Loading summary
Transcript22 lines
- [00:02]
Maria Varmazis
You're listening to the Cyberwire Network powered by N2K. Do you know how the space and cybersecurity domains connect? T minus Space Cyber Briefing is your guide through the space based systems that expand the attack surface. I'm Maria Varmazis host here at N2K CyberWire and I'm excited to share that T minus is back now as a weekly podcast, the T Minus Space Cyber Briefing. We have a new dedicated focus on two great things that are even better together. Space and cybersecurity. Because whether we realize it or not, we all depend on space based systems that are, by the way, increasingly Internet enabled. We're talking cybersecurity technologies, policies and organizations that are securing the critical space based infrastructure that powers, protects and connects our lives here on Earth. So join me for T Minus Space Cyber Briefing. New episodes every Sunday.
- [01:13]
Dave Bittner
Most environments trust far more than they should, and attackers know it. ThreatLocker solves that by enforcing default deny at the point of execution. With Threat Locker allow listing, you stop unknown executables cold. With ring fencing, you control how trusted applications behave. And with threatlocker DAC defense against configurations, you get real assurance that your environment is free of misconfigurations and clear visibility into whether you meet compliance standards. ThreatLocker is the simplest way to enforce zero trust principles without the operational pain. It's powerful protection that gives CISOs real visibility, real control and real peace of mind. ThreatLocker makes zero trust attainable even for small security teams. See why thousands of organizations choose Threat Locker to minimize alert fatigue, stop ransomware at the source and regain control over their environments. Schedule your demo@threatlocker.com N2K today. Asthma malware meddles with Microsoft SAP fixes critical flaws, Google patches and exploited Chrome Zero day canister worm spreads through npm. Mac users face a new malvertising threat. France investigates a breach of its secure messaging platform, insurers rethink AI risk, the FBI launches a Most Wanted fraudsters list and a US citizen admits to spying for China. Our guest is Steve Steve Winterfeld, Advisory CISO from Akamai, discussing how AI powered bots are driving financial services attacks and unpacking a million dollar hotel fee. It's Tuesday, June 9, 2020 26. I'm Dave Bittner and this is your Cyberwire Intel Briefing. Thanks for joining us here today. It's great as always to have you with us. Late last week, attackers compromised dozens of cryptographically verified open source packages linked to Microsoft, inserting sophisticated credential stealing malware that activated when developers opened the packages in AI coding tools such as Claude Code, Gemini, CLI, Cursor, and VS Code. Researchers identified 73 malicious packages before GitHub removed them, initially citing only a terms of service violation rather than explicitly warning users of compromise. The incident marks the second major software supply chain breach involving a Microsoft repository account in two months. The malware, known as Miasma and linked to the threat actor Team PCP steals credentials from cloud platforms including aws, Azure and Google Cloud, along with Kubernetes, environments, password managers and numerous developer tools. It can also spread laterally across cloud infrastructures and developer systems. Researchers say the attackers abused legitimate Microsoft publishing credentials and OpenID Connect tokens to create packages with valid cryptographic provenance, allowing them to appear trustworthy and evade traditional security checks. Miasma further complicates detection by generating unique encrypted payloads for each infection. Security experts warn that anyone who interacted with the affected packages should assume credential compromise and and immediately investigate their systems and cloud environments. SAP's June 2026 Patch Day addresses 15 security issues, including four critical vulnerabilities affecting Netweaver, ABAP, Platform, Commerce, Cloud and DataHub. The most severe is an XML signature wrapping flaw that could allow authenticated attackers to tamper with identity information and and gain unauthorized access to sensitive data. Other critical fixes address memory corruption, HTTP header handling, weaknesses tied to spring security and a directory traversal flaw enabling unauthenticated access to sensitive files or denial of service conditions. SAP also patched multiple high severity vulnerabilities, including Apache tomcat flaws and and authorization issues. Google has released emergency updates to fix a zero day vulnerability in Chrome's V8 JavaScript engine that is already being exploited in the wild. The flaw involves an out of bounds memory access issue, which can potentially lead to application crashes, privilege escalation or remote code execution. Google confirmed active exploitation but has not disclosed technical details about the attacks. This is the fifth Chrome zero day known to have been exploited in the wild and patched by Google so far in 2026. Researchers at PICUS analyze Canister Worm, a self propagating malware campaign linked to Team PCP that emerged in March 2026 after attackers compromised Aqua Security's Trivi vulnerability scanner and stole NPM publishing credentials using those credentials. The attackers infected more than 60 npm packages within a day, targeting developers who installed packages from several affected namespaces. The malware