For hackers, sharing is caring.

Summary

CYBERWIRE DAILY
Episode: For hackers, sharing is caring.
Host: Dave Bittner, N2K Networks
Date: July 16, 2026

---

Episode Overview

This episode of CyberWire Daily delivers the latest in cybersecurity news, from urgent warnings on active SharePoint exploits to novel ransomware operations. A centerpiece of the episode is an interview with Ryan Kalember, Chief Strategy Officer at Proofpoint, who discusses how agentic AI is creating a new class of insider threats. The episode wraps with a cautionary tale of ticketing scams targeting Celine Dion fans.

---

Key Discussion Points & Insights

1. CISA’s Urgent Warning: SharePoint Exploits

[00:38]

• The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning organizations to urgently secure on-premises Microsoft SharePoint servers due to active exploitation of three vulnerabilities.
  • Admins are urged to apply updates, follow incident response and mitigation guidance, hunt for IOCs, and rotate machine keys.
  • Experts highlight that a compromised SharePoint server opens pathways to critical internal resources, increasing risks of ransomware and large-scale data compromise.

2. NSA Promotes Coordinated Vulnerability Disclosure (CVD)

[02:39]

• The NSA, with CISA and international counterparts, released new guidance for tech suppliers to launch or enhance CVD programs.
  • Recommendations include clear policies, inclusive processes, broad scopes for testing, and the use of third-party intermediaries.
  • Regular reviews and updates are encouraged to match evolving threats and best practices.

3. New Threats: ClickLock Stealer, Spirals Ransomware, Labubarat RAT

• ClickLock Stealer (macOS malware):
  • Relies on social engineering over exploits; targets via fake Cloudflare pages and malicious terminal commands.
  • Exfiltrates browser data, crypto wallets, passwords, and more via Telegram bots, bypassing macOS defenses.
• Spirals Ransomware:
  • New operation identified by Symantec—executes full attack (compromise to exfiltration and encryption) in under 24 hours.
  • Uses double extortion schemes and disables security software.
• Labubarat RAT:
  • Undocumented Rust-based remote access trojan masquerades as Nvidia software, supports command execution, data exfiltration, and communicates via multiple covert channels.
  • Described as a reusable access framework, not a one-off tool.

4. 23andMe Breach Settlement

[10:00]

• 42 state attorneys general reach $18 million settlement over 23andMe’s 2023 breach (affected 6.9 million customers).
• Criticism includes lack of defense against credential attacks, poor monitoring, and downplaying the breach's seriousness.
• The settlement mandates ongoing consumer rights (data deletion), security assessments, and independent oversight.

5. Data Center Heist: Lessons in Physical Security

[11:24]

• New York Times Magazine reports on a 2007 London Verizon data center heist by criminal Terry Ellis.
  • The team posed as police, subdued guards, and stole 80 servers in under an hour.
  • The episode underscores increasing threats to the physical (not just digital) security of data centers.

---

FEATURE INTERVIEW: Agentic AI as a New Insider Threat

Guest: Ryan Kalember, Chief Strategy Officer, Proofpoint
[15:12 – 26:15]

Framing the Problem

• Insider risk is foundational:

  “Insider risk, I believe, is one of the more foundational problems in information security, even going back farther than cybersecurity.” – Ryan Kalember [15:15]

• Agentic AI (software agents capable of autonomous action) presents related but heightened risks—these agents often have broad data access and operate with fewer guardrails than humans.

What Is ‘Agentic AI’?

“I would say everything from a coding agent, Claude code certainly counts in this, as well as autonomously constructed agents… Those are all under the umbrella of agentic AI.” – Ryan Kalember [16:06]

• This encompasses autonomous coding bots to LLM-driven personal assistants acting via users’ cloud accounts.

Real-World Risk Scenarios

Unintentional Risk Creation by Agents:

• Agents running code they “probably shouldn't,” e.g., installing risky VS Code extensions at the behest of North Korean actors.
• Agents seeking and importing open-source code without adequate vetting—risks especially pronounced when an agent is tasked with building secure software it does not know how to write.

Data Handling Issues:

• AI agents can access and process massive amounts of data—far exceeding what any human can do—exacerbating the classic “least privilege” problem.

“Agents can look at much more data and they often do so in ways that… are much, much more expansive than any human could do.” – Ryan Kalember [18:18]

Redefining ‘Trust’ in the Age of AI

• Unlike humans, AI agents lack judgment, context, and accountability.
• Properly attributing actions to agents (agentic identity) is an unsolved problem.

