CyberWire Daily

The FBI blames North Korea for a record-breaking crypto heist. Hackers hijack air raid alerts in Ukraine and Russia. European supermarket freezers come under attack again. Aur0ra ransomware operators put AI agents to work. Android’s SMS of Death gets a proof-of-concept exploit. Malicious Claude Code extensions infiltrate Cursor’s marketplace. Google offers a quarter-million-dollar bug bounty. ChatGPT faces a wrongful death lawsuit. Monday business briefing. Our guest is Cynthia Kaiser, SVP of Halcyon’s Ransomware Research Center and former Deputy Director of the FBI’s Cyber Division, sharing how the AI cybercrime economy is open for business and booming. The secure USB drive that wasn’t.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Cynthia Kaiser, SVP of Halcyon’s Ransomware Research Center and former Deputy Director of the FBI’s Cyber Division, shares how the AI cybercrime economy is open for business and booming.

Selected Reading

FBI Attributes Binance Heist to North Korea’s TraderTraitor (Infosecurity Magazine)

Ukraine's air raid alert system hacked, Russian system targeted hours later (Kyiv Independent)

News Cybercrime Recorded Future Second wave of suspected cyberattacks hits supermarket freezers across Europe (The Record)

AI used in Aur0ra ransomware testing and execution (SOPHOS)

New Android SMS of Death exploit can remotely crash unpatched phones (Bleeping Computer)

Malicious Claude Code Extension Served in Cursor Supply Chain Attack (SecurityWeek)

Google Introduces $250,000 Root-in-Cloud Bug Bounty Reward (SecurityWeek)

Parents of woman who died of seizure after ChatGPT misguidance sue OpenAI (The Guardian)

Upwind Security raises $400 million in Series C funding. (N2K Pro Business Briefing)

Lenovo's 'encrypted' fingerprint USB drive is just an unencrypted SD card in a fancy case — AI-assisted follow-up finds a backdoor and hardcoded keys in other ‘secure’ USB products (Tom's Hardware)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.
Learn more about your ad choices. Visit megaphone.fm/adchoices

As space's infrastructure continues to grow, the question of space leadership will not center around who has the most satellites, but instead around who can leverage the greatest satellite capabilities.

Host Maria Varmazis met with Yasrine Ibnyahya, VP of  technology investments and partnerships at Viasat, to discuss Mobile Satellite Services Association (MSSA) Reference Architecture. Ibnyahya discusses how evolving architecture has continued to build on earlier work utilizing multiple waveform technologies, greater interoperability, and incorporating more satellite payloads.

Key Sources:

MSSA Reference Architecture 2.0

Like what you heard? Be sure to subscribe to our free Signals and Space Briefing⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, our Sunday newsletter covering the intersection of cybersecurity and space. Subscribe at: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thecyberwire.com/newsletters/signals-and-space⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠

Is there a topic or person you’d like to hear on our show? You can send your questions and feedback to ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠space@n2k.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠. You can also fill our our audience survey: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://www.surveymonkey.com/r/NJYCN2P ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠

T-Minus: Space-Cyber Briefing is a production of N2K CyberWire. ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠N2K⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ is your nexus for discovery and connection for people, technology, and ideas shaping the future of secure innovation. Learn how at ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠n2k.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠.
Learn more about your ad choices. Visit megaphone.fm/adchoices

Today we are joined by ⁠Subhajeet Singha⁠, Senior Security Researcher at ⁠Acronis⁠ Threat Research Unit, discussing their work on "Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit." A Chinese-speaking threat actor tracked as Red Heron exploited a critical Gitea remote code execution vulnerability, CVE-2026-60004, within days of its public disclosure, compromising organizations across five countries and stealing source code, credentials, and sensitive infrastructure data.

The campaign involved deploying persistent backdoors and a newly identified Linux implant called JITTERLY, which contains an undocumented rootkit, SIXZUT, capable of hiding files, processes, and network connections while protecting the malware from removal. Acronis assesses with moderate confidence that Red Heron operates within a PRC-linked context, highlighting how quickly attackers can weaponize newly disclosed vulnerabilities and turn exposed development platforms into gateways for broader network compromise.

