CyberWire Daily - Turbulence in the cloud.

Episode Date: June 27, 2025

Hawaiian Airlines reports a cybersecurity incident. Microsoft updates its Windows Resiliency Initiative after the 2024 CrowdStrike crash. CitrixBleed 2 is under active exploitation in the wild. Researchers disclose a critical vulnerability in Open VSX. Malware uses prompt injection to evade AI analysis. A new report claims Cambodia turns a blind eye to scam compounds. Senators propose a ban on AI tools from foreign adversaries. An NSA veteran is named top civilian at U.S. Cyber Command. Maria Varmazis speaks with Ian Itz from Iridium Communications on allowing IoT devices to communicate directly with satellites. One Kansas City hacker’s bold marketing campaign ends with a guilty plea. Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guest Our guest today is Ian Itz, Executive Director at the IoT Line of Business at Iridium Communications. Ian spoke with T-Minus Space Daily host Maria Varmazis on their Deep Space weekend show about how Iridium allows IoT devices, like sensors and trackers, to communicate directly with satellites, bypassing terrestrial infrastructure. We share an excerpt of their conversation on our show today. You can listen to the full conversation on Deep Space. And, be sure to check out T-Minus Space Daily brought to you by N2K CyberWire each weekday on your favorite podcast app. Selected Reading Hawaiian Airlines Hit by Cybersecurity Incident (Infosecurity Magazine) Microsoft to Preview New Windows Endpoint Security Platform After CrowdStrike Outage (SecurityWeek) CitrixBleed 2 Vulnerability Exploited (Infosecurity Magazine) Vulnerability Exposed All Open VSX Repositories to Takeover (SecurityWeek) Prompt injection in malware sample targets AI code analysis tools (SC Media) Scam compounds labeled a 'living nightmare' as Cambodian government accused of turning a blind eye (The Record) Bipartisan bill seeks to ban federal agencies from using DeepSeek, AI tools from ‘foreign adversaries’ (The Record) NSA’s Patrick Ware takes over as top civilian at U.S. Cyber Command (The Record) Man Who Hacked Organizations to Advertise Security Services Pleads Guilty (SecurityWeek) Audience Survey Complete our annual audience survey before August 31. Want to hear your company in the show? You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [e-mail] to request more info. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the CyberWire Network powered by N2K. Risk and compliance shouldn't slow your business down. HyperProof helps you automate controls, integrate real-time risk workflows, and build a centralized system of trust so your teams can focus on growth, not spreadsheets. From faster audits to stronger stakeholder confidence, HyperProof gives you the business advantage of smarter compliance. Visit www.hyperproof.io to see how leading teams are transforming their GRC programs.

Hawaiian Airlines reports a cybersecurity incident. Microsoft updates its Windows Resiliency Initiative after the 2024 CrowdStrike crash. Citrix bleed 2 is under active exploitation in the wild. Researchers disclose a critical vulnerability in OpenVSX. Malware uses prompt injection to evade AI analysis. A new report claims Cambodia turns a blind eye to scam compounds. Senators propose a ban on AI tools from foreign adversaries. An NSA veteran is named top civilian at U.S. Cyber Command. Maria Ramazes speaks with Ian Itz from Iridium Communications on allowing IoT devices to communicate directly with satellites. And one Kansas City hacker's bold marketing campaign

ends with a guilty plea. It's Friday, June 27, 2025. I'm Dave Bittner and this is your CyberWire intel briefing. Happy Friday and thanks for joining us. It's great to have you with us. Hawaiian Airlines has reported a cybersecurity incident affecting some of its IT systems. The airline posted updates yesterday confirming that flights are operating safely and on schedule despite the disruption. The company stated it's working with experts and federal authorities while restoring systems in an orderly manner, implying some systems were taken offline.