“Even in the human world, this is hard. We have more non-human identities in enterprises right now than we have human identities. But it is still very, very difficult to attribute activity back to an identity…” – Ryan Kalember [19:48]

• Most users don’t specify clear instructions or set robust access controls for AI agents.

Adjusting Insider Threat Programs for AI

• Most organizations still have only rudimentary insider threat capabilities.
• Traditional reactive models (incident reconstruction after HR/legal alerts) may break down with AI agents due to the volume and speed of possible actions.
• New proactive, privacy-preserving approaches are emerging—e.g., AI “risk investigator agents” that review both agent and human behavior, producing anonymized dossiers.

“Agents are incredibly good at doing these insider investigations… And they can do so in a way that is privacy preserving.” – Ryan Kalember [23:39]

• Key difference vs. traditional insiders: AI agents won’t yet “leave for a competitor,” but can still cause mass data exposure nearly instantly—making classic anomaly detection less effective.

Notable Quotes & Memorable Moments

• On the breadth of agentic AI risk:

  “It's like the old Homer Simpson quote about beer, right? It's the cause of and solution to all life's problems. I think that's where we are with AI right now.” – Ryan Kalember [25:55]

• Host’s humorous wrap:

  “It's AI all the way down.” – Dave Bittner [26:08]
  “Exactly.” – Ryan Kalember [26:12]

---

Cyber Scam Spotlight: Celine Dion Ticket Fraud

[26:52]

• Group-IB finds scammers selling fake Celine Dion concert tickets via Facebook and counterfeit websites.
  • Victims get what looks like authentic Ticketmaster tickets with QR codes—only the first scanned works; subsequent buyers are out of luck.
  • More than 20 phishing domains discovered, many running on Shopify.

“If the deal seems too good to be true, don't let your heart go on. You may find yourself singing the blues outside the arena instead of inside.” – Dave Bittner [28:55]

---

Timestamps for Key Segments

• [00:38] — CISA SharePoint attacks & NSA CVD guidance
• [03:30] — macOS “ClickLock Stealer” overview
• [04:45] — Spirals Ransomware attack timeline
• [06:50] — Windows evasion techniques & Labubarat RAT
• [09:40] — 23andMe data breach settlement
• [11:24] — Verizon data center physical heist
• [15:12–26:15] — Interview: Ryan Kalember on Agentic AI & Insider Threats
• [26:52] — Celine Dion ticket scams and practical advice

---

Summary

This episode paints a dynamic picture of the cybersecurity landscape, with urgent new threats demanding both technical and organizational adaptation. The deep-dive interview with Ryan Kalember underscores agentic AI's potential to both aggravate and help solve insider threats, highlighting the urgent need for new trust paradigms and investigative approaches. Finally, the episode closes on a reminder that threats aren’t limited to servers and code—social engineering and fraud remain persistent risks for businesses and the public alike.

Transcript

[Ryan Kalember]

You're listening to the Cyberwire Network powered by N2K.

[Sponsor Announcer]

This episode is brought to you by Google Chrome. You think you know a browser, but Gemini and Chrome? That's new. It can help you with practically anything on the web, like restoring a vintage motorcycle from a 50 page restoration block. Or finally break down that long article you've had open for weeks. Gemini and Chrome is here for it, ready to make anything online make sense. There's no place like Chrome. Check Responses Setup required compatibility and availability various 18/.

[Dave Bittner]