operates in three stages a Node JS post install dropper, a stealthy Python backdoor and a worm component that harvests NPM tokens, and republishes compromised packages. It steals cloud SSH, Kubernetes, GitHub and CICD credentials, establishes persistence, and can hijack GitHub actions. Secrets researchers warn that developers using affected packages or compromised Trivi releases should assume credential exposure, rotate secrets and audit systems and package repositories for unauthorized changes. Researchers at Palo Alto Networks Unit 42 have uncovered operation Flutter Bridge, a large scale malvertising campaign targeting Mac users since late 2025. The operation, linked to the cybercrime group CLCRI 1089, uses fake Google search ads purchased through shell companies to distribute Trojanized applications disguised as podcast players and PDF tools. The malware, called fluttershell, functions as a backdoor capable of executing commands, accessing files, and stealing system information. It can hijack Chrome browser settings, redirect users through attacker controlled websites, and silently exfiltrate uploaded documents through fake AI powered features. Researchers observed multiple evolving versions of the malware, suggesting active development. The campaign evaded detection by using legitimate developer signatures and fake business entities to obtain verified advertising accounts. Although Google has suspended the identified advertiser accounts, researchers warn that the threat actors rapidly launch new variants indicating the operation remains active and ongoing. France's Digital Affairs Directorate Dynam, has disclosed a breach of tchap, the French government's encrypted messaging platform, after attackers gained access through a compromised user account. The incident was detected by ansi, France's cybersecurity agency, which said the malicious account was quickly blocked. While investigators assess what data may have been accessed or exfiltrated, tchap, built on the Matrix protocol and used by more than 300,000 monthly users across the French public sector, may have exposed information shared in public chat rooms, which are not end to end. Encrypted. A threat actor claimed the breach resulted from a social engineering attack and alleged access to hundreds of thousands of messages, account details and shared files. Dynam has notified France's Data Protection Authority and warned users against sharing sensitive information in public channels while the investigation continues. As AI adoption accelerates, insurers are increasingly adding exclusions to liability policies to limit coverage for AI related lawsuits and regulatory actions. The shift comes as businesses face growing legal exposure from claims involving copyright infringement, privacy violations, antitrust concerns, algorithmic bias, and alleged misrepresentations about AI capabilities. Some insurers have introduced broad exclusions that seek to deny coverage for claims arising from AI development, deployment disclosures or compliance obligations. However, legal experts note that courts often interpret exclusions narrowly and may still require insurers to defend claims containing both AI related and non AI allegations. Policyholders may also challenge overly broad exclusions if they effectively eliminate coverage for core business operations, creating illusory insurance. Experts advise organizations to carefully review policy language, negotiate narrower exclusions where possible, and evaluate older policies issued before AI specific exclusions became common as they may provide broader coverage for current AI related claims. The FBI has launched a new Most Wanted Fraudsters list to publicly identify and help capture individuals accused of major fraud schemes who have evaded arrest. The initiative is part of a broader federal anti fraud effort established by a March 2026 executive order creating the Task Force to Eliminate Fraud, chaired by Vice President J.D. vance. The FBI says the listed suspects are charged with causing significant financial harm to victims and communities. The Bureau is encouraging the public to submit tips anonymously through its website, hotline or local field office to assist in locating and apprehending the fugitives. Thomas Weir Paukin II, a 50 year old US citizen, has pleaded guilty to acting as an agent for China and helping collect sensitive US Information. According to court documents, Paucan worked with individuals he believed were Chinese intelligence operatives, receiving more than $100,000 and travel expenses in exchange for gathering information and producing reports on US Technology and government matters, the FBI said. He also attempted to infiltrate US Political circles on behalf of China's Ministry of State Security. Han faces up to 10 years in prison with sentencing scheduled for September 1st of this year. Coming up after the break, my conversation with Steve Winterfeld, Advisory CISO from Akamai, discussing how AI powered bots are driving financial services attacks and unpacking a million dollar hotel fee. Stay with us. When it comes to mobile application security, good enough is a risk. A recent Survey shows that 70% of organizations reported at least one mobile application security incident last year and 92% of responders reported threat levels have increased in the past two years. Guard Square delivers the highest level of security for your mobile apps without compromising performance, time to market or user experience. Discover how Guard Square provides industry leading security for your Android and iOS apps at www.guardsquare.com.
