? You can send your questions and feedback to space@n2k.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠. You can also fill our our audience survey: https://www.surveymonkey.com/r/NJYCN2P

T-Minus: Space-Cyber Briefing is a production of N2K CyberWire. N2K is your nexus for discovery and connection for people, technology, and ideas shaping the future of secure innovation. Learn how at n2k.com.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Lauren Fievisohn, Ph.D, Senior Threat Researcher from Silent Push, is sharing their work on "Meet DriveSurge: A New Threat Actor Using ClickFix and Fake Update Drive-By Attacks in Thousands of Compromised Sites." Silent Push researchers have identified a newly named threat actor, DriveSurge, which has compromised thousands of legitimate websites and uses ClickFix and fake browser update lures to distribute malware at scale through a pay-per-install operation.

The group leverages a traffic distribution system called zTDS to silently redirect visitors from trusted websites to malicious payloads, while employing sophisticated infrastructure, obfuscation, and fingerprinting techniques to evade detection. The report also details how DriveSurge targets both Windows and macOS users and provides defenders with eight infrastructure fingerprints to help identify and disrupt the campaign.

The research and executive brief can be found here:

Meet DriveSurge: A New Threat Actor Using ClickFix and Fake Update Drive-By Attacks in Thousands of Compromised Sites

Learn more about your ad choices. Visit megaphone.fm/adchoices

Nightmare Eclipse drops another Windows zero-day. The Gentlemen take the ransomware crown. CISA orders emergency Fortinet patching. Canada’s surveillance bill faces U.S. scrutiny. Meta’s Oversight Board flags AI censorship bias. Commerce tops the cyber target list. An active espionage campaign hits Bangladesh’s military. The Hewlett Foundation commits $100 million to emerging tech security. And U.S. prosecutors dismantle an alleged cyber-enabled money laundering network. Our guest is Nick Stohlman, Vice President of CJIS Strategy at Imprivata, talking about CJIS readiness and the identity security challenges facing public safety agencies. Leaked source code reveals an AI mixtape.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today we are joined by Nick Stohlman, Vice President of CJIS Strategy at Imprivata, talking about CJIS, Criminal Justice Information Services, readiness and the identity security challenges facing public safety agencies.

Selected Reading

New Windows LegacyHive zero-day gives hackers admin privileges (Bleeping Computer)

The Gentlemen Overtakes Qilin as Most Prolific Ransomware Threat (Infosecurity Magazine)

CISA urges immediate action on actively exploited Fortinet flaws (Bleeping Computer)

Senator calls on Rubio, Blanche to push back against Canadian surveillance legislation (The Record)

Meta Oversight Board finds top AI models less likely to criticize repressive regimes (Reuters)

Commerce faces rising AI bot activity, escalating DDoS attacks, and new fraud tactics (Akamai)

From Biography to Backdoor: Tracking a DoNot (APT-C-35) Intrusion Targeting Bangladesh Military Personnel (Cyderes)

Hewlett Foundation Announces New $100 Million Emerging Technology and Security Initiative (Hewlett Foundation)

US charges two over laundering $43 million from investment fraud (Bleeping Computer)

Hack Reveals Suno AI Music Generator Scraped YouTube, Deezer, and Genius (404 Media)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.
Learn more about your ad choices. Visit megaphone.fm/adchoices

CISA warns of active SharePoint attacks. The NSA pushes coordinated vulnerability disclosure. ClickLock Stealer targets macOS. Splunk and Zoom patch critical flaws. Spirals ransomware strikes in under 24 hours. New Windows evasion techniques emerge. LabubaRAT poses as NVIDIA software. 23andMe settles over its 2023 breach. Plus, a look back at one of the most audacious data center heists ever pulled off. Our guest is Ryan Kalember, Chief Strategy Officer at Proofpoint, discussing why agentic AI is creating a new insider threat. Near, far, wherever you are…the scam must go on.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today we are joined by Ryan Kalember, Chief Strategy Officer at Proofpoint, and he is discussing why agentic AI is creating a new insider threat.

Selected Reading

CISA urges immediate SharePoint hardening as exploits mount (CSO Online)

NSA joins CISA and Others in Releasing the Cybersecurity Information Sheet “Establishing a Coordinated Vulnerability Disclosure Program to Work with Security Researchers” (NSA)

‘ClickLock Stealer’ Bypasses macOS Security With Social Engineering, Process Killing (SecurityWeek)

Splunk, Zoom Patch Critical Vulnerabilities (SecurityWeek)

New Spirals ransomware encrypts victim network in under 24 hours (Bleeping Computer)

Bind Link Abuse: One Windows Feature, Many Ways to Blind Your EDR (Bitdefender)

LabubaRAT: A Rust Based Remote Access Tool Masquerading as NVIDIA Software (Blackpoint Cyber)

23andMe reaches $18 million settlement with states for massive breach (The Record)

How a Gang of Thieves Pulled Off a Multimillion-Dollar Data Center Heist (The New York Times)

Fake Céline Dion Paris Tickets Sold on Facebook and Ticketmaster Clones (Hackread)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.
Learn more about your ad choices. Visit megaphone.fm/adchoices