CyberWire Daily - Inside job interrupted.

Episode Date: November 24, 2025

CrowdStrike fires an insider who allegedly shared screenshots with hackers. Google agrees, it wasn’t Salesforce. Cox Enterprises confirms Oracle EBS breach. Alleged Transport for London hackers plea...d not guilty. Hackers exploit new WSUS bug to deploy ShadowPad backdoor. Iberia discloses breach of customer data. Harvard discloses voice-phishing breach exposing alumni and donor data. We have our Monday Business Briefing. Our guest today is Brandon Karpf, friend of the show discussing maritime GPS jamming and spoofing. And the launderers who wanted a bank for Christmas. Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guest Today we are joined by Brandon Karpf, friend of the show discussing maritime GPS jamming and spoofing. Selected Reading CrowdStrike fires 'suspicious insider' who passed information to hackers (TechCrunch) Google says hackers stole data from 200 companies following Gainsight breach (TechCrunch) Cox Confirms Oracle EBS Hack as Cybercriminals Name 100 Alleged Victims (SecurityWeek) Teens plead not guilty over TfL cyber-attack (BBC) Attackers deliver ShadowPad via newly patched WSUS RCE bug (Security Affairs)  Iberia discloses customer data leak after vendor security breach (Bleeping Computer)  Harvard University discloses data breach affecting alumni, donors (Bleeping Computer)  Doppel secures $70 million in a Series C round. (N2K Pro Business Briefing)  Russia-linked crooks bought a bank for Christmas to launder cyber loot (The Register) Share your feedback. What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show. Want to hear your company in the show? N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices

Transcript
Discussion (0)
Starting point is 00:00:00 You're listening to the Cyberwire Network, powered by N2K. AI agents are now reading sensitive data, executing actions, and making decisions across our environments. But are we managing their access safely? Join Dave Bittner and Barack Shalef from Oasis Security on Wednesday, December 3rd, at 1-Py, Eastern for a live discussion on agentic access management and how to secure non-human identities without slowing innovation. Can't make it live? Register now to get on-demand access after the event. Visit events.thecyberwire.com. That's events with an s.thecyberwire.com to save your spot. What's your 2 a.m. security worry? Is it, do I have the right controls in place? Maybe are my vendors secure? Or the one that really keeps you up at night? How do I get out from under these old tools and manual processes? That's where Vanta comes in. Vanta automates the manual works so you can stop sweating over spreadsheets, chasing audit evidence, and filling out endless questionnaires. Their trust management platform continuously monitors your systems, centralized, your data and simplifies your security at scale.
Starting point is 00:01:33 And it fits right into your workflows, using AI to streamline evidence collection, flag risks, and keep your program audit ready all the time. With Vanta, you get everything you need to move faster, scale confidently, and finally get back to sleep. Get started at Vanta.com slash cyber. That's V-A-N-T-A-com slash cyber. CrowdStrike fires an insider who allegedly shared screenshots with hackers.
Starting point is 00:02:15 Cox Enterprises confirms Oracle EBS breach. Alleged transport for London hackers plead not guilty. Iberia discloses reach of customer data. We have our Monday business briefing. And our guest today is Brandon Karp, friend of the show. discussing maritime GPS jamming and spoofing, and the launderers who wanted a bank for Christmas. Today is Monday, November 24th, 2025.