- [14:43]
Home Depot Announcer
This Father's Day do more with dad and spend less with low prices guaranteed at the Home Depot. Get him fired up with a new grill and accessories like the next Grill 5 burner for just $299 so you can spend more time together while he becomes the grill master he was always meant to be. Or build memories with of savings on top brand power tools so you can tackle projects side by side, gift more and do more together. This Father's Day with help from the Home Depot. Exclusions apply to homedepot.com pricematch for details.
- [15:18]
Dave Bittner
Steve Winterfeld is advisory CISO at Akamai. I recently caught up with him to discuss how AI powered bots are driving financial services attacks.
- [15:29]
Steve Winterfeld
AI powered bots are really focused on a few things, but we've seen 147% surge in advanced bot activity and in one case staggering 96% of all traffic was identified as malicious. And so this has a couple impacts. One, as a CISO is a cyber threat, but then the CIO is just bandwidth consumption and cost of these things. And so, you know, that first one was a scraping bot. We're also dealing with training bots and fetcher bots and ato, I'm sorry, account takeover or credential stuffing type of bots, hoarding and scalping bots. And these are just the kind of bots that we do research on because it's within our protective infrastructure. And then on the other side is the whole, you know, Turbo Mirai DDoS bot. So, you know, when we talk about all these bots, it is a matter of scale and speed.
- [16:39]
Dave Bittner
How are organizations prioritizing their defenses against these sorts of things?
- [16:46]
Steve Winterfeld
You know, I think there's a lot of difference across industries. Finance and commerce are two of the most heavily hit on the DDoS side because of again, Turbo Mirai and what it's been able to do to the new scales. We've definitely seen on that side. People, as a cso, I got to relook at my risk portfolio. What's the largest attack I could weather and then make sure that I'm meeting the new peaks that I'm seeing or the new records I'm seeing. And then on the other, for me, it's about visibility. I really think the key here is, you know, and this is all coming back to APIs, because that's where a lot of this engagement is happening. And so do I have visibility on my APIs? Do I have, you know, the ability to monitor and mitigate in real time? And that's what we're seeing. Most of my peers and our customers from aamai, our focus on is first of all that visibility and second of all that ability to meet their board's risk appetite.
- [17:54]
Dave Bittner
What does visibility look like these days? What sorts of things can be seen?
- [18:01]
Steve Winterfeld
Well, I mean, the first is for me, discovery, you know, going back to APIs, I've got marketing introducing an API into my infrastructure for analytics. I've got pick a department entering some API. Then I've got developers pushing out new APIs. For most large companies, it's not one platform. I've got APIs in my data center, I've got APIs in the cloud. Can I have one shield in front of all of that or do I have a different shield in front of the cloud than I do in my data center or. Which adds complexity, which I feel is an enemy of security. So I think that first piece is discovery, then the second piece is that integrated view. So I can answer the question to the leadership, what is our current risk in a uniform way?
- [19:02]
Dave Bittner
Well, I mean you mentioned the leadership, the folks sitting on the board. What are the types of conversations that are being had these days? What is the back and forth sound like?
- [19:14]
Steve Winterfeld
So it really depends on whether or not the board feels like their engagement with their customers is web centric. And so for banks, APIs are becoming the engagement level, the new front line. I will tell you we're working on a commerce report right now and our statement is the API is a new storefront and in some cases that's true for a lot of the companies. So in the case where we're seeing more and more engagement with customers move online, then I think the board is having those discussions because the risk is real. The chance of a material impact is much higher than say somebody in manufacturing.
- [20:07]
Dave Bittner
Well, getting back to the report that Akamai recently put out, again, this is the attack trends in financial services. What are some of the other things in this report that caught your eye?
