CISA furlough sparks fears.

Summary

---

CyberWire Daily: "CISA Furlough Sparks Fears" – October 2, 2025

Episode Overview

This episode of CyberWire Daily, hosted by Dave Bittner, explores a tumultuous moment in U.S. cybersecurity: the CISA furlough resulting from a federal government shutdown, which coincides with the expiration of the CISA 2015 liability protection law. The episode delivers a packed cyber news briefing and features a timely interview with Cynthia Kaiser, SVP at Halcyon’s Ransomware Research Center and former FBI cyber leader, who shares her sharp insights on the shutdown’s operational impact, information sharing uncertainty, and supporting federal employees under stress.

---

Key News Highlights and Analysis

1. CISA Furloughs and the Government Shutdown

• CISA, the critical U.S. Cybersecurity and Infrastructure Security Agency, has furloughed most of its staff—only 35% remain active, per DHS—with the possibility of recalling more for emergencies.
• The furlough occurs alongside the expiration of CISA 2015—the law shielding companies from liability when sharing cyber threat information—raising sharp concerns that corporations might now pull back from industry security groups.
• Expert fears: This twin disruption could “hamper efforts against ransomware and Chinese state-linked hacking campaigns.”
• The timing is especially awkward during Cybersecurity Awareness Month.

2. Interview: Cynthia Kaiser on Shutdown Implications

• [14:59–21:18] See in-depth highlights and quotes below.

3. US Air Force and SharePoint Breach

• The USAF is investigating a privacy issue after a reported breach in Microsoft SharePoint may have exposed personally identifiable and health information.
• Servicewide shutdowns of SharePoint systems were considered, potentially disabling certain tools for up to two weeks. Microsoft has not commented.
• Concerns are raised regarding possible connections to a summer wave of SharePoint exploits by Chinese hackers, data thieves, and ransomware gangs.

4. Google Warns of Massive Executive Extortion Campaign

• Attackers claim to have breached Oracle’s E-Business Suite, sending ransom demands up to $50M.
• Group linked: Fin11, affiliated with the Clop ransomware gang.
• Hundreds of extortion emails originate from compromised accounts.
• Mandiant confirms the email activity but not the data breach; Google advises heightened vigilance and incident investigation.

5. Android Spyware Disguised as Messaging Apps

• ESET researchers discover Pro Spy and 2Spy targeting UAE users by mimicking apps like Signal and Tutalk.
• Spread via fake sites and app stores, these steal sensitive data and reinstall legitimate apps to avoid raising suspicion.
• Both campaigns require manual third-party installation; 2Spy has been active since 2022, Pro Spy since 2024.

6. Red Hat GitHub Extortion Claim

• An “extortion group” called Crimson Collective claims to have stolen 570GB from Red Hat’s private GitHub, including detailed customer and infrastructure data.
• Red Hat confirms a consulting-related incident but does not validate the specific data loss; assuages that its software supply chain is intact.

7. Motility Software Ransomware Breach

• RV and powersports dealership software provider Motility notifies 750,000 people of a ransomware event with the Pair gang claiming over 4TB of stolen data.
• Personal data including SSNs and driver’s licenses were accessed.
• Motility says systems have been restored; 12 months of identity protection offered.

8. Patchwork APT: New PowerShell Loader

• Patchwork (Dropping Elephant, etc.) deploys a multi-stage loader using scheduled tasks.
• Attack flow: Macro triggers shortcut and PowerShell script, installs decoy apps, persists malware, enables encrypted command-and-control, and exfiltrates data.
• Defenses: Restrict macros, monitor suspicious tasks, and use up-to-date endpoint security.

9. U.S. Senator Urges Post-Quantum Cyber Readiness

• Senator Marsha Blackburn (R-TN) pushes legislation and federal strategy for quantum-resistant encryption by 2027.
• Priorities: Countering Chinese technological advances, workforce development, and commercial sector involvement.

10. Malaysian Man Pleads Guilty in $6B Crypto Fraud

• Hock Sen Ling admits to aiding a Ponzi-style scam orchestrated by Jiming Quan, targeting 128,000 victims.
• $15 million in assets seized, authorities pursuing $7.1B in Bitcoin. Both men face sentencing in November.