Starting point is 00:02:54 I'm Maria Vermazza, host of T-minus Space Daily, in for Dave Bittner, as he's defrauded. casting his turkey. And this is your Cyberwire Intel Briefing. Thank you for joining me, everyone. Let's dive in. CrowdStrike has fired an insider who allegedly shared screenshots of internal systems with hackers, according to a report from TechCrunch. The scattered Lapsus hunters published the screenshots in a telegram channel last week, claiming to have gained access to crowd Strikes systems after breaching gain site. Crowdstrike says these claims are false, stating that,
Starting point is 00:03:36 quote, its systems were never compromised and customers remained protected throughout. The company says the hackers obtained the screenshots from a malicious insider whose access has been terminated. Bleeping computer cites a shiny hunters member who said the group offered the insider $25,000 to grant access to Crowdstrikes networks, but the insider was detected and locked out before they could do so. These details have not, however, been confirmed by CrowdStrike. In related news, Google's Threat Intelligence Group reports that hackers accessed and stole data from over 200 instances of Salesforce via third-party apps published by GainSight. The campaign claimed by the Scattered Lapsus Hunters Collective, including Shiny Hunters,
Starting point is 00:04:22 exploited integrations, not the core Salesforce platform, to infiltrate high-profile targets such as Dentor Sign, LinkedIn, and Verizon. Salesforce says the breach, quote, is not the result of any vulnerability in the Salesforce platform. U.S.-based global conglomerate Cox Enterprises has confirmed that its Oracle E Business Suite, or EBS, instance, was breached, leading to the theft of personal information belonging to nearly 9,500 individuals, according to a report from Security Week. Cox is one of the more than 100 entities named by the Klop ransomware gang as victims of a campaign targeting a zero-day flaw in Oracle EBS. Logitech, Harvard University, The Washington Post, Envoy Air, and Mazda have also confirmed that they were targeted by this campaign. Mazda told Security Week, however, that its defenses prevented the attackers from exfiltrating information. Two alleged scattered spider hackers have pleaded not guilty to charges related to last year's cyber attack against transport for London, according to a BBC report.
Starting point is 00:05:33 The defendants, 19-year-old Talha Joubert from East London and 18-year-old Owen Flowers from the West Midlands were arrested last year and charged with offenses under the Computer Misuse Act. Flowers has also been charged with attempting to hack two U.S.-based health care entities, The two defendants will be held in custody until their trial in June 2026. Attackers have exploited a recently patched vulnerability in Windows server update services, more commonly known as WSSS, and it is CVE 2025-59-287, rated as a CVSS score of 9.8, enabling unauthenticated remote code execution at the system level. Once inside WS-enabled servers, the adversary deploy. the sophisticated backdoor shadow pad by chaining tools like Powercat, cert util, and curl to download and side load a malicious DLL, which then persists via scheduled tasks and system process injection.
Starting point is 00:06:35 SISA has added the flaw to its known exploited vulnerabilities catalog, and organizations using WSUS are urged to patch immediately, restrict access, and audit for abnormal activity. Spanish airline Iberia has disclosed a breach affecting customers' names, email addresses, and loyalty card identification numbers, according to a new report from bleeping computer. The incident did not affect login credentials or financial details. The airline has attributed the breach to a third-party vendor, saying in a statement, quote, as soon as we became aware of the incident, we activated our security protocol and procedures, and implemented all necessary technical and organizational measures to contain it, mitigate its effects and prevent its recurrence.
Starting point is 00:07:21 The bleeping computer story also notes that a threat actor posted on a criminal forum claiming to have stolen data from Iberia and offering to sell it for $150,000. It is unclear if these claims are related, however, since the threat actor claimed to have breached Iberia's own servers and stolen technical details related to aircraft. Harvard University has disclosed that its alumni affairs and development systems were compromised following a voice fishing attack on November 18, 2025, which allowed an unauthorized party to access data related to alumni, donors, students, faculty, and staff. The exposed information includes email addresses, phone numbers, home and business addresses,
Starting point is 00:08:06 donation and event attendance records, but notably not social security numbers, payment card data, or financial account credentials. The university is working with law enforcement and third-party cybersecurity experts and has begun notifying affected individuals. And now it's time for your Monday business briefing. Last week's business breakdown highlights just over $180 million raised across seven investments and three acquisitions. On the investment front, U.S.-based social engineering defense company Dopple raised $70 million in a series C-round.
