← Cybersecurity Headlines
Loading summary
Transcript1 lines
- [00:00]
A
From the CISO series, it's Cybersecurity Headlines these are the cybersecurity headlines for Monday, March 9, 2026. I'm Steve Prentiss. FBI investigates suspicious activities on agency network this investigation focuses on a cybersecurity breach suffered by the Digital Collection System Network, which is connected to the agency's wiretaps, pen register, surveillance tools and other intelligence collection systems used in criminal and national security investigations. The incident occurred on February 17th and was discovered after irregular network behaviour was witnessed. A letter to Congress from the FBI allegedly claimed that the threat actors gained entry through an Internet service provider that served as a vendor to the agency. End quote over 100 GitHub repositories distributing Boriped grab stealer this malware spelt B O R Y P T G R A B can harvest browser and cryptocurrency wallet data along with system information and user files and can assist in command and control communication. Researchers at Trend Micro have now revealed the existence of multiple zip archives masquerading as free software tools that have been distributed since late 2025 through the GitHub repositories. The researchers stated that the Borit Grab campaign illustrates an evolving threat ecosystem targeting users through deceptive software downloads and fake GitHub repositories, showing an increasing level of engineering sophistication. Hackers abuse ARPA, DNS and IPv6 to evade phishing defenses the ARPA domain is a special top level domain reserved for Internet infrastructure rather than normal websites. It is used for reverse DNS lookups which allow systems to map an IP address back to a host name. Researchers at Infoblox described a campaign that uses the IP6 ARPA reverse DNS TLD to essentially point to faked IPv6 addresses owned by the threat actors, who can then abuse the reverse DNS zone for the IP range by configuring additional DNS records for phishing sites. End quote A link to a more detailed description of this technique is available in the show Notes to this episode. European Union Court Advisor suggests banks compensate phishing victims the Advocate General of the Court of Justice of the eu, Athanasios Rantos, has made a formal suggestion that banks immediately refund account holders affected by unauthorized transactions, even when the customer has fallen for a phishing scam. This dialogue is based on a specific lawsuit that was issued in Poland against the bank in which a customer had been led to a spoofed auction site and had had money stolen. The bank had initially refused, but Rantos stated that under European Union Directives bank can only do this if they have reasonable grounds to suspect customer fraud. This can be reversed however, if the bank can prove negligence on the part of the customer. To be clear, this is not a European Union Court of Justice ruling, but rather an indication of the direction that the court may take when the matter reaches that stage. Huge thanks to our sponsor DropZone AI. Here is a number worth knowing before RSAC, the average enterprise SOC sees tens of thousands of alerts a day. Most get triaged, a fraction get thoroughly investigated, the rest sit in the queue or get auto closed. Dropzone AI puts AI SOC agents on every one of those alerts, every alert investigated end to end across your full tool stack around the clock. Over 300 deployments in production today. Dropzone AI is at RSAC this year at booth 455 and you can get more information at dropzone AI rsa2026 AI diner d I n E R this link is also available in our show Notes New Jersey county suffers a malware attack Passaic county, one of the largest counties in New Jersey, suffered a cyber attack that disrupted phone lines and IT systems used across government offices. Officials in Passaic recognize that this is just one of several attacks on local governments in New Jersey, noting recent ones in Somerset County, Camden County, Bergen county, the Township of Montclair and the city of Hoboken. North Korea scaling up fake worker schemes with Generative AI A warning from Microsoft Threat Intelligence states that North Korean threat groups are using AI tools to accelerate and expand the country's long running scheme to get remote technical workers hired at global companies for longer durations. A report released Friday calls AI a force multiplier in this pursuit by shortening the time it takes to create digital Personas for specific job markets and roles, including impersonations and real time voice modulation. Claude finds 22 Firefox vulnerabilities as part of its security partnership with Mozilla, Anthropic said on Friday that it discovered these new security vulnerabilities in the Firefox Web browser, with 14 classified as high. The vulnerabilities were discovered using The Claude Opus 4.6 large language model and have been addressed in Firefox 148, released late last month. Anthropic said the LLM detected a use after free bug in the browser's JavaScript after just 20 minutes of exploration, which was then validated by a human researcher in a virtualized environment to rule out the possibility of a false positive. End quote. Transport for London slightly increases their count of the number of people affected by the 2024 breach, following up on a story we covered in September 2024. Transport for London, the local government body responsible for managing much of Lo London's transport system, now says that the September 2024 data breach exposed the data of more than 7 million people, somewhat more than the 5,000 initially suggested. Two teens affiliated with the scattered spider group were charged with committing this crime. The discrepancy in these numbers was not an error, but reflected Transport for London placing priority on 5,000 customers whose digital pass cards, known as the Oyster card, may have been breached, potentially leading to banking Information do you want to know more about the most pressing stories of the last few days in time for your weekly standup? Join us today at 4:00pm Eastern for the Department of no Where. Our guests, John Barrow, CISO at JP Poindexter Co. And Derek Fisher, Director of the Cyber Defense and Information Assurance Program at Temple University, will sort out the priority stories and do a deep dive on the ones that matter most. And of course we will actively involve you in the conversation. If you want, just go to YouTube, search for CISO series and look for Department of no for March 9 under upcoming live Streams. And if you have some thoughts on the news from today or about this show in general, please be sure to reach out to us@feedbackisoseries.com we would love to hear from you. I'm Steve Prentiss reporting for the CISO series. Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories behind the headlines.