No details have been released about the nature of the cyber event or whether customer data was impacted. The FAA said it is in contact with the airline and monitoring the situation. This incident follows a similar cyber attack on Canada's WestJet Airlines less than two weeks ago. Hawaiian Airlines was recently acquired by Alaska Airlines, with plans to integrate their systems under a single passenger service platform. Microsoft has shared progress on its Windows Resiliency Initiative, launched after last

year's major CrowdStrike incident that caused global Windows outages. In July 2024, a faulty CrowdStrike update crashed systems due to its use of kernel drivers for security functions. In response, Microsoft announced a redesign to reduce risks when endpoint security software interacts with the Windows kernel. The Windows Resiliency Initiative, or WRI, launched in November of last year and aims to boost Windows reliability and resilience. Microsoft is working with vendors like CrowdStrike, Bitdefender, SentinelOne, and Trend Micro to ensure safer update processes.

Starting next month, some partners will preview a new security platform allowing antivirus and endpoint protection tools to run in user mode instead of the kernel, enhancing stability and recovery. Microsoft has also released an e-book on digital resilience and introduced features like quicker PC recovery, hot patch security updates without reboots, and Windows 365 Reserve, offering temporary cloud PCs when primary devices fail. A critical vulnerability, dubbed Citrix Bleed 2, has been discovered in Citrix Netscaler ADC and Gateway devices and is reportedly being exploited in the wild.

This out-of-bounds read flaw allows attackers to extract session tokens, bypass multi-factor authentication and hijack user sessions. Similar to the 2023 Citrix bleed, this vulnerability targets session tokens rather than cookies. It affects multiple versions. Security firm ReliaQuest reports medium confidence of active exploitation based on session hijacking, MFA bypassing, LDAP reconnaissance, and activity from VPN-related IPs. Additionally, a separate memory overflow vulnerability is under active attack, potentially causing denial of service. Citrix urges immediate patching and session termination.

Researchers at Koi Security have disclosed a critical vulnerability in OpenVSX, the open source extension marketplace hosted by the Eclipse Foundation. The flaw exposed the publishing account's secret token to any extension or its dependencies. This token acts as a super admin credential, giving attackers the ability to publish malicious extensions or overwrite existing ones, potentially compromising over 8 million developers. OpenVSX is widely used by VS code-based editors like Cursor, Gitpod, and WindSurf as an alternative to Microsoft's marketplace. Koi Security warned that attackers could have installed keyloggers, information stealers, or backdoors, posing a solar winds-like supply chain risk for developer tooling.

The vulnerability was discovered in early May and has now been patched after thorough vetting. SecurityWeek reached out to the Eclipse Foundation for further comment, but so far has received none. Checkpoint researchers have discovered a malware sample containing a prompt injection designed to bypass AI code analysis tools. Uploaded to VirusTotal in early June, the sample included a string instructing large language models to act as a calculator and reply with no malware detected. Named Skynet by its author, the malware is half-complete and acts as a proof-of-concept rather than fully functional malware. It uses bytewise rotating XOR obfuscation with a hard-coded key, sandbox evasion techniques,

and decrypts an embedded Tor client to create a controllable proxy before deleting its installation directly to cover its tracks. OpenAI's O3 and GPT 4.1 models identified the prompt injection as a jailbreak attempt. Researchers warn this reflects the next evolution in malware, targeting AI-driven defenses with prompt injection and jailbreak methods to evade detection. with prompt injection and jailbreak methods to evade detection. Amnesty International has condemned what it calls Cambodia's grossly inadequate response to human trafficking in online scamming compounds. Its two-year study, released Thursday, documented 53 active scam centers where workers are forced

to assist in fraudulent operations, often under threat from guards armed with electric batons. Victims are lured with fake job offers, trapped in prison-like compounds, and made to run cryptocurrency scams, create fake websites, or set up bank accounts for money laundering. Some describe pig-butchering scams, where scammers build trust before defrauding victims. Despite police rescues, Amnesty says abuses continue, with authorities often freeing only those who contact them while ignoring others. Survivors also reported collusion between police and traffickers. The UN estimates Southeast Asia's scam centers generate $40 billion annually.

