Loading summary
Transcript20 lines
- [00:02]
A
You're listening to the Cyberwire Network, powered by N2K. Risk and compliance shouldn't slow your business down. Hyperproof helps you automate controls, integrate real time risk workflows, and build a centralized system of trust so your teams can focus on growth, not spreadsheets. From faster audits to stronger stakeholder confidence, Hyperproof gives you the business advantage of Smarter compliance. Visit www.hyperproof.IO to see how leading teams are transforming their GRC programs. At Talas, they know cybersecurity can be tough and you can't protect everything. But with Thales, you can secure what matters most. With Thales industry leading platforms, you can protect critical applications, data and identities anywhere and at scale with the highest roi. That's why the most trusted brands and largest banks, retailers and healthcare companies in the world rely on Thales to protect what matters most applications, data and identity. That's Talas T H A L E S learn more@talasgroup.com Cyber China linked hackers target Cisco firewalls MIT Sloan withdraws a controversial AI driven ransomware paper A new study questions the value of cybersecurity Training hackers exploit OpenAI's API as a malware command channel. Apple patches over 100 security flaws across devices A Florida based operator of mental health and addiction treatment centers exposes sensitive patient information. OPM plans a mass deferment for Cyber Corps scholars affected by the government shutdown. Lawmakers urge the FTC to investigate Flock Safety's cybersecurity gaps. Cybercriminals team with organized crime for high tech cartel cargo thefts Ben Yellen from the University of Maryland center for Cyber Health and hazard strategies discusses ICE's controversial facial scanning initiative and A priceless theft meets a worthless password. It's Tuesday, November 4, 2025. I'm Dave Bittner and this is your CYBERW Intel Briefing. Thanks for joining us here today. It's great as always to have you with us. China Affiliated threat group Storm 1849, also tracked as UAT 4356, has been exploiting Cisco Adaptive Security appliance firewalls used by governments and major firms worldwide. According to Palo Alto Networks Unit 42, the hackers leverage two known Cisco vulnerabilities to gain persistent control over critical network gateways. Targets include US Federal and state agencies, defense contractors and financial institutions, as well as organizations in Europe, Asia, Africa, and the Middle East. Despite CISA's emergency patch directive, attacks persisted through October. But pausing briefly during China's Golden Week, experts warn that affected entities must not only patch but also reset configurations and credentials to fully remove intrusions. MIT Sloan has retracted a working paper that falsely claimed over 80% of ransomware attacks in 2024 involved artificial intelligence. The study, co authored with cybersecurity firm Safe Security, faced strong backlash from independent researchers, including Kevin Beaumont and Marcus Hutchins, who called the report ridiculous and nonsense, citing its lack of evidence and inclusion of long defunct malware like Emotet. Even Google's AI overview disputed the statistic. Following the criticism, MIT removed the paper and said it is revising the work after recent reviews, co author Michael Siegel acknowledged that an updated version is forthcoming, emphasizing the paper's intent to explore AI's growing role in ransomware rather than assert a precise figure. Beaumont later accused MIT Sloan and Safe Security of spreading cyberslop or baseless AI claims for profit, warning that such hype misleads security leaders and undermines trust in cybersecurity research. A UC San Diego Health study of nearly 20,000 employees found that cybersecurity training had little impact on phishing susceptibility. Trained workers were about as likely to click phishing links as untrained ones, regardless of when they last took training. Popular lures included fake HR and vacation policy updates. Researcher Ariana Merian said results showed users eventually fall for a lure, suggesting organizations should emphasize technical defenses like multi factor authentication and spam filtering instead of relying on training alone. Microsoft has uncovered a stealthy backdoor dubbed Sesame OP, that hijacks OpenAI's assistance API to control infected systems. Instead of using the API for normal chatbot interactions, attackers use it as a covert command and control channel, blending malicious traffic with legitimate AI activity. The backdoor, first detected in July, employs. Net app domain manager injection, layered encryption, and heavy obfuscation to execute and exfiltrate commands invisibly by routing through OpenAI's trusted infrastructure. Sesame Op avoids traditional detection