Starting point is 00:08:43 With this new funding, Dopple aims to expand its digital risk protection product portfolio. alongside expanding its existing human risk management offerings. Additionally, bedrock data, a U.S.-based data security firm, raised $25 million in a series A round. Through this funding, the company aims to accelerate product development timelines and invest in scaling its data security, integrations, classification, and AI governance. Additionally, the company also aims to meet its growing enterprise demand for infrastructure, platforms and software as a service, and AI systems at the multi-petabyte scale. For acquisitions, Cloudflare announced its intention to acquire Replicate,
Starting point is 00:09:25 and that's a U.S.-based AI model development company. Through Replicate, Cloudflare is looking to expand its Cloudflare workers' offering to allow it to build scalable and reliable AI applications. Additionally, Cloudflare aims to enable developers to access AI models across the globe with minimal code. And that wraps up this week's business breakdown. For deeper analysis on major business moves shaping the cybersecurity landscape, subscribe to N2K Pro, and check out thecyberwire.com every Wednesday for the latest updates. Now make sure to stick around after the break because Dave Bittner and I recently sat down with Branden. Karp, friend of the show, as we discuss maritime GPS jamming and spoofing.
Starting point is 00:10:19 And the launderers who wanted a bank for Christmas. From fishing to ransomware, cyber threats are constant, but with Nordlayer, your defense can be Nordlayer brings together secure access and advanced threat protection in a single, seamless platform. It helps your team spot suspicious activity before it becomes a problem, by blocking malicious links and scanning downloads in real time, preventing malware from reaching your network. It's quick to deploy, easy to scale, and built on zero-trust principles, so only the right people get access to the right resources.
Starting point is 00:11:08 Get 28% off on a yearly plan at Nordlayer.com, slash Cyberwire Daily, with code Cyberwire-28. That's Nordlayer.com slash Cyberwire Daily, code Cyberwire-28. That's valid through December 10, 2025. Most environments trust far more than they should, and attackers know it. Threat Locker solves that by enforcing default deny at the point. point of execution. With Threat Locker Allow listing, you stop unknown executables cold. With ring fencing, you control how trusted applications behave, and with Threat Locker DAC, defense against
Starting point is 00:11:55 configurations, you get real assurance that your environment is free of misconfigurations and clear visibility into whether you meet compliance standards. Threat Locker is the simplest way to enforce zero-trust principles without the operational pain. It's powerful protection that gives CISO's real visibility, real control, and real peace of mind. Threat Locker make zero trust attainable, even for small security teams. See why thousands of organizations choose Threat Locker to minimize alert fatigue, stop ransomware at the source, and regain control over their environments. Schedule your demo at Threatlocker.com slash N2K today.
Starting point is 00:12:42 Dave Bittner and I recently sat down with Brandon Karpf, friend of the show, as we discussed maritime GPS jamming and spoofing. Here's our conversation. It is my pleasure to welcome Brandon Karpf to the show. He is the leader for international public-private partnerships at NTT. Brandon, welcome. Thank you. I was good to be here, Dave.
Starting point is 00:13:07 And of course, Maria Vermazas, host of the T-Minis Space Daily podcast. Maria, thank you. Thanks for having me, Dave. Glad to be here. And I, Brandon. You are a graduate of the U.S. Naval Academy, and as such, have actually spent time out at sea. So our topic today is GPS maritime spoofing. And what we're seeing around the world when it comes to our adversaries, taking advantage of the GPS system and their ability to jam it or block it or do the things.
Starting point is 00:13:42 want to do. Can I just start with you, Brandon, for folks who aren't familiar with GPS and the reliance of it from folks at sea, how would you describe that? Yeah, sure. So from a high level, starting with what is this thing that we all do rely on? And every aspect of our daily lives and economy today relies on this brilliant innovation from the U.S. military developed around the 1970s, that was really designed to drop a precision guided munition on Moscow during the Cold War. Not to put too fine a point on it. Which was the whole point of this thing. It's always great talking to you, Brandon.
