CyberWire Daily - The Flax Typhoon gets a cold front.

Starting point is 00:00:00 You're listening to the Cyberwire Network, powered by N2K. You want a vision. I was an Avenger, but I'm not a hero anymore. It's like I'm losing my... On October 14th, the Vision returns for the final chapter of the groundbreaking trilogy. That family wasn't real. You sure about that? I had a father called Vision.

Starting point is 00:00:25 How is this possible? Don't miss the two-episode premiere of Marvel Television's Vision Quest. Nothing bonds a family together quite like Mortal Jeopardy. Streaming October 14th, only on Disney Plus. When you're running security for a fast-growing company, the stakes keep rising. More compliance frameworks, more vendors, more risk, and a board that wants the whole picture in one place. The problem is your compliance data usually isn't in one place. Controls live in one tool, vendor risk, and another, and customer commitments are.

Starting point is 00:01:03 buried in contracts. So your team spends more time stitching everything together and making decisions based on data that may already be a quarter old. Vanta connects it all. Its agenetic trust platform is built for enterprise scale, with more than 400 integrations and continuous monitoring to automate evidence collection, surface the risks that matter, and organize audits around your auditor's requirements. And the Vanta agent works around the clock with full program context, helping make sure nothing slips through the cracks. Vanta says customers see a 526% return on investment over three years with payback in three months. More than 16,000 companies trust Vanta, including Snowflake, Atlassian, and Ramp. Learn more at vanta.com slash cyber.

Starting point is 00:01:55 An international coalition disrupts Chinese state-backed hacking operations. Officials dismantle cybercrime centers in Ghana. Anthropic launches initiatives aimed at quicker remediation. A maximum severity sonic wall vulnerability is under active exploitation. The Cybersecurity Information Sharing Act remains in legislative limbo. Attackers are exploiting unpatched vulnerabilities in popular backup software. Midnight Mimosa targets cheap Android device. firmware. Prosecutors saddle a money mule. Maria Vermazas joins me to continue our Cyberwire

Starting point is 00:02:46 10th anniversary celebration with a conversation about public-private partnerships. And OpenAI does the math. It's Friday, October 9th, 26. I'm Dave Bittner, and this is your Cyberwire Intel briefing. Thanks for joining us here today. Happy Friday. It is great to have you with us. An international coalition has disrupted infrastructure used by Integrity Technology Group, a Chinese cybersecurity company that U.S. officials say supports state-backed hacking operations. The Justice Department seized websites supporting two integrity tech tools, microscan and fish hub, used in the long-running Flax Typhoon campaign. Microscan automated reconnaissance and vulnerability scanning against targets, including power companies, airports, and other critical infrastructure.

Starting point is 00:04:09 Fish Hub helped attackers conduct fishing operations and deploy malware after gaining access to victim networks. Authorities say Chinese actors have also targeted poorly monitored edge devices to maintain persistent access, potentially positioning themselves to disrupt critical infrastructure later. agencies from the U.S., Australia, Japan, the UK, Spain, New Zealand, and Canada contributed to a detailed advisory describing integrity techs tools and operations. Authorities in Ghana say they dismantled suspected cybercrime centers in the Great Accra region, arresting eight suspects and rescuing 120 people believed to have been trafficked and forced into online fraud, including romance scans. investigators seized 136 phones, 130 laptops, networking equipment, vehicles, and other evidence. The operation has also prompted a dispute over who was in charge. FBI director Cash Patel portrayed the raid as part of the Bureau's global operation blackout,

Starting point is 00:05:18 but Ghana's cybersecurity authority says the operation was planned, coordinated, and executed by Ghanaian authorities. The CSA acknowledged intelligence support from the FBI and Britain's National Crime Agency, while stressing that foreign agencies cannot independently exercise police powers in Ghana. Most of those rescued were Nigerians, and authorities are working to repatriate them. Anthropic has launched two cybersecurity initiatives aimed at turning AI-discovered vulnerabilities into fixes more quickly. Its free OSS scanner lets open source maintainers opt into periodic scans using Anthropics' most capable models. Reports include vulnerability details, proof-of-concept exploits, and, when available, suggested fixes. To speed disclosure, reports are sent

Starting point is 00:06:14 without human review, meaning some may contain errors, though Anthropic expects a true positive rate above 90%. The company is also launching its critical infrastructure defense program, bringing clawed models, engineers, and threat research to companies that secure operational technology. Anthropics says OT vulnerabilities are particularly challenging because industrial systems often can't be taken offline for patching. The initial program includes security vendors, consultancies and industrial manufacturers, with plans to expand to additional partners and sectors. Attackers appear to be targeting a maximum severity vulnerability in Sonic Wall SMA-1000 remote access appliances just days after a patch became available.

