CyberWire Daily - Taking the cloud out of the sky.

Episode Date: October 13, 2026

French supermarkets lose their cool in a refrigeration cyberattack. Anthropic pulls the plug on AI agents behaving badly. A Canadian ransomware negotiator is arrested in the FBI’s ShinyHunters investigation. XWorm expands its surveillance capabilities. A Dutch grocery giant suffers a cyberattack. Leaked files reveal Luna Moth’s playbook. Monday business brief. Our guest is Tim Starks from CyberScoop discussing how major rules for federal contractors handling sensitive data are nearing the finish line. Six digits sink Danish security. Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guest Today we are joined by Tim Starks from CyberScoop discussing how major rules for federal contractors handling sensitive data are nearing the finish line. Selected Reading Ukraine strikes third Yandex data center, disrupting digital services across Russia (The Record) Cyberattack Hits Hundreds of Supermarket Refrigeration Systems in France (The New York Times) DoD confirms ‘refrigeration disruption’ at military commissaries (MilitaryTimes) Anthropic takes risky AI tests offline after models breach govt sites (Bleeping Computer) Shock and surprise after FBI arrests Canadian cybersecurity expert in ShinyHunters hacking case (CBC News) XWorm RAT Evolves Into Surveillance Platform (SecurityWeek) Cyberattack Prompts Ahold Delhaize to Disconnect Systems (SecurityWeek) Luna Moth Leaks Shed Light on Ransomware Group's Inner Workings (Infosecurity Magazine) Armadin has raised $255.5 million in a Series B round led by Andreessen Horowitz and Accel (N2K Pro Business Briefing) '123456' password linked to Denmark data breach affecting 8.8M people (The Register) Share your feedback. What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show. Want to hear your company in the show? N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyberwire Network, powered by N2K. The Cyber Innovation Conference brings together startups, SISOs, researchers, and VC firms building trust into tomorrow's digital world. This year, two signature events come together under one roof. On day one, DMV Rising brings cybersecurity leaders together for SISO-led conversations about securing tomorrow's technology. Then, on day two, the ninth annual Data Tribe Challenge puts emerging cyber startups in the spotlight as they compete for exposure, acceleration, and funding. It all happens October 26th and 27th in Washington, D.C., alongside the Innovation Expo, opportunities to connect with the cyber community, and conversations designed for substance over noise.

Learn more at Cyber Innovationconference.com. Quick question. Who or what has access to your critical systems right now? I'll give you a hint. It's not just employees anymore. It's vendors, machines, applications, workloads, and so many AI agents. Zage security helps organizations control every identity with zero-trust policies that govern what they can access, what they can do, and when. Because when critical systems are at stake, compromised access, can mean downtime, disrupted production, and real-world consequences. Protect what matters most with the Zage Identity Fabric platform. Learn more at Zage.com. That's XAGE.com. French supermarkets lose their cool in a refrigeration cyber attack. Anthropic pulls the plug on AI agents behaving badly.

A Canadian ransomware negotiator is arrested in the FBI's shiny hunters investigation. X-Werm expands its surveillance capabilities. A Dutch grocery giant suffers a cyber attack. Leaked files reveal Luna Moth's playbook. We got your Monday business brief. Our guest is Tim Starks from CyberSoup, discussing how major rules for federal contractors handling sensitive data are nearing the finish line.

And six digits sync Danish security. It's Tuesday, October 13, 2026. I'm Dave Bittner, and this is your Cyberwomen. Intel briefing. Thanks for joining us here today. It's great as always to have you with us. Ukrainian drone strikes have hit three of Russian technology giant Yandex's six data centers, disrupting digital services across Russia.

