A (0:00)

Cybersecurity Today would like to thank Meter for their support in bringing you this podcast. Meter delivers a complete networking stack, wired, wireless and cellular in one integrated solution that's built for performance and scale. You can find them at meter.com CST

B (0:17)

cameras and AI aid deadly US Israel strike AI puts advanced cyber weapons in criminal hands CISA CIO Robert Costello resigns amid Agency shakeup Ransomware disrupts healthcare and GPS jamming in the Middle east threatens global shipping this is Cybersecurity Today and I'm your host David Shipley. Let's get started. Our lead story today takes us to Tehran, where hacked traffic cameras and advanced AI systems played a key role in a joint US Israeli operation to target Iran's top leadership. According to reporting from cnn, the operation, dubbed Epic Fury, culminated in a series of coordinated strikes on Saturday morning resulting in the death of Iran's Supreme Leader, Ayatollah Ali Khamenei and several high ranking military officials. It's being called one of the most sophisticated examples of intelligence driven warfare ever. Here's how it unfolded. Hacked traffic cameras were at the heart of the operation. These cameras, compromised years ago, gave Israel real time visibility into Tehran streets, helping them map the city, track movement patterns and identify high value targets. But the cameras were one piece of the puzzle. The operation relied heavily on what's being described as an AI powered target production machine. This system combined visual intelligence camera intercepted communications, satellite imagery, signals intelligence and human intelligence to pinpoint targets with astonishing precision. The result? A 14 digit grid coordinate that left little room for error. This wasn't the first time the system had been deployed. Israel has reportedly used it during the initial days of its 12 day conflict with Iran last June, successfully targeting some of the country's most senior officials. However, Saturday's strike marked the first time it was used to target the Supreme Leader himself. And while the operation achieved its immediate objective, it also highlights the growing use of AI and hacking as tools of war. From compromised critical infrastructure to leveraging massive amounts of data, this is a new era of conflict where the digital frontline is as critical as the physical one. The story of the assassination of Iran's Supreme Leader and the role of AI tools in military operations comes amidst the continued fallout from the showdown between the US Department of War and Anthropic. For organizations and governments, this isn't just your average geopolitical story. It's a glimpse into the future of cyber and physical kinetic capabilities. The ability to weaponize AI and use compromised infrastructure to enable precision attacks is a reminder of the risk pose of increasingly interconnected systems. The big question on many minds after this how do we defend against these kinds of modern threats? And it's not just countries doing it. Last year we learned that a Mexican cartel hacked traffic cameras in Mexico City to track US Officials so they could threaten, harm, or kill informants. The answer to defending the future lies in a combination of securing critical infrastructure, investing in advanced cybersecurity measures, and developing international norms around the use of cyber tools and AI in warfare. And as we've seen with this operation, the game is changing and the stakes continue to get higher. Our next story highlights the emergence of a new tool, CyberStrike AI, an open source toolkit that's being weaponized by cyber kernels to automate and enhance attacks. Recent findings from security researchers at Team CMERU reveal that Cyber Strike AI was used in a campaign targeting Fortinet Fortigate appliances, compromising over 600 devices in 55 countries. Here's how it worked. The attackers employed generative AI models like Anthropic Cloud and Deepsea to systemically scan for vulnerabilities in fortigate devices. They were able to automate their attack chain, exploit weaknesses, and scale their operations globally with ease. What makes this incident even more concerning is Cyberstrike AI itself. The tool, created by a Chinese developer known as Edison, is built in Go and integrates more than 100 security tools. While it's marketed as a research tool for discovering vulnerabilities and analyzing attack chains, it's clear that bad actors see it as a golden opportunity to leverage open source AI and use it as a weapon. Cyberstrike servers have been detected in multiple locations, including China, Singapore, Hong Kong, the United States, and even Switzerland. Researchers have also linked Edison to other offensive tools, including ransomware and privilege escalation exploits, and even to organizations potentially aligned with Chinese state sponsored cyber operations. Let's pause for a moment. This isn't just a story of one campaign or popping 600 Fortinet boxes, or even one tool. This is, at its core, about the proliferation, irresponsibly, of