This episode is supported by Black Hat usa. If you follow the research you know a lot of it breaks on Black Hat stages hundreds of peer reviewed briefings, more than 100 hands on trainings, and the largest business hall in Black Hat's history. Six days to learn the skills you'll need tomorrow, August 1st through the 6th, use code CYBERWIRE for $200 off your briefings [e-mail] we'll see you in Vegas. CISA warns of active SharePoint attacks the NSA pushes coordinated vulnerability disclosure Click Lock Stealer targets macOS Splunk and Zoom Patch Critical flaws spirals Ransomware strikes in under 24 hours, new windows evasion techniques emerge Labubarat poses as Nvidia Software 23andMe settles over its 2023 breach. Plus a look back at one of the most audacious data center heists ever pulled off. Our guest is Ryan Kalember, Chief Strategy Officer at proofpoint, discussing why Agentic A is creating a new insider threat. And near far Wherever you are, the scam must go on. It's Thursday, july 16, 2026. I'm dave bittner and this is your cyberwire intel brief. Thanks for joining us here today. It's great as always to have you with us. CISA is urging organizations to immediately secure on premises Microsoft SharePoint servers after confirming that three vulnerabilities are being actively exploited. Administrators are advised to apply Microsoft security updates, follow mitigation and incident response guidance, hunt for indicators of compromise and rotate sharepoint machine keys where appropriate, as patching alone may not remove attacker persistence. Microsoft also recommends enabling anti malware scan interface integration to help detect malicious activity. Security experts warn that organizations should treat the advisory as more than a routine patching exercise, noting that a compromised SharePoint server can provide attackers with a pathway to critical systems, increasing the risk of ransomware, widespread network compromise and data disclosure. The National Security Agency, in partnership with cisa, Japan's JPCERTCC and the Netherlands ncscnl, has released new guidance encouraging technology suppliers to establish coordinated vulnerability disclosure programs that promote collaboration with security researchers. The guidance recommends publishing a clear vulnerability disclosure policy, maintaining an open and inclusive reporting process, and defining a broad scope for security testing. It also highlights the value of third party intermediaries so, such as national incident response teams in coordinating disclosures and facilitating communication between researchers and vendors. Officials say robust CVD programs help organizations identify and remediate vulnerabilities more effectively, strengthen customer trust and improve overall security. The agencies also encourage suppliers to regularly review and update their disclosure programs to keep pace with evolving cyber threats and industry best practices. Researchers at Group IB have identified Click Lock Stealer, a new macOS malware that relies on social engineering rather than software exploits to steal sensitive data. First observed in early June, the malware has reportedly targeted more than 100 users across 33 countries, primarily in Europe. Victims are lured to fake Cloudflare verification pages that instruct them to manually execute a malicious terminal command. Once launched, the malware steals browser data, cryptocurrency wallets, password manager information, macOS keychain contents, FTP credentials and shell history before exfiltrating the data through a Telegram bot to defeat macOS security protections. Click Lock Stealer repeatedly terminates processes, suppresses security notific and displays convincing password prompts, coercing users into granting the access needed to harvest protected credentials while maintaining a persistent backdoor on infected systems. Splunk and Zoom have released security updates addressing multiple vulnerabilities across their products, including several critical and high severity flaws. Splunk patched three product specific issues that could enable command safeguard bypass path traversal, credential exposure and unauthorized file rights, alongside fixes for vulnerabilities in third party components such as Open SSL and Golang. Zoom resolved four Windows vulnerabilities, including a critical flaw that could allow remote unauthenticated account takeover and three high severity privilege escalation and race condition issues. Neither company has reported evidence that the vulnerabilities are being actively exploited. Researchers at Symantec have identified a new ransomware operation called Spirals that completed a full attack from initial compromise to data theft and encryption in less than 24 hours. The June intrusion targeted a South Asian IT services firm after attackers compromised an Internet facing IIS server and rapidly established persistence, harvested credentials and moved laterally across the network. The attackers disabled Microsoft Defender, attempted to remove security software and stopped backup database and virtualization services before deploying a rust based ransomware payload disguised as bits admin exe. Stolen data was used to support a double extortion scheme, with victims threatened with public disclosure if they failed to pay within six days. Symantec has published Indicators of Compromise to help organizations defect and defend against the emerging threat. Bitdefender Labs has documented three new attack techniques that abuse Windows legitimate bind filter file system virtualization feature to evade security tools after attackers gain local administrator privileges. Dubbed file binding, process binding, and silo binding, the techniques can redirect trusted file paths to malicious content, disguise malicious processes as legitimate applications, and present different file system views to security tools and running processes. According to bitdefender, these methods can undermine endpoint detection and response products, applocker, Windows Firewall, amsi, Sysmon, and forensic tools by exploiting assumptions that file paths reliably identify executable content. Microsoft assessed the issue as low severity because it requires administrator access, but Bitdefender argues the techniques represent a significant post compromise threat similar to bring your own vulnerable driver attacks, and has published detection guidance for defenders. Blackpoint Cyber's Adversary Pursuit Group has identified a previously undocumented Rust based remote access trojan dubbed labubarat, which masquerades as legitimate Nvidia software to evade detection. The malware uses fake Nvidia metadata and artifacts while providing attackers with persistent remote access to compromised Windows systems. Researchers found that Labubarat supports command execution, PowerShell and JavaScript execution, screenshot capture, file transfers, archive management, Socks 5 proxying, and optional user level persistence. The malware communicates through multiple channels, including HTTPs polling, WebView2 and DNS tunneling, allowing operators to maintain access even if one communication method is blocked. Blackpoint says the malware appears to function as a reusable access framework rather than a one off payload with configurable settings for organizations, groups, servers and API keys managed through associated command and control infrastructure. A coalition of 42 state attorneys general has reached an $18 million settlement with 23andMe over cybersecurity failures that led to a 2023 data breach affecting 6.9 million customers. The breach exposed sensitive personal information, including genetic ancestry data, and investigators found the company lacked protections against credential based attacks, failed to monitor for suspicious activity, and did not address known security vulnerabilities. Attorneys general also criticized 23andMe for initially denying the breach and blaming customers password practices. The settlement requires the 23andMe Research Institute, which acquired the company's assets following its 2025 bankruptcy, to implement stronger security measures, conduct regular risk assessments, establish independent security oversight, and preserve customers ongoing rights to delete their personal data and destroy genetic samples. The institute has pledged to maintain 23andMe's existing privacy policies Governing Customer Data