The Thai government has closed border crossings and halted fuel exports to Cambodia in response as organized criminal networks shift operations from Myanmar to Cambodia. Senators Rick Scott and Gary Peters have introduced the No Adversarial AI Act to ban federal agencies from using AI tools made in countries deemed foreign adversaries, including China, Russia, Iran, and North Korea. The bill would create and update a federal list every 180 days, prohibiting tools like China's DeepSeek, which reportedly aids China's military and shares user data with its government. Exceptions would exist for research, requiring written justification to Congress. The legislation aims to protect national security and personal data from potential exploitation

by adversarial AI systems. It follows reports that a USDA employee attempted to access DeepSeq but was blocked. Lawmakers compared the move to past bans on foreign software such as TikTok and Kaspersky, framing it as necessary to keep U.S. government technology secure against evolving threats. Patrick Ware, a 34-year NSA veteran, has been appointed executive director of U.S. Cyber Command, becoming its top civilian leader. He replaces Morgan Adamski, who is expected to move to the private sector after serving

in the role since June of 2024. The position traditionally filled by an NSA official is the number three role at Cyber Command, where it takes over during a period of leadership uncertainty, as Cyber Command has lacked a permanent chief since General Timothy Hogg was fired nearly three months ago. A planned appointment of Lieutenant General Richard Angle was reportedly rejected by the White House for undisclosed reasons. Ware will oversee strategic initiatives, talent management, and partnerships amid questions

about the future of the Cyber Command 2.0 overhaul. Ware holds electrical engineering degrees from the University of Maryland and Johns Hopkins University. We wish Mr. Ware the very best as he steps into this critical role, guiding U.S. Cyber Command through its next chapter of challenges and opportunities. Coming up after the break, Maria Vermazes speaks with Ian Itz from Iridium Communications on allowing IoT devices to communicate directly with satellites. And one Kansas City hacker's bold marketing campaign ends with a guilty plea. Stick around.

Did you know Active Directory is targeted in 9 out of 10 cyber attacks? Once attackers get in, they can take control of your entire network. That's why Sempris created PurpleKnight, the free security assessment tool that scans your Active Directory for hundreds of vulnerabilities and shows you how to fix them. Join thousands of IT pros using PurpleKnight to stay ahead of threats. Download it now at sempris.com slash purple-knight. That's sempris.com slash purple dash night. That's sempris.com slash purple dash night. And now a word from our sponsor, Spy Cloud. Identity is the new battleground, and attackers are exploiting stolen identities to infiltrate your organization.

Traditional defenses can't keep up. Spy Cloud's Holistic Identity Threat Protection helps security teams uncover and automatically remediate hidden exposures across your users from breaches, malware, and phishing to neutralize identity-based threats like account takeover, fraud, and ransomware. Don't let invisible threats compromise your business. Get your free corporate dark net exposure report at spycloud.com slash cyberwire and see what attackers already know. That's spycloud.com slash cyberwire.

Our guest today comes from T-Minus Space Daily's Deep Space program. Host Maria Vermazes speaks with Ian Itz, executive director at the IoT line of business at Iridium Communications. They're talking about how Iridium allows IoT devices like sensors and trackers to communicate directly with satellites, bypassing terrestrial infrastructure. So my name is Ian Itz. I'm the executive director for the IoT line of business here at Iridium. And kind of the way that I started my journey in space was through a very small universal bus building company. And so they were building universal buses for the Navy and for the Air Force.

And so I was looking for product management jobs coming out of college, and there just happened to be a space startup in the town that I was living in. And we're not too far outside of the DC region, and so there's obviously a lot of tech here, a lot of government work. And so that was kind of my entry.

And so I was working on course sun sensors and star trackers and things that satellites need to kind of keep their navigation and their orientation. I started to look at, you know, who are the big kind of satellite carriers in what we call this MSS space. And looked at GlobalStar and looked at, you know, Iridium and I actually ended up working a little bit for GlobalStar, worked for one of their largest distributors for a bit. But I always wanted to be at Iridium. That was always kind of the seal of excellence for me in terms of what I was into,

which was very small devices, mobile devices, IoT really. That's kind of where I kind of gravitated towards that. And Iridium kind of had all the pieces, right? They had a great constellation. They did small devices. They're very reliable in terms of the product. And so I'm always aspired to be part of the Iridium team. I said, this is a great opportunity for me.

