CyberWire Daily - The guest nobody invited.

Starting point is 00:00:00 You're listening to the Cyberwire Network, powered by N2K. Social engineering attacks look trustworthy, a routine request, an internal email, a familiar face on a call. But Dopple sees through the disguise. Their AI-native platform detects and disrupts attacks across every channel, trains employees to recognize deepfakes and deception, and investigates every fish to take down the campaign behind it. They fight relentlessly to protect your. your business, brand, and people. Dopple, outpacing what's next in social engineering.

Starting point is 00:00:43 Learn more at doppel.com. That's do p-p-p-e-l.com. SISA orders patching of TrueConf server vulnerabilities. LockBid threatens release of stolen banking data. Researchers disclose a critical type confusion vulnerability. A new agent Tesla campaign introduces enhanced evasion techniques. A novel malware delivery technique abuses FTP server banners. Apple patches a critical image processing flaw. A North Korean software supply chain

Starting point is 00:01:29 attack targets the Rust ecosystem. Latvian officials resign following a major data breach. Defense contractors are confident in compliance, less so in their ability to prove it. Our guest is Patrick Coughlin, co-founder and CEO of Savvy Security, discussing the free utility he's developed to protect the sandwich generation from AI-driven scams. And when it comes to cyber extortion, who you're going to call? It's Friday, August 21st, 2026. I'm Dave Bittner, and this is your Cyberwire Intel Briefing. Thanks for joining us here today, and happy Friday.

Starting point is 00:02:29 It is great as always to have you with us. SISA has directed federal agencies to urgently patch two critical, actively exploited vulnerabilities in the self-hosted true conf-server communications platform. The flaws allow unauthenticated attackers to achieve remote code execution, with one exploiting a missing authentication weakness, and the other enabling sandbox escape through code injection. SISA has added both to its known exploited vulnerabilities catalog and ordered federal civilian executive branch agencies

Starting point is 00:03:05 to remediate them by September 3rd. While Sisa has not disclosed attack details, Kaspersky reports the head mayor hacktivist group has exploited both vulnerabilities since July to distribute backdoor malware through trojanized client installers, targeting Russian organizations across multiple sectors. The advisory follows earlier reports of separate zero-day attacks against true confh by suspected Chinese threat actors. U.S. Bank is investigating claims by the LockBit Ransomware Group that it breached the bank and stole data, which the attackers threatened to publish on September 3rd unless an extortion demand is paid.

Starting point is 00:03:50 The bank says it is aware of the claims but has found no evidence of unauthorized access to its network or impact to internal systems. LockBit posted the alleged breach on its leak site without disclosing the scope or nature of the purportedly stolen data. The incident comes despite law enforcement's 2024 disruption of lockbit, which later resurfaced with its LockBit 5.0 ransomware. The claims also follow recent third-party data exposure incidents

Starting point is 00:04:21 affecting U.S. bank customers, though those were linked to vendors rather than the bank's own systems. U.S. Bank says its investigation remains ongoing while it continues monitoring the situation. Researchers have disclosed a critical type confusion vulnerability in the widely used Node.js isolated VM library that could allow remote code execution on the host system. The flaw, which has not yet received a CVE identifier, allows the external copy function used to transfer data between version 8 JavaScript isolates.

Starting point is 00:05:00 According to Endor Labs, the vulnerability stems from a time, of check time-of-use weakness that lets attackers manipulate the transfer process, potentially causing a denial of service crash or hijacking the host process to escape the sandbox. Systems that execute untrusted JavaScript and expose at least one IVM reference to the sandbox are particularly at risk. The issue has been patched in versions which prevent user-controlled JavaScript from executing during the data copy operation. Researchers at Know Before have identified a new Agent Tesla version 4 campaign