11. Protected Health Information Misuse in Marketing

• Cadia Healthcare fined $182,000 for HIPAA violations related to posting patients’ data on social media.
• Regulators stress proper authorization is non-negotiable for sharing protected health information.

---

Special Feature: Interview with Cynthia Kaiser – CISA Furlough & Shutdown Impact

[14:59] What is Shutdown Like for Federal Cyber Personnel?

• Cynthia Kaiser:
  “At the FBI, almost all the work that we do is accepted. And what that means is it's essential for the American people so people still come into work... But that being said, there’s obviously a lot of stress around not knowing when your next paycheck's going to come.”
• The camaraderie and shared ordeal create a support network—but agencies are often without normal lines of collaboration:
  “You don’t necessarily have all of your counterparts across government that can help you. So, sometimes it almost becomes more busy.” [15:40]

[16:03] CISA 2015 Expiration: Information Sharing Under Threat

• “After a decade of having protections, liability protections, antitrust protections, those don’t exist anymore. And companies are going to have to make choices about what their risk tolerance is.”
  — Cynthia Kaiser

• Kaiser says some will, like Halcyon, maintain sharing, trusting in reauthorization:
  “We’re not going to change our sharing posture... But not every company has that luxury.”

• The risk: “If the government doesn’t have that information, they can’t warn others.” [17:37]

[18:09] On CISA Furloughs: What’s the Impact?

• “CISA was probably my closest partner when I was in government. Every day, multiple times a day, I was talking to my CISA counterparts... If the same people at CISA aren’t there, that makes that job all the more difficult because...you can’t just have one agency...and be the same level of effectiveness if the other agencies that have complementary activities, that’s not occurring.”
  — Cynthia Kaiser

[19:25] National Cybersecurity Impact of Shutdowns

• “In every shutdown...it felt like we weren’t able to have kind of the full spectrum picture of cyber activity that was going on... And when the shutdown was done, you were felt like you were playing catch up. And so really...there’s always going to be a natural slowing, not stop, but slowing of some of the important work.”
  — Cynthia Kaiser

[20:19] Advice for Federal Employees Under Shutdown Stress

• “My advice is that most of America is really accommodating...I could remember talking to a credit card company...and them saying, ‘oh you work for the government, that’s fine, you’ll just pay us when you get paid.’ So don’t be afraid to call, ask for help...because we all rely on you and we want you to be able to counter these criminals that don’t care for shutdown or not.”
  — Cynthia Kaiser

---

Notable Quotes

• “If the government doesn’t have that information, they can’t warn others.”
  — Cynthia Kaiser, on the expiration of data sharing protections [17:37]
• “In every shutdown...it felt like we weren’t able to have kind of the full spectrum picture of cyber activity that was going on.”
  — Cynthia Kaiser [19:25]
• “You don’t necessarily have all of your counterparts across government that can help you. So, sometimes it almost becomes more busy.”
  — Cynthia Kaiser [15:40]
• “Don't be afraid to call, ask for help...because we all rely on you and we want you to be able to counter these criminals that don’t care for shutdown or not.”
  — Cynthia Kaiser [20:36]

---

Timestamps for Key Segments

• CISA Furlough and Shutdown Overview: [00:12–02:00]
• USAF SharePoint Breach: [03:00–05:00]
• Google/Oracle Extortion Campaign: [05:00–06:30]
• Android Spyware Discovery: [06:30–07:30]
• Red Hat Extortion Claim: [07:30–08:30]
• Motility Software Ransomware Breach: [08:30–09:30]
• Patchwork APT Tactics: [09:30–10:45]
• Quantum Cyber Law Push: [10:45–12:00]
• Crypto Fraud Guilty Plea: [12:00–13:00]
• Interview: Cynthia Kaiser – Gov’t Shutdown Impacts: [14:59–21:18]
• HIPAA/PHI Marketing Enforcement: [22:30–23:30]

---

Tone and Takeaways

The episode maintains a clear-eyed, urgent tone, somberly detailing the high-stakes consequences of the shutdown on national cyber defense and the private sector’s willingness to share intelligence. The interview segments, in particular, deliver practical insight and empathy for the federal workforce, as well as a blunt warning to industry and policymakers about the risks of pausing critical collaboration.