And so that was kind of how I started here at Iridium. So kind of continued on and became a product manager. And then slowly learned the business here. Did some BD work for a couple of years, and now I'm fully running the entire IoT line of business here at Iridium, which is our fastest growing business. And for me, it's probably the most exciting business unit here, but I say that very, very biased. Thank you for sharing your journey with me.

I love hearing people's stories because they're all so different and I find them just really fascinating So thank you. So yeah, we are here to talk about the IOT line of business that iridium has So maybe we can just set the scene a bit first about What it kind of looks like, you know, what IOT and satellite connectivity together are enabling. Let's start there Absolutely. So, you know the way that I kind of look at IOT is a little bit of what I described earlier Which is you know small devices that are sending small chunks of data now that So, you know, the way that I kind of look at IoT is a little bit of what I described earlier, which is, you know, small devices that are sending small chunks of data. Now that obviously has, you know, a variety of different meanings for different folks. You know, IoT could be big chunks of data and, you know, lots of information passing

back and forth. But when we kind of marry the two, IoT and satellite, what we're really looking at is smaller pieces of data because that's the most efficient way to get that across on the network. And so from our perspective, IoT is typically small devices with small antennas. In a lot of cases, they can be carried by a human, so by an individual, or they're just getting environmental data from wherever they're at. So it could be tracking an asset, it could be a sensor in a farm measuring the amount of water in the soil. It could be buoys in the ocean that are measuring ocean currents, salinity, early warning, tsunami

detection. So, really, IoT is kind of all encompassing in terms of the way that we think about it. We're really applying the fundamentals of IoT to basically any application that's out there today on the terrestrial network, we complement it on the satellite side. So we're really kind of that backup link in a lot of cases. But in many cases, for IoT specifically, we are the primary comms. We are operating in locations where terrestrial coverage just simply isn't available.

And so our customers look to us to provide, again, kind of rugged, small devices that can be deployed anywhere on the globe. And that's kind of our forte, right? That's really where Iridium shines. And so that's kind of the way that we see IoT in general, but small devices, small aperture antennas, low energy. And then typically satellite and cellular are complementary to each other, right? We're bouncing back and forth from one network to another. But that's kind of my world in terms of IoT and satellite specifically.

That's so fascinating what this all enables and the places that IoT is being used. It just blows my mind. And I know we think maybe, or I think, about IoT as usually small devices sending small amounts of data, but that's changing, right? Where a lot of these devices are sending a lot more information now, lots more data being sent out. And I guess, how do you all support that? That must be an interesting advancement for you.

Yeah, so what we strive to do is obviously continue to support customers that have kind of those low data rates, and those will always be, you know, a pertinent customer for us. You know, as I mentioned, the ground soil sensors, you know, those things don't go away. They'll be used for quite some time, and they don't send that much data. But what we do obviously look at are some of these higher applications, as you mentioned. And so we look to develop kind of new technology kind of on a cycle basis primarily, right? So primarily we developed core modules that were built for load data transmissions as we talked about, but we've got some new devices that have just

come online that are now able to do more rich data sets. So they're able to send images, for example. They're able to send voice snippets. And so these things are very part and parcel to what we do from a reliability perspective. A lot of the devices that work on the Iridium network are there for safety of life type applications. And so the ability to send kind of voice snippets and these images from remote locations kind

of aids in those potential situations where somebody is injured, they're able to not only kind of send their location and maybe some text messaging about what's going on, but they're able to then send images about their environment. They're able to potentially talk if they're unable to use their hands. And so, yeah, I mean, we try to offer a variety of services on the network to cater to different IoT applications. So yeah, we tend to focus on new modules every couple of years and expand the capabilities

with each one as we develop. That's really neat. And I have to ask the inevitable question that I think I ask in every interview nowadays is about AI AI AI in cloud How this all plays in because I know there's a lot of talk about what we're able to do at the edge now What we're not able to do at the edge, but a lot of IOT always comes up in that conversation So often I'm talking to cloud and AI folks asking them about IOT now

I'm talking about cloud and edge. So tell me about what what advances you're seeing there and what that's enabling Yeah, so cloud for us is extremely important. We integrated You first said about cloud and edge. So tell me about what advances you're seeing there and what that's enabling. Yeah, so cloud for us is extremely important. We integrated kind of AWS as our first foray, I want to say five or six years ago now. You know, they were looking for to expand their satellite connectivity options for their customers. And so we developed a partnership where we're now kind of fully hooked in from an IoT perspective. We're able to send data back and forth on all of our IoT platform devices through the AWS cloud and not just AWS, right?