offensive AI hacking tools. Tools like CyberStrike AI lower the barrier to entry for complex attacks, putting sophisticated capabilities into the hands of just about anyone willing to misuse them with little or no skill. This is a whole new class of offensive tool. Comparing previous security tooling to Cyber Strike AI is like comparing a musket to an AK47. Making this kind of tool available is going to reignite the fierce debate around whether it's responsible to make certain tools available as open source and and how they're used by ethical hackers and security researchers as well as criminals. The takeaway for organizations if you're not already including AI enabled threats in your risk assessments, you're behind the curve. Start by ensuring systems are patched as fast as possible and particularly if you're using Fortinet devices. And think about how you're monitoring for unusual patterns that could indicate automated AI driven activity. There's yet another shake up at the Cybersecurity and Infrastructure Security Agency, or cisa, as Chief Information Officer Robert Costello has announced his resignation. His nearly five year tenure is coming to an end, and it's a departure that raises a lot of questions. Costello, a veteran of the Department of Homeland security and the US Air Force, shared the news on LinkedIn, calling his team at CISA quote, one of the greatest privileges end quote of his career. Under his leadership, SISA worked on strengthening cybersecurity measures, modernizing critical systems, and integrating artificial intelligence into its operations. But his time as CIO wasn't without controversy. Reports surfaced in recent weeks that the former acting director of cisa, Madhu Guttamakala, had attempted to force Costello out. And just last week, Costello received transfer orders for a possible reassignment to another federal agency, a move that many saw part of an ongoing power struggle within CESA's leadership. Costello's exit comes on the heels of other high profile leadership changes at the agency, including what we reported on Monday with the departure of Ghata McCalla and the appointment of Nick Anderson as acting director. These changes are happening against the backdrop of ongoing challenges for cisa, including staffing shortages and stalled leadership nominations, most notably that of Shawn Plenke for the permanent director role. And the turmoil comes at a critical time not just for cisa, but the United States. With escalating cyber threats targeting critical infrastructure including healthcare systems and national security assets, the agency's ability to respond effectively has repeatedly been called into question. Losing experienced leaders like Costello only adds to that concern. And in the midst of all this, it looks like healthcare organizations are back in a big way in the crosshairs of ransom groups. Our next story takes us to the University of Hawaii Cancer center, where a ransomware attack exposed the personal data of nearly 1.2 million individuals. This incident, which occurred in August 2025, targeted the center's epidemiology division and has since thrown a harsh spotlight on the risks of storing sensitive data in research environments. Here's what we know. Attackers access files related to several long term research projects, including the Multi Ethnic Cohort and other diet and cancer research initiatives. These files contained highly sensitive personal information names, social insurance numbers, driver's license numbers, even voter registration data dating back to the 1990s. In response, the university took the drastic step of paying the attackers for a description tool and what they called secure destruction of stolen data. While they haven't disclosed the exact ransom they paid, this marks the second time in recent years that the University of Hawaii system has paid a ransom demand. Back in 2023, Hawaii Community College also paid attackers to prevent the leak of sensitive data. And here's the kicker. This breach didn't just affect current research participants. Among those impacted were nearly 900,000 individuals whose contact details were found in old data sets, some dating back more than 25 years. While the university has stated that no student records or clinical trial data was compromised, the sheer scale of the breach raises serious questions about data governance and the risks posed by legacy systems. By the way, if you've been listening to the show for a while, you know that I generally don't support paying ransoms. It encourages groups to come back. As we've seen, it funds further crime. In the case of irreplaceable medical data, it can be hard to stick to that principle. But paying a premium because the attackers promise to delete the data is dumb. You cannot trust them to do that. Paying it to get access again to critical life saving or research on medical information to avoid negative impact on patient health okay, paying so you can check a box in a civil lawsuit? Potential defense isn't worth it Staying with Healthcare Another US State suffered