Transcript
A (0:02)
You're listening to the Cyberwire network, powered by N2K.
B (0:12)
And now a word from our sponsor. The Johns Hopkins University Information Security Institute is seeking qualified applicants for its innovative Master of Science in Security Informatics degree program. Study alongside world class interdisciplinary experts and gain unparalleled educational research and professional experience in information security and assurance. Interested U.S. citizens should consider the Department of Defense's Cyber Service Academy program, which covers tuition, textbooks and a laptop, as well as providing a $34,000 additional annual stipend. Apply for the fall 2026 semester and for this scholarship by February 28th. Learn more at CS JHU. EDU MSSI.
A (1:21)
DHS reassigns cyber to immigration duties A massive DDoS attack disrupts several major gaming platforms Discord refuses ransom after a third party support system breach. Researchers examine chaos ransomware and creative log poisoning web intrusions. The FCC reconsiders its telecom data breach disclosure rule. Experts warn of teen recruitment and pro Russian hacking operations. Ukraine's Parliament approves the establishment of cyber forces. Troy Hunt criticizes data breach injunctions as empty gestures. Our guest today is Sarah Graham from the Atlantic Council's Cyber Statecraft initiative, discussing their report Mythical Beasts diving into the Depths of the Global Spyware Market and Spy Dog's secret Site goes off Leash Today is Thursday, October 9th, 2025. I'm Maria Var, and this is your Cyber Wire Intel Briefing. Hi everyone. Thank you for joining me today. I'm standing in for Dave Buettner. He'll be back tomorrow. Let's get into it. The Department of Homeland Security has reassigned hundreds of national security employees, including cybersecurity specialists from the Cybersecurity and Infrastructure Security Agencies Agency, better known as cisa, to support President Trump's deportation initiatives. Current and former employees say that the reassignments, which are described as mandatory, come with threats of dismissal for refusal and often involve sudden relocations. Many of those moved had focused on protecting federal systems from nation state cyber attacks. Their transfers to agencies such as Immigration and Customs Enforcement and and Customs and Border protection have disrupted CISA's core mission, particularly within its capacity building and international engagement divisions. Staff morale has reportedly plummeted amid a climate of fear and censorship. Critics warn that the shift leaves the United States more vulnerable to cyber threats as major hacks continue to target government networks. DHS officials defend the moves as routine personnel alignment to meet agency priorities. Earlier this week, a massive DDoS attack disrupted several major gaming platforms, including Steam, Xbox, PlayStation, Riot Games and Epic Games. The coordinated assault, reportedly powered by the Airsuru Botnet reached record levels of 29.69 terabits per second, overwhelming servers and causing widespread outages across the industry. Riot Games confirmed that while its internal systems remained secure, Riot the flood of network traffic severely affected gameplay for League of Legends and Valorant users. Services have since been restored, but experts warn that the scale and simultaneity of this event reveal growing vulnerabilities in global gaming infrastructure. Discord says it will not pay a ransom to threat actors that are claiming to have stolen data on five and a half million users through its Zendesk support system, according to a report from Bleeping Computer. Discord disputes the hackers figures, stating that only about 70,000 users had government ID photos exposed, and emphasized that Discord itself was not breached. The attackers, on the other hand, alleged that they accessed a compromised support agent account with an outsourced provider stealing 1.6 terabytes of data, including user IDs, emails and partial payment details. For its part, Discord dismissed those claims as part of an extortion attempt and reaffirmed that no internal systems were compromised. The hackers reportedly demanded up to $5 million and threatened to leak the data after failed negotiations. Bleeping Computer could not verify the authenticity of the stolen data samples. Researchers at Fortinet examine Chaos ransomware, which resurfaced in 2025 with the new C variant, its first version not written in. Net, marking a major evolution in the malware's capabilities. Dubbed Chaos C, the strain combines encryption with destructive behavior, deleting large files entirely instead of encrypting them and then hijacking clipboard data to steal cryptocurrency payments. The malware disguises itself as a fake utility, silently executes its payload and employs multiple encryption methods including AES, RSA and xor. Its Clipboard hijacking feature replaces Bitcoin wallet addresses with attacker controlled ones redirecting potential payments. This Chaos variant reflects a broader shift from traditional ransomware to hybrid extortion and destruction, signaling chaos developers growing focus on financial theft and operational impact over simple data encryption and in other new research findings elsewhere. An investigation by Huntress details a hands on compromise that began in August 2025 with log poisoning, also called log injection. On a public phpmyadmin panel, the actor planted a one liner PHP web shell reminiscent of China Chopper, controlled it with Ant Sword and then installed Nezah, which is a monitoring tool used peer to run commands. The sequence ended with Ghost Remote Access Trojan or Ghost Rat. Huntress reports likely more than 100 victims, most frequently in Taiwan Japan, South Korea and Hong Kong. The access path involved weak defaults and exposed admin interf, highlighting real world risk from test stacks and outdated packages. Huntress suggests that defenders harden public apps, enforce authentication, monitor for Web shells, and detect suspicious service creation and execution paths. The Federal Communications Commission, better known as the FCC, will revisit its 2024 data breach disclosure rule that requires telecom providers to notify customers within 30 days. A 6th Circuit panel had upheld this rule, rejecting claims from the industry groups that it exceeded FCC authority and violated the Congressional Review Act. After those groups sought a rehearing, the FCC asked to suspend the case while it reexamines the order. A court then granted abeyance requiring Progress reports every 60 days. The arrest of two 17 year olds in the Netherlands has raised alarms about nation state hackers recruiting teenagers for espionage. The teens were detained for collecting WI fi data near Europol and other sensitive sites and were reportedly approached on telegram by pro Russian operatives. Dutch intelligence tipped police to the activity, which officials link to Russia's hybrid tactics. Security analysts say that this case underscores a growing pattern, and that is that threat actors are grooming teens on Telegram discord and gaming platforms to perform low skill digital tasks, from network scanning to credential theft. Experts warn that young recruits, who are often unaware of the consequences here, are being manipulated into aiding cyber operations. Dutch Prime Minister Dick Schoof called the trend extremely worrying, urging vigilance from parents and educators. Ukraine's parliament has approved in the first reading a bill to establish cyber forces within its military, reflecting the growing role of cyber warfare in its conflict with Russia. Backed by 255 lawmakers, the new command will defend Ukraine's digital infrastructure and report directly to the commander in chief and president. The cyber forces will recruit reservists, conduct training and operate under the General Staff's Cyber Directorate, aligning operations with NATO standards. Final approval awaits a second reading and presidential signature. Security researcher Troy Hunt argues that court injunctions following major data breaches like those granted to Hwl Ebsworth and Qantas are the legal equivalent of offering thoughts and prayers. In his analysis, Hunt notes that such orders don't detect hackers or Prevent leaks. After H.W.L. ebsworth's injunction against Russia's AlphaV group, the attackers ignored it and dumped the data anyway. Hunt says that these injunctions mainly restrict journalists, researchers and services like have I been pwned? Rather than the criminals themselves. While companies use them to appear proactive and protect shareholder interests, they offer little real defense for victims or transparency about compromised information. Stick around after the break where Dave Bittner sits down with Sarah Graham discussing their work and findings on mythical beasts diving into the depths of the global spyware market and Spy Dog's secret Psych goes off leash.