The attacks began October 7th, targeting facilities in multiple cities. Two data centers have shut down completely, while a third sustained infrastructure damage. The outages have affected Yandex class. payment systems, taxi bookings, food deliveries, and numerous third-party services. Yandex says its remaining infrastructure is unstable and cannot provide a timeline for full recovery. The targeted facilities also house powerful supercomputers used for artificial intelligence, although any damage to those systems remains unconfired. Ukrainian President Volodymyr Zelensky described the strikes as retaliation for Russian attacks on

Ukrainian data centers and telecommunications infrastructure, which disrupted internet access for thousands of households in September. A cyber attack targeting supermarket refrigeration systems has disrupted at least 380 stores across France, forcing some retailers to throw away entire inventories of fresh and frozen food. The attack affected refrigeration management systems manufactured by Danish company Danfaw. Multiple grocery chains were affected. Danfoss says the attack primarily affected older systems that no longer receive security updates. Some supermarkets managed to intervene before food spoiled, while others suffered substantial losses.

One retailer estimates that refrigeration failures could cost larger stores more than $200,000. French prosecutors are investigating the attack, including reports of food spoilage and fires. No group has claimed responsibility and authorities have not identified the attackers. A similar attack targeted commissaries on U.S. military bases in late August. Anthropic has cut off Internet access for its internal AI model evaluations after several agents took unauthorized actions on government and other websites. The incidents included models exploiting server vulnerabilities, bypassing data access restrictions. and circumventing safeguards designed to prevent unwanted activity.

In one case, Claude Haiku 4.5 fabricated and submitted a homicide tip to Philadelphia Police. Another model exploited a university server to complete a scientific calculation. Anthropic believes its reinforcement learning process may have encouraged models to find unauthorized workarounds rather than abandon blocked tasks. The company says the incidents caused minimal real-world harm, but notified the White House and moved all internal evaluations offline until stronger safeguards are in place. The decision follows earlier incidents involving malicious package uploads and unauthorized system access. A prominent Canadian ransomware negotiator has reportedly been arrested in connection with the shiny hunters' cyber attack on the FBI.

Reuters identifies the subject as Ed Dobrovsky, a longtime cybersecurity executive known for negotiating with ransomware gangs. FBI director Cash Patel confirmed the arrest of a suspected co-conspirator in the breach of FBIjobs.gov, which exposed sensitive information about bureau employees. Dubrovsky faces federal charges involving conspiracy to commit cyber extortion and interference with commerce through, threats. The allegations have not been proven in court. The arrest has surprised Canadian cybersecurity professionals familiar with Dubrovsky's work. Shiny hunters, a prolific data theft and extortion group, claimed responsibility for the FBI breach last month, describing it as retaliation against the agency. The FBI says it intends to pursue the group

and its associates. The X-Werm Remote Access Trojan is of all into a more powerful surveillance platform, according to researchers at Netscope. First observed in 2022, Xworm gives attackers extensive control over infected Windows systems. Its developers have expanded its available plugins from 35 to 46, adding capabilities including location tracking, live microphone monitoring, and webcam access.

A particularly concerning addition called H-browser, lets attackers remotely control authenticated browser sessions, effectively bypassing multi-factor authentication without stealing credentials. NetScope observed more than 1,200 X-Worm incidents across 100 organizations during the third quarter. The malware's development has accelerated since its builder was cracked and its source code leaked in 2025, making the toolkit more widely accessible. Researchers expect further enhancements and continue, use of Xworm by cybercriminals.

Dutch Belgian grocery giant Ahol Deliz has taken some systems offline following a cyber attack. The company says its stores remain open and customer service is unaffected, although local reports indicate disruptions to deliveries and online orders in Belgium and the Netherlands. There are reports that U.S. operations may also be affected. It's unclear whether the incident is connected to recent cyber attacks, targeting supermarket refrigeration systems across Europe. Ahold Delees previously suffered a ransomware attack in 2024 that compromised personal information belonging to more than 2.2 million people.