Starting point is 00:05:42 that introduces enhanced evasion techniques and credential theft capabilities. Delivered through a business email compromise lure targeting financial teams, the malware uses a J-Script dropper containing Unicode emoji characters to evade signature-based detection and hinder manual analysis. Once executed, it injects the payload directly into memory, avoiding file-based scanners, and employs multiple anti-analysis techniques, including code obfuscation, debugger detection, and hardware fingerprinting. Agent Tesla version 4 is designed to steal credentials for more than 40 applications, including web browsers, messaging platforms, and Windows credential stores,

Starting point is 00:06:27 while also capturing keystrokes and clipboard data. Stolen information is exfiltrated within seconds to an attacker-controlled FTP server. Know Before recommends updating email security and detection rules to identify the malware's distinctive emoji-based obfuscation patterns. Researchers have uncovered a novel malware delivery technique that abuses FTP server banners to hide commands used to deploy two previously undocumented remote access Trojans. FTP banners are text strings the server uses as a greeting message for connecting hosts before they log in.

Starting point is 00:07:08 First observed by Malware Hunter team and further analyzed by SOC radar, the campaign has been active since at least July and likely begins with phishing emails delivering zip archives containing malicious LNK files. These files retrieve PowerShell commands embedded in FTP greeting messages, enabling malware delivery without traditional command and control infrastructure. Although FTP-based command delivery is less stealthy than web-based dead-drop resolvers, researchers warn it is flexible and could be adapted for future malware campaigns. Apple has released security updates for iPhones, iPads, Macs, and other devices,

Starting point is 00:07:53 addressing multiple vulnerabilities, including a critical image processing flaw that security experts, say, resembles past spyware delivery vectors. The most significant fix is an integer overflow vulnerability in Apple's image I.O. framework that could allow arbitrary code execution when a malicious image is processed. Reported by META's Red Team X, the flaw was mitigated through improved input validation. Experts recommend installing the updates promptly, noting that similar image parsing vulnerabilities have previously been exploited in zero-click spyware campaigns. Apple also patched a telephony authentication flaw

Starting point is 00:08:36 that could allow attackers with privileged network access to intercept traffic. Additional security updates were released for older iPhones and iPads, as well as Vision OS. Researchers at Wiz have attributed a recent software supply chain attack targeting the Rust ecosystem to North Korean state-sponsored threat The attackers compromised a trusted maintainer's account on crates I.O. Modifying three widely used rust libraries to silently import a malicious typo-squatted dependency during the build process. Because the payload executed during compilation, developers and continuous integration systems

Starting point is 00:09:19 could be compromised simply by building affected projects. The malware was designed to steal browser credentials, cryptocurrency wallet data, and developer secrets. WIS found the campaign's infrastructure closely matched previous North Korean operations attributed to the Sapphire Sleet Group. The Rust Security Response Team removed the malicious packages and revoked the compromised account, but organizations are urged to inspect dependency lock files, treat affected build systems as compromised, and rotate exposed credentials and API keys. Latvia's road traffic safety directorate, the CSDD, has confirmed that a cyber attack exposed

Starting point is 00:10:05 historical payment receipt data belonging to more than 1.2 million people and 200,000 businesses, affecting roughly two-thirds of the country's population. The stolen data includes personal or company identification numbers, vehicle license plates, payment details, and some address information, though passwords, phone numbers, and email addresses were not compromised. Authorities say the attack exploited an internet-facing vulnerability and followed significant preparation by technically skilled attackers. While CSDD's services remain operational and a subsequent attack was blocked, the breach has sparked political fallout, with Latvia's president calling for the agency's leadership to resign.

Starting point is 00:10:51 Investigators continue to examine the incident, while CERTLV warns the stolen information could be used in fishing and social engineering campaigns. Criminal and regulatory investigations remain underway. Two new industry surveys suggest defense contractors are increasingly confident in their security compliance, but many still lack the evidence needed to prove it. Kiteworks found that while 96% of contractors believe their self-reported supplier performance risk system scores would withstand scrutiny, only 29% could support that confidence with both a current SPRS submission and a FedRamp authorized platform. The survey also revealed widespread confusion following the Pentagon's pause of CMMC 2.0 Phase 2 assessments, despite ongoing

Starting point is 00:11:47 D-FAR's compliance obligations. Separately, CyberSheath reported SPRS scores reached a five-year high, but confidence in their accuracy declined sharply, and only 1% of respondents felt fully prepared for CMMC certification. Both surveys found broad support for maintaining independent verification while simplifying compliance requirements without sacrificing objective proof of cybersecurity readiness. Coming up after the break, my conversation with Patrick Coughlin from Savvy Security, we're discussing the free utility he's developed to protect the sandwich generation from AI-driven scams. And when it comes to cyber extortion, who you're going to call?