Starting point is 00:14:23 And then, you know, the private sector started realizing, hey, we can do a lot with this. And early days, GPS, you know, the resolution was down to a few meters. and then over the last 20 years, the U.S. military opened up more reserve frequencies that allowed our iPhones to geolocate us to within really centimeters, you know, incredibly high fidelity location that has opened up literally, I mean, literally trillions of dollars of economic value have been attributed to GPS. So talk about a great investment for the government to, for the U.S. government to put, you know, into the economy.
Starting point is 00:15:02 We've literally gained trillions of dollars. But when it comes to specific areas of the economy, you know, think any sort of transportation, whether it's aviation or maritime, having the ability to precisely geolocate where you are on Earth to navigate around things like hurricanes or typhoons or things like sea state that is beyond the capabilities of your ship to do things like autonomous navigation, where you now have ships who are pretty much, you know, these days the large American. time trade ships pretty much drive themselves you know they have a small crew who are there to really bring it in and out of port other than that these ships really kind of just drive themselves all of that relies on and requires the accurate GPS signals from our position navigation and timing satellites and Maria on the space side of things that's what we're talking about here this is a constellation of satellites you're right there there are several different ones GPS is the US-owned one. I'm sure Brandon was going to get to that. But there are many different ones.
Starting point is 00:16:06 Galileo is famously the one that Europe has, and then China has its own. And I'm sure there's others that I'm forgetting. And there's always more being added. But there are sort of in the industry is called either PNT position, navigation and timing, as Brandon said, or GNSS is another one, sort of as the generic. But often, when you say GPS, people know what you mean. So, yeah, but there are a lot. And there are going to be increasingly more because many global economies are realizing that these are extraordinarily valuable and they're being increasingly tied to many different markets where you might not, in ways you might not expect. I'm always surprised to find where else it's turning up and what else were, is totally dependent on these satellites being
Starting point is 00:16:44 accessible and working correctly. So let's talk about the implications for the maritime industry and indeed the military. I mean, we've got, as you say, Brandon, these ships that are relying on GPS, but it is evidently easy or not too hard to jam or spoof, which can throw ships off course. Yeah, most definitely. The signal characteristics themselves are actually incredibly basic. And just with some commercial off-the-shelf technology, you can replicate specifically a GPS signal. And again, as Maria mentioned, there are multiple different constellations. All of them have their own signal characteristics.
Starting point is 00:17:27 but the GPS signal itself is an incredibly low power signal. It's not very complex in terms of the modulation. It uses a very basic form of modulation. So again, this is something that you could probably buy maybe $50 of off-the-shelf equipment and create a spoofed GPS signal. In fact, I've even heard of some companies who are doing precision robotics doing this inside their own labs of spoofing these signals or replicating these signals, which is technically illegal. Technically illegal. But it's so easy to do that when you need to create some sort of robotics laboratory, you can really do it with literally probably about $50 of equipment. Now, the problem there is that not only are military ships and equipment,
Starting point is 00:18:13 and by the way, we didn't mention, but military ships heavily reliant on GPS, not just where you are, but also deconflicting where you are with other ships, but also your munitions, as we talked about the original intent of GPS, These days, smart munitions all rely on GPS. And so what you're seeing is increasing incidents of GPS spoofing and jamming, which are different things. And we could talk about the difference there. But GPS spoofing and jamming really kind of took off by the Russians in the Eastern Mediterranean
Starting point is 00:18:42 during the conflict in Syria and the mid to late 2010s has really expanded in the war in Ukraine around the Black Sea and Ukraine. We've seen it in the Western Pacific around Taiwan and even in some of the Straits, the Straits of Malacca, and we are starting to see it in areas like the Red Sea, the Straits or Hormuz, et cetera. And even recently, some reports of manipulated GPS signals off the coast of Venezuela. We've heard rumors of whenever Vladimir Putin is on board of a ship and board a ship's location. So I guess to make it a more difficult target to find or something like that. His short, certainly, his dacha in the mountains of Russia, similarly,
Starting point is 00:19:32 no GPS signals will work anywhere near that location. And we have seen this, of course, with foreign leaders or dictators who understand how easy it is to manipulate these signals, but also how much the U.S. and U.S. allies rely on these for our military intelligence operations and how pretty much everything we have today in terms of those more technical operations rely on an accurate geolocated signal.
