CyberWire Daily

CISA scales back its Election Day role. Google takes down a massive Android TV botnet. The UK warns of AI-powered attacks on critical infrastructure. German lawmakers face potential spyware threats. An AI-enabled infostealer ranks its victims. Ivanti patches more exploited zero-days. NATO launches cyber war games in Estonia. A Harvard breach exposes data linked to 850,000 email addresses. Our guest is Alex Weinert, Chief Product Officer at Semperis, on protecting the identity fabric in the AI era. Democracy is calling. And texting.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today on our Industry Voices segment, we are joined by Alex Weinert, Chief Product Officer at Semperis, talking about protecting the identity fabric in the AI era. If you enjoyed this conversation be sure to check out the full interview here.

Selected Reading

CISA Retreats From Election Security Ahead of Midterms (The New York Times)

Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies (Krebs On Security)

NCSC Chief Warns of Imminent AI Ransomware Threat to UK Critical Infrastructure (Infosecurity Magazine)

Germany says lawmakers' iPhones may have been hacked with spyware (TechCrunch)

Spooky New Infostealer Malware Uses AI to ‘Autodox’ Victims (WIRED)

Ivanti patches two more Connect Secure zero-days chained in attacks (Bleeping Computer)

NATO's Crossed Swords Exercise Brings AI Agents Into Cyber Operations Training (SecurityWeek)

Harvard University data breach exposed info of 851,000 accounts (Bleeping Computer)

My Journey to the Center of America’s Political Spam Text Hell (WIRED)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.
Learn more about your ad choices. Visit megaphone.fm/adchoices

The FBI blames North Korea for a record-breaking crypto heist. Hackers hijack air raid alerts in Ukraine and Russia. European supermarket freezers come under attack again. Aur0ra ransomware operators put AI agents to work. Android’s SMS of Death gets a proof-of-concept exploit. Malicious Claude Code extensions infiltrate Cursor’s marketplace. Google offers a quarter-million-dollar bug bounty. ChatGPT faces a wrongful death lawsuit. Monday business briefing. Our guest is Cynthia Kaiser, SVP of Halcyon’s Ransomware Research Center and former Deputy Director of the FBI’s Cyber Division, sharing how the AI cybercrime economy is open for business and booming. The secure USB drive that wasn’t.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Cynthia Kaiser, SVP of Halcyon’s Ransomware Research Center and former Deputy Director of the FBI’s Cyber Division, shares how the AI cybercrime economy is open for business and booming.

Selected Reading

FBI Attributes Binance Heist to North Korea’s TraderTraitor (Infosecurity Magazine)

Ukraine's air raid alert system hacked, Russian system targeted hours later (Kyiv Independent)

News Cybercrime Recorded Future Second wave of suspected cyberattacks hits supermarket freezers across Europe (The Record)

AI used in Aur0ra ransomware testing and execution (SOPHOS)

New Android SMS of Death exploit can remotely crash unpatched phones (Bleeping Computer)

Malicious Claude Code Extension Served in Cursor Supply Chain Attack (SecurityWeek)

Google Introduces $250,000 Root-in-Cloud Bug Bounty Reward (SecurityWeek)

Parents of woman who died of seizure after ChatGPT misguidance sue OpenAI (The Guardian)

Upwind Security raises $400 million in Series C funding. (N2K Pro Business Briefing)

Lenovo's 'encrypted' fingerprint USB drive is just an unencrypted SD card in a fancy case — AI-assisted follow-up finds a backdoor and hardcoded keys in other ‘secure’ USB products (Tom's Hardware)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.
Learn more about your ad choices. Visit megaphone.fm/adchoices

As space's infrastructure continues to grow, the question of space leadership will not center around who has the most satellites, but instead around who can leverage the greatest satellite capabilities.

Host Maria Varmazis met with Yasrine Ibnyahya, VP of  technology investments and partnerships at Viasat, to discuss Mobile Satellite Services Association (MSSA) Reference Architecture. Ibnyahya discusses how evolving architecture has continued to build on earlier work utilizing multiple waveform technologies, greater interoperability, and incorporating more satellite payloads.

Key Sources:

MSSA Reference Architecture 2.0

Like what you heard? Be sure to subscribe to our free Signals and Space Briefing⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, our Sunday newsletter covering the intersection of cybersecurity and space. Subscribe at: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thecyberwire.com/newsletters/signals-and-space⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠

Is there a topic or person you’d like to hear on our show? You can send your questions and feedback to ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠space@n2k.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠. You can also fill our our audience survey: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://www.surveymonkey.com/r/NJYCN2P ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠

T-Minus: Space-Cyber Briefing is a production of N2K CyberWire. ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠N2K⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ is your nexus for discovery and connection for people, technology, and ideas shaping the future of secure innovation. Learn how at ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠n2k.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠.
Learn more about your ad choices. Visit megaphone.fm/adchoices

Today we are joined by ⁠Subhajeet Singha⁠, Senior Security Researcher at ⁠Acronis⁠ Threat Research Unit, discussing their work on "Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit." A Chinese-speaking threat actor tracked as Red Heron exploited a critical Gitea remote code execution vulnerability, CVE-2026-60004, within days of its public disclosure, compromising organizations across five countries and stealing source code, credentials, and sensitive infrastructure data.

The campaign involved deploying persistent backdoors and a newly identified Linux implant called JITTERLY, which contains an undocumented rootkit, SIXZUT, capable of hiding files, processes, and network connections while protecting the malware from removal. Acronis assesses with moderate confidence that Red Heron operates within a PRC-linked context, highlighting how quickly attackers can weaponize newly disclosed vulnerabilities and turn exposed development platforms into gateways for broader network compromise.

The research and executive brief can be found here:

⁠⁠⁠⁠Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit⁠

Learn more about your ad choices. Visit megaphone.fm/adchoices

Binance suffers a record-breaking cryptocurrency heist. Attackers exploit a critical GitLab flaw. Russian disinformation targets U.S. elections. Treasury sanctions North Korean IT worker operations. A cyberattack halts Polymarket trading. GCHQ loses track of thousands of storage devices. An abandoned Mac app leaves security risks behind. Japan Airlines reports a third-party breach. An AI-powered command-and-control framework emerges in the wild. Our guest is Josh Devon, Co-founder & CEO of Sondera, winner of the 9th annual DataTribe Challenge. We bid farewell to the captain who inspired a generation of innovators.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today Josh Devon, Co-founder & CEO of Sondera and winner of the 9th annual DataTribe Challenge, is discussing their win.

Selected Reading

CISA says max severity GitLab flaw now exploited in the wild (Bleeping Computer)

Covert Russian Group Targets James Talarico With Baseless Claims in Texas Senate Race (The New York Times)

US sanctions Russians, North Koreans for laundering IT worker earnings (The Record)

Polymarket confirms cyberattack on third-party provider after outages (The Record)

Britain’s spy agency doesn’t know where thousands of its memory sticks are (POLITICO)

Old 'Popcorn Time' App Left Hundreds of Thousands of Macs at Risk (MacRumors)

Japan Airlines warns of data breach as country grapples with multiple cyber incidents (The Record)

NIK C2: The new AI-enabled command-and-control framework (Cisco Talos)

How North Korean hackers pulled off the biggest crypto heist in history (Metacurity)

Patrick Stewart, ‘Star Trek’ Captain and Professor X on ‘X-Men,’ Dies at 86 (The New York Times)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.
Learn more about your ad choices. Visit megaphone.fm/adchoices