Leaked internal documents have exposed what appears to be a surprisingly organized operation behind the Luna Moth Cyber Extortion Group, also known as Silent Ransom Group. According to Checkpoint Researchers, the group operates, much like a business, with specialized roles, detailed scripts, and carefully coordinated social engineering attacks. Operators impersonate IT support personnel, persuading employees to install remote access software. While one attacker keeps the victim engaged on the phone, another quietly takes control of the computer. The two coordinate through a messaging service. The leaked instructions even include techniques for overcoming suspicious or reluctant victims.

researchers caution that the documents haven't been independently authenticated but say they illustrate how effectively attackers can exploit human trust. Their advice, verify unexpected IT requests independently, and restrict unauthorized remote access tools. Turning to our Monday business brief, investment in AI-driven cybersecurity continues to attract substantial funding with five companies announcing new financing rounds, California-based Armaden leads the pack, raising $255.5 million to expand its agentic security platform.

Amsterdam's Hadrian secured $40 million for its AI-powered offensive security technology, while privacy-focused networking startup docks.net raised $38 million. Italian compliance automation provider Complian collected $15.1 million, and Luxembourg-based risk intelligence company Osovel raised 9.5 million. On the mergers and acquisitions front, Quantum E-Motion agreed to acquire Canadian cybersecurity firm Plurlock. Germany's Sequario acquired three domestic security service providers, while South Africa's Risk X group purchased Wolfpack information risk.

Swiss certification company SGS acquired Nashville-based Precianed Security, and Dyna Trace completed its acquisition of AI evaluation platform Arise, aiming to combine AI testing capabilities with its existing observability tools. The activity reflects continued investor interest in AI security, compliance automation, and cybersecurity services. Be sure to check out our complete business briefing on our website. That's part of Cyberwire Pro. Coming up after the break,

Tim Starks from Cyberscoop discusses how some major rules for federal contractors are nearing the finish line, and six-digits sync Danish security. Stay with us. When you're running security for a fast-growing company, the stakes keep rising, more compliance frameworks, more vendors, more risk, and a board that wants the whole picture in one place. The problem is your compliance data usually isn't in one place. controls live in one tool, vendor risk, and another, and customer commitments are buried in contracts. So your team spends more time stitching everything together and making decisions based on data that may already be a quarter old. Vanta connects it all. Its agenic trust platform is built for enterprise scale, with more than 400 integrations and continuous monitoring to automate evidence collection,

surface the risks that matter and organize audits around your auditor's requirements. And the Vanta agent works around the clock with full program context, helping make sure nothing slips through the cracks. Vanta says customers see a 526% return on investment over three years with payback in three months. More than 16,000 companies trust Vanta, including Snowflake, Atlassian, and Ram. Learn more at Vanta.com. slash cyber. Social engineering attacks

look trustworthy, a routine request, an internal email, a familiar face on a call, but Dopple sees through the disguise. Their AI native platform detects and disrupts attacks across every channel, trains employees to recognize deepfakes and deception

and investigates every fish to take down the campaign behind it. They fight relentlessly to protect your business, brand, and people. Doppel. Outpense. what's next in social engineering. Learn more at doppel.com. That's d-O-P-P-P-E-L.com.

It is always my pleasure to welcome back to the show. Tim Starks, he is a senior reporter at CyberSoup. Tim, welcome back. It's my pleasure as well. Interesting article that you published over on CyberSoup. This is about some new rules that federal contractors might be faced with in the coming months and years ahead. What's going on here, Tim?

That's accurate. Yeah, so here's what I found interesting about this story. First, it was pretty under the radar. I don't think we've seen a lot of talk about this. So I like to shed light on corners of the cyber policy world that people aren't paying a ton of attention to. The second thing is it is, of course, important to contractors, but it's important as well to anybody at all

in the sense that it pertains to a kind of information and protecting that kind of information that falls short of classified, but is still sensitive and important. So that means things like our social security numbers. It means things like critical infrastructure information that could reveal vulnerabilities. The regulations that are in the works