- [20:18]
Steve Winterfeld
So for me, I mean I always want to say, where can I take action as a ciso? I want to know what things that I should be actually thinking about. So like we said, the first is understanding what's hitting our edge, where we engage with our customers. The second was around those denial service attacks and we talked about those layer three and four that infrastructure attacks and those could be bits per second or packets per second. There's also that DNS or queries per second. So we have a section in there that really talks about be careful that your name system or what I call the GPS of the Internet is protected as well. As far as APIs, I'm surprised that 96% of the global respondents of our survey have said they have at least one incident in the last 12 months. Now again, that's an incident, not necessarily a major crisis, but it is just showing that APIs and in many cases large language models, genai, are really becoming the way we interact with our customers and our clients. And so I think those were not earth shattering but certainly, you know, real. The last part is more and more we're talking about agentic AI. So large language model is answering a question. Agentic AI is making a decision and we really tried to put out the new MITRE tool around the top 10 for Agentic AI framework as a way for CISOs to look and understand about how to protect around those. And again this is all tied back to things we're doing.
- [22:11]
Dave Bittner
To what degree do you think the financial sector is meeting this challenge?
- [22:18]
Steve Winterfeld
So I mean you say the financial sector and we're protecting globally. And so I think really some of the more aggressive attacks are tied to GEO conflicts. So some of the wars are causing financial institutions to get attacked based on state sponsored cyber criminals that are now becoming hacktivist. And so I would say that's probably one of the biggest banks are almost collateral damage to these larger conflicts. And that's been a trend we've seen for a while now. And so they are doing a good job of making sure that while attacks are growing, the impacts are not huge. The other is just around how dynamic this is and looking at all the compliance requirements, we see more and more coming through on being either the EU laws or the state laws in the United States or China and pick your country. We're also seeing a lot more compliance being introduced here, which is another bit of complexity as I manage my risk portfolio.
- [23:35]
Dave Bittner
That's Steve Winterfeld from Akamai.
- [23:49]
Microsoft Announcer
So good, so good, so good.
- [23:51]
Nordstrom Rack Announcer
New markdowns up to 70% off are at Nordstrom Rack stores now. Stock up and save big on shoes, tops, dresses, accessories and more must haves for summer. Join the Nordy Club to unlock exclusive discounts. Shop new arrivals first and more. Plus buy online and pick up at your favorite Rack store for free. Great brands, great prices. That's why you Rack,
- [24:16]
Microsoft Announcer
study and play come together on a Windows 11 PC. And for a limited time, college students get the best of both worlds. Get the unreal college deal Everything you need to study and play with select Windows 11 PCs. Eligible students get a year of Microsoft 365 Premium and a year of Xbox game Pass ultimate with a custom color Xbox wireless controller. Learn more@windows.com studentoffer while supplies last ends June 30th terms at aka mscollegepc.
- [24:54]
Dave Bittner
If I Had a Million Dollars if I had a Million Dollars and finally, middle school teacher Matthew Spencer can finally sleep a little easier after a mysterious $1,002,852.82 hotel charge vanished from his bank account. For five days, Spencer watched his finances with understandable concern after a one night stay at America's Best Value Inn in Blytheville, Tennessee somehow resulted in a seven figure charge. Hotel management says the culprit appears to be a cyber attack affecting card processing systems, not an unusually ambitious room rate. General manager maid Ramon demonstrated that the hotel's payment terminal cannot even accept a million dollar transaction, then provided transaction records showing no such charge was processed through the property. With the charges now dropped, Spencer says he feels significantly better. The hotel, meanwhile, is eager to reassure travelers that it would much rather collect room fees than accidental millionaire sized payments and continues investigating how the bogus charge appeared in the first place. Yes sir, you'll need a major credit card upon checking.
- [26:20]
Nordstrom Rack Announcer
Credit card, you got it.
- [26:35]
Dave Bittner
And that's the Cyber Wire. For links to all of today's stories, check out our daily briefing@thecyberwire.com we'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast podcast app. Please also fill out the survey in the show notes or send an email to cyberwire2k.com N2K's lead producers, Liz Stokes, were mixed by Trey Hester with original music and sound design by Elliot Peltzman. Our contributing host is Maria Vermazis. Our executive producer is Jennifer Ibin. Peter Kilpe is our publisher and I'm Dave Bittner. Thanks for listening. We'll see you back here tomorrow.