---

For cybersecurity professionals and stakeholders, this episode is an essential listen and read—a snapshot of the risks, uncertainty, and human elements facing the U.S. cyber ecosystem at a time of government inaction.

Transcript

[A]

You're listening to the Cyberwire Network powered by N2K.

[B]

At Talas, they know cybersecurity can be tough and you can't protect everything. But with Thales, you can secure what matters most. With Thales industry leading platforms, you can protect critical applications, data and identities anywhere and at scale with the highest roi. That's why the most trusted brands and largest banks, retailers and healthcare companies in the world rely on Talas to protect what matters most applications, data and identity. That's Talas T H A L E S learn [e-mail] Cyber CISA furloughs most of its workforce due to the government shutdown the US Air Force confirms it's investigating a SharePoint related breach. Google warns of a large scale extortion campaign targeting executives. Researchers uncover Android spyware campaigns disguised as popular messaging apps. An extortion group claims to have breached Red Hat's private GitHub repositories, a software provider for recreational vehicle and powersports dealers, suffers a ransomware breach. Patchwork Apt deploys a new PowerShell loader using scheduled tasks for persistence. A Tennessee Senator urges aggressive U.S. action to prepare for a post quantum future. Our guest is Cynthia Kaiser, SVP of Halcyon's Ransomware Research center and former deputy assistant director at the FBI's Cyber Division, joining us with insights on the government shutdown and A Malaysian man pleads guilty to supporting a massive crypto fraud and protected health information is not a marketing tool. It's Thursday, October 2nd, 2025. I'm Dave Buettner and this is your Cyberwire Intel Brief. Thanks for joining us here today. It's great to have you with us. The US Cybersecurity and infrastructure security agency, responsible for safeguarding the electric grid, water and other vital services, has furloughed most of its workforce due to the government shutdown. Only 35% of staff remain active, though more may be recalled for emergencies, according to the Department of Homeland Security. The disruption coincides with the expiration of CISA 2015, the law shielding companies from liability when sharing cyber threat information without reauthorization. Some corporations are pulling back from industry security groups, raising fears of weakened collective defense. Experts warn this could hamper efforts against ransomware and Chinese state linked hacking campaigns. The timing is especially awkward arriving during Cybersecurity Awareness Month, when collaboration and vigilance are traditionally emphasized. Be sure to stay tuned for my conversation with Cynthia Kaiser, senior vice president of Halcyon's Ransomware Research Center. We're discussing her experience with previous government shutdowns the US Air Force has confirmed it's investigating a privacy related issue after reports surfaced of a Microsoft SharePoint breach that may have exposed personally identifiable and health information. An alleged breach notice shared online warned that all Air Force SharePoint systems would be shut down service wide, potentially disabling teams dashboards for up to two weeks. The Air Force has not confirmed which services, if any, are offline, with some personnel reporting continued access. Microsoft declined to comment on any link to earlier SharePoint vulnerabilities that Chinese hackers, data thieves and ransomware gangs exploited this summer, compromising hundreds of organizations worldwide. The timing has raised concerns about operational disruptions and sensitive data exposure within the military. Google has warned of a large scale extortion campaign targeting executives after attackers claim to have stolen data from Oracle's E Business suite. Since late September, victims have received emails demanding ransoms ranging from millions to as much as $50 million. The campaign appears linked to Fin11, a group affiliated with the Clop ransomware gang, though Google says it cannot yet verify the breach claims Mandiant confirmed the extortion emails are being sent from hundreds of compromised accounts with contact details tied to Clop's leak. Site Security firm Halcyon suggested attackers may be exploiting password resets in Oracle systems, with Oracle silent. So far, Google advises companies receiving these emails to investigate for signs of Compromise. Researchers at ESET uncovered two Android spyware campaigns, Pro Spy and 2Spy, disguised as popular messaging apps Signal and Tutalk, to target users in the UAE. Spread through fake websites and app stores, the spyware steals contacts, chat backups, media and other sensitive data while reinstalling legitimate apps to avoid detection. 2Spy appears active since 2022, while ProSpy emerged in 2024. Both require manual installation via third party sites, including one impersonating Samsung's App Store, and are designed for persistent, regionally focused operations. An extortion group calling itself Crimson Collective claims to have stolen 570 gigabytes of data from Red Hat's private GitHub repositories, including 28,000 internal projects and around 800 customer engagement reports. These reports often contain detailed client infrastructure information, configuration data and authentication tokens that could be exploited to breach networks. Red Hat confirmed a security incident affecting its consulting business, but did not validate claims about the stolen repositories or CERs, stressing that its software supply chain remains intact. The attackers, who say the breach occurred two weeks ago, published repository listings and CER directories naming