[Commercial Announcer]

A

[Dave Bittner]

lengthy feature in the New York Times magazine recounts the 2007 theft of roughly 80 servers from a Verizon data center in London orchestrated by career criminal Terry Ellis. Hired through an intermediary who claimed the servers contained sensitive banking records, Ellis assembled a team of thieves and computer technicians to execute the highly planned operation. Disguised as police officers responding to a rooftop emergency, they subdued security guards, removed the targeted servers, and escaped in under an hour. The article uses the heist to explore the growing importance of data centers as repositories of the world's most valuable digital assets and argues their physical security often receives less attention than cybersecurity. Although Ellis was eventually arrested and imprisoned, the incident highlighted the risks of physical attacks on critical infrastructure and underscored how concentrated stores of sensitive data remain attractive targets for determined criminals. Coming up after the break, my conversation with Ryan Calomber, Chief strategy Officer at proofpoint. We're discussing agentic AI and insider threats and near Far Wherever you are, the scam must go on. Stay with us.

[Commercial Announcer]

Right now get up to 15% off select storage solutions put heavy duty HDX totes to good use, protecting what's important to you. The solid impact resistant design prevents cracking and the clear base and sides make items easy to find even when the totes are stacked. Find select shelving and tote storage up to 15% off at the Home Depot to organize each other every room in your home from your garage to your attic, visit home depot.com how doers get more done.

[Dave Bittner]

What's the one thing in business that's spreading as fast as AI? AI risk Every new tool your team signs up for, every vendor that turns on AI features, every new integration, each one is another opportunity for something to go wrong. And most security programs weren't built to keep up with AI's pace of growth. Enter Vanta. Vanta is the number one agentic trust platform trusted by more than 16,000 fast moving companies like Ramp, Purser and Harvey to help them stay audit ready. And now Vanta helps companies like yours keep an eye on the risks that appear between audits across your vendors, your AI tools and your entire environment. The Vanta agent works like a 24.7grc engineer. In the background it finds, issues, drafts, fixes for you and can cut vendor assessment time by up to 50%. Whether you're a fast growing startup or a global enterprise, Vanta is here to help you automate your security and compliance and earn and prove trust. Get started [e-mail] cyber that's V A N T A dot com cyber. Ryan Kalimber is Chief Strategy Officer at proofpoint. We recently got together to discuss why agentic AI is creating a new insider threat.

[Ryan Kalember]

I'm tempted to go really far back because insider risk, I believe, is one of the more foundational problems in information security, even going back farther than cybersecurity. When you give someone or something that can act like someone access to sensitive data, you have to have a lot of trust in them to actually handle it appropriately, or you have to have some really strong safeguards around that. As AI agents have become more and more capable and dare I say it, more and more humans in their capabilities, and we've entrusted them with more and more data, asked them to do more and more things, a lot of the same risks that we had historically dealt with when it comes to people who are insiders creating risk have now transferred very elegantly over to agents effectively doing the same things.

[Dave Bittner]

So to kind of level set for us, when you say agentic AI, what do you put under that umbrella?

[Ryan Kalember]

Really good question. I think the word agent is one of the more front words in general in the discourse right now. I would say everything from a coding agent, Claude code certainly counts in this, as well as autonomously constructed agents that might be running in containers through to, I think what most people are doing, which is running agents themselves effectively, using their own identities, using something like cloud, cowork. Those are all under the umbrella of agentic AI.

[Dave Bittner]

Now, can you walk us through a realistic example of how an AI agent, let's say acting with good intentions, could accidentally create a security problem?

