CyberWire Daily - The pay system needs a patch.

Starting point is 00:00:00 You're listening to the Cyberwire Network, powered by N2K. When you're running security for a fast-growing company, the stakes keep rising. More compliance frameworks, more vendors, more risk, and a board that wants the whole picture in one place. The problem is your compliance data usually isn't in one place. Controls live in one tool, vendor risk, and another, and customer commitments are buried in contracts. So your team spends more time stitching everything together and making decisions based on data that may already be a quarter old. Vanta connects it all. Its agenetic trust platform is built for enterprise scale, with more than 400 integrations and continuous monitoring to automate evidence collection,

Starting point is 00:00:54 surface the risks that matter, and organize audits around your auditor's requirements. And the Vanta agent works around the clock with full program context, helping make sure nothing slips through the cracks. Vanta says customers see a 526% return on investment over three years with payback in three months. More than 16,000 companies trust Vanta, including Snowflake, Atlassian, and Ram. Learn more at vanta.com slash cyber. Military cyber personnel face pay cuts.

Starting point is 00:01:44 A critical RCE threatens banking and government authentication systems. Dell Patches. a critical update flaw. A missed patch costs Accenture and FBI contract. Packers hijack a fashion retailer's push notifications. Insurers brace for rogue AI claims. Packers breach a supertanker's propulsion system. Denmark suffers a massive population data breach.

Starting point is 00:02:10 Japan extradites a suspected Keelan ransomware operator. Our guest is Steve Ryan, founder and CEO of Trinity Cyber, on surviving first contact from a frontier-eastern-eastern-a-fropeer. AI-enabled cyber threat. And there's no honor among gentlemen. It's Tuesday, October 6, 2026. I'm Dave Bittner, and this is your Cyberwire Intel Briefing. Thanks for joining us here today.

Starting point is 00:03:00 It's great to have you with us. The Pentagon's new Cybermastery Incentive Pay Program is supposed to reward military cyber personnel for developing advanced technical skills. But its rollout is proving rocky. with some troops facing substantial pay cuts. C-MIP, as it's known, replaces service-specific incentives

Starting point is 00:03:23 with a standardized system that pays more as personnel advance from basic to senior and master skill levels, with additional compensation for certain duties. Internal Army documents reviewed by Defense Scoop show many basic and senior cyber roles losing between $100 and $1,000 a month compared with the previous system.

Starting point is 00:03:47 The Army is temporarily cushioning those losses with a year-long pay protection policy. Critics warn the changes could hurt morale and retention just as military cyber capabilities are becoming increasingly important. Pentagon officials say C-MIP isn't intended as a blanket retention bonus, but rather to encourage personnel

Starting point is 00:04:09 to develop the military's most sought-after cyber skills. A critical remote code execution vulnerability in Talas's S-Connect browser extension could expose systems used for banking and government authentication. The vulnerability with a CVSS score of 9.4 stems from improper RSA signature validation and buffer handling. Attackers can exploit it through a malicious website or iFram, ultimately loading a malicious DLL and compromising the endpoint. S-Connect is used as authentication middleware in environments, including swift banking networks and government identity systems. Multiple researchers have reported drive-by attacks and observed endpoint compromise and session hijacking,

Starting point is 00:05:01 though no unauthorized swift transfers or identity card signing events have been confirmed. Sisa has not added the flaw to its known exploited vulnerabilities catalog. Chrome and Apple versions were patched in August, while the Edge version was removed from distribution in September. Organizations running older versions are urged to update or migrate to supported alternatives. Dell is urging customers to patch a critical vulnerability in its system update tool that could allow unauthenticated attackers to execute arbitrary code with root privileges on affected Power Edge service. servers. The vulnerability rated 9.6 is a path traversal flaw affecting multiple DSU versions. Dell also patched four additional vulnerabilities that could enable privilege escalation or code execution. Customers should upgrade to the latest versions. Dell says it has not observed active

Starting point is 00:06:02 exploitation. The FBI has removed an Accenture contractor after determining that a missed security patch led to a breach exposing sensitive information on thousands of Bureau employees. FBI Cyber Chief Brett Leatherman said the contractor failed to install a patch specifically issued to secure a third-party platform. Reuters identified that platform as Oracle PeopleSoft, which Accenture managed for the Bureau. The Shiny Hunter's Cybercrime group claimed responsibility, saying it exploited PeopleSoft to compromise FBI recruitment infrastructure. The stolen information reportedly includes social security numbers, home addresses, assignments, family details, and sensitive medical records. Reuters partially verified some of the leaked data. The FBI hasn't confirmed all of Shiny Hunter's claims,

Starting point is 00:07:01 including the scope of its access, but former bureau officials warn the exposed information could pose significant operational security risks to FBI personnel. Online fashion retailer ASOS is investigating a possible breach after thousands of customers received a push notification claiming hackers had fully compromised the company's snowflake cloud environment. The alert, titled ASOS Hacked, directed users to a telegram channel associated with a previously unknown group calling itself Joannier. ASOS hasn't confirmed that a breach occurred, and its website and app remained operational Tuesday morning.

