Transcript
A (0:02)
You're listening to the Cyberwire Network powered by N2K.
B (0:11)
Most environments trust far more than they should, and attackers know it. ThreatLocker solves that by enforcing default deny at the point of execution. With ThreatLocker allow listing, you stop unknown executables cold. With ring Fencing, you control how trusted applications behave, and with threatlocker DAC defense against configurations, you get real assurance that your environment is free of misconfigurations and clear visibility into whether you meet compliance standards. ThreatLocker is the simplest way to enforce zero trust principles without the operational pain. It's powerful protection that gives CISOs real visibility, real control, and real peace of mind. ThreatLocker makes zero trust attainable even for small security teams. See why thousands of organizations choose Threat Locker to minimize alert fatigue, stop ransomware at the source, and regain control over their environments. Schedule your demo@threatlocker.com N2K today. Suspects Russia is developing a new anti satellite weapon to disrupt the Starlink network. A failed polygraph sparks a DHS probe and deepens turmoil at cisa. A look back at Trump's cyber policy shifts. Max sinksteeler adopts a stealthy new delivery method. Researchers warn a popular open source server monitoring tool is being abused. Cybercriminals are increasingly bypassing technical defenses by recruiting insiders. Scripted Sparrow sends millions of BEC emails every federal prosecutors take down a global fake ID marketplace We've got our Monday business brief. Our guest is Eric Woodruff, chief identity architect at Semperis, discussing no auth abuse alert, Full account takeover and atomic precision meets Colorado Weather. It's Monday, December 22, 2020. I'm Dave Buettner and this is your Cyberwire Intel Briefing. Thanks for joining us here today. It's great to have you with us. Two NATO intelligence services suspect Russia is developing a new anti satellite weapon designed to disrupt Elon Musk's Starlink network by releasing clouds of high density pellets into orbit. According to intelligence findings seen by the Associated Press, the so called Zone Effect weapon could disable many satellites at once, potentially undermining Western space advantages that have supported Ukraine. Analysts not briefed on the findings question whether such a system could be used without causing uncontrollable debris and widespread damage, including to Russia's own satellites. Some experts argue the concept may be experimental, exaggerated or intended as a deterrent rather than a deployable weapon. While Russia denies plans to weaponize space, officials have warned that commercial satellites aiding Ukraine could be legitimate targets, keeping concerns about escalation and orbital chaos alive. Our history repeats itself. Desk sent us a link to the Wikipedia page on project Westford, a US experiment from the 70s which involved putting needles in orbit. We'll have a link in the show, notes Acting Cybersecurity and Infrastructure Security Agency Director Madhu Gadamukkala failed a polygraph exam in July after seeking access to a highly sensitive intelligence program, according to multiple current and former officials. That access required a counterintelligence polygraph, which senior career staff had questioned, arguing Gautamukkala lacked a clear need to know and could rely on less classified material. He nevertheless pushed forward and took the test. After the failed exam, the Department of Homeland Security launched an investigation alleging that career staff misled Ghatamukala into taking an unsanctioned at least six employees were placed on paid administrative leave, a move that angered staff and raised concerns about leadership accountability. DHS disputes that Gautamukkala failed an authorized test, while career officials contest that characterization. The episode has intensified instability at cisa, which is already grappling with staffing losses, budget cuts and the absence of a Senate confirmed director. A sweeping report by Krebs on security details how the Trump administration has pursued rapid policy shifts that critics say are undermining U.S. capacity to manage cybersecurity, corruption, privacy disinformation and press freedom. The changes span nearly every corner of government and emphasize reduced enforcement, dismantled oversight and and tighter political control. According to the report, the administration expanded ideological screening and surveillance through new executive orders affecting speech, immigration and travel. At the same time, it scaled back anti corruption efforts by halting enforcement of bribery laws, dissolving kleptocracy and