CyberWire Daily - Building a great firewall around AI.

Episode Date: July 30, 2026

China embraces open AI models, then worries it’s become a national security risk. The cyberattack on Minnesota water systems proves larger than first reported. CISA updates its SBOM guidance. AI supercharges dangling DNS attacks. Researchers uncover a self-propagating Copilot worm. A critical Rails flaw demands urgent patching. Mac users are lured into installing malware through fake Claude guides. Amazon links a string of NPM compromises to North Korea. And Russia charges Telegram founder Pavel Durov with aiding terrorism. Ben Yelin joins us with a border search case that’s breaking new ground. Don’t bite the North Korean hand that feeds you. Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guest Today we are joined by Ben Yelin from University of Maryland Center for Cyber Health and Hazard Strategies talking about a border search case that’s breaking new ground. If you enjoyed this conversation, check out Ben on the Caveat podcast here.  Selected Reading As China’s A.I. Gets Stronger, It Poses New Risks to Beijing (New York Times) Minnesota Water Utilities Suffer ‘Coordinated Cyber Attack’ (GovTech) CISA Updates Software Bill of Materials Guidance to Strengthen Supply Chain Security (HSToday) ‘DangleGeddon’: AI Could Weaponize Forgotten DNS Records at Global Scale (SecurityWeek) Word worm crawls into Copilot, spreads chaos (The Register) Possible arbitrary file read and remote code execution in Active Storage variant processing (GitHub) Fake Claude Install Guide Leads to MacSync Stealer and RAT: What We Pulled From the Attacker's Servers (Huntress) Amazon identifies North Korean hacker group behind open-source supply chain attacks (AWS Security Blog) Russia accuses Telegram CEO Pavel Durov of aiding terrorism in its latest digital crackdown (AP News) North Korea's elite hackers turned on their own government — and got caught (Bitdefender) Share your feedback. What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show. Want to hear your company in the show? N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

You're listening to the Cyberwire Network, powered by N2K. This episode is supported by Black Hat USA. If you follow the research, you know a lot of it breaks on Black Hat stages. Hundreds of peer-reviewed briefings, more than 100 hands-on trainings, and the largest business hall in Black Hat's history. Six days to learn the skills you'll need tomorrow. August 1st to the 6th. Use code Cyberwire for $200 off your briefings pass.

at blackhat.com. We'll see you in Vegas. China embraces open AI models, then worries it's become a national security risk. The cyber attack on Minnesota water systems proves larger than first reported. Sisa updates its S-bomb guidance, AI supercharges dangling DNS attacks,

researchers uncover a self-propagating copilot worm. A critical rails flaw demands urgent patching. Mac users are lured into installing malware through fake clawed guides. Amazon links a string of NPM compromises to North Korea. Russia charges telegrams founder with aiding terrorism. Ben Yellen joins us with a border search case that's breaking new ground. And don't bite the North Korean hand that feeds you. It's Thursday, July 30th, 2026. I'm Dave Bittner, and this is your Cyberwire Intel briefing. Thanks for joining us here today. It's great as always to have you.

with us? China has promoted itself as a leader in low-cost open-source artificial intelligence, arguing that AI should be widely accessible and criticizing U.S. efforts to restrict Chinese models. Open source systems from companies such as Alibaba and Moonshot have gained global adoption because they can be freely downloaded, modified, and deployed. However, the New York Times reports that Beijing is increasingly concerned that the same openness could threaten national security and political stability. Officials worry advanced models could enable cyber attacks, scams, biological threats, or bypass government censorship, while also weakening the communist party's control over information. Reports suggest Chinese authorities are considering restrictions

on exports or overseas access to their most advanced models, even as they continue promoting openness in principle. Analysts say China is trying to balance global influence with tighter control over strategically important AI technologies. The debate mirrors similar discussions in the U.S., where companies disagree over whether open-source or closed-source AI offers the safest path forward, particularly as increasing capable models emerge. As a follow-up to our earlier reporting,

Minnesota officials say more than 30 community water systems were targeted in a coordinated cyber attack on July 26th and 27th. The attacks focused on operational technology, but authorities say there's no evidence of public health risks, and the investigation remains ongoing. State officials have launched a whole-of-state response, bringing together federal, state, local, tribal, and private sector partners to investigate the incident, share threat intelligence, and support affected utilities. Agencies involved include SISA, the EPA, the FBI, and Minnesota Public Safety and Health Officials.