Starting point is 00:07:45 But the incident rattled investors, sending the company's shares down more than 14%. Security experts say the notification itself suggests attackers may have gained access to systems capable of sending messages through the ASOS app, while the claimed snowflake compromise could potentially expose sensitive customer information. Researchers also warn that publicity surrounding the incident could fuel follow-on fishing campaigns impersonating ASOS and targeting concerned customers. Insurers are preparing for potentially multi-million dollar claims arising from autonomous AI agents, including the possibility that executives could face liability when their models cause harm, the Financial Times reports. The concern follows incidents in which AI agents have escaped their developers' controls,

Starting point is 00:08:42 including OpenAI's reported hacking of hugging face. Insurance brokerage and risk management firm Aon reviewed more than 300 AI-related legal cases and found potential exposure across cyber, crime, intellectual property, media liability and technology errors and omissions policies. Some experts say directors and officers insurance could also come into play if executives are accused of failing to adequately govern AI risks. But the legal landscape remains largely untested. Potential claims against AI companies could involve product liability, discrimination, privacy, copyright, and wrongful death. Lawyers suggest future litigation could even borrow from environmental, tobacco, and

Starting point is 00:09:31 pharmaceutical cases to establish responsibility for damage caused by autonomous AI systems. FBI and Coast Guard investigators have found evidence that hackers gain temporary access to the propulsion system of the VL Prosperity, an oil supertanker approaching the Texas coast this summer. officials are still investigating how the breach occurred, who was responsible, how long access lasted, and what the attackers could have controlled. Authorities boarded the fully loaded tanker in August after it lost communications and showed signs of a network compromise. The FBI says there were no reported operational disruptions, danger to the crew, vessel instability, or environmental impacts.

Starting point is 00:10:21 The incident highlights the potential physical comments. consequences of maritime cyber attacks, as ships increasingly depend on network-connected operational technology. By September, U.S. agencies were reportedly tracking cyber threats against nearly 20 vessels worldwide. The VL prosperity remains anchored off Galveston. Denmark's Central Person Register is notifying roughly 8.8 million people after hackers stole personal information through a private company with legitimate access to the national database. The attackers obtained names, addresses, and CPR numbers, Denmark's equivalent of social security numbers, during September. People enrolled in name and address protection were not affected. CPR has terminated the company's access,

Starting point is 00:11:13 notified regulators and police, and launched an investigation. Officials haven't identified the attackers and are warning people to watch for fishing and other suspicious communications. Japanese authorities have arrested a suspected member of the Kielin ransomware operation and extradited him to Germany. The 28-year-old Russian man was detained in Osaka in May and transferred to German authorities this month. He's accused of breaching a German logistics company in 2024, stealing data and demanding $165,000 in Bitcoin. Active since 2022, Keelan operates a ransomware as a service model, providing infrastructure and malware to affiliates who conduct attacks and share ransom proceeds.

Starting point is 00:12:04 The group has become one of the world's most active ransomware operations, particularly following law enforcement's disruption of lockbit. Kielin has also claimed several attacks against. Japanese organizations. Its activity comes amid a broader surge in ransomware incidents in Japan, where authorities recorded 123 cases during the first half of this year, with small and mid-sized businesses accounting for most victims. Coming up after the break, my conversation with Steve Ryan, founder and CEO of Trinity

Starting point is 00:12:47 Cyber, on surviving first contact from a frontier-enabled AI cyber threat. And there's no honor among gentlemen. Stay with us. And now a word from our sponsor, Trinity Cyber. Detection and response was failing before AI. Now it's breaking under the speed and scale of AI-driven threats. That's the reality Trinity Cyber was built for. The Trinity Cyber platform analyzes network sessions in real time,

Starting point is 00:13:29 removes malicious content in line, and provides unified control across users. users, applications, devices, networks, and AI. By bringing protection and policy together, Trinity Cyber helps security teams reduce risk, simplify operations, and stop threats before they become incidents. Learn how at trinitycyber.com. And now a word from our sponsor, SpectorOps. Today, AI is rapidly adding non-human and agentic identities to modern enterprise environments,