Starting point is 00:20:02 And so right now, this is starting to occur regularly. And as I mentioned, it's pretty inexpensive and easy to do this. Brandon, can I ask you to walk us through the different modes of jamming or swoving? Because I think we often, and I know I often get confused and when I read various mainline news stories about some person doing something with a Bluetooth device to do something to GPS,
Starting point is 00:20:27 and I'm going, well, what exactly happened there? And my understanding is there's actually a couple different ways to achieve this, and they all kind of be a little bit different. So can you walk us through them? Sure. So the first I'll talk about is really kind of the least sophisticated form of jamming, which is really just putting a whole bunch of noise out into the atmosphere. So imagine you and I are having kind of like a little whispered conversation,
Starting point is 00:20:48 and then someone else just turns on a radio super loud, and you can't hear yourself think, that is barrage jamming. That is just the simplest form of jamming. You're just putting so much noise into the atmosphere that whoever's trying to receive the correct signal can't really hear the right signal, can't distinguish the signal for the noise.
Starting point is 00:21:08 And that's the simplest form, really easy to generate that, and you're just putting a whole bunch of energy out there under the world. There are techniques for getting around that. Again, that's relatively unsophisticated. And so there are some interesting modulation techniques that you can actually still extract the signal from that kind of a noise.
Starting point is 00:21:26 But that is still a very effective technique. And when it comes to GPS, you're just denying the availability of a user of GPS. No one's going to have GPS there. Now, a little more sophisticated is when you talk about more spot jamming, which is if you know the frequencies that someone is going to communicate on,
Starting point is 00:21:43 which GPS is an open standard now, everyone knows those frequencies, even if it's moving frequencies, you can, instead of putting out just noise across the whole spectrum, put out noise specifically over those frequencies. And in that way, you're actually being much more efficient with the energy that you need and the resources you need to jam,
Starting point is 00:22:03 and you're being much more effective in terms of jamming the specific frequencies being used by whatever user. But still jamming. You're just denying availability of that signal for someone to collect on it. Now, the much more sophisticated type is actual GPS spoofing. And GPS spoofing is where you actually copy the GPS signal itself. You copy the modulation, you copy the frequencies,
Starting point is 00:22:25 you copy the power level that someone expects to see, because devices are actually pretty smart, and there are ways of seeing, okay, this signal I'm receiving seems too powerful, and so let's just ignore it or filter it out. And so a really effective, sophisticated GPS spoofer is going to copy that modulation, copy the frequency, copy the power level,
Starting point is 00:22:44 and replicate that out into the environment. and give you just a slight timing delay. And really, that's how the GPS signals work. It's looking at the timing between you and multiple satellites, you and multiple satellite transponders. And if an adversary is spoofing that signal and slowly introduces a timing offset and slowly increases that timing offset over time,
Starting point is 00:23:08 the adversary is going to pull your GPS location away from where it's supposed to be manipulating where you think you are in the world. That's so cool. I hate that, that's my reaction. Like, that's so smart. And you can look up, you can look up, I mean, open source, you know, GitHub repos that do this, you know, algorithms that do this, you know, any sort of software-defined radio has the ability to do this.