Starting point is 00:07:06 The vulnerability affects the workplace interface on several SMA-1000 models and could allow an unauthenticated attacker to make the appliance active. internal functionality and perform unauthorized operations. Security firm Pravidian says its honeypots detected exploitation attempts consistent with the flaw, though researchers haven't confirmed that those attempts successfully compromised systems. Shadow Server is tracking more than 400 Internet-exposed SMA-1,000 appliances, but it's unclear how many remain vulnerable. The activity continues a rough stretch for Sonic Walsh.

Starting point is 00:07:45 SMA-1000 line. Attackers exploited multiple zero days earlier this year, including vulnerabilities used to install custom malware and others that SISA later linked to ransomware operations. More than a year after permanent authorization for the Cybersecurity Information Sharing Act of 2015 expired, Congress remains deadlocked over its future. Sisa 2015 protects companies from. certain liabilities when they share cyber threat indicators with the government or one another. Short-term extensions have kept those protections alive, but tied them to recurring government funding

Starting point is 00:08:27 battles. Senate Homeland Security Chairman Rand Paul continues to block a long-term extension, seeking an amendment restricting government efforts to influence social media content moderation. Bipartisan proposals in both chambers would extend the law through 20, 35, but none has advanced. The Cyber Threat Alliance says uncertainty hasn't dramatically reduced existing information sharing, though it may discourage new participants. Its president, Michael Daniel, favors a medium-term extension that would give Congress time to modernize the law for AI-era threats, including information about attacks, such as

Starting point is 00:09:08 model distillation. Ransomware activity reached a record high in the third quarter of the third quarter of of 2026, according to Comparatech, which counted over 2,600 claimed attacks, up 27% from the second quarter, and 61% year over year. Only 247 have been confirmed by the targeted organizations. Finance and technology saw the sharpest quarterly increases, while education, health care, government, and utilities also experience substantial growth. Comparatex suggested advances in AI could be helping attackers scale and accelerate their campaigns. Researchers also noted growing use of triple extortion, in which attackers encrypt systems,

Starting point is 00:09:56 steal data, and then pressure individuals or customers connected to the victim. The average ransom demand was just over $600,000. Kielin and The Gentleman were the most prolific groups, while the United States accounted for over 1,000 claimed attacks or 41% of the worldwide total. Attackers are exploiting two unpatched vulnerabilities in Assay-CBS backup software to gain unauthenticated remote code execution. Huntress says the vulnerabilities affect even the latest version and have targeted at least

Starting point is 00:10:34 five organizations. Attackers chained the flaws to deploy web shells, conduct reconnaissance, install XM-Rig cryptocurrency miners and establish persistence. With no patch available, Huntress recommends restricting the Assay-CBS management interface to trusted IP addresses or requiring VPN access and checking systems for compromise. Bit Defender has uncovered Midnight Mimosa, a supply chain malware campaign affecting low-cost Android devices built on media tech platforms. The malware is embedded in device firmware before sale, giving it system-level privileges and persistence that survives normal uninstall attempts. Operators can remotely install or remove apps, grant permissions,

Starting point is 00:11:26 and load additional code, enabling ad fraud, click fraud, and botnet activity. Bit Defender has observed thousands of affected devices across more than 150 countries over two years, with Western Europe and the Americas particularly represented. Researchers also found 13 Google Play apps containing related ad fraud code, though without the firmware malware's privileged access. Midnight Mimosa can temporarily disable Google Play and Play Protect while installing additional payloads, giving its operators extensive control over compromised devices from the moment they're activated.

Starting point is 00:12:07 A Ukrainian-Russian dual citizen has pleaded guilty to helping run Your Miseries, mule cash out, a money laundering operation that processed millions of dollars for cybercriminals worldwide. Prosecutors say 42-year-old Oleg Korniev helped manage the organization, which operated since 2007 and recruited more than 15,000 U.S. money mules through fake job offers. The mules received stolen funds in their bank accounts and wired the money to cash-out contractors in Eastern Europe. The organization allegedly processed more than $10 million stolen from over 750 U.S. bank accounts. Cornev admitted the operation caused more than $14.7 million in actual and intended losses, and that he laundered at least $7 million. He pleaded guilty to charges including money laundering,

Starting point is 00:13:04 identity theft, and computer fraud conspiracy, and faces between 2 and 50 years in prison. Coming up after the break, Maria Vermazas and I continue our Cyberwire 10th anniversary celebration with a conversation about public-private partnerships. And OpenAI does the math. A lot of math. Stay with us. And now a word from our sponsor, Trinity Cyber. Detection and response was failing before AI.