Starting point is 00:14:11 creating new trust relationships and attack paths. Bloodhound Enterprise helps defenders map attack paths across AWS and hybrid environments as one connected graph. Identify the choke points that matter most and bring trusted attack path intelligence into approved AI workflows with Bloodhound Hunter. See how SpectorOps helps teams secure the AI-driven identity era at SpectorOps.io. Steve Ryan is founder and CEO of Trinity Cyber. And in today's sponsored industry voices conversation, we discuss surviving first contact from a frontier AI-enabled cyber threat. If you stop and think about the way we address cyber threats today,

Starting point is 00:15:15 I would state that the ecosystem that we use to protect ourselves is already broken. It's completely flawed. it's a detected response ecosystem. And so that has a few implications. One is that the cybersecurity ecosystem will always be responding after the fact. Even if it's close to after the fact, it's still after the fact.

Starting point is 00:15:39 Something will have had to have happened and then we respond to it. We don't do that in any other domain. When you stop and think about it, we don't wait for something to happen. It's like that commercial, you know, of the security guard and the bank, Banks being robbed and he's like, hey, I can't do anything about it.

Starting point is 00:15:55 I can just pull the alarm. So we've got this ecosystem that to me is already broken, right? It's reactive. It's not proactive. And it relies on a set of indicators that are derived from somebody being attacked already. Right. So when you think about it, you know, people subscribe to these lists of IOCs, you know, hashes of bad doc files, URLs that are nasty, you know, IP addresses that should be blocked.

Starting point is 00:16:26 Where does that list come from? It comes from the fact that somebody has already been a victim, right? Like we know now that this file is bad because, you know, Mary downloaded it, and when we did the forensics, it came back, there was something bad in that file, right? So now we've got these jillions of IOCs. So when you stop and think about how well, sock operations, take a tour of any sock. And the sock director will start by talking about how they process, you know, some trillions of events a day, trillions of logs a day. And then they go through these processes to reduce that down to billions and then reduce it down again to millions and then to thousands. And then there's some hundreds that the sock team can get through. How does that scale?

Starting point is 00:17:16 that's today so now take an AI enabled threat look at things like the big ones heart bleed 2014 right log 4 shell 2021 7 years between those two and I'd call each of them

Starting point is 00:17:35 you know a watershed CBE and years after heartbleed half the servers were still weren't patched Now, take that seven years and reduce it down to seven days, seven months, seven days, seven hours. Now you're going to have more threats, more variations of those threats, more IOCs as a result of all those variations, more tickets, right? More logs, more storage, more, more, more, more, more. more isn't better here right and so surviving for first contact to me is not more of all of this

Starting point is 00:18:23 but a different approach right we have to we have to find a way to focus on the threat itself not all the manifestations of that threat and all the iocs associated with that threat and take that threat out of the delivery mechanism, which is the network. So find a way to take that threat, but find it in a network transmission and remove it before something happens. But at the threat level, not at the IOC level. I can go into that in more detail. But that's what I'm talking about. So is this at its heart an issue of speed and velocity that for decades we've been dealing with these things, human speed, as they say. And now we need to work at machine speed.

Starting point is 00:19:14 How do you unpack those realities in this rapidly changing environment? Let's tear apart a vulnerability. It's a bit of an oldie, but it's a goody. CVE 2018 11882. It's a Microsoft equation editor vulnerability. The concept here is that in any office document, you know, a document, PowerPoint, spreadsheet, RTF. Anywhere that there's an equation used in that document,

Starting point is 00:19:47 there is a part of the data, if you look at a document at a, you know, hex dump level, somewhere in that data is the definition of the font that was used in the equation. But here's the thing. In the document itself, there are multiple nested file systems, right? It's not, it's, you know, you can't look at all the, you know, all the, all the, all the, all the hex and say, oh, there it is, right?

Starting point is 00:20:12 The multiple nested file systems, those file systems, you've got to be able to interpret them for what they are. And inside the double nested file systems are a number of objects. One of them is an object that defines the equation. And in that object, the actual equation name itself is found, I think it's like a byte 28 or something like that. Don't quote me on it, but it's in there. The key is that the equation name has to fit within a 40-byte buffer.

Starting point is 00:20:44 And after that equation name is established, there's a null character afterwards. Somewhere in that 40-byte buffer is a null character. The vulnerability is manifest by not having a null-character. So if all 40 bytes are full, then everything on the other half on the other side of that is a buffer overflow and anything can be executed at that point. The rest of it is executable content. So I've just taken something like an office document and broken it down into all these different components.

