Multifunction Windows backdoor, NSA revives TAO, urgent ShareFile warning

Summary

---

Cybersecurity Headlines — July 13, 2026

Host: Steve Prentiss, CISO Series
Main Theme:
A packed daily update on urgent threats, notable breaches, ongoing exploits, and significant industry trends in the world of information security.

---

1. Multifunction Windows Backdoor: "Giga Wiper"

[00:06–01:29]

• Discovery and Capabilities:
  Microsoft has identified a new, sophisticated Windows backdoor, now named "Giga Wiper."
  This Golang-based malware merges data-wiping and ransomware-like encryption features into a single tool.
• On-Demand Functionality:
  It functions as a "Swiss Army knife" for attackers:
  • Includes several wiper commands
  • Can encrypt files with no possibility of decryption
  • Blends multiple malware families
• Industry Implication:
  This marks a shift in wiper malware trends:
  • Traditional wipers solely destroy data, but Giga Wiper also facilitates extortion.
  • “Reflects a notable shift in wiper malware, which is typically designed purely to destroy rather than to extort and carry real world consequences.” (Microsoft Threat Intelligence Group, 01:16)

---

2. NSA Revives TAO for Elite Hacking Operations

[01:29–02:06]

• What Happened:
  The NSA is rebranding its elite hacking wing, restoring the Tailored Access Operations (TAO) name (from “Computer Network Operations”).
• Why Now:
  The change is part of an internal reshuffle, echoing pre-2016 structures to better address current digital threats from major adversaries like China and Russia.
• Notable Insight:
  The re-consolidation is seen as a return to a structure that “a decade later, is described by those involved to have been the better approach.” (Steve Prentiss, 02:01)

---

3. ShareFile Emergency: Storage Zone Controller Shutdown

[02:06–02:52]

• Urgent Alert:
  Progress Software is urging all ShareFile customers to immediately shut down Windows servers running storage zone controllers, due to a credible, external security threat.
• Response Actions:
  • Temporarily disabled access to affected accounts
  • Engaged with internal and external security experts
  • Assurance: No evidence (yet) of unauthorized access to data.
  • Only Storage Zone Controller customers are affected, not standard cloud or other ShareFile accounts.

---

4. Global CMS Exploits: Australian Advisory

[02:52–03:30]

• Attack Campaign:
  Australian Cybersecurity Centre warns about a campaign targeting vulnerabilities in global Content Management Systems (CMS), such as WordPress and Joomla.
• Attack Method:
  Adversaries scan sites for chances to deploy web shells via unpatched plugins.
  • Many Australian businesses already impacted.
• Resource:
  “A full list of these exploits is available in the show notes to this episode.” (Steve Prentiss, 03:30)

---

5. Dutch Odido Telco Breach: Local Accomplice Involved

[04:28–05:25]

• Findings:
  Following a February breach at Dutch telecom provider Odido, Dutch police say a Dutch-speaking man, pretending to be an Odido IT worker, called customer service, enabling the attack.
• Impact:
  Over 6 million customer records were exposed.
• Next Steps:
  The police haven't identified the caller yet and may release a recording to the public to seek help.

---

6. Steganography Hits AI: Ghost Commit Attack

[05:25–06:10]

• Research Breakthrough:
  University of Missouri–Kansas City researchers built a proof-of-concept attack hiding prompt injection inside a PNG image in a code repository pull request.
• Attack Vector:
  • AI code reviewers ignore binary blobs like PNGs.
  • Malicious prompt injection was hidden in text inside the image file—“the words ‘malicious prompt injection’ and an explicit order to read the env file”—but still evaded detection.
• Disclosure:
  Findings have been reported to affected vendors.

---

7. Cloud Data Centers Spike Big Tech Carbon Emissions

[06:10–06:58]

• Report:
  Microsoft, Amazon, and Google increased their collective carbon output by nearly 20% year-over-year, now equaling 1/3 of France's annual emissions.
• Key Insight:
  “Shifting to the cloud helps other corporations obscure their environmental footprint.” (Cecilia Rickapp, UCL, 06:44)
• Driver:
  Broad data center construction and increased AI model hosting are the culprits.

---

8. Ransomware Negotiator-Turned-Extorter Sentenced

[06:58–08:04]

• Incident:
  Ex-Digital Mint ransomware negotiator Angelo John Martino III sentenced to 70 months (~6 years) in prison.
• Crime Details:
  • He abused insider knowledge to help BlackCat ransomware affiliates
  • Provided confidential victim info
  • Extorted $75.3 million from five US-based victims (including a non-profit, a financial firm, and a hospitality company): “Effectively conducting ransomware negotiations with himself and with his co-conspirators.” (Steve Prentiss, 07:37)
• Outcome:
  Victims all paid the ransoms.

---

Notable Quotes

• "Reflects a notable shift in wiper malware, which is typically designed purely to destroy rather than to extort and carry real world consequences."
  —Microsoft Threat Intelligence Group ([01:16])
• "A decade later, is described by those involved to have been the better approach."
  —Steve Prentiss on NSA TAO ([02:01])
• “Shifting to the cloud helps other corporations obscure their environmental footprint.”
  —Cecilia Rickapp, University College London ([06:44])
• “Effectively conducting ransomware negotiations with himself and with his co-conspirators.”
  —Steve Prentiss ([07:37])

---

Segment Timestamps for Quick Reference

• Windows Backdoor Giga Wiper: 00:06–01:29
• NSA brings back TAO: 01:29–02:06
• ShareFile alert: 02:06–02:52
• Australian CMS exploit warnings: 02:52–03:30
• Odido Telco attack update: 04:28–05:25
• AI prompt injection via PNG: 05:25–06:10
• Big Tech carbon emissions spike: 06:10–06:58
• Ransomware negotiator sentenced: 06:58–08:04

---

For further details and the full list of CMS vulnerabilities, see the show notes at CISOseries.com.