Starting point is 00:13:56 Now it's breaking under the speed and scale of AI-driven threats. That's the reality, Trinity Cyber. was built for. The Trinity Cyber platform analyzes network sessions in real time, removes malicious content in line, and provides unified control across users, applications, devices, networks, and AI. By bringing protection and policy together, Trinity Cyber helps security teams reduce risk, simplify operations, and stop threats before they become incidents. Learn how at trinity cyber.com. a word from our sponsor, Specter Ops.

Starting point is 00:14:44 Today, AI is rapidly adding non-human and agentic identities to modern enterprise environments, creating new trust relationships and attack paths. Bloodhound Enterprise helps defenders map attack paths across AWS and hybrid environments as one connected graph. Identify the choke points that matter most and bring trusted attack path intelligence into approved AI workflows with Bloodhound. Hunter. See how SpectorOps helps teams secure the AI-driven identity era at SpectorOps.io. I'm Maria Varmazes, and today I am speaking with host of the CyberWire Daily, Dave Bittner. We're continuing our 10th anniversary of the CyberWire Daily series of conversations.

Starting point is 00:15:47 In today's show, we're going to be discussing the legacy of the past 10 years of public-private partnerships and law enforcement operations in cybersecurity. Here's our conversation. We've been taking a look over this course of interviews at what's been going on the last 10 years of your coverage in the world of cybersecurity and we've been focusing on certain topic areas. And the one that we're going to be using as our focus today

Starting point is 00:16:12 is public-private partnerships. And this one, I had to take a moment and go, what do we mean by that? And I feel like we should start there and actually just define that a little bit. I suppose it maybe is a little bit intuitive for a lot of our listeners, but in your own words, what do you think of with public-private partnerships in cybersecurity? What does that really entail?

Starting point is 00:16:35 Well, I think we find ourselves in the cybersecurity world as a, can we call it an accident of history or perhaps somebody intended it to be this way? I don't know. But we've got a whole lot of effort and resources and capabilities that are in the private sector. And then we've got a whole lot of effort, capabilities, and resources that are in the public sector, i.e. the government. And it is through the course of natural things, it is necessary, if not inevitable, for those two silos to interact and hopefully support each other to help make our great nation and indeed the world a safer place to be. Well done.

Starting point is 00:17:24 That's a great way of defining it. Did I get a gold star? I think so. Bing. Okay. Yay me. Yeah. It's one of those phrases that I go, I have in my mind what that might mean,

Starting point is 00:17:36 but I didn't want anyone getting lost in the sauce on what they think we might be talking about. So I'm glad that you define that so beautifully there, Dave. So thinking back to when the show started 10 years ago and the state of things back then in terms of these collabs, if we want to use that kind of terminology. And certainly things have evolved over the last decade in terms of how those two silos have worked together. And again, the siloed for no fault of anyone, just the way things have really happened.

Starting point is 00:18:05 What was it like 10 years ago compared to where we find ourselves today? Well, I think back then, and we're talking in 2016 or so, there was collaboration, but I think it was more episodic, maybe relationship-driven. Something bad,

Starting point is 00:18:22 what happened and everybody would get on the phone and the people who knew each other would figure out how to work together. There were information sharing organizations and, of course, there were established relationships. But I think there was still a fair amount of uncertainty on the private sector side about what you actually got by bringing the government into the room. Yeah. Like, was it even worth doing? I mean, one must sometimes, but is it something we always want to do? Right. Was it worth doing? And what could you possibly be saying? setting yourself up for because I think there's a natural inclination of any business organization to say, do we really want to invite the government in here and where they might start looking around?

Starting point is 00:19:03 You know, you just don't know. Or slowing things down if we want to put it more politely. Slowing things, whatever. Yeah. They're just, they're different breeds of organism. But I think today it feels a lot more institutionalized. We've got standing relationships. We've got established channels. And I think there's a greater recognition. that neither side can really do this alone. You know, the government has authorities and they have intelligence that the industry doesn't necessarily have. And industry owns and operates much of the infrastructure and has visibility that the government doesn't have. So that basic interdependence

