← Cybersecurity Headlines
Cybersecurity Headlines
DarkSword emerges, "ShieldGuard" dismantled, NK IT worker army rakes in money
00:06:32
Loading summary
Transcript3 lines
- [00:00]
A
From the CISO series, it's Cybersecurity Headlines
- [00:07]
B
these are the cybersecurity headlines for Thursday, March 19, 2026. I'm Sarah Lane. Dark Sword emerges from suspected Russian hackers Researchers from Iverify Lookout and Google identified a new iOS exploit kit called Dark Sword, linked to suspected Russian backed groups and targeting users in Ukraine and beyond. The kit can steal passwords, messages and crypto wallets and may impact millions of iPhones running older iOS versions, though vulnerabilities have since been patched by Apple. Shieldguard dismantled after malware discovery Okta Threat Intelligence uncovered and helped dismantle ShieldGuard, a crypto scam posing as a browser extension that claimed to protect wallets but instead harvested sensitive data from platforms like Coinbase and Binance. The malware could capture wallet data, browsing activity and execute remote code via command and control servers. Researchers linked the campaign to a broader network and worked with partners to remove the extension, shut down infrastructure and cut off attacker access. North Korea's fake IT worker army rakes in 500 million per year Researchers at IBM X Force and Flare Research report that North Korea runs a network of up to 100,000 fake IT workers across more than 40 countries, generating roughly $500 million per year for the regime. The operation uses recruiters, facilitators and Western collaborators to place workers and remote tech jobs under stolen or fake identities. The researchers say these workers infiltrate companies, earn high salaries and can access sensitive systems, highlighting a large scale revenue and espionage pipeline tied to North Korea. CISA official says no uptick in cyber threats Cybersecurity and Infrastructure Security Agency Acting Director Nick Anderson said the US has not seen an increase in Iranian cyber activity despite recent military strikes, describing the threat landscape as steady while warning other actors remain active, Anderson added the agency is prioritizing faster vulnerability response timelines and monitoring AI driven attacks while continuing to work with Stryker following a cyber attack linked to the Iran Associated Group Hondala. Huge thanks to our sponsor Adaptive Security. This episode is brought to you by Adaptive Security, the first security awareness platform built to stop AI powered social engineering. Picture a new hire who interviews well, except they're synthetic AI video AI voice, AI backstory. Once they're in, they go after payroll, internal docs and access. That's the new reality. The attack surface is trust itself. Adaptive fights back with realistic deepfake simulations and training that actually sticks. Learn more@adaptivesecurity.com how SaaS apps enable massive breaches A new report from Grip Security finds shadow AI embedded in software as a service apps is driving a surge in breaches, with a 490% increase in attacks and 80% involving sensitive data. Researchers say stolen OAuth tokens can let attackers exploit AI agents to access connected systems and trigger cascading compromises across organizations. The report points to the 2025 SalesLoft drift breach, which impacted more than 700 companies, as a model for how a single SaaS compromise can spread widely. The company warns 2026 could see even larger incidents without better visibility and control over AI enabled apps. US Intelligence chief grilled on absence of election threats US Intelligence chief Tulsi Gabbard defended leaving foreign election threats out of this year's global threat assessment and explained her presence at the FBI raid on Georgia's 2020 election office. Gabbard says the omission reflects threat prioritization, not absence of risk. Lawmakers raised concerns about foreign influence, citing prior Iran, Russia and China operations and about Gabbard observing the FBI action at the president's request. AI beats 99% of humans in hacking competitions Israeli startup Tenzai tested an AI hacker in six elite capture the flag competitions, saying that it outperformed 99% of 125,000 human participants using models from OpenAI and Anthropic. The AI was good at exploiting software vulnerabilities and manipulating AI apps. CEO Pavel Gurvich warns that such capabilities are spreading beyond governments, raising risks and regulatory questions. Amazon says Cisco firewall flaw abused weeks before disclosure Ransomware group Interlock exploited a critical zero day in Cisco Secure Firewall Management Center 36 days before Cisco patched it on March 4th. That's according to Amazon CISO CJ Moses. The flaw let unauthenticated remote attackers execute Java code as root. Interlock's toolkit collects detailed Windows and browser data, uses custom rats and Java implants for persistence, and deploys legitimate software like ConnectWise to evade detection. The group has hit hospitals and municipal targets using multiple redundant access methods to maintain control and pressure victims for ransom. We know there's tension between security teams and developers, but where does this tension start? Is the constant friction between developers and security teams a leadership problem disguised as a team problem? We're trying to find out how to keep the peace on this week's episode of Defense In Depth. Look for the episode who is responsible for the conflict between security and developers? Wherever you get your podcasts, if you have some thoughts on the news from today or about our show in general, be sure to reach out to us feedbackisoseries.com we'd love to hear from you. I am Sarah Lane reporting for the CISO series. Stay safe out there and we'll talk to you tomorrow.
- [06:16]
A
Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories behind the headlines.