methods like suspicious IPs or domains. Microsoft emphasized that this is not an OpenAI vulnerability but a misuse of legitimate capabilities. The company shared indicators and hunting queries to help defenders flag unusual API activity. OpenAI has since disabled a compromised account linked to the attack. Experts warn that as AI integration expands, trusted cloud services will increasingly be repurposed for stealth operations. Apple has released major security updates for iOS, iPadOS, and macOS, addressing more than 100 vulnerabilities. IOS and iPadOS 26.1 fix 56 issues, including 19 in the WebKit browser engine, while iOS Tahoe 26.1 patches 105 flaws. The bugs could allow data theft memory corruption or sandbox escapes. Many were discovered by Google's Big Sleep AI, which identifies exploitable weaknesses before attackers can act. Apple also issued fixes for macOS, Sequoia, Sonoma, TVOS, WatchOS, Vision OS and Safari. Oglethorpe Inc. A Florida based operator of mental health and addiction treatment centers, is notifying over 92,000 patients of a data breach discovered in June. The company reported the incident to the main attorney general, saying attackers accessed its IT systems and stole personal data, including names, Social Security numbers and medical information. While no misuse has been confirmed, Oglethorpe is offering affected individuals 12 months of credit monitoring. The firm, which runs facilities in Florida, Ohio and Louisiana, has rebuilt compromise systems, notified the FBI and strengthened network defenses. Experts say breaches involving behavioral health data carry heightened risks of emotional and social harm. Security consultant Dave Bailey emphasized that such incidents erode patient trust and urged healthcare providers to go beyond compliance by prioritizing risk based protections for sensitive health information. The U.S. office of Personnel Management says it will coordinate a mass deferment for participants in the federal Cyber Corps Scholarship for Service program once the government shutdown ends. The program, run by the National Science foundation with OPM and dhs, funds cybersecurity students tuition in exchange for post graduation. Federal service scholars unable to find qualifying jobs must normally repay their awards due to hiring freezes and budget cuts. Many current and recent graduates fear they'll owe as much as $100,000amid limited federal openings. OPM spokesperson McLaurin Pinover said the deferment will grant more time for job placement and added that no participants have yet been sent to repayment. OPM director Scott Kupor emphasized that recruiting cybersecurity and AI specialists remain a national priority and that new guidance will urge agencies to fully leverage the SFS program once operations resume. Senator Ron Wyden, Democrat from Oregon, and Representative Raha Krishnamoorthy, Democrat from Illinois, have asked the Federal Trade Commission to probe police surveillance firm Flock Safety over alleged weak cybersecurity. Their letter cites at least 35 hacked customer accounts and criticizes Flock for not requiring multi factor authentication or supporting phishing resistant mfa. The lawmakers warn that poor security could expose location data on millions of Americans. Flock's license plate reader network spans over 8,000 communities nationwide. Both the FTC and Flock declined to comment. Researchers at Proofpoint warn that cybercriminals are teaming with organized crime groups to carry out a modern wave of cargo thefts targeting US Logistics firms. The attackers infiltrate freight brokers, load boards, post fake shipping jobs and use malicious remote monitoring and Management tools such as Enable or Screen Connect to gain network access. Once inside, they steal credentials and impersonate brokers to redirect legitimate shipments to criminal controlled addresses. Goods stolen range from electronics to energy drinks, with losses totaling millions of dollars. Proofpoint says the criminals are opportunistic, targeting carriers of all sizes. Cargo Net's latest data supports the trend, reporting over $111 million in losses across 772 thefts in the third quarter of 2025, with an average stolen shipment worth $336,000. Experts expect these cyber enabled social engineering schemes to grow more sophisticated as attackers exploit public load board data to value shipments. Coming up after the break, my caveat. Co host Ben Yellen discusses ICE's controversial facial scanning initiative and a priceless theft meets a worthless password. Stay with us.
- [12:42]
B
What happens when cybercrime becomes as easy as shopping online? Spy Cloud's Trevor Hilligoss joined Dave Buettner on the Cyberwire Daily to explain how a wave of cybercrime enablement services are lowering the barrier to entry and making sophisticated attacks available to anyone.