Starting point is 00:12:42 Stick around. Patrick Coughlin is co-founder and CEO of Savvy Security. He's developed a free utility to protect the sandwich generation from AI. driven scams. Well, savvy security and this collection of products that we're talking about today have a pretty interesting

Starting point is 00:13:17 origin story, and my understanding is that that starts with your mom. That's right. That's right. Yeah. So about three years ago now, my mom got one of these fake kidnapping calls. And so these are very popular in common right now amongst scammers

Starting point is 00:13:36 known as sort of a grandparent style scam. But basically, my mom received a call in the middle of the evening, looked like it was coming from my sister. It spoofed my sister's phone number. And she answered the phone and she swears she hears my sister's voice saying, Mom, I need help. They've got me. You've got to do exactly what they say.

Starting point is 00:13:56 And then a man's voice comes on the line and says, if you don't pay PayPal's money right now, we're going to kill your daughter in the parking lot of the Walmart in Olathe, Kansas, which is right between their two houses. And by a sequence of events, luckily my mom actually was able to get off the line, mostly, mostly by luck. And she called my sister's brother-in-law and said, what are we going to do about Courtney? And he said, you know, what do you mean? Courtney's in the shower.

Starting point is 00:14:22 So it was at that moment that my mom realized that something was not right. She called me being sort of the cybersecurity son in the family. And of course, we recognized that it was a scam. But it sent me down a rabbit hole, Dave, of looking at the incredible acceleration in digital fraud and consumer scams that have really been on a tear since the launch of Chad GPT in 2021. So where do you suppose we find ourselves today when it comes to people's vulnerability to these scams?

Starting point is 00:14:57 Yeah, I mean, look, when I started my career, and I'm sure we all remember the, you know, like the Nigerian Prince email scams of the, the early 2000s. And we've come a long way from there. And the data really shows it. I mean, right now, digital fraud is the fastest growing crime in the country, and it's also the largest economic crime in the country. Experts estimate that Americans alone are losing close to $200 billion a year

Starting point is 00:15:27 to these AI-powered digital scams. And they're coming from international organizations all around the world. it's become an epidemic challenge for consumers, really the primary challenge facing consumers today when it comes to crime online. And it's hitting across all demographics to answer your question. I mean, you know, the trope is that this is only affecting sort of senior citizens, which are disproportionately affected, but actually not because they're any more vulnerable than anybody else. Studies show that actually Gen Z is more likely to click on a scam, the same. scam. They're three times as likely to click on it as a senior citizen. It's just that senior citizens have more savings and more money. So they show up more often in the fraud loss data at higher

Starting point is 00:16:18 take rates for the criminals simply because they have more savings and scammers know that. So they target them with more sophisticated and personalized scams. But it hits across all demographics, young people, older adults, and really the sandwich generation, sort of 35 to 50, 55-year-old is caught right in the middle because many of us have kids that are that are onboarding a little too quickly into the digital world. We've got aging parents that are getting targeted with increasingly sophisticated scams. And, of course, we have ourselves and our own work that is very much online and in our own families. And so it's a story that unfortunately isn't isolated to any particular type of persona. It's hitting Americans across all ages and all demographics.

