Cyber Security Headlines – Episode Summary

Podcast: Cyber Security Headlines (CISO Series)
Episode Date: September 29, 2025
Host: Steve Prentiss
Main Theme:
A fast-paced round-up of the day’s top cyber security stories, ranging from international espionage and government risk management frameworks to the latest threats facing businesses and updates on major software vulnerabilities.

Key Discussion Points and Insights

1. Dutch Teenagers Arrested for Suspected Russian Espionage

• [00:21] Two Dutch teenagers were arrested for allegedly attempting espionage on behalf of Russia.
  • Incident details:
    • The teens used a Wi-Fi sniffer device near the offices of Europol, Eurojust, and the Canadian Embassy in The Hague.
    • No systems were compromised.
    • Recruitment occurred over Telegram; they were caught following an intelligence tip.
    • This marks an "escalation to lower level recruitment cases" in Europe, referencing prior incidents in Germany involving young recruits.
  • Quote:
    • "There are no signs of compromise on any of the agency's systems. The boys were allegedly recruited over Telegram and were arrested following a tip from the country's intelligence service." – Steve Prentiss [00:36]

2. U.S. Department of Defense Announces New Cybersecurity Framework

• [01:28] The DoD introduced the "Cybersecurity Risk Management Construct" (CSRMC) to replace its former risk management framework (RMF).
  • The old system was criticized for being “overly reliant on static checklists and manual processes that failed to account for operational needs and cyber survivability requirements.”
  • CSRMC promises a shift to "dynamic, automated, and continuous risk management," aligning cyber defense with the realities of modern warfare.
  • Listeners are directed to the show notes for a full outline of the framework’s five phases.
  • Quote:
    • "...enabling cyber defense at the speed of relevance required for modern warfare." – Steve Prentiss [02:17]

3. Oyster Malware Distributed via Fake Microsoft Teams Installers

• [02:44] Attackers are leveraging SEO poisoning and malvertising to distribute fake Teams installers, leading to Oyster malware infections.
  • Oyster malware (aka Broomstick, Cleanup Loader):
    • Gives attackers remote access, ability to execute commands, deploy payloads, transfer files.
    • Initially surfaced in 2023, tied to several campaigns, including ransomware group Raisida.
  • Quote:
    • "Hackers have been using SEO poisoning and search engine advertisements, also called malvertising, to promote fake Microsoft Teams installers..." – Steve Prentiss [02:48]

4. Union County, Ohio, Targeted in Data-Stealing Cyberattack

• [04:44] Recent cyberattack on Union County, Ohio:
  • Stolen data includes Social Security numbers, financial info, driver’s licenses, fingerprints, medical information, and passport details.
  • Impact: Approximately 45,000 individuals affected.
  • No group has taken credit as of airing.
  • Security concern: Highlights trend of local government attacks increasing in scope and severity.

5. Maximum Severity Flaw in GoAnywhere File Transfer Service

• [05:16] Ongoing concerns regarding FORTA’s GoAnywhere MFT product:
  • Researchers warn of a maximum severity vulnerability, with differing accounts on when exploitation began.
  • Conflict:
    • Forta says it self-identified the vulnerability and claims no active exploitation.
    • Watchtower researchers report credible exploit evidence from a day prior to Forta’s claim.
  • Issue: Challenges in vulnerability disclosure and vendor communication highlighted.
  • Quote:
    • "The conflicting accounts highlight ongoing challenges in vulnerability disclosure, especially when vendors downplay severity or exploitation status." – Steve Prentiss [05:41]

6. UK Government’s Digital ID (“Brit Card”) Proposal

• [06:00] Prime Minister Keir Starmer to propose digital ID cards for all working adults to address illegal migration.
  • Would require new legislation; faces strong privacy and civil liberty criticism.
  • The government argues it is essential for ensuring legal employment rights.
  • Cites a shift in public opinion since the Blair administration’s failed ID card plan in the 2000s.

7. Cisco Patches Two Actively Exploited Zero-Days in Firewall Products

• [06:42] Cisco urges immediate patching for two serious VPN web server vulnerabilities in its ASA and Secure Firewall products:
  • Both have been exploited in the wild; CVSS scores of 9.9 and 6.5.
  • Cisco does not disclose attackers’ identity or attack prevalence.
  • Quote:
    • "Cisco said it is aware of attempted exploitation of both vulnerabilities, but did not reveal who may be behind them or how widespread these attacks are." – Steve Prentiss [06:56]

Notable Quotes and Memorable Moments

• On the shift in government frameworks:
  "Shifting from snapshot-in-time assessments to dynamic, automated, and continuous risk management, enabling cyber defense at the speed of relevance..." – Steve Prentiss [02:10]

• On malvertising trends:
  "Hackers have been using SEO poisoning and search engine advertisements, also called malvertising, to promote fake Microsoft Teams installers that infect Windows devices..." – Steve Prentiss [02:44]

• On digital privacy concerns:
  "The proposal...has already drawn criticism from civil liberties and privacy groups." – Steve Prentiss [06:17]

Key Segment Timestamps

• [00:21] – Dutch espionage arrests
• [01:28] – DoD Cybersecurity Risk Management Construct
• [02:44] – Oyster Malware via Fake Teams Installers
• [04:44] – Union County, Ohio cyberattack
• [05:16] – GoAnywhere maximum severity flaw
• [06:00] – UK Digital ID proposal
• [06:42] – Cisco zero-day vulnerabilities

This episode delivers a densely packed update on international espionage activity, evolving government and enterprise cybersecurity frameworks, ongoing cyber threats—including malware and ransomware campaigns—and highlights critical vulnerabilities impacting organizations worldwide. Steve Prentiss maintains a clear, concise, and slightly urgent tone, emphasizing both breaking news and deeper trends in cyber risk and policy.