State Chief Information Security Officer John Israel said the coordinated response helped contain the incident quickly and demonstrated the value of Minnesota's cybersecurity investments and cross-agency partnerships in protecting critical infrastructure. SISA, working with U.S. and international partners, has released its 26 minimum elements for a software bill of materials or S-bomb. The updated guidance incorporates public feedback and expands to cover all software, including open source, artificial intelligence, and software as well. a service. It adds new required data elements, clarifies existing ones, and reflects lessons

learned since the original 2021 guidance. Sessa says the revisions will help organizations strengthen software supply chain visibility and make more informed cybersecurity risk management decisions. Researchers at Silent Push are warning that artificial intelligence could dramatically increase the threat posed by dangling DNS takeovers, a long-known attack in which abandoned DNS records allow attackers to hijack subdomains. In research dubbed Dangle Gedden, the team used AI to automate domain discovery, identify exploitable targets, and generate takeover scripts, reducing thousands of potential targets to hundreds of vulnerable systems in minutes. Safe demonstrations showed how exposed government

financial, manufacturing, and pharmaceutical domains could be abused for fishing, malware hosting, or credential theft. Silent push argues that while dangling DNS attacks have traditionally been used for financial gain, AI could make them far more attractive to nation-state actors seeking widespread disruption. The researchers say the findings underscore the importance of promptly removing stale DNS records and decommissioned cloud resources. A researcher is warning of a new class of AI-assisted attack that could allow malicious instructions hidden in Microsoft Word documents to spread through copilot workflows.

Hakon Maloy found that attacker-controlled prompts embedded in a document can influence copilot-generated content and silently copy themselves into newly created files, enabling a self-propagating AI worm. Despite months of coordinated disclosure, Maloy says Microsoft has addressed specific proof-of-concept exploits, but not the broader vulnerability class. He argues the issue stems from a fundamental challenge with large language models processing untrusted content. Microsoft says it has implemented multiple safeguards and continues to strengthen its defenses, but recommends users treat external documents as untrusted,

install updates, and carefully review AI-generated content before sharing it. Ruby on Rails developers are being urged to patch a critical active storage vulnerability that could let unauthenticated attackers read arbitrary files from affected servers. The flaw affects applications that use lib-vips for image processing and allows uploads from untrusted users. By uploading a specially crafted file, an attacker may be able to expose sensitive data, potentially leading to remote code execution or lateral movement.

The recommended fix is to upgrade to a patched version of active storage, then rotate all potentially exposed secrets. For systems already running the current version, administrators can also block vulnerable operations through configuration as a temporary mitigation. Researchers at Huntress say attackers disguised the Macsync Steeler and Remote Access Tool as a Claude Installation Guide hosted on the legitimate clod.AI domain. Victims searching for Claude on a Mac encountered a paid Google advertisement

leading to a public Claude Share labeled as Apple Support. The page instructed users to paste a curl command. into terminal. That command launched a six-stage infection chain, granting full disk access, stealing browser and keychain data, capturing validated account passwords, and installing a persistent remote access Trojan. The malware could also request screen recording access and modify installed cryptocurrency wallet applications to steal recovery phrases. Trusted platforms, sponsored search results, and user-executed commands, can bypass traditional warning signs.

Defenders should prioritize behavioral detections over file hashes which change between builds. Amazon says a North Korea-linked threat actor compromised several popular node package manager or NPM libraries through maintainer's social engineering and malicious software updates. Amazon threat intelligence links the Axios, debug, Chalk, and Typo CryptoInns, to the same actor with medium confidence. The campaigns use trojanized packages, automatic post-install scripts, reused code, and shared command and control infrastructure.

