CyberWire Daily – "Chinese Hackers Serve Up Espionage"

Date: October 8, 2025
Host: Dave Bittner (N2K Networks)
Featured Guest: Sean Duby, Principal Technologist at Sempras

Episode Overview

Today’s CyberWire Daily episode centers on a spate of high-profile cyber incidents, including Chinese state-linked espionage against US law firms, waves of Russian cyber operations in Europe, and escalating innovation and complexity in offensive and defensive security. The show includes news highlights on malware threats, ransomware, employee data oversharing via AI tools, and spotlights both rising cybersecurity startups and expert perspectives from the ongoing Hybrid Identity Protection (HIP) Conference.

Main News Topics & Key Insights

1. Chinese Espionage Hits US Law Firm

(00:30–02:35)

• Williams & Connolly, a top US law firm, disclosed that Chinese hackers infiltrated its systems as part of a broader campaign against American law and tech firms.
• The FBI is investigating; more than a dozen organizations may have been targeted.
• Attackers accessed attorney email accounts via a zero-day vulnerability—no client files or databases are confirmed compromised.
• Crowdstrike and Norton Rose Fulbright are assisting in the response.
• Mandiant attributes the campaign to Chinese state espionage focused on intelligence relating to US national security and trade.
• Quote (Dave Bittner):
  “The campaign aligns with a Chinese espionage effort seeking intelligence on US national security and trade issues.” (02:20)

2. Russian Hybrid Warfare Against Europe

(02:36–03:48)

• European Commission President Ursula von der Leyen warned of Russia’s ongoing hybrid warfare—a mix of cyberattacks, sabotage, and provocations.
• Tactics cited: airspace violations, drone incursions over critical infrastructure.
• A new Pan-European Security Strategy with NATO is in development to boost rapid cyber response.
• Notable Quote (Ursula von der Leyen):
  “Every square centimeter of our territory must be protected.” (03:38)

3. ESET Unveils 'Lojax' UEFI Malware

(03:49–05:08)

• ESET researchers discovered Lojax, first malware found actively infecting UEFI firmware.
• Attributed to Russia’s Fancy Bear (APT28/Sednit), Lojax survives drive replacements/OS reinstalls, granting deep persistent access.
• Recommendations: Enable Secure Boot, update firmware, and, if infected, reflash or replace the motherboard.

4. Ransomware, Data Leaks, and Law Enforcement Actions

(05:09–07:03)

• Salesforce refuses to pay ransom to “Scattered Lapsus Hunters,” who claim theft of nearly a billion customer records; data leak threats target major brands (FedEx, Disney, Google, Marriott).
• In the UK, two teens were arrested after ransomware actors (“Radiant Group”) targeted a preschool, leaking children/family info for extortion before deleting it after backlash.
• Police treat the case very seriously; investigations continue.

5. Microsoft Tightens Windows 11 Account Restrictions

(07:04–08:13)

• Microsoft is eliminating workarounds for bypassing Microsoft Account requirements during Windows 11 setup.
• Upcoming builds will require internet and MS account—aiming for enhanced security and configuration completeness.
• Registry workarounds may be removed in future.

6. Cybersecurity Innovators & Startup Recognition

(08:14–09:15)

• SciNet announced Innovator Award winners, spotlighting startups like Bedrock Security, ConductorOne, Oligo Security, Prompt Security, Seamplicity.
• DataTribe announced finalists (Acuity, Citadel, Tensor Machines, Starseer, Evercoast) for its 2025 Cybersecurity Startup Challenge.
• Both programs highlight AI-driven innovation in cloud and enterprise security.

7. Employees Oversharing on ChatGPT and AI Risks

(09:16–10:46)

• LayerX’s 2025 Report finds 45% of enterprise employees use AI tools; 77% paste data into chat prompts—22% include sensitive info (PII, PCI), mostly on unmanaged accounts.
• ChatGPT has 90%+ usage; Microsoft Copilot lags (<3%).
• CISOs are urged to enforce single sign-on for visibility and to cut regulatory/geopolitical risk.

Spotlight Topic: The Hybrid Identity Protection (HIP) Conference

Guest: Sean Duby, Principal Technologist, Sempras
(12:28–28:29)

The HIP Conference: Origins and Growth

(12:28–13:44)

• Founded in 2017 by Sempras’ CEO Mickey Bresman, HIP is the premier vendor-agnostic conference by and for identity experts.
• Attendance has grown from ~30 to 300–500 participants, with expanded professionalism and global reach.
• Quote (Sean Duby):
  “It’s the best conference they’ve ever been to. So it doesn’t get much better than that.” (13:19)

Operation Blind Spot: Tabletop Exercises

(14:24–15:11)

• Year-round crisis management exercises that expose “blind spots” in cyber response.
• Events at Black Hat, Singapore Govware (Oct 21), Microsoft Ignite SF (Nov 19).
• “The point... is that they expose the blind spots that can hinder efficient cyber response.” (14:39)

Organizational Readiness: Are Plans Enough?