I mean, we operate now with kind of any cloud infrastructure that you bring to the table. So from that perspective, cloud is of utmost importance. We just want to give customers options and so we don't charge more for it. It's really just an additional data delivery mechanism. And then obviously there's all of the other features that are built into the cloud, either IoT Core or any of the other kind of security capabilities that are involved or any of the translation mechanisms that are in there. Our customers are more and more leveraging the cloud into their own internal applications.

It's really just by virtue of us offering that as a capability. We're not doing a whole lot of application building. We're kind of really just leveraging what's already there and then providing the data through our standard interconnects. The AI thing is really interesting to me specifically because a lot of our customers have been doing this for quite some time. As you probably know, sending data over a satellite link is going to be traditionally more expensive than when you send it over a cellular link. And so a lot of our customers, especially early on when IoT was called M2M, those customers were figuring out how to optimize their data before sending it over the satellite link, right?

And so the advent of edge computing, edge technology, and then add on top of that, machine learning and AI. And it gives these users kind of a lot more benefit in terms of being able to analyze their data, make decisions on the edge, and then really only pass the data that's critical or the most relevant to what they're doing. And so from that perspective,

our customers have been early adopters of edge computing, ML and AI for some time. And so now that it's really kind of, you know, in everybody's face, it's kind of everywhere you go. It's really just kind of now being adopted by the mainstream. But I'd say that IoT and IoT and satellite specifically, we're kind of leading the front on a lot of those early technologies because it was necessary for them for a cost operation kind of environment. I find that really fascinating what Iridium does because you all are really a backbone and that you do enable all these different people and organizations to figure out how

to use what you all provide and then it just makes a whole constellation, if I can use the space cliche, of just different capabilities. It's quite amazing to watch. And something that I've been increasingly trying to learn more about is also the phrase is non-terrestrial networks. And just, again, you guys are a huge player in that. I mean, enabling all that and, you know, what that looks like and what that's enabling as part of that the ecosystem that's building a non-terrestrial network, how are these different pieces all sort of fitting together to work towards what's coming in non-terrestrial networks?

Yeah, absolutely. I think the vision for the non-terrestrial network is to offer a service that, to the consumer, doesn't look any different than what they've used today, right? So, you're outside of terrestrial coverage, and whether it be your smartwatch or your phone or your vehicle or whatever it happens to be falls outside of terrestrial coverage, the transition to satellite and the use of satellite

should be pretty deprecated from view from the customer. If I can, for lack of a better term, they shouldn't know which network is providing the service underlying. deprecated from view from the customer, right? For lack of a better term, they shouldn't know which network is providing the service underlying. Seamless? Yeah. Seamless, right? They just want to be able to close the links and the data. And so from that perspective, I think that's where we're headed, right? What you'll end up seeing over time and how all these pieces fit together is really kind of that seamless experience from a data connectivity perspective. You've got devices that primarily live on cellular and that want to jump over to satellite, and now they're doing the opposite,

which is they're living potentially their entire lives on satellite and using cellular sometimes. And so, again, I think what we drive for is the ability to have customers, again, that see this kind of seamless experience and not necessarily know which satellite carrier they're operating on or that their device is actually on a satellite, right? So I think really what we're doing from an NTN perspective is moving towards a more standardized approach where any manufacturer of a chip or a module can now integrate Iridium into that same module without any additional cost, right? And so that's really the benefit,

and that's kind of where all these things fit together, is along the standardization of the satellite networks within existing terrestrial networks. And that's really what's going to make everything kind of, as you mentioned, seamless, Maria, and ensure that satellite is a connectivity piece that's integral to pretty much any IoT solution that's out there today. Very cool.