Starting point is 00:21:17 And in one of those components, there's this one thing and this one condition. Now, stop and think about it. That condition can be found in an infinite number of documents. Really, there's no end to the number of documents I could create that would have that condition in it, right? And then once that condition is manifest, the executable content on the other side of it could be an infinite number of executable things, right? So, well, infinite times infinite, well, it's still infinite, right?

Starting point is 00:21:51 Yeah. But here's the thing. So that means that if we continue, like if we take the normal path, a normal path would say every one of those infinite conditions, we have to look for with traditional IOCs, like every hash, every variant, every delivery location, right, every place that's being downloaded,

Starting point is 00:22:16 every source of email, every, every, every, every, every. And again, that's a way that does not scale. And when you start taking that kind of a concept and apply, you know, an AI altering that content, you know, every minute, every second, every millisecond, you'll never keep up.

Starting point is 00:22:39 But remember, breaking it down into those components, there's a condition. There's a single condition that can result in an infinite number of variations, but it's one condition. When you talk about machine to machine, you've got to get parity between the machines. So you can't take one machine

Starting point is 00:23:01 and expect it to address the zillions of variants of a single condition that can be spewed out every few minutes, right? You have to get that parity between the machines. And so the defending machine has to be able to find that condition. It's one condition. But it sounds easy,

Starting point is 00:23:22 but that is the only way that we scale to the AI threat. remember David Bianco, created that pyramid of pain. Yeah, right? I spoke to him about it and I asked him if I could use that in our marketing and he gave me permission.

Starting point is 00:23:42 But it was really profound, right? He had this pyramid that on the very top talks about like TTPs and methodologies, right? The conditions, as I just described, these are the way the threat is manifest. Is at the very, very tip of the pyramid all the way down on the bottom are things like, you know, IP addresses, domains,

Starting point is 00:24:02 hashes, right, the things that can change in a nanosecond. But the actual condition, the actual threat itself doesn't change. So the way we survive is to be at the top of the pyramid to be able to look for the manifestation of the threat itself, right, as it's being developed. That's part one. Part two is we can't just look for it and then feed a detection and response ecosystem

Starting point is 00:24:30 because it's going to be too late. And too late in the AI, in the post-AI world, is like you're done. There's no coming back from that, right? So finding it in the network as it occurs, the threat condition, and then being able to do something about it, then and there.

Starting point is 00:24:52 Rip it out, change the condition. So that's it. Rip it out, change. Yeah. So we've seen this explosion of CVEs. You know, the last patch Tuesday, I think Microsoft was pushing up against around 1,000. It seems like it's doubling every month these past few months.

Starting point is 00:25:11 How do we contend with that? They're coming at us faster than we can deal with them. What's the answer there? You deal with them the same way, right? So the answer there is every, right, when these patches come out, there are models out there that can take a patch and reverse engineer it to find the vulnerability and then build it exploit against the vulnerability. We're seeing that today.

Starting point is 00:25:37 That same model could then build the detection syntax, detection and remediation syntax for a system that would look for the threat itself and rip it out. at the same time that the bad guys are creating the vulnerabilities and the exploits those vulnerabilities, the good guys are creating the, I'm just going to call it an active countermeasure, right? Like an active countermeasure to the threat itself, not to all the variations of the threats, but to the threat itself. Is it fair to call that like automated patching or is it more sophisticated than that?

Starting point is 00:26:18 the result is a form of, of patching, say virtual patching, right? The system isn't yet patched. And patching brings to mind like some, you know, a server that needs to be patch, right? Like somebody's going after a server. And so that's one piece of it. You know, but the other piece is, you know, the lure, right, that, that entices somebody to click on a link that drops a second stage download, right? It's a patching kind of applies to a CVE, applies to a server, got it.

Starting point is 00:26:49 But it's also the other part. It's the human part. How do I trick a human, right, into clicking on this thing? Right. How do I click a human into clicking on the screen to download the second stage? Oh, how about if I throw up a fake capture? Right. Like, we're all tuned to that, right?

Starting point is 00:27:08 This thing pops up. What's the first thing you do? I'm not a robot. Of course I'm not a robot. Right, right. And you click on it. Right. Right. Right. Every one of the, like for those that we're seeing these fishing PDFs, and they're all different. Every one of them is different. So you can't signaturize these. You can't be going after the hashes. You've got to be looking inside them, looking for this code, looking for the fake capture. And you see one of those. You say, all right, well, we're just, we're just going to kill that. Right. So part of the idea, as I'm hearing it from you, is that before anything is

Starting point is 00:27:44 put in front of a human, it's been run through one of these systems to evaluate if it should even make it to that step. That's what I think. And the way I think of it is we need a new approach, a smarter approach, right? Well, new technology, smarter technology, right? That can do what I just described. I think that's part one. I think part two is that that technology, that approach, needs to live in a layer in the internet, right? As a single thing, sounds a little sci-fi, I know, right? But stop and think of it this way. You know, there are good vendors out there.