major corporations and US Government entities. Crimson Collective alleges Red Hat ignored their extortion demands. Responding only with automated support instructions. Motility Software Solutions, which provides dealership software for recreational vehicle and power sports dealers, is notifying just over three quarters of a million people of a ransomware breach. Hackers accessed business servers on August 19, encrypted files and stole personal data, including names, contact details, dates of birth, Social Security numbers and driver's license numbers. Motility says there's no evidence of misuse, they've restored systems from backups, and they're offering 12 months of identity protection. The pair ransomware gang later claimed 4.3 terabytes of stolen data, likely from Motility Patchwork, also known as Dropping Elephant, Monsoon and Hangover Group, an advanced persistent threat actor since at least 2015, is deploying a new multi stage PowerShell loader that abuses Windows scheduled tasks to persist and run its final payload. Infection begins with a malicious office macro that drops a shortcut and runs a PowerShell script. The script installs a faux vlce, places a decoy PDF and creates a scheduled task named Windows ErrorReport to launch the loader. The loader establishes an encrypted command and control channel, fingerprints hosts and uses layered obfuscation for communications. Capabilities include in memory payload execution, chunked resumable exfiltration and screenshot capture. In terms of defenses, experts say, enable macros only from trusted sources, monitor for suspicious scheduled tasks, enforce application whitelisting and run up to date endpoint protections. Senator Marsha Blackburn, Republican from Tennessee, is urging aggressive US Action to prepare for a post quantum future where current encryption may be broken. Speaking at a Politico event, she confirmed elements of a White House quantum initiative while promoting her own legislative push. Blackburn co sponsored the National Quantum Cybersecurity Migration Strategy act, requiring agencies to move at least one high risk system to quantum resistant encryption by 2027. She emphasized the need to counter Chinese ambitions in emerging technologies while praising White House officials leading federal quantum strategy. Blackburn highlighted workforce development, commercial involvement and stronger encryption as priorities. She's also backing bills to accelerate Defense Department quantum planning, create a quantum sandbox at nist and to establish a federal institute for quantum manufacturing. A Malaysian man pleaded guilty in a London court to supporting a massive crypto fraud tied to Chinese national Jiming Quan, also known as Yadi Zhang. Prosecutors say Hock sen Ling, age 46, acted as a fixer for Kwon, who ran a Ponzi style scheme in China that stole $6.2 billion from 128,000 victims. Ling admitted to transferring criminal property and cryptocurrency and helping evade capture by arranging accommodations across the UK Police surveillance led to their arrests in York in April 2024, seizing $15 million in assets. Authorities are now pursuing confiscation of 61,000 bitcoins valued at $7.1 billion. Both face sentencing in November. The case could set a precedent for compensating overseas victims in cross border crypto fraud. Coming up after the break, my conversation with Cynthia Kaiser from Halcyon's Ransomware Research Center. We're discussing the government shutdown and Protected health information is not a marketing tool. Stay with us. Compliance regulations, third party risk and customer security demands are all growing and changing fast. Is your manual GRC program actually slowing you down? If you're thinking there has to be something more efficient than spreadsheets, screenshots and all those manual processes, you're right. GRC can be so much easier and it can strengthen your security posture while actually driving revenue for your business. You know, one of the things I really like about Vanta is how it takes the heavy lifting out of your GRC program. Their trust management platform automates those key compliance, internal and third party risk, and even customer trust so you're not buried under spreadsheets and endless manual tasks. Vanta really streamlines the way you gather and manage information across your entire business. And this isn't just theoretical. A recent IDC analysis found that compliance teams using Vanta are 129% more productive. That's a pretty impressive number. So what does it mean for you? It means you get back more time and energy to focus on what actually matters, like strengthening your security posture and scaling your business. Vanta GRC Just imagine how much easier trust can be. Visit vanta.com cyber to sign up today for a free demo that's V A n T a dot com Cyber AI adoption is exploding and security teams are under pressure to keep up. That's why the industry is coming together at the datasec AI Conference, the premier event for cybersecurity, data and AI leaders. Hosted by data security leader ciara. Built for the industry, by the industry, this two day conference is where real world insights and bold solutions take center stage. Datasec AI25 is happening November 12th and 13th in Dallas. There's no cost to attend. Just bring your perspective and join the conversation. Register now at datasecai2025.com cyberwire Cynthia Kaiser is senior vice president of Halcyon's Ransomware Research center and former Deputy Assistant director at the FBI's Cyber Division. We caught up for insights on the Government shutdown. Cynthia, thanks for taking the time for us today. I'd love to start with your own personal insights. Your time in the government with the FBI. You've experienced some of these government shutdowns. What's it like?