Starting point is 00:23:34 So one of the potential perils here that I've seen covered is that an adversary can, as you say, lure a ship away from, say, an international shipping lane into an area where, they shouldn't be, therefore giving that adversary an excuse to board that ship or fire upon it. Certainly, right. And when you think about maritime, every country who has coastal regions has this thing called an exclusive economic zone, and then this thing called territorial waters. Your exclusive economic zone is within 200 nautical miles of your coast, and then territorial waters is within 12 nautical miles of your coast. Certainly military operations are very sensitive not to infringe upon that 12 nautical miles. Foreign nation military ships are not allowed to transit within 12,
Starting point is 00:24:22 that, you know, that territorial waters of a foreign nation without being invited. But that exclusive economic zone is really, you know, gives that nation, you know, the nation permission to do their fishing and mining and oil drilling, et cetera, without being infringed upon. And so certainly the GPS spoofing would affect that, right, would affect a military's ability like ours, who's doing something like a freedom of navigation operation, which is where we move a ship between, say, Taiwan and mainland China and say, this is a free economic zone. Anyone can transit here. We are participating in that freedom of navigation operation. But if the GPS signals are spoofed in that area, it makes the U.S. military much more concerned that we might accidentally
Starting point is 00:25:08 infringe upon the territorial waters of a foreign nation. So they might be more sensitive to that or pull further away. Also just accurate navigation, right? Ships are navigating based on charts and shoal waters and other potential hazards. And not having confidence in where you are creates a massive amount of risk that these ships might just not accept.
Starting point is 00:25:30 Brandon, when you were describing just the jamming and spoofing techniques, the thought that I had was we often shorthand talk about these satellite hacking problems. And it sounds like, yet again, it's really more a terminal, a ground terminal thing. Is my read on that correct? I mean, what is the mitigation here for, you know, somebody who's dealing with this in, you know, contested waters or whatnot? Yeah, it is kind of a terminal, right?
Starting point is 00:25:59 Because it's all, you jam a receiver, not a transmitter, right? When you jam something or spoof something, you are spoofing or jamming against the receiver, not the transmitter. The GPS constellation is just a whole bunch of transponders in medium Earth orbit. So, yeah, I mean, the problem is that the protocol itself, right, the modulation, the technology is so fundamental that it's just so easy to replicate. But even if you did something much more complex, I mean, it could still be hacked, right? You know, you can manipulate a cell signal using CDMA pretty easily. You know, you see that all the time with like the cellular collection stingrays and things like that. So that's even a more complex signal that's pretty easy to spoof.
Starting point is 00:26:42 So there are these things called navigation message authentications, which essentially think of it like a digital signature, right, where you can maybe sign the signal, but that requires the receiver to have a little more processing power. And so you're putting attacks on the terminal on the receiver to actually do some calculation to take some CPU time to authenticate these messages. Really, that's to me really kind of the only solution here.
Starting point is 00:27:10 You know, those digital signatures, using kind of the techniques from authenticating communications in network technologies and applying that to these GPS signals might be, I think, the best solution. That certainly has worked very well in terms of secure authentication in networks, secure software updates, et cetera, making sure that the message you're receiving is actually coming from who you think it's coming from. To me, that's approved and a well-established solution in the network space probably applies quite well here also. You mentioned earlier that the military at some point had opened up access to GPS.
Starting point is 00:27:53 And I remember when that happened, suddenly devices got a lot more accurate, as you say. We're down to centimeter accuracy now. Does the military have their own separate fallback on this? are they still using the same system that all the rest of us use? The military is very much using the same system that all the rest of us use. There's been a lot of talk and some funding going towards the next generation of GPS. And Maria, certainly, I'm curious what you've heard about this. It's early days for those.