Starting point is 00:28:23 They're good tools. Why are there so many breaches? And, you know, why do some get breached more than others? Why would we expect the mom-and-pop electric co-op in rural Pennsylvania to have a team that could go toe to toe with Russia. Why would we expect that? And think about how many of those there are all across the country. And before you think, well, you know,

Starting point is 00:28:50 who's going to go after the little mom-and-pop shop? Go back again, you have to go back in the wayback machine. But when Target got hit in 2014, right, another watershed event, right? They lost 46 million credit card numbers almost overnight. Today, that probably wouldn't even make the news. But back then, right, they almost went out of business for that. Bad guy didn't go after the Target.

Starting point is 00:29:14 The bad guy went after their HVIC vendor, which was a mom and pop shop in rural Pennsylvania. And they rode the VPN in and then compromised the systems. That's Steve Ryan from Trinity Cyber. There is an extended version of this interview. Be sure to find that link in our show notes. DLP sucks. Every Sissau knows it. 20 years of rules and regex built for another era.

Starting point is 00:29:57 Jazz is the DLP that deeply understands your business. Melody, Jazz's agentic investigator, weighs every data movement against the data, systems, people, and process, then provides analysts with the few incidents fully investigated. In 30 days, 2 million signals in, about 80 investigated. incidents out. No rules written. Jazz won the 2026 CrowdStrike, AWS, and NVIDIA startup accelerator from a nearly thousand applicants. See Melody inaction at jazz.security slash N2K. Every time your team deploys a new cloud workload or AI agent, another identity gets

Starting point is 00:30:49 permitted access to your critical systems. Legacy tools were built to manage human employees, leaving modern machine and AI access largely unmanaged. That's where IDERA by Palo Alto Networks comes in. Human, machine, AI, one identity platform for all. Ider replaces permanent permissions with dynamic access, so you can lock down every identity without slowing down your business. Secure every identity with IDERA by Palo Alto Networks. Visit Palo Alto Networks slash ILOA.

Starting point is 00:31:25 IDERA. Again, that's Palo Alto Networks.com slash IDIRA. And finally, a Russian-speaking ransomware affiliate apparently decided that extorting victims wasn't quite enough, and allegedly double-crossed his criminal partners as well. CloudSec says an operator known as Azazel, affiliated with the gentleman ransomware as a service operation, secretly ran his own leak site and kept extortion payments for himself. Researchers discovered exposed servers containing several terabytes of data stolen from more than two dozen victims across six countries. Azazel's methods included mining old GitHub commits for credentials and exploiting an SSRF vulnerability in an unauthenticated AI medical imaging API.

Starting point is 00:32:31 One week's long intrusion ultimately compromised six terabytes of data. CloudSec says Azazel also used an AI coding assistant connected through MCP to issue commands on a compromised system. And rather than relying on disposable cloud infrastructure, he maintained more than 50 terabytes of dedicated storage. Apparently, even ransomware has an expense account tier. And that's the Cyberwire. For links to all of today's stories, check out our daily briefing at thecyberwire.com. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity.

Starting point is 00:33:28 If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to Cyberwire at n2K.com. N2K's lead producer is Liz Stokes. We're mixed by Trey Hester with original music and sound design by Elliot Peltzman. Our contributing host is Maria Vermazas. Our executive producer is Jennifer Ivan. Peter Kilpe is our publisher, and I'm Dave Bittner. Thanks for listening.

Starting point is 00:33:56 We'll see you back here tomorrow. Yes, you can have an enterprise network that's secure and reliable and high performance. And no, you don't need to choose the best two out of three. With Meter, you can get the end-to-end network built from the ground up, fast to deploy, and easy to manage. That's because Meter is software-led for easy installation, maintenance, and control for everything running on your enterprise network. Hardware, firmware, and software all working together from the start seamlessly on a unified platform that's secure by design. You can't protect what you don't know exists, which is why Meter gives you comprehensive visibility into wires. in wireless routing, switching, firewalls, DNS security, and VPNs.

Starting point is 00:35:03 You'll really know what's running on your network down to the most granular client level. Step off the hardware box upgrade treadmill and switch to Meter for a predictable fee and free up your team to spend time on all the other things that keep your business running. Try it out for yourself and book a demo online at meter.com slash cyberwire. That's M-E-T-E-R dot com slash cyberwire.

CyberWire Daily - The pay system needs a patch.

There aren't comments yet for this episode. Click on any sentence in the transcript to leave a comment.