Starting point is 00:17:05 So what was it that made you and your colleagues at Savvy decide to spin up this suite of tools? Yeah. So after my mom was targeted, like I said, I kind of went down a rabbit hole and did a bunch of research. I did work for the government years ago and worked as an analyst and intelligence. And so it kind of resurfaced some latent intelligence analyst skills that I had. I went deep into the dark web. I was getting into chat rooms. I was buying scam kits online and seeing how they worked and taking them apart. And ultimately, I wrote a book called Dark Side of the Boom, which is we published about a month and a half ago, which really goes into the groups that are behind these types of scams, how these scams work, the ecosystem that they operate in, and tries to pull back the veil on how these scams actually operate and,

Starting point is 00:18:02 remove some of the myths around vulnerability and really put the blame where it belongs onto these cyber criminal organizations. And then, of course, recommend what we can do at a community level and a family level and then at a policy level and international level. But when I was writing that book, Dave, it also became clear to me that, you know, the bad guys essentially with AI have been able to move their crosshairs, which for the last couple of decades have been pointed at the juicy targets of the enterprise and government agencies. But now all of a sudden, with AI, it's profitable for them to scale personalized campaigns at the everyday consumer. And so, you know, when I started my career, working in consumer cybersecurity wasn't really that

Starting point is 00:18:54 sexy, you know. It was all kind of like, you know, eat your cyber vegetables, have strong passwords, put in multi-factor authentication, because really the bad guys were focused at the enterprise and government agencies and the really sophisticated threat actors were focused there. But now we're seeing those exact same groups have essentially spun up consumer arms. They've essentially moved down market like you would kind of expect from a from a private sector company on the back of AI and are now targeting consumers at scale. But what's missing is a wave of innovation and investment and technology to help protect the consumer. A lot of that work over these last couple decades has understandably, and I've been a part of it, as have you,

Starting point is 00:19:43 been focused at how do we up-level enterprise cyber defense and the defense around, you know, sensitive government agencies, because that's where the bad guys were focusing. But now that they have shifted, we have to shift to you. And that's really the mission behind savvy security, which is how do we create a whole new generation of tools to protect consumers from this rapidly evolving threat? Well, I want to dig into the details here. I mean, some of the things that you're offering are free for users. There is a subscription tier as well.

Starting point is 00:20:14 what's the scope of things that you're trying to help people with here? Yeah, so when we started, you know, and again, we've been out of here for about 11 months, so we're still very, very early. But one of the things that we saw was there was a, there was a real need to put a utility out there for the public, to get a quick second opinion on a text message that comes in, an email that got through, a voicemail that somebody left. You know, there were all these places where you could get feedback from,

Starting point is 00:20:44 the internet, great Reddit threads, next door and places like that, and even Facebook are places where people were going to kind of ask the question, is this a scam? But the reliability of the answers was all over the place. And so we launched a product called Scamwise. It's available at scamwise.com. Totally free. Does not require any email registration. So there's, you know, no concerns about us. I'm selling your data to advertisers or anything like that. Just a frictional way for everyday consumers to get a quick second opinion on content. And we launched that in March, and it's taken off like crazy. You know, we're now processing close to 200,000 submissions a month from consumers all

Starting point is 00:21:26 across the country. And it comes in all those forms. People will forward emails to submit it at scamwise.com. They'll take a screenshot of a text message that they got and uploaded. We even get pictures of physical mail, which is a use case I hadn't really expected. But, oh, I just got this jury duty summons. Is this real? or this Medicare bill that I wasn't expecting.

Starting point is 00:21:46 And so scam-wise was our initial product and launched that in March, like I said. And then we were hearing from people, you know, I don't only just want a way to analyze this when it comes. I would like something to stop this content from getting to me. And so we launched our mobile app last month called Savvy, SAB. It's available in the app stores for Apple and Google. And it's our attempt to step into more process.

Starting point is 00:22:13 proactive prevention. And so we filter text messages from actually reaching your device. We'll put them in the appropriate folder so they stay out of your main feed, clean up your text message inbox. We analyze voicemails. I don't know about you, Dave, but like my voicemail on iOS had become sort of unusable. And so we've applied analysis to those to try to prioritize what should you respond to and also just clean out all the crap and spam from that. And then we've got a cool feature that we call on call, which allows anybody to add savvy to a call that is in progress. So let's say you do find yourself on a call that you thought was real, but then all of a sudden it starts to sound funky. We make it super easy to add savvy to that call. It will listen to the first 20 seconds. And then it will send you a notification about the verdict of that content and say this sounds fishy or not and tell you exactly why. So that's what we've launched so far. We've got a ton more in store.