Starting point is 00:19:42 was always there, but I think we've just gotten a lot better at acknowledging it. Yeah, yeah. And formalization of those pathways, as you said, makes a lot of sense. And, out of necessity, but also just expedience, I would say, as opposed to, I used to work at a three-letter agency and now I'm in the private sector. So I know all the three-letter agency guys back in that place. And I can reach them real easy. And the only way that you can do that is if you hire me. Right, right. Job security. Great. And that's a real thing, you know. I mean, that that is a tried and true pathway for folks who... Hasn't gone away. Yeah, no, and it exists to this day, and it has its ups and downs and pluses and minuses,

Starting point is 00:20:27 but to deny it would be a foolish thing to do. Indeed, absolutely. So in terms of that formalization of pathways and maybe just the evolution in general that you were describing, were there specific events that precipitated this? Is it just how things were going, or did we see big jumps in that change? Yeah, I'm not sure there was like one big event, you know. For as long as we've been doing this, people have been talking about Cyber Pearl Harbor or Cyber 9-11, right? And, you know, I mean, those are useful metaphors and good cautionary tales.

Starting point is 00:21:03 But looking back, to me, it's more the accumulation of incidents that demonstrated how fuzzy the line between public and private risk can be. And you can point to things like solar winds, colonial pipeline, the rise of ransomware, and then certainly attacks against health care and critical infrastructure. Over and over again, we've been seeing something that begins as a cybersecurity problem inside a private organization, and that can turn into a national security problem. It can have to do with economic security or even public safety. I think ransomware was particularly important because it made cyber risk tangible. When a hospital can't see patients or people are worried about getting gaffirmed,

Starting point is 00:21:51 gasoline, cybersecurity stops being something that happens in the server room, right? Yeah, yeah, yeah, yeah. And that creates pressure on government and industry to figure out how to work together before the next crisis happens. I'm sure over the last decade, you've seen that actively evolve. I mean, I'm thinking of the more ad hoc organizations email lists that you had to know somebody to get added to the ISACs, but also the joint cyber defense collaborative, things like that that have cropped up. Have those moved the needle to use that corporate cliche a lot?

Starting point is 00:22:27 Is there a lot of work still to be done there? Or have you seen a huge change from those kinds of collaboratives? I think the needles definitely moved in the right direction. And I think there's been a general acknowledgement that relationships are difficult to build during a crisis. You don't want the first time you're exchanging phone numbers to be while someone is actively inside your network. No, not usually anyway, yeah.

Starting point is 00:22:53 So, you know, the move towards standing partnerships gives folks a chance to establish trust to have a better understanding of what each organization can actually contribute and then work through some of that bureaucratic friction before there's an emergency. That doesn't mean you solve the problem. You know, a partnership on an organizational chart

Starting point is 00:23:14 isn't necessarily a partnership in practice, right? People change jobs, priorities change, administrations change. So those relationships have to be maintained. But having that machinery in place ahead of time is a meaningful improvement over reinventing the wheel to mix metaphors every time something catches fire. I mean, it makes so much sense, especially when you think about, to use the word against silos, of what we might have thought is public sector versus. private sector, entities or organizations or infrastructure, there's a lot of mixing that's always been happening. You know, how much private sector software is running on the public infrastructure, that sort of thing. So when, I don't know, a colonial pipeline happened, you know, who do you call?

Starting point is 00:24:05 You call a big mix of everybody. And I would imagine that that was probably a big teaching moment for a lot of orgs, not that this was something that necessarily they had no idea might happen. But, you know, you do need to have those numbers handy. You do have to train for this. You have to practice for stuff like that. And I'm wondering if through all the interviews that you've been doing all these years and if you heard that sort of become a crystallizing moment,

Starting point is 00:24:29 the colonial pipeline, for example. I think it was. I think colonial pipeline was an important demonstration of how quickly a private sector cyber incident can become a government problem. A ransomware attack against one company became a national story about fuel supplies, about transportation, and about critical infrastructure. And so for the executives who watch that unfold, I think one of the lessons was that there are

Starting point is 00:24:59 incidents where calling the government isn't simply a compliance decision or something that your lawyers debate. Yeah. Right? The government, they may have intelligence about the attacker. They could have visibility into other victims. They could have relationships with foreign partners. Or, even resources that could help with their response, there's still understandable hesitation. You know, companies worry rightfully so about regulatory exposure, litigation, reputation, and just losing control of the process. Yeah, yes. That is something I would wonder about that hesitation of going, you know, we let the government

Starting point is 00:25:37 in right now. And it also changes the optics considerably. It makes you, if I was a corporation, I might go, you bring them in. it might engender confidence in some people, but other people might go, this means you've lost control of the situation. And I wonder how that changes the conversation. Yeah. And I think Colonial Pipeline also helped demonstrate that when an incident reaches a certain scale, government involvement may be inevitable. Mm-hmm. Whether you wanted to or not. Right. When it affects enough people,

Starting point is 00:26:07 there's no denying. It's going to happen. So you should be ready for that. And you should have those relationships before you need them. There is much more to my conversation with Maria, and we will be running that extended interview this coming Monday, so look for it in your podcast feed. DLP sucks. Every CISO knows it. 20 years of rules and reg X built for another era. Jazz is the DLP that deeply understands your business.