Researchers also observed attackers splitting malicious behavior across multiple packages and delaying activation through remotely controlled resources. Trusted open source dependencies can provide access to thousands of downstream environments. Security teams should exist examine runtime behavior and dependency relationships, not only individual packages or signatures. Amazon also warns that generative AI may help attackers create convincing packages and manipulate

automated code review systems. Russian authorities have charged Telegram founder and CEO Pavel Durov with aiding terrorism, accusing the messaging platform of failing to remove channels and bots allegedly used. by Ukrainian intelligence and extremist groups to coordinate sabotage, terrorism, and cyber fraud. Russia's Federal Security Service said the activity resulted in casualties and claimed a telegram-based chatbot was used to recruit young Russians for attacks. Authorities have also placed Durav on international wanted lists, marking another step in the Kremlin's broader crackdown on online communications

since the 2022 invasion of Ukraine. Coming up after the break, Ben Yellen joins us with a border search case that's breaking new ground. And don't bite the North Korean hand that feeds you. Stick around. It is always my pleasure to welcome back to the show, Ben Yellen. He is from the University of Maryland Center for Cyber Health and Hazard Strategies and also my co-host on the caveat podcast.

Ben, welcome back. Good to be with you again, Dave. Interesting story. This is coming from The Guardian, and it is about a gentleman who was stopped at the border, a gentleman named Sam Tunic, who was on his way back from the Dominican Republic, and police pulled him aside. He found himself on a terrorist watch list because of his alleged ties to a protest movement in Atlanta, a movement called Cop City. but the gist of what's happening here is that when police asked him to hand over his mobile device so they could search it and they asked him for his passcode, he gave it to them, but he was using graphene OS, which is a privacy-focused open-source operating system,

and when they put in the password, the phone wiped itself clean. Yeah, so this is a fascinating story. The relevant federal law here makes it a crime to destroy property. to prevent government seizure. So there's kind of the mens rea or criminal intent element here that the reason you are destroying that property is for the purpose of preventing government access

to something. And here that would be the device. What makes this case unique is that all of the experts interviewed for this article were unaware of any previous case in which prosecutors had targeted a person because they use graphene or similar privacy-focused operating systems.

to wipe their phones in a scenario like this. And this could have significant downstream effects. If the use of these graphene-type tools is enough to cause law enforcement suspicion, then people who want to keep their communications private for whatever reason, they mention journalists or activists or lawyers, or people who are part of disfavored, religious, or other types of groups, people who are using privacy tools and security tools like graphene for their own purposes might be discouraged from doing so.

And that would have a very deleterious impact. That goes against best practices. It goes against the recommendations of security experts who will tell people to employ these tools for their own protection. And the use of these tools is not in and of itself an indication that somebody is trying to facilitate criminal activity. And the fact that we have a prosecution here might create a dangerous precedent where the simple use of a privacy enhancing technology like this is inherently suspect. Now, what makes this very complicated is that this happened at the border.

So airports count as the border. And the level of suspicion required to search people's devices, even for U.S. citizens, is lessened at the border because the government has a security interest in being able to protect the country from, visitors and from U.S. residents coming back from abroad. So they are generally given more leeway. There have been some disagreements among courts about how far that leeway extends. And generally, courts have been reluctant to allow law enforcement without a warrant to do a full forensic search of a phone in the first place. But because we have that lesson standard, this case might not be so clear cut. I think if this had happened in a different context where it was not a border search,

I think a judge might look at this and say a person's use of this privacy-enhancing technology clearly shouldn't be enough to ignite criminal suspicion and in and of itself can in no way support the charge that a person was trying to destroy property to prevent government seizure. But my concern is that because this happened at the border, everything law enforcement does at the border,

I guess customs and border protection, everything they do at the border, comes with a little bit more leeway because it is a border search. So I'm wondering how much of an impact that's going to have in this case. Do you think it's fair to consider automatic data deletion to say that that is destruction of property? I really don't because there is a legitimate privacy and security purpose to employing those types of tools.

It's something that security professionals recommend. And so I think it would be a misreading of the statute to interpret wiping one's device through the use of a graphene-type tool as evidence that the person was trying to destroy property to prevent government seizure. Let me play out another scenario here. So suppose instead of wiping the device, this passcode invoked extraordinarily strong encryption, right? uncrackable strong encryption. So all the data is still there, but we've rendered it inaccessible. Is this a distinction without a difference?