a far more impactful healthcare ransomware attack on February 20, the University of Mississippi Medical center, one of the largest healthcare providers in Mississippi, had a ransomware attack. It forced UMMC to close all of its clinic locations statewide after the ransomware took down key IT systems, including access to its EPIC electronic medical records platform. The scale of disruption was massive. UMMC operates seven hospitals, 35 clinics and more than 200 telehealth sites. While hospital services have continued using downtime procedures, outpatient surgeries, imaging appointments and clinics have all been canceled indefinitely. UMMC activated its emergency operations plan and reported working closely with the FBI, Department of Homeland Security and CISA to investigate the attack. Officials have confirmed that they're in communications with the ransomware group responsible, though no group has publicly claimed responsibility, likely because they're still negotiating. Here's what's concerning about this attack. It's not just about patient data theft. It impacted the availability of healthcare services. The incident highlights a troubling trend. Hospitals and healthcare facilities are being hit harder and more frequently by ransomware. In the post pandemic era, these organizations are uniquely vulnerable due to their reliance on IT systems for patient care and the need to comply with strict healthcare privacy regulations for healthcare and research institutions. Cybersecurity cannot be an afterthought, but it still is. And the reality of the healthcare funding crisis impacting systems around the world tells us why that is. With rural and small hospitals closing in the US with Canadian provincial public healthcare systems drowning post pandemic, and it's not surprising we're seeing a continued lack of investment in information technology, resiliency and security in healthcare. It's a symptom of a bigger problem, and it's everyday people who continue to pay the price. And with war raging in the Middle east and cyber a key part of the conflict, US Hospitals and healthcare organizations are more at risk than ever. And Washington, or if you're in Canada, Ottawa, they're not coming to the rescue. Our last story brings us once more back to the current Middle east war. Since February 28, when the United States and Israel launched strikes on Iran, attacks on GPS and other navigation systems have spiked, creating a dangerous situation for shipping in the Middle East. The Strait of Hormuz, a critical chokepoint for the global oil trade, has become a hotspot for cyber and electronic warfare. A new analysis from maritime intelligence firm Windward reports that more than 1,100 ships in the Gulf region have experienced disruptions to their GPS or automatic identification systems communications since the outbreak of hostilities. These attacks are coming in two primary forms, jamming, which blocks satellite signals entirely, and spoofing, which creates false signals to mislead navigation systems. In this case, many ships were made to appear as though they were inland, some even at airports or a nuclear power plant. These disruptions weren't just annoying, they're dangerous. Imagine a supertanker running off course, colliding with other vessels, or running aground in one of the busiest shipping lanes in the world. The potential for accidents, oil spills, or worse, loss of human life is immense. Windward's analysis also found these attacks are escalating. Since February 28th, they'd identified 21 new clusters of GPS interference across waters near Iran, UAE, Qatar and Oman. The Joint Maritime Information center has issued a critical warning describing both physical and electronic attacks on ships as, quote, almost certain. Here's the bigger picture. GPS and navigation systems interference is becoming a hallmark of modern conflict. We've seen it in Ukraine, Gaza, and now the broader Middle east war. These tactics aren't just disrupting ships, they're affecting air travel too. Six new spoofing signatures have been detected in the region, impacting hundreds of flights before air travel was largely grounded. So what does this mean for the global economy and for cybersecurity? For one, it highlights the vulnerabilities in our navigation infrastructure. GPS and AIs systems were not designed for these kinds of threats, and now they're being exploited to destabilize critical industries like shipping. For companies operating in these high risk regions, it's time to reassess the resilience of your navigation systems. Are they equipped to handle jamming or spoofing? Do you have contingency plans in place? Are your sailors trained to use old school navigation methods when computers don't work? And for governments, this is yet another wake up call to secure critical infrastructure against the growing threat of electronic and cyber warfare. That's Cybersecurity today for Wednesday, March 4, 2026. Thanks for listening and thank you for your continued support. I've been your host, David Shipley, Jim Love will be back on the news desk on Friday.