say that contractors who have to handle this kind of information called controlled unclassified information have to adhere to some security standards, some higher security standards, for protecting that information, and that when there is a, breach of that information in any kind of unauthorized access, which includes cybertax. They have to notify the government within 72 hours, and that dovetails with some other policy

stuff that has been circulating out there in the world. Quite specifically, the Circea law, that is the regulations for which are still in the works all these years later, but seemingly closer to the finish line. And the idea of the 72 hours standard is that if you look back at earlier versions of this regulation, there was talk of it being more like eight hours. notification if it would breach. So this time, the government, you know, this administration and the prior administration, to a lesser extent, have made harmonization, that glorious word, of harmonization of regulations, especially as it pertains to these kinds of breach notification standards, a big priority.

And one of the ideas here is to fit that in there. There's some other cyber ramifications as well, but those are the two main ones. Well, the reporting window certainly caught my eye. And one of the things that you note in your reporting is that, there's been some pushback from industry. Well, I guess the initial pushback from industry was going from eight hours to 72, but there are some folks in industry who were saying, how about 30 days? Yeah, it's interesting that there's been a push in industry toward that harmonization that I just mentioned.

They made it a big priority in their messaging. And here we have what appears to be harmonization. And they're saying, not quite what we like. we'd like to have more leniency on reporting. And, you know, one of the people who I spoke to for the story who spoke on condition of anonymity was a little bit more glib about it saying 72 hours is kind of a made-up number. It's not like there's not been a study done

to determine that 72 hours is the best standard. It's a policy consideration. You might recall back when Sercia was being debated before it settled on the final form, but it was in, there were a variety of bills out there that were saying, let's do it in eight hours, It's soon in 12 hours. It's soon in 24 hours.

And they settled on 72. So that source was right in that sense that it is something of a magical number that just kind of exists by virtue of compromise. But it seems like they would like to see that be even more lenient as it pertains to this particular regulation. I guess we should mention that Sercia stands for the Cybersecurity Incident Reporting for Critical Infrastructure Act.

I thought about doing it, Dave. But I was kind of... I... Look, I can't keep track of all of these... acronyms and abbreviations, so it is unreasonable for us to expect our audience to do the same. I agree. And just to get a little bit more further than the explanation of that law, that, as it sounds, pertains primarily to critical infrastructure owners and operators and trying to get a standard for them to report when they suffer a major breach in addition to reporting when they

suffer ransomware tax. The ransomware tax portion is not a part of this new regulation, but the 72-hour standard for reporting a breach in the case of this regulation for government contractors and, in fact, their subcontractors, there's another element of this, versus Circea and the pertinence for critical infrastructure owners. What sort of timeline does the administration hope to be on here with this? It's a little vague. They are at the proposed rule state and without getting too deep into how this normally works. there is a chance that they could go to an interim rule that would kind of put it in place for the time being, as the word interim implies. They could move to a final rule. One of the people I talked to in the law world was of the mind that it could happen as soon as the end of this year.

But it does seem at least that the latest they're looking at is at the end of the Trump administration's term. They have made it pretty clear that this is, by the way, a part of a broader. change to federal acquisition regulations. And so this is something that's been a priority for this administration. I think that that expectation by the end of the term is very reasonable. I think sooner is not unreasonable, but I think as we've seen with us to see a law, that was supposed to be done a long time ago. And we're still waiting on that can do the finish line.

So someone being optimistic about the government finishing something early would probably be maybe foolish, but it's at least possible that they'll get it done sooner than the end of this administration. Yeah, another tidbit from your reporting that caught my eye was this notion that the whole definition of controlled unclassified information, CUI, as you say, it may not be consistent from agency to agency. And so there's some frustration from contractors as to what exactly falls under that umbrella. Yeah, I think that's one of the worries that goes back to 2010 even when there was

executive order on this in the Obama administration to try to take all these terms like for official use only and since it have been unclassified. So there's that terminology, but there's also the fact that a lot of people think of being a contractor who maybe isn't handling any control unclassified information and suddenly you have it. Is it clearly labeled enough as such? Therefore, what kind of standard do you have that you're like, you know that you have the CUI? That's a concern that some of these contractors have. And then, you know, the other thing is that it could open people up to the False Claims Act punishments, which is something that we've seen, you know, is it old law.