[A]

Well, at the FBI, almost all the work that we do is accepted. And what that means is it's essential for the American people so people still come into work and they continue to do the work they need to do to keep the American people safe. But that being said, there's obviously a lot of stress around not knowing when your next paycheck's going to come. It will come, but not kind of knowing that, like having that kind of personal stress on you. I mean, it's, it's trying and it was good to be able to go through that with everybody else at the same time. Right. Have that support network. But you also find that you don't necessarily have all of your counterparts across government that can help you. So sometimes it almost becomes more busy.

[B]

Yeah, we are dealing with the, I guess, end of legislation that allowed information sharing, CISA 2015. What do you suppose the impact of that's going to be?

[A]

Well, from what I'm hearing, it sounds like some of those efforts to get that legislation reauthorized, you know, whether it's in the 2015 name or in a different name, those continue apace. And I think the ideal outcome would be if, when the budget's passed, there's a way in which to include CISA 2015 reauthorization within that. And I'm hearing there's some like, good movement towards there. But right now what we find ourselves in is after a decade of having protections, liability protections, antitrust protections, those don't exist anymore. And companies are going to have to make choices about what their risk tolerance is at Halcyon, because we have faith that there are some of these ongoing efforts that it will likely be reauthorized at some point, hopefully in the near future. We're not going to change our sharing posture, our sharing posture with government, our sharing posture across industry. But not every company has that luxury. And especially if you're a company and you're dealing with like very intimate PII type type information, you just can't share the way you would have. If you don't have legal protections in place that allow you to give the information about compromises, attacks, campaigns to the government and like take that to its natural conclusion. If the government doesn't have that information, they can't warn others.

[B]

Yeah, well, let's switch Gears to the other cisa, Cybersecurity Infrastructure and Security Administration. They are saying that they're furloughing up to 2/3 of their folks there. What could the impact of that be?

[A]

Since I don't have knowledge of who may be furloughed and for what amount of time, it's hard to get into the details of impacts. But I would say that SISA was probably my closest partner when I was in government. Every day, multiple times a day, I was talking to my SISA counterparts. We were going back and forth on who was going to be able to do threat hunting, learning information from victims, especially when there's multi victim campaigns. And it kind of goes back to my point from earlier. FBI is coming in every day. You know, they're all there, a little stressed about the financial situation, but doing that same work. But if the same people at CISA aren't there, that makes that job all the more difficult because you can't just have one agency doing their activities and be the same level of effectiveness if the other agencies that have complementary activities, that's not occurring.

[B]

In your estimation, what is the material impact of a government shutdown like this on, on the cybersecurity of our nation?