- [13:01]
C
I think it's a pretty good general term that describes kind of an umbrella of tools and services that I would kind of tag as criminal or criminal adjacent instead of having, you know, sort of the smaller pool of high sophistication actors that are able to kind of carry out these really vast and costly cyber attacks. You know, we see that being given to much lower sophistication, lower tech folks that are, you know, a much lower barrier to entry to get into this field. The person that's buying access to this, they basically need a phone and a Bitcoin wallet.
- [13:41]
B
Make sure you hear this full conversation and learn how the underground economy is reshaping Cyber risk. Visit explore.thecyberwire.com spycloud that's explorer.thecyberwire.com Spycloud.
- [14:11]
A
What'S your 2am Security worry? Is it do I have the right controls in place? Maybe are my vendors secure? Or the one that really keeps you up at night? How do I get out from under these old tools and manual processes? That's where Vanta comes in. Vanta automates the manual work so you can stop sweating over spreadsheets, chasing audit evidence and filling out endless questionnaires. Their trust management platform continuously monitors your systems, centralizes your data and simplifies your security at scale. And it fits right into your workflows. Using AI to streamline evidence collection, flag risks, and keep your program audit ready all the time. With Vanta, you get everything you need to move faster, scale confidently, and finally, get back to sleep. Get started@vanta.com cyber that's v a n t a dot com cyber it is always my pleasure to welcome back to the show Ben Yellen. He is my co host over on the Caveat Podcast and he is from the University of Maryland center for Cyber Health and Hazard Strategies. Ben, welcome back.
- [15:28]
B
Good to be with you again, Dave.
- [15:30]
A
We had a discussion for this week's.
- [15:32]
B
Caveat show, which you should listen to.
- [15:35]
A
Which you should totally listen to, about some facial recognition software that ICE is using here. Can you unpack this? Ben? What's going on?
- [15:44]
B
Sure. So this comes from a story from 404 Media, which is some really interesting work in this space. And it's about an ICE application originally developed by Customs and Border Protection called Mobile Fortify. And under that application, ICE uses facial recognition scans in order to determine if a person is either a US Citizen or a lawful legal resident. And if they are not, they are eligible for detention and potential deportation. Data that's collected through the use of this app. This biometric data can be stored for 15 years. So generally how it works in practice, agents will take a photo on one of their issued mobile devices. It's checked against the Customs and Border Protection's Traveler Verification System, which has a database database of roughly 200 million faces. And the system returns relevant details, name, date of birth, nationality, et cetera. It is also capable of capturing fingerprints and GPS locations from this encounter. What's particularly controversial is that DHS has stated as a policy that you cannot refuse to be scanned by this facial recognition application. So this obviously has Fourth Amendment implications. Almost by definition, these types of searches are taking place among people for whom ICE is not sure if they're US Citizens or proper US Residents. So it's going to implicate the rights of US Persons. And I think the concern here is, given that this is a pretty invasive use of technology, it's data that can be collected and used against you for up to 15 years. If you're ever arrested for a crime, even if you have never committed a crime in the past, your face could be in national facial recognition databases and that could be used as evidence to convict you. So given those implications, you can understand, I think, why this is particularly controversial. For their part, DHS has not responded to that story for comment. I think in their minds, this is a tool that will shorten ID verification time compared to other manual methods. And most notably, they believe, at least according to this article, that the use of these Biometric tools is more reliable even than things like actual passports, birth certificates, et cetera. So they are using the results of their facial recognition search as the definitive word as to whether a person is here legally. So this is certainly something that's rankled people who believe in civil liberties and Fourth Amendment rights.
- [18:35]
A
I saw this in this article. It got the attention of Congressman Benn Thompson, who's a Democrat from Mississippi. He said that this practice is frightening, repugnant, and unconstitutional. You know, we've seen concerns, justified concerns, that facial recognition is less reliable when dealing with people of color. And of course, no small irony that that's who ICE is targeting here. Right, right.