I think it was back to the Civil War era, war profiteers, where people were worried that people were claiming that, you know, their product that they were giving to the government could do more than it could do. And we've seen, starting with the Biden administration and continuing to this administration, we've seen the executive branch use this. as a financial punishment for companies that purport to be meeting certain sub-security standards and are not. So there is the risk that these contractors are worried about, that they'll be exposed to that risk of that punishment, but may not be terribly sure what is CUI in any given

occasion. And then there's also the issue of where they're going to report it. So there's a few things that they still need to sort out here, it seems, before the final regulation, but the people are talking to were saying, this is something that looks like it's close to the final version. So if you're a contractor, you probably want to go ahead and start studying this and gearing up for the fact that this is going to be a fact of life and it's going to look significantly like the version that is out now. Well, Tim Starks is senior reporter at CyberScoop. We will have a link to this story in our show notes. Tim, thanks so much for joining us. Thanks, Dave.

And now a word from our sponsor, Trinity Cyber. Detection and response was failing before AI. Now it's breaking under the speed and scale of AI-driven threats. That's the reality Trinity Cyber was built for. The Trinity Cyber platform analyzes network sessions in real time, removes malicious content in line, and provides unified control across users, applications, devices, networks, and AI. By bringing protection and policy together,

Trinity Cyber helps security teams reduce risk, simplify operations, and stop threats before they. become incidents. Learn how at trinity cyber.com. And now a word from our sponsor, Specterops. Today, AI is rapidly adding non-human and agentic identities to modern enterprise environments, creating new trust relationships and attack paths. Bloodhound Enterprise helps defenders map attack paths across AWS and hybrid environments as one connected graph. Identify the choke points that matter most and bring trusted attack path intelligence into approved AI workflows with

Bloodhound Hunter. See how SpectorOps helps teams secure the AI-driven identity era at Spectorops.io. And finally, Denmark is investigating a massive breach of its national population register, and the alleged point of entry is a password that practically qualifies as an invitation. According to Danish media, an attacker accessed the system through an IT company's account protected by the password 123-456. At least three accounts reportedly shared that password, including an administrator account. The attacker allegedly conducted 14 million automated searches over 10 days, accessing information belonging to 8.8 million people. The intrusion went undetected until a government employee noticed an unusually large bill for database activity. The company has confirmed its access was exploited but hasn't addressed the password allegations.

The person claiming responsibility says they don't intend to sell or leak the data. But apparently the password wasn't the only thing missing a few safeguards. And that's the Cyberwire. For links to all of today's stories, check out our daily. briefing at the cyberwire.com. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity.

If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey and the show notes or send an email to Cyberwire at n2k.com. Don't forget to check out the grumpy old geeks podcast where I contribute to a regular segment on Jason and Brian's show every week. You can find grumpy old geeks where all the fine podcasts are listed. N2K's lead producer is Liz Stokes. We're mixed by Trey Hester with original music and sound design by Elliot Peltzman. Our contributing host is Maria Vermazas.

Our executive producer is Jennifer Ivan. Peter Kilby is our publisher, and I'm Dave Bittner. Thanks for listening. We'll see you back here tomorrow. Every time your team deploys a new cloud workload or AI agent, another identity gets permanent access to your critical systems. Legacy tools were built to manage human employees, leaving modern machine and AI access largely unmanaged.

That's where IDERA by Palo Alto Networks comes in. Human, machine, AI, one identity platform for all. Idera replaces permanent permissions with dynamic access, so you can lock down every identity without slowing down your business. Secure every identity with Idira by Palo Alto Networks. Visit Palo Alto Networks slash Idira. Again, that's Palo Alto Networks.com slash IDIRA.