foreign influence task forces, retreating from crypto regulation and issuing controversial pardons. Federal cybersecurity suffered acute damage. Leadership was purged, advisory boards disbanded, budgets slashed and staff reassigned, leaving agencies like CISA severely weakened. The report also describes intensified pressures on the press, erosion of consumer and privacy protections, and unprecedented data access under the now defunct DOGE initiative, raising long term national security concerns. Researchers at JAMF report that the macOS malware MacSync stealer has adopted a new delivery method that no longer requires users to run commands in the terminal. Originally a rebrand of the low cost Mac C InfoStealer, MacSync Stealer now uses a code signed, notarized Swift app disguised as a legitimate installer. The dropper quietly fetches and executes malicious scripts, adding stealth persistence and gatekeeper evasion. JAMF says this shift reflects a broader trend toward abusing trusted macOS app mechanisms. Researchers at Ontinu warn that Neja, a legitimate open source server monitoring tool, is being abused by attackers as a remote access Trojan. Because NESA is widely trusted and rarely flagged by security tools, hackers can use it to gain persistent system level access across Windows, Linux, macOS and even routers. Its normal looking network traffic helps it blend in. Experts say. The abuse reflects a growing trend of attackers weaponizing legitimate software, forcing defenders to focus on behavior and context rather than labels alone. Researchers at Check Point say cybercriminals are increasingly bypassing technical defenses by recruiting insiders to provide access to corporate networks, devices and cloud environments. On Darknet forums, employees are solicited or sometimes volunteer to sell credentials, disable security controls or share sensitive data in exchange for cash, often paid in cryptocurrency. These insider actions create major blind spots for security teams and make attacks far harder to prevent. Financial services Cryptocurrency platforms, banks, technology firms, telecoms and logistic companies are frequent targets, with payouts ranging from a few thousand dollars to six figures for high value access or datasets. Ransomware groups have also expanded recruitment through encrypted platforms offering profit sharing schemes. The trend highlights a growing insider threat that combines financial incentives with anonymity. Defending against it requires employee education, strict access controls, behavioral monitoring and proactive surveillance of Darknet activity alongside traditional cybersecurity tools. Researchers at Fortra have identified a prolific business email compromise group dubbed Scripted Sparrow, which sends an estimated 4 to 6 million targeted emails each month. Active since mid 2024. The group poses as executive coaching firms and targets accounts payable teams with fake invoices and W9 forms. Fortress says the loose collective operates across multiple continents, uses hundreds of domains and bank accounts and relies on spoofed reply chains to boost credibility. US prosecutors have charged Zahid Hassan, a 29 year old resident of Bangladesh, with running a global fake ID marketplace that fueled identity theft worldwide. According to the US Department of Justice, Hassan sold digital templates for forged passports, driver's licenses and Social Security cards through multiple websites from 2021 to 2025. Investigators say the scheme generated more than $2.5 million from over 1400 customers. The operation was dismantled by the FBI with international partners, and Hasan now faces multiple federal fraud charges. Turning to our Monday business brief, a wave of global cybersecurity funding and deal making highlights sustained investor interest across fraud prevention, AI security, identity and infrastructure protection. New York based Adaptive Security led the week with an $81 million Series B, bringing its total funding to $146.5 million since launching in early 2025. Other notable raises include Echo at $35 million, Casada at $20 million, Resemble AI at 13 million and EverTrust at 10 million euros. Early stage funding went to startups including Dux, Verisol, Cyflens, Soverli and Realm Security. Mergers were equally active, with acquisitions by Outpost24, Silent Push, MetaCompliance, Arterys, Spy and Sideras, underscoring continued consolidation across the security market. Be sure to check out our weekly business brief on our website that's part of Cyberwire Pro. Coming up after the break, my conversation with Eric Woodruff from Sempras. We're discussing no AUTH Abuse Alert, Full Account Takeover and Atomic Precision meets Colorado Weather. Stay with us.