Starting point is 00:23:13 And again, it's really about not just providing reactive ways to help give users second opinions, but to start to get into the proactive posture of blocking all of this malicious noise from overwhelming our devices. I have to ask you from a technical point of view, because it's impressive the degree to which your suite of tools here are able to interact with sort of the core of the mobile device. I'm an iOS user myself. How hard was it to get this level of access from iOS itself? Well, it's, you know, the access itself is not so. Apple has changed some things over the last couple of years

Starting point is 00:23:54 that provide some more inroads into calls and texts that historically weren't there. But the privacy elements of iOS still hold up. So, for example, like, while we can filter your text, we actually don't know which texts are yours. We just provide a global algorithm in front of Apple's text modules, and it's applied to every single user. So Savvy doesn't know which text we filtered, for example, for Dave.

Starting point is 00:24:26 We just know the algorithm that was applied to your text. Voicemails, we can have a little bit more personalization around, and we can see your voicemail specifically and make sure that we are, for example, if you get calls from a particular doctor or your kid's school, one of the hard challenges in doing this work of prevention for the consumer is, how do you put on a fast lane the prioritized communications that I actually want? And they may not always come from known numbers, you know, an Instacart shopper, an Uber driver.

Starting point is 00:25:03 My kid's school, when he's sick, I don't always have the number saved. If I'm getting a call from a doctor after some text, it doesn't always come from a set number. It will come from some void provider that they use. So part of the really interesting technical challenges here, and I think the key to unlocking good consumer security isn't just about blocking the bad. It's about how do you prioritize and elevate the good to help make the consumer more productive? That's Patrick Coughlin from Savvy Security. And finally, a curious new twist in the ransomware economy suggests there may be even less honor among thieves than usual. Researchers at GuidePoint's security say a group calling itself ransom busters has been approaching ransomware victims before attacks become public,

Starting point is 00:26:18 offering to recover encrypted files and delete stolen data for far less than the original ransom demand. According to Guidepoint, the supposed rescuers are likely not independent cyber vigilantes, but a ransomware affiliate diverting payments away from the very ransomware-as-a-service gangs it worked with. Investigators link the activity to attacks involving Dragon Force, Cetra, and Anubis, finding identical forensic artifacts across incidents, including shared tools, the same backdoor account password, and a common and a commonest. attacker host name. The findings suggest one affiliate may be working across multiple ransomware operations while quietly undercutting its criminal partners. As guide point notes, paying these

Starting point is 00:27:08 helpers offers no guarantee that stolen data will actually disappear, making this a particularly enterprising variation on cyber extortion. And that's the Cyberwire. For links to all of today's stories, check out our daily briefing at thecyberwire.com. Be sure to check out this weekend's Research Saturday. And my conversation with Aaron Beardsley, manager of threat research at Securonics, we're discussing analyzing sheet creep. Sheet creep is up again with different config obfuscation. That's Research Saturday. Do check it out. And hello, Maria Vermazas here. On Sunday's T-minus space cyber briefing, it's my interview with Philip Rezabek, C-T-Evac. of Space Computer on building secure orbital infrastructure.

Starting point is 00:28:03 That's Sunday on T-minus. Don't miss it. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to Cyberwire at n2K.com.

Starting point is 00:28:26 N2K's lead producer is Liz Stokes. We're mixed by Trey Hester with original music and sound design by Elliot Peltzman. Our contributing host is Maria Vermazas. Our executive producer is Jennifer Ibin. Peter Kilpsey is our publisher, and I'm Dave Bittner. Thanks for listening. We'll see you back here next week.

CyberWire Daily - The guest nobody invited.

There aren't comments yet for this episode. Click on any sentence in the transcript to leave a comment.