Could that be considered destruction? See, I think your example is a great one because I think it would be impossible for a prosecutor to argue that a person was destroying their property by employing encryption tools. But employing encryption tools has the same, like, real-world, tangible effect

of using graphene, right? Right. In that moment, both of those tools are being employed to prevent government officials from looking at your device. And that's what the law is about. Exactly, exactly. But the fact that they're arguing here that one tool as opposed to the other one counts as destroying one's property, I think is suspicious. I mean, I don't think in our kind of normal understanding of what destroying property means, that it would necessarily include something. like this graphene tool. I mean, it would obviously be destroying property if somebody took a

baseball bat and tried to physically destroy their device. I think the statute was intended for government agents coming to your house, looking for incriminating evidence, and you burn the evidence. Right. That's what this law was designed to prevent. And I think it's very possible. This is just a misuse of that statute applying it to a scenario that's completely inappropriate. So do you suspect this could be a groundbreaking case, one to keep an eye on? It is. I just, again, would raise my eyebrows of the co-founding factors. It might be that this particular search was permissible because it happened at the border, but the court might take no position on whether the use of this federal statute

as grounds for suspicion of criminal activity is acceptable in any other setting, if that makes sense. Yeah. So they might decide this on the narrow issue of, well, there's a decreased expectation of privacy for border searches. And that wouldn't give us necessarily any indication of what would happen if there was a garden variety of law enforcement investigation. You employed this tool and they said, look, they're trying to, federal law prevents you from destroying property to prevent government seizure. So you're in trouble. It would be nice if we could have a groundbreaking case that was not at the border because the border just introduces all of these conversations.

So we might get that, but this is certainly a case to follow. But just warning about all these co-founding factors that might make this particular case more difficult. Yeah. Well, just a program note for our listeners, Ben and I discuss this in much greater detail over on this week's caveat podcast. So if you're interested, please do check that out. Ben Yellen is from the University of Maryland Center for Cyber Health and Hazard Strategies. Ben, thanks so much for joining us. Thank you, Dave.

If you're heading to Black Hat USA this year, make plans to visit the SpectorOps Kennel Club. As creators of Bloodhound, the SpectorOps team will host talks with OpenAI and the UK AI Security Institute, as well as hands-on workshops aimed at helping you understand AI accelerated attack paths and the latest in identity tradecraft. Visit Spectorops.io to pre-register and learn more. SpectorOps Kennel Club is adjacent to Libertine Social, inside Mandalay Bay. While you're there, visit the N2K Cyberwire podcast studio, where we'll be capturing expert perspectives and conversations from across Black Hat.

And finally, in a twist that might qualify as career limiting, some of North Korea's elite hackers allegedly turned their talents against the government that trained them. According to Daily NK, authorities arrested a group of former military cyber operators, accused of stealing from the country's own central and foreign trade banks. The suspects reportedly trained through the same system that produced the notorious Lazarus Group, allegedly recruited university graduates, infiltrated banking networks, siphoned off small amounts of state funds,

converted the proceeds into cryptocurrency, and laundered the money through brokers in China. The scheme unraveled after officials noticed irregular foreign currency, transactions and traced suspicious cryptocurrency activity to a location in Pyongyang, where investigators reportedly caught the group in the act. While the irony is hard to miss, the consequences are likely anything but amusing. Reports suggest the accused and potentially their families now face severe punishment under North Korea's system of collective responsibility.

And that's the Cyberwire for links to all. all of today's stories, check out our daily briefing at thecyberwire.com. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights to keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey and the show notes or send an email to Cyberwire at n2K.com. N2K's lead producer is Liz Stokes. were mixed by Trey Hester with original music and sound designed

by Elliot Peltzman. Our contributing host is Maria Vermazes. Our executive producer is Jennifer Ibin. Peter Kielp me is our publisher, and I'm Dave Bittner. Thanks for listening. We'll see you back here tomorrow. Heading to Black Hat USA, the N2K's Cyberwire team

will be on-site recording from our podcast studio in the SpectorOps Kennel Club. If you're interested in joining us for a conversation or learning more about what we're recording throughout the week, stop by the studio and meet the N2K Cyberwire team. SpectorOps's Kennel Club is adjacent to Libertine Social inside Mandalay Bay.