(15:11–16:47)

• Sempras research: 95% of organizations have a crisis plan, but 90% say response is hampered by communication gaps.
• “People, process, and technology, with oftentimes people being the thing that is slower than anything else.” (16:26)

Tabletop Realism: The Value of Failure

(16:47–20:01)

• Exercises must go beyond check-the-box routines; they should be realistic, show messy realities, and encourage adaptive thinking.
• “If a tabletop’s overly structured or sanitized, it doesn’t force either the leaders or the responders to think on their feet…” (19:15)
• Notable moment:
  “We actually... had an ace in the hole. I had Marcus Hutchins... It made for some pretty hair raising moments as we sparred back and forth aggressively.” (20:18)

Cyberpsychology Keynote by Prof. Mary Icahn

(21:19–24:05)

• Focused on the intersection of technology and human behavior—how trust, perception, and user interactions form the weakest link in identity security.
• AI enables ever more targeted phishing—human frailty remains critical.
• Notable quote:
  “The human dimension, how users perceive authentication systems... remains the most exploited and least understood aspect of cyber defense.” (21:53)

Upcoming Keynotes: Jen Easterly & Chris Inglis

(24:05–26:12)

• Easterly will discuss cyber resilience (“Yesterday’s Lessons, Tomorrow’s Challenges”): leadership, incident response, and AI’s growing threat/defense roles.
• Inglis will address “Evolving Cyber Resilience in the Age of Innovation”—managing vulnerabilities amid infrastructural change, nationalism, and disruptive tech.
• “If he’s talking, I’m going out of my way to make sure that I’m listening.” (26:06)

AI & Velocity – Keeping Pace with Innovation

(26:12–28:20)

• The pace of change, driven by AI, makes predictions unreliable: “Who knows what next week is going to bring us?”
• Emerging threat—attackers targeting non-obvious systems (e.g., hospital HVAC).
• “Certainly if you follow the news feeds, as you do as a professional, you’re seeing more rapid changes all the time in ways that you had never thought about before.” (27:03)

Notable Quotes & Memorable Moments

• “Every square centimeter of our territory must be protected.”
  — Ursula von der Leyen, European Commission President (03:38)

• “So the exercise should show messy realities... Or unclear decision authority where your leadership ends up being political infighting to make disruptive decisions.”
  — Sean Duby, on cyber crisis tabletops (18:27)

• “The human dimension... remains the most exploited and least understood aspect of cyber defense.”
  — Sean Duby on cyberpsychology (21:53)

• “Who knows what next week is going to bring us?... threat actors are now targeting HVAC systems in hospitals.”
  — Sean Duby on AI & threat evolution (27:03)

Timestamps for Key Segments

• Chinese hackers/Williams & Connolly: 00:30–02:35
• Russia’s hybrid war in EU: 02:36–03:48
• ESET / Lojax UEFI malware: 03:49–05:08
• Ransomware news (Salesforce, London preschool): 05:09–07:03
• Microsoft account policy change: 07:04–08:13
• Startup/Innovation Spotlights: 08:14–09:15
• AI, ChatGPT enterprise leakage: 09:16–10:46
• HIP Conference/Sean Duby interview: 12:28–28:29
  • Conference background: 12:28–13:44
  • Blind Spot exercises: 14:24–15:11
  • Tabletop realism/adaptive thinking: 16:47–20:01
  • Cyberpsychology keynote: 21:19–24:05
  • AI velocity/threat evolution: 26:12–28:20

Language & Tone

The tone remained brisk, precise, and informative—Dave Bittner and Sean Duby balanced technical clarity and industry-insider commentary with relatable anecdotes and wit, particularly during Duby’s breakdown of tabletop exercises and human risk factors.

Summary Takeaways

• Espionage and criminal attacks are growing more sophisticated (Chinese and Russian nation-state actors).
• Law firms, infrastructure, and enterprises face mounting risks from both advanced malware and poor employee data hygiene—especially with the rise of AI tools like ChatGPT.
• Industry leaders stress the importance of realistic preparedness—not just planning, but practicing messy and unpredictable scenarios.
• Human psychology and communication gaps remain the biggest wildcards in cyber defense.
• The pace of change demands adaptability and constant vigilance—no organization can afford complacency.

For further links and details, visit the CyberWire daily briefing.