[Ryan Kalember]

Sure, maybe. I'll give you two. And we really see two primary ones right now, just from a categorizing perspective. The first is that agents can run code that they probably shouldn't. In fact, we published some great threat research on a dprk, that is to say North Korean threat actor, basically tricking people into getting their coding agents to install malicious extensions to VS Code and Cursor, which are two of the more common agentic coding platforms out there. When it comes to doing that autonomously, though, we have definitely seen coding agents, when given a task like, hey, I'm really interested in writing a secure application. Do you know how to write code in Rust? Maybe it doesn't. So it'll go out to the Internet, look at something that might have a lot of stars on GitHub and go acquire the ability to do that. Now, there are lots of technical ways that that can happen. Skills have become one of the more common ones, but agents are perfectly capable if you give them the ability to basically go out, find code on the Internet and start running it. So we do see that as kind of one of the primary categories of introduced risk right now. Second category is more around data handling. And this is a lot like what we see with humans, right? When people are curious about things or are given a task that might put them in contact with sensitive data, they don't always handle it perfectly and they sometimes exceed the scope of what they were supposed to be doing. Agents are very, very tough to give only the access they need to in terms of data. This is the least privileged problem that has actually been with us in concept since the 70s in InfoSec Sec. We've never really figured out how to give people the data that they need to do their jobs and nothing more. And now that is a compounded problem because agents can look at much more data and they often do so in ways that they one, will not forget. And two, are much, much more expansive than any human could do. A human can look at a few files a day, maybe a couple dozen, a few hundred. If you're incredibly diligent. Agents can look at thousands, tens of thousands, hundreds of thousands, maybe millions, depending on what those files are. So that data exposure can also teach them things that are truly secret that they shouldn't have access to to do their jobs and make them a vector for data loss in all kinds of ways,

[Commercial Announcer]

really.

[Dave Bittner]

You bring up what I think is a fascinating aspect of all of this, which is the notion of trust and how we use that word, because I think in a human context we talk about things like judgment and accountability and even context. But as you, as you say, AI agents don't necessarily have those same qualities, do we as security teams? Do we need to be rethinking how we define trust, how we casually throw that word around.

[Ryan Kalember]

I think we do. And this actually goes to one of the hardest and most unsolved problems here, which is agentic identity. Even in the human world, this is hard. We have more non human identities and enterprises right now than we have human identities. But it is still very, very difficult to attribute activity back to an identity and then make sure that identity has the proper set of permissions so that you can be as far left as possible, as preventative as possible in terms of taking care of your sensitive data. Agents don't really have a great framework for doing that right now. So when you're trusting them, you're trusting them usually on the level of whatever that individual who is directing the agent because really that is a more common use case than fully autonomous agents right now. And the users themselves don't always give great instructions to the agents. And they are goal seeking and people pleasing. They have been built to be that way. So yes, it's totally possible to build an agent with a detailed system prompt, very much like sort of the Constitution that Claude itself uses. And you can be very, very diligent about that. However, at the same time, we're pushing people to adopt AI really fast, adopt it in ways that they haven't really done before. And very, very few people are going to be diligent enough about their information handling practices to do things like very, very specifically instruct an agent on how to, to actually honor the trust that they're giving it. That's just a very, very difficult and very tricky problem to not only do from an infosec perspective, but even from an end user perspective right now. And that's why building real time guardrails and those sorts of things has become sort of a measure of last resort from at least a technical perspective. But that approach has pros and cons

[Dave Bittner]

as well, let's say. I'm a security professional and I feel as though I'm pretty up to speed on what we would consider to be traditional insider threat programs. What kind of adjustments do I need to make to the way that I think about this, the way I approach this? Now that we're faced with AI agents,

[Ryan Kalember]