Starting point is 00:28:27 You know, there's a number of companies on those contracts. But as of right now, military is totally reliant on the legacy GPS architecture. Yeah, I was just thinking of that, because just as you mentioned it, Dave, I was racking my brains. I'm like, I know I've been hearing a lot about this, and it still does sound very preliminary to Brandon's point. But I want to say I've also been hearing about putting P&T in low Earth orbit, which is an interesting idea. I guess the idea there'd be more redundancy, but just because of where it would be versus in medium Earth orbit, I'm just kind of like, how would that work? Someone's figuring it out. But it's like, why low Earth orbit
Starting point is 00:29:05 in that case? What would be the advantage there? aside from proliferation, I would assume. Yeah, I've heard that as a defense against some other elements, which is that's not necessarily defending against jamming and spoofing. Or kinetic stuff? It's more kinetic stuff, right? It's more attacks against the space-based architecture itself. In lower Earth orbit, you need a lot more satellites,
Starting point is 00:29:27 but those satellites can be a lot less exquisite because they're a lot closer. I mean, a lot, a lot closer. I mean, low Earth orbit, we're talking about. like 300 miles. Medium Earth orbit is like 12,000 miles or something like. So the amount of power you need to transmit down to ground much less. But then again, you need a lot more satellites to provide that proper coverage. But, you know, I've heard talks about putting it on some of these mega constellations, et cetera, as well. Yeah. But I mean, some of the other techniques here are going away from space-based solutions altogether. There are terrestrial-based solutions in
Starting point is 00:30:06 One of them is a legacy technology called Lowran, which was originally invented during the Cold War using a much lower frequency communication, but an over-the-horizon frequency range that would allow kind of, I mean, it's really hard to jam that, really hard to spoof that. But unfortunately, that also requires much larger equipment, at least back in the day, to properly receive those signals. So there are other ideas out there. There's some quantum stuff that I've been reading about in terms of navigation and laser-based inertial navigation. I mean, tons of different technologies that people are actively investing in right now to try to solve this problem.
Starting point is 00:30:51 That was Brandon Karp, friend of the show, discussing maritime GPS jamming and spoofing. at talus they secure what matters most the most trusted companies and organizations utilize talus cybersecurity products to protect critical applications sensitive data and identities anywhere at scale through their innovative services and integrated platforms talus provides customers a greater visibility of risks the ability to defend against cyber threats close compliance gaps, and deliver trusted digital experiences for billions of consumers every day. That's Talas, T-H-A-L-E-S. Learn more at CPL.tallisgroup.com. At Desjardin, we speak business. We speak startup funding and comprehensive game plans.
Starting point is 00:32:03 We've mastered made-to-measure growth. an expansion advice, and we can talk your ear off about transferring your business when the time comes. Because at Desjardin business, we speak the same language you do, business. So join the more than 400,000 Canadian entrepreneurs who already count on us, and contact Desjardin today. We'd love to talk, business. On Christmas Day, 2024, a Russian linked crime network gifted itself something far more festive. A 75% stake in a Kyrgyzstani bank. The UK's national crime agency says that Mary Bank mispurchase became a convenient machine for
Starting point is 00:32:48 washing cybercrime profits and channeling money into Moscow's war chest. Operation destabilized found the scheme began with low-paid couriers roaming 28 UK towns, collecting envelopes of cash from drug, firearm and immigration crimes. That cash was then flipped into crypto and funneled through Karamit Bank, the one that they bought, to support Promsvias Bank, Russia's military lender. At the top were two laundering crews, smart, allegedly led by Akaterina Jadanova and TGR, headed by George Rossi. Each leader worked alongside two partners, and all six are now sanctioned by the U.S. Treasury. The network also crossed paths with figures linked to Russian intelligence, including a group led by convicted spy Orlin Rusev,
Starting point is 00:33:39 and drew in Russian Moldovan oligarch, Elon Shore, and his sanctions dodging crypto ventures. Curiers have already been jailed, including one caught with 750,000 pounds at home, and another pair who laundered 6 million pounds under the guise of war-related transfers, With more than 120 arrests and millions seized, the NCA says its crackdown is tightening the pressure. And the money launderers?
Starting point is 00:34:08 Oh, yep, they know it. And that's the Cyberwire. For links to all of today's stories, check out our daily briefing at thecyberwire.com. We'd love to know what you think of our podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your podcast app. Please also fill up the survey in the show notes or send an email to Cyberwire at N2K.com. N2K's senior producer is Alice Caruth.
Starting point is 00:34:57 Our producer is Liz Stokes. We are mixed by Elliot Peltzman and Trey Hester with original music by Elliot Peltzman. Our executive producer is Jennifer Ibin. Peter Kilby is our publisher. And I'm your host, Maria Varmazes, in for Dave Bittner. Thank you for listening. We'll see you tomorrow. Thank you.
Starting point is 00:35:31 Thank you.

There aren't comments yet for this episode. Click on any sentence in the transcript to leave a comment.