The research and executive brief can be found here:

⁠⁠⁠⁠Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit⁠

Learn more about your ad choices. Visit megaphone.fm/adchoices

Binance suffers a record-breaking cryptocurrency heist. Attackers exploit a critical GitLab flaw. Russian disinformation targets U.S. elections. Treasury sanctions North Korean IT worker operations. A cyberattack halts Polymarket trading. GCHQ loses track of thousands of storage devices. An abandoned Mac app leaves security risks behind. Japan Airlines reports a third-party breach. An AI-powered command-and-control framework emerges in the wild. Our guest is Josh Devon, Co-founder & CEO of Sondera, winner of the 9th annual DataTribe Challenge. We bid farewell to the captain who inspired a generation of innovators.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today Josh Devon, Co-founder & CEO of Sondera and winner of the 9th annual DataTribe Challenge, is discussing their win.

Selected Reading

CISA says max severity GitLab flaw now exploited in the wild (Bleeping Computer)

Covert Russian Group Targets James Talarico With Baseless Claims in Texas Senate Race (The New York Times)

US sanctions Russians, North Koreans for laundering IT worker earnings (The Record)

Polymarket confirms cyberattack on third-party provider after outages (The Record)

Britain’s spy agency doesn’t know where thousands of its memory sticks are (POLITICO)

Old 'Popcorn Time' App Left Hundreds of Thousands of Macs at Risk (MacRumors)

Japan Airlines warns of data breach as country grapples with multiple cyber incidents (The Record)

NIK C2: The new AI-enabled command-and-control framework (Cisco Talos)

How North Korean hackers pulled off the biggest crypto heist in history (Metacurity)

Patrick Stewart, ‘Star Trek’ Captain and Professor X on ‘X-Men,’ Dies at 86 (The New York Times)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.
Learn more about your ad choices. Visit megaphone.fm/adchoices

DHS suffers a massive data leak. Researchers reveal Volt Typhoon’s sophisticated methods. Cisco patches a firewall zero-day. A suspected coordinated supply chain attack targets public GitHub repositories. Online scams overtake phishing. NIST shares post-quantum cryptography guidance. CISA warns a VMware ESXi vulnerability is under active exploitation. The Federal Election Commission takes systems offline. A Ukrainian national gets prison time for ransomware operations. Our guest is Yonald Chery, CTO from Technology Advancement Center (TAC), discussing securing operational technology in our critical infrastructure. Bitcoin mining gets you in hot water.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

On today’s Industry Voices segment, we are joined by Yonald Chery, CTO from Technology Advancement Center (TAC), discussing securing operational technology in our critical infrastructure takes more than traditional I.T. cybersecurity skills. If you enjoyed this conversation, be sure to check out the full interview here.

Selected Reading

Massive Leak Exposes 41,000 Homeland Security Workers—Including Undercover ICE Agents (WIRED)

Silent Train: Volt Typhoon’s Sophisticated Infection Chain into US Targets Exposed (Zero Day)

New Cisco firewall zero-day exploited to crash SSL VPN devices (Bleeping Computer)

Attackers turn GitHub issues into supply chain campaign against 61 public repos in less than an hour (The Register)

Online Scam Volumes Double to Overtake Phishing (Infosecurity Magazine)

NIST Publishes Guidance to Meet Federal Post-Quantum Deadlines (Infosecurity Magazine)

Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day (SecurityWeek)

FEC takes down electronic filing platform after attempted hack (Nextgov)

Ukrainian Nefilim and Hive Affiliate Artem Stryzhak Jailed for 70 Months (Hackread)

Heatbit Says Your Water Heater Should Be Mining Bitcoin, and Now It Can (Gizmodo)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.
Learn more about your ad choices. Visit megaphone.fm/adchoices