I think this is actually maybe the key question, because I would argue that a lot of security teams have not gotten to that theoretical point where they feel good about insider risk. Those that have are way ahead of the game here. But even when you look at a really sophisticated organization with a big cybersecurity team, it's honestly a bit rare for them to have dedicated resources, technologies, humans, processes for insider risk. It's a tough problem. As an analogy, right, if you're in a police department and you're working in internal affairs, you're probably not the most popular person, right? It's a, it's a tough job to do for all sorts of different reasons. And historically it's actually brought up lots of fairly legitimate privacy concerns as well. And that is sort of doubly or even trebly true for organizations that operate globally. So what I would actually say is we are in a really interesting place from an insider risk perspective, oddly enough, both because of agents and now because we have agents. One of the things that we've had the most success with from an insider risk perspective is transforming telemetry which most insider risk teams, even when there were dedicated resources, looked at in a purely reactive context, meaning HR or legal, told you there's an issue with a person, maybe they're leaving and joining a competitor, something along those lines, and you needed to go reconstruct their activity and make sure that none of your crown jewels went out the building. That's the sort of thing that, you know, you hope that you have all that telemetry and you have it in a good place and you can do a proper sort of analysis of it. And obviously in our work at Proofpoint, we try and make that as easy as possible, but we were still very dependent on humans to do that investigation. There were only limited sorts of early warning signs that you could do to maybe make things a little bit more proactive. The part that really is changing right now, and this is maybe the one thing I would want to leave everybody with, is agents are incredibly good at doing these insider investigations. And they can do so in a way that is not just kind of simple pattern matching. Although if they're built on top of language models, they tend to be great at that. They can also do so in a way that is privacy preserving. So we have actually organizations that are both looking at their humans and their agents solely through the lens of AI investigators, call them risk investigator agents. And they basically put together dossiers and the dossiers don't have any names on them. Obviously, when there's an agent, that's not a privacy problem. So of course you can name the agent. But the security teams actually, when it comes to a human creating insider risk, are usually looking to get that problem off their desk as quickly as possible back in the hands of HR and legal, who can actually do something about it. On the agent side, it has actually been useful to train on certain aspects of how humans create insider risk. But there are two big differences. One is that the biggest risk for humans tends to be leaving and going to a competitor and taking a lot of data with you. That has been there since the dawn of cybersecurity. And agents won't really do that. At least they won't do that now. The agents that I build hopefully will not go work for our competitors anytime soon. And the second piece is that we did used to rely pretty heavily on anomaly detections for unusual activity for people like, hey, you looked at 20 files every day last week, now you're looking at 200,000 and you're putting them in zips or something. That doesn't really work for agents. So agents because they're able to access and manipulate so much more data so quickly and do it 24 by 7. So even things like after hour detections kind of decline in utility, we do have to change a little bit about how we think about it. But the nice thing about it is we have agents now to do a lot of that work for us. So it's like the old Homer Simpson quote about beer, right? It's the cause of and solution to all life's problems. I think that's where we are with AI right now. Yeah.

[Commercial Announcer]

Yeah.

[Dave Bittner]

It's like, what is it like the Turtles? It's AI all the way down.

[Ryan Kalember]

Exactly.

[Dave Bittner]

That's Ryan Calimber from Proofpoint

[Ryan Kalember]

sa.

[Dave Bittner]

And finally, Celine Dion's long awaited Return to Paris has created another sold out performance, just not the one fans expected. According to Group ib, scammers are targeting eager concertgoers through Facebook and convincing fake ticket and convincing fake ticket websites, turning excitement into an encore of fraud. The scheme is particularly clever. Victims receive what appears to be a legitimate Ticketmaster ticket, complete with a valid transfer and QR code, only to discover that the same ticket has been sold to multiple buyers. The first person through the gate enjoys the show while everyone else gets an expensive lesson in ticket validation. Researchers also uncovered more than 20 phishing domains impersonating Ticketmaster AXS, the venue and Celine Dion's official site, many built with Shopify to mimic authentic checkout pages. Group IB advises fans to buy only through authorized sellers, avoid direct bank transfers, and verify that payment details match the seller's identity before hitting the high note on a purchase. If the deal seems too good to be true, don't let your heart go on. You may find yourself singing the blues outside the arena instead of inside. And for sure, that would be a sinking feeling of titanic proportions. My heart will go under. And that's the Cyber Wire. For links to all of today's stories, check out our daily [e-mail] we'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to cyberwire2k.com N2K's lead producer is Liz Stokes. We're mixed by Trey Hester with original music and sound design by Elliot Peltzman. Our contributing host is Maria Vermazes. Our executive producer is Jennifer Ibin. Peter Kilpe is our publisher and I'm Dave Bittner. Thanks for listening. We'll see you back here tomorrow.

[Sponsor Announcer]

Foreign.

[Dave Bittner]

Heading to this year's Black Hat USA, the N2K CyberWire team will be on site recording from our podcast studio in the Spectrops Kennel Club. If you're interested in joining us for a conversation or learning more about what we're recording throughout the week, visit sponsor TheCyberWire.com for more information. And make sure you stop by the studio and meet the N2K CyberWire team. We'll see you there.