- [19:04]
B
So there's very well established research that facial recognition frequently fails, as you say, when reviewing faces of people of color. And so I think that's one of the concerns that Representative Thompson has brought up and many others. We know that the Supreme Court, in one of its decisions on ICE's tactics, said that the use of race is an acceptable, at least as an initial matter, impetus for attempting to question somebody's citizenship is kind of a common sense. If most of the undocumented immigrants in this country are from Central, south and Central America and parts of South America, then by necessity, at least according to a concurrence by Justice Kavanaugh, we should be able to take the person's race into consideration. So when you combine that constitutional finding with the fact that this app is being used widely and facial recognition does poorly in circumstances with faces of people of color, I think you have the recipe for a real civil liberties disaster here.
- [20:06]
A
So what could people do to push back on this? We have Congressman Bennie Thompson who's against it. I'm sure he has colleagues who agree with them. Would it be up to Congress to push back? Would someone be able to bring a case against this if they were wrongly accused?
- [20:22]
B
Yes. So somebody could certainly bring a case. I can't say I would be super optimistic of a person trying to bring a constitutional Fourth Amendment case, given that it's unclear whether facial recognition of people, at least in public thoroughfares, qualifies as a constitutional search. It doesn't neatly meet the definition of search or seizure under the Fourth Amendment. And then the government could always claim that they're doing this in the interest of national security, which always weighs favorably toward the government in terms of an analysis of whether the search is reasonable. So somebody could bring that legal challenge. They'd have to have standing, which means they would have had to have been unlawfully detained, and they could challenge the circumstances around their detention. Short of that, it would be Congress who could intervene and could prevent the use of this technology or the use of this technology without proper safeguards, like giving people the right to opt out. But I certainly do not see the current Congress agreeing to something like that. So at the very least, we'd have to wait a year until there is a different Congress in place that isn't as supportive of the president's immigration policies.
- [21:37]
A
Just to be crystal clear here, I'm walking down the street and I cross paths with the folks from ice. They say, hey there, sir, we need you to stop to get your face scanned. And I say, no, I'm good, and try to keep walking. What likely happens next, they will tell.
- [21:54]
B
You that you have to do it. And they're the ones with the guns and the handcuffs. So they could probably make you comply with the use of physical force. We don't know exactly what would happen because DHS didn't comment for this article. But I think the implication is they could use any means necessary if they feel this is the definitive word on somebody's right to be in this country. I think they could compel through force or the threat of physical force somebody into complying, and they will put your face in front of a camera.
- [22:27]
A
All right. Well, again, this is from the folks over at 404 Media, who, as you say, Ben, are doing some really good work with these sorts of things. We'll have a link to that in the show Notes. Ben Yellen, thanks so much for joining us.
- [22:39]
B
Thank you, Dave.
- [22:57]
A
And finally, the recent jewel heist at the Louvre Museum in Paris looked like something out of a Hollywood script. Broad daylight, the Apollo Gallery and a team of thieves coolly lifting crown jewels worth nearly 90 million euros before vanishing on a motorbike into Paris traffic two weeks later. Investigators have suspects in custody, but no trace of the treasure, only questions about how the world's most famous museum could be robbed so easily. Well, documents now reveal that the Louvre's surveillance server once required a password. Louvre? Yes, the museum guarding centuries of priceless art apparently thought security should rhyme with simplicity. Prosecutor Laura Bacow says the culprits aren't criminal masterminds, just lucky opportunists aided by what she said was the Louvre's chronic underestimation of risk. So while the thieves remain at large, the true embarrassment hangs in the network logs. A password so weak it could have been guessed by a tourist in line for tickets. And that's the cyberwire for links to all of today's stories, check out our daily briefing@thecyberwire.com we'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to cyberwire2k.com N2K's senior producer is Alice Carruth. Our Cyberwire producer is Liz Stokes. Were mixed by Trey Hester with original music by Elliot Peltzman. Our executive producer is Jennifer Ibin. Peter Kilpe is our publisher and I'm Dave Pitner. Thanks for listening. We'll see you back here tomorrow.
- [25:18]
B
Sat.