I want to make sure if there's anything that we didn't talk about that you wanted to mention that was a high priority for you guys to make sure you get out there, I want to give you the floor if there's anything that you wanted to mention. It's over to you for that. Yeah. I mean, the only thing I'd mention anything that you wanted to mention. It's it's over to you for Yeah, I mean the only thing I'd mention is that you know, we we cater to the developer, right? That's kind of as I talked about earlier Maria We couldn't be where we are today without kind of the expertise that our partners bring and so, you know One of the things that we try to do is be very developer friendly in terms of providing developer kits and the experience

For those that are wanting to try satellite. It can seem quite daunting if you've never been part of a satellite project, but I assure you that it's extremely easy. For our latest module, which is the 9704, you can go out and buy a kit. You can receive that kit within a couple of days, and you can be transmitting and talking to a satellite within a matter of minutes of opening up the kit. That's awesome. Ian, you've been a great guest. Thank you so much for explaining so many things to me that have been confused in my mind for quite some time.

So you've been awesome. Thank you. Thank you so much. Maria, thanks for having me. I certainly appreciate the opportunity and it's been a great conversation. We'll have a link in the show notes to Ian and Maria's full conversation on Deep Space. Be sure to check out T-Minus Space Daily brought to you by N2K Cyberwire each weekday on your favorite podcast app. Did you know Active Directory is targeted in 9 out of 10 cyber attacks? Once attackers get in, they can take control of your entire network. That's why Semperis created Purple Night, the free security assessment tool that scans your Active Directory for hundreds of vulnerabilities and shows you how to fix them.

Join thousands of IT pros using PurpleKnight to stay ahead of threats. Download it now at sempris.com slash purple-knight. That's sempris.com slash purple-knight. And finally, in a plot that was just so crazy it might work, Kansas City's Nicholas Michael Kloster, age 32, has pleaded guilty to hacking multiple organizations, all to advertise his own cybersecurity services. Prosecutors say Closter's methods were bold but far from sophisticated. At one gym, he strolled in, hacked their computer to access security cameras, erased his photo

from their system, and reduced his membership fee to a bargain bin $1. Then, like any enterprising entrepreneur, he emailed the owners the next day, offering his professional services. His business development tour continued at a nonprofit where he used a boot disk to reset passwords and install VPN software for future access, presumably in preparation for his follow-up sales email.

Kloster's resume also includes using his employer's credit card to buy a hacking thumb drive, which led to his termination. He now faces up to five years in prison and a hefty fine. Talk about your failed penetration test. And that's the CyberWire. For links to all of today's stories, check out our daily briefing at the cyberwire dot com. For links to all of today's stories, check out our daily briefing at the cyberwire.com. Be sure to check out Research Saturday and my conversation with Kyle Lefton, security

researcher from Akamai. We're discussing their research, Two Botnets, One Flaw. Mirai spreads through Waza vulnerability. That's Research Saturday. Check it out. We'd love to hear from you. We're conducting our annual audience survey to learn more about our listeners. We're collecting your insights through August 31st of this year.

There's a link in the show notes. Please do check it out. N2K's senior producer is Alice Carruth. Our producer is Liz Stokes. We're mixed by Elliot Peltsman and Trey Hester with original music by Elliot Peltsman. Our executive producer is Jennifer Iben. Peter Kilpey is our publisher, and I'm Dave Bittner. Thanks for listening. We'll see you back here next week. Hey everybody, Dave here.

I've talked about DeleteMe before, and I'm still using it because it still works. It's been a few months now and I'm just as impressed today as I was when I signed up. DeleteMe keeps finding and removing my personal information from data broker sites, and they keep me updated with detailed reports so I know exactly what's been taken down. I'm genuinely relieved knowing my privacy isn't something I have to worry about every day. The DeleteMe team handles everything.

It's the set it and forget it piece of mind. And it's not just for individuals. DeleteMe also offers solutions for businesses, helping companies protect their employees' personal information and reduce exposure to social engineering and phishing threats. And right now, our listeners get a special deal, 20% off your DeleteMe plan. Just go to JoinDeleteMe.com slash N2K and use promo code N2K at checkout. That's JoinDeleteMe.com slash N2K, code N2K.