[A]

In every shutdown that I was part of, whether partial or full, it felt like we weren't able to have kind of the full spectrum picture of cyber activity that was going on. We would have partial pictures, we would be able to still counter the threats, but it took longer. And when the shutdown was done, you were felt like you were playing catch up. And so really I think there's just a, there's always going to be a natural slowing, not stop, but slowing of some of the important work that we all rely on to keep ourselves safe.

[B]

What are your recommendations for the folks who are in the midst of this? Any words of wisdom based on your own experience?

[A]

Especially to the employees who may be going through their first shutdown, that's the most stressful. My advice is that most of America is really accommodating and great to these employees. And so I could remember talking to a credit card company when there was, I think that like one that was almost a month long and them saying, oh you work for the government, like that's fine, you'll just pay us when you get paid. So like don't be afraid to kind of call, ask for help would be my advice to them financially because you want to free yourself up emotionally to be able to do the important work that still has to get done. And so ultimately do what you need to do. Ask for the help that you need, because we all rely on you and we want you to be able to counter these criminals that don't care for shutdown or not.

[B]

That's Cynthia Kaiser, senior vice president of Halcyon's Ransomware Research Center. Think your certificate security is covered by March 2026, TLS certificate lifespans will be cut in half, meaning double today's renewals. And in 2029, certificates will expire every 47 days, demanding between eight and 12 times the renewal volume. That's exponential complexity, operational workload and risk. Unless you modernize your strategy. Cyberark Proven in Identity Security is your partner in certificate security. Cyberark simplifies lifecycle management with visibility, automation and control at scale. Master the 47 day shift with CyberArk. Scan for vulnerabilities, streamline operations, scale Security. Visit cyberark.com 47day that's cyberark.com the numbers 47day and now a word from our sponsor, ThreatLocker, the powerful zero trust enterprise solution that stops ransomware in its tracks. Allowlisting is a deny by default software that makes application control simple and fast. Ring Fencing is an application containment strategy, ensuring apps can only access the files, registry keys, network resources and other applications they truly need to function. Shut out cybercriminals with world class ENDPOINT protection from ThreatLocker. And finally, CADIA Healthcare thought it had found a clever marketing angle, a Success stories campaign showcasing patients recoveries on social media. Unfortunately, regulators saw it less as inspiration and more as a HIPAA violation. The Office for Civil Rights says the Delaware nursing home chain posted names, photos and medical details of about 150 patients without the legally required consent forms. One complaint in 2021 unraveled the entire program, leading to a $182,000 fine and a two year corrective action plan. Cadia has since pulled the campaign and now faces the less glamorous task of rewriting policies, training staff and sending belated breach notices. As OCR dryly noted, marketing is important, but valid written authorization tends to be even more so when dealing with protected health information. And that's the Cyberwire. For links to all of today's stories, check out our daily [e-mail] we'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to cyberwiren2k.com N2K senior producer is Alice Carruth. Our Cyberwire producer is Liz Stokes. We're mixed by Trey Hester with original music by Elliot Peltzman. Our executive producer is Jennifer Ibin. Peter Kilpe is our publisher and I'm Dave Bittner. Thanks for listening. We'll see you back here tomorrow. And Doug Limu and I always tell you to customize your car insurance and save hundreds with Liberty Mutual, but now.

[A]

We want you to feel it.

[B]

Cue the emu music.

[A]

Limu Save yourself money today. Increase your wealth, Customize and save.

[B]

We say that may have been too much feeling. Only pay for what you need@liberty mutual.com Liberty Liberty Liberty Liberty Savings Very unwritten by Liberty Mutual Insurance company And affiliates Excludes Massachusetts Cyber Innovation Day is the premier event for cyber startups, researchers and top VC firms building trust into tomorrow's digital world. Kick off the day with unfiltered insights and panels on securing tomorrow's technology. In the afternoon, the 8th annual DataTribe Challenge takes center stage as elite startups pitch for exposure, acceleration and funding. The Innovation Expo runs all day, connecting founders, investors and researchers around breakthroughs in cybersecurity. It all happens November 4th in Washington, D.C. discover the startups building the future of cyber. Learn [e-mail].