Transcript

[A]

From the CISO series, it's Cybersecurity Headlines

[B]

these are the cybersecurity headlines for Monday, July 13, 2026. I'm Steve Prentiss. Windows Backdoor stuffs multiple wipers and ransomware code into a single package. According to Microsoft, this newly identified backdoor combines ransomware like encryption with multiple data wiping features. First spotted last October, this Golang based application is now named Giga Wiper. It contains multiple malware families in the software as on demand commands, giving criminals a Swiss army knife of command and control and destructive capabilities including multiple wiping commands and file encryption without any possibility of decryption. Microsoft's Threat Intelligence Group says this quote reflects a notable shift in wiper malware, which is typically designed purely to destroy rather than to extort and carry real world consequences. NSA brings back tailored access operations name for Elite hacking unit this is a rebrand of sorts for its Elite Hacking division changed from Computer Network Operations. The change is part of a reorganisation to make the largest electronic spy agency in the world more adept at facing evolving digital threats from China, Russia and others. It's not just the name that has reverted, but so too some of the internal reshuffle from 2016 in which offensive operations and intelligence collection were spread out into broader directorates from a standalone unit, which now, a decade later, is described by those involved to have been the better approach. Progress software urges ShareFile customers to shut down storage zone controllers Progress Software made this alert on Friday to shut down the Windows servers running their storage zone controllers, confirming that it is responding to a credible external security threat. The company has temporarily disabled access to affected accounts while it works with internal and external security experts. As of this announcement, the company has no indication of any unauthorized access to any ShareFile accounts or data and has not said what the threat is or who is behind it. Only the storage zone controller is affected and not standard cloud, only ShareFile accounts. Australian Cyber agency warns of global CMS exploits the Australian Cybersecurity Centre is warning about a global exploitation campaign targeting including vulnerable content management systems and plugins, with many Australian businesses already affected by the malicious activity with web shells being deployed on their sites. The agency says as part of this campaign, malicious cyber actors are actively scanning websites for opportunities to deploy web shells, leveraging various vulnerabilities affecting CMS software and plugins. This activity leverages flaws in several CMS platforms and plugins including WordPress Joomla, and a full list of these exploits is available in the show. Notes to this episode Huge thanks to our sponsor Threatlocker Every security leader is being asked the same question right now. How do we enable innovation without creating unnecessary risk? That's the challenge behind cloud adoption, behind AI, behind automation, and behind every major technology decision. ThreatLocker helps organizations take a zero trust approach to that challenge, giving them greater control over what can execute, what can access their environment, and what users and applications are allowed to do. That's why ThreatLocker is proud to support cybersecurity headlines, because security works best when innovation and control move together. Dutch Odido Telco cyber attack traced to local accomplice maybe following up on a story we covered in February Dutch police announced on Thursday they had uncovered evidence suggesting that Dutch criminals were involved in the cyber attack on telecom provider Odido that exposed the personal data of more than 6 million customers. According to the announcement, a Dutch speaking man posing as an Odido IT employee called the company's customer service department before the February attack, helping trick employees into granting access that enabled hackers to steal customer information. The police force is still trying to identify the caller and suggested they might release a recording of the caller's voice if necessary. Ghost commit hides prompt injection in images to fool AI agents and steal secrets, Steganography has come to the AI world. Researchers at the University of Missouri, Kansas City's Asset Research Group have built a pull request that steals a repository's secrets by hiding the malicious instruction inside a PNG that AI code reviewers never open. The researchers published a proof of concept on GitHub this past week and says it has disclosed the findings to affected vendors. The exploit lives in text rendered inside a png, which appears to automated reviewers as simply a binary blob. As part of their research, the team even stuffed the PNG with the words malicious prompt injection and and an explicit order to read the env file. But it still passed. Clean data centers drive up big Tech's carbon emissions to a third of those of all of France the collective carbon emissions of Microsoft, Amazon and Google have increased by nearly 20% in the past year, driven largely by data center construction. For the financial year ending March 2026, the three companies produced an amount of carbon dioxide equivalent to one third third of that of France, a country of 69 million people. Cecilia Rickapp, an economics professor at the University College London, warns that other companies that store data and train and use AI models are outsourcing their own digital AI carbon footprint to cloud giants. Basically, shifting to the cloud helps other corporations obscure their environmental footprint. End quote. Former digital Mint ransomware negotiator who duped clients sentenced to 70 months in jail. Angelo John Martino III exploited his insider position and fed confidential information to ransomware co conspirators to extort a combined $75.3 million from five US based victims. This former ransomware negotiator for Digital Mint has now been sentenced to 70 months in jail, that is almost six years for helping Black Cat affiliates, effectively conducting ransomware negotiations with himself and with his co conspirators. The victims in this scam, all of whom did pay ransoms, include a non profit, a financial services company and a hospitality company. If you have some thoughts on the news from today or about this show in general, please be sure to reach out to [e-mail] we would love to hear from you. Steve I'm Steve Prentice reporting for the CISO series.

[A]

Cybersecurity headlines are available every weekday. Head to CISoseries.com for the full stories behind the headlines.