Starting point is 00:26:53 Melody, Jazz's agentic investigator, weighs every data movement against the data, systems, people, and process, then provides analysts with the few incidents fully investigated. In 30 days, 2 million signals in, about 80 investigated incidents out. No rules written. Jazz won the 26 Crowdstrike AWS and NVIDIA's startup accelerator from a nearly thousand applicants. See Melody inaction at jazz.security slash N2K. Every time your team deploys a new cloud workload or AI agent, another identity gets permitted access to your critical systems.

Starting point is 00:27:44 Legacy tools were built to manage human employees, leaving modern machine and AI access largely unmanaged. That's where IDERA by Palo Alto Networks comes in. human, machine, AI, one identity platform for all. IDERA replaces permanent permissions with dynamic access, so you can lock down every identity without slowing down your business. Secure every identity with IDERA by Palo Alto Networks. Visit Palo Alto Networks slash IDERA.

Starting point is 00:28:18 Again, that's palo Alto Networks.com slash IDIRA. And finally, OpenAI dropped more than 350 AI-generated mathematical findings in a single day, prompting reactions ranging from breathtaking to something closer to professional vertigo. The results span algebra, number theory, topology, and other fields, including a proof of the quasi-Ryman hypothesis that Rutgers mathematician Alex Kontorevich says would merit a metal if produced by a human. But mathematics has not simply packed up and gone home. The enormous collection still needs verification,

Starting point is 00:29:14 and OpenAI had withdrawn three papers and corrected others by Thursday. Researchers are also wrestling with what industrial-scale AI discovery means for peer review, graduate education, and the pleasure of doing mathematics itself. The consensus seems to be that the machine, have climbed some formidable mountains. Mathematicians now get to verify the routes and contemplate what happens when the climbing equipment starts choosing the peaks. And that's the Cyberwire.

Starting point is 00:29:54 For links to all of today's stories, check out our daily briefing at thecyberwire.com. A quick program note, we are not publishing this coming Monday, October 12th, as we observe Indigenous People's Day here in the U.S. Please enjoy our chosen programming in place of the Cyberwire Daily podcast, and we will be back on the mic on Tuesday. Be sure to check out this weekend's research Saturday in my conversation with Adam Myers, head of counter-adversary operations at CrowdStrike. The research we're discussing is titled Phantom Raven, an LLM-generated information

Starting point is 00:30:30 stealer developed for bug bounty hunting. That's Research Saturday. Check it out. And hello, Maria Varmazis here on Sunday's T-minus space cyber briefing, the first part of our deep dive into the executive orders driving U.S. space policy with producer Ethan Cook. That's Sunday on T-minus. Don't miss it. We'd love to know what you think of this podcast.

Starting point is 00:30:54 Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to Cyberwire at N2K.com. N2K's lead producer is Liz Stokes. We're mixed by Trey Hester with original music and sound design by Elliot Peltzman. Our contributing host is Maria Vermazas. Our executive producer is Jennifer Ibin.

Starting point is 00:31:24 Peter Kilpe is our publisher, and I'm Dave Bittner. Thanks for listening. We'll see you back here next week. Yes, you can have an enterprise network that's secure. secure and reliable and high performance. And no, you don't need to choose the best two out of three. With meter, you can get the end-to-end network built from the ground up, fast to deploy, and easy to manage.

Starting point is 00:32:11 That's because meter is software-led for easy installation, maintenance and control for everything running on your enterprise network. Hardware, firmware, and software all working together from the start seamlessly on a unified platform that's secure by design. You can't protect what you don't know exists, which is why meter gives you comprehensive visibility into wired and wireless routing, switching, firewalls, DNS security, and VPNs. You'll really know what's running on your network down to the most granular client level. Step off the hardware box upgrade treadmill and switch to meter for a predictable fee and free up your team to spend time on all the other things that keep your business running. Try it out for yourself and book a demo online at meter.com slash cyberwire.

Starting point is 00:33:03 That's M-E-T-E-R dot com slash cyberwire.

CyberWire Daily - The Flax Typhoon gets a cold front.

There aren't comments yet for this episode. Click on any sentence in the transcript to leave a comment.