Transcript
A (0:02)
You're listening to the Cyberwire Network powered by N2K.
B (0:11)
Most environments trust far more than they should, and attackers know it. ThreatLocker solves that by enforcing default deny at the point of execution. With ThreatLocker allow listing, you stop unknown executables cold. With ring Fencing, you control how trusted applications behave and with threatlocker DAC defense against configurations, you get real assurance that your environment is free of misconfigurations and clear visibility into whether you meet compliance standards. ThreatLocker is the simplest way to enforce zero trust principles without the operational pain. It's powerful protection that gives CISOs real visibility, real control, and real peace of mind. ThreatLocker makes zero trust attainable even for small security teams. See why thousands of organizations choose Threat Locker to minimize alert fatigue, stop ransomware at the source, and regain control over their environments. Schedule your demo@threatlocker.com N2K today. The White House bans foreign made drones African law enforcement agencies crack down on cybercrime. A new phishing campaign targets Russian military personnel and defense related organizations. A University of Phoenix data breach affects about three and a half million people. A pair of Chrome extensions covertly hijack user traffic. Romania's National Water Authority suffered a ransomware attack. A cyber attack in France disrupts postal, identity and banking services for millions. NIST and Mitre announced a $20 million partnership for a research centers. A think tank says the US Needs to go on the cyber offensive. Tim Starks from cyberscoop discusses the passage of the Defense Authorization bill and in high school, it's no Child Left Unscanned. It's Tuesday, December 23rd, 2025. I'm Dave Buettner and this is your Cyberwire Intel Brief. Thanks for joining us here today. It's great as always to have you with us. The Trump administration announced that all foreign made drones and their components pose unacceptable national security risks and will be placed on a federal blacklist, effectively blocking new sales in the United States. While exceptions may be granted by the Pentagon or Homeland Security, the move is widely understood to halt future US Sales of drones from China's dji, the dominant global manufacturer. Existing drones will remain legal to use in part to avoid disrupting emergency and law enforcement operations that rely heavily on DJI equipment. Many US Drone pilots and small businesses say the decision threatens their livelihoods and limits access to affordable, high quality technology. DJI has protested the ruling and requested a formal security audit. Meanwhile, US Drone manufacturers welcome the decision, calling it a turning point for rebuilding a domestic drone industry. African law enforcement agencies arrested 574 suspects during a month long cybercrime crackdown coordinated by Interpol. Operation Sentinel, which ran from October 27 through November 27, targeted business, email compromise, digital extortion and ransomware. Authorities recovered $3 million in alleged criminal proceeds, dismantled 6,000 malicious links and decrypted six ransomware variants. Interpol says the cases were tied to more than $21 million in losses, highlighting the rapid growth and increasing sophistication of cybercrime across Africa. A little known cyber espionage group known as GoFi has launched a phishing campaign targeting Russian military personnel and defense related organizations, according to researchers at Intezer. The operation used Russian language lures, including fake New Year concert invitations for senior officials and forged letters tied to defense contracts to deliver a malicious Excel Xll file. When opened, the file installed a previously undocumented backdoor echogather, enabling system reconnaissance, command execution and data theft. Stolen data was exfiltrated to servers disguised as a food delivery site. Researchers say the group's technical and linguistic errors suggest evolving tradecraft. While gophy, also called Paper Werewolf, is believed to be pro Ukrainian, its origins remain unconfirmed. The University of Phoenix disclosed a data breach affecting about three and a half million people, including students, former attendees and staff. The breach stemmed from unauthorized external access that began in August but was not discovered until November. Exposed data included names paired with other personal identifiers, creating potential identity theft risks. More than 9,000 residents of Maine were affected, triggering regulatory notifications. The university has offered identity theft protection and retained outside counsel to manage the response. A pair of Chrome extensions called Phantom Shuttle are masquerading as proxy tools while covertly hijacking user traffic and stealing sensitive data, according to researchers at Socket. The extensions, which have been available in the Google Chrome Web Store since at least 2017, target users in China and are marketed to foreign trade workers testing network connectivity Sold via subscription, the plugins route all browsing traffic through attacker controlled proxies using hard coded credentials hidden in obfuscated code, researchers say. The extensions dynamically reconfigure Chrome's proxy settings and selectively intercept traffic from more than 170 high value domains. Acting as a man in the middle, Phantom Shuttle can capture credentials, session cookies and API tokens. Google had not commented at the time of reporting. Romania's national water authority, Romanian Waters, is recovering from a ransomware attack that began Dec. 20, impacting roughly 1,000 systems, according to the National Cybersecurity Directorate. The attack disrupted email servers, workstations and GIS systems across the central office and 10 regional branches, though dams and flood defenses remained operational and are being managed manually. Investigators say attackers abused Windows BitLocker, a legitimate encryption tool to lock files, complicating detection. A ransom note demanded negotiations, which authorities rejected under a no payment policy. The incident highlights growing cyber risks to water infrastructure and has prompted moves to bring Romanian waters under stronger national cyber protection. With support from the Romanian intelligence service, France's postal service, La Poste confirmed that a major network incident knocked all of its information systems offline, disrupting online postal identity and banking services for millions of customers. The outage affected the company's website, mobile app, Digipost, document storage and digital identity services, with some post offices also experiencing temporary disruptions. La Banque Postal said its online and mobile platforms were unavailable, but core banking operations, including card payments, ATM withdrawals and transfers, continue to function. While La Poste has not disclosed the technical cause, French media reported the disruption was likely due to a distributed denial of service attack. The incident highlights the operational impact of large scale cyber disruptions on critical public services operated by Group La Poste. The National Institute of Standards and Technology announced a $20 million partnership with the Mitre Corporation to launch two new artificial intelligence research centers, including one focused on cybersecurity risks to US Critical infrastructure. One center will support advanced manufacturing, while the AI Economic Security center will examine how sectors like water, power and communications can defend against AI enabled cyber threats. NIST said the centers will drive adoption of AI tools, including agentic AI, while addressing adversarial use and insecure AI systems. The effort is part of a broader federal push to strengthen US Competitiveness in AI. Industry experts welcomed the move but stressed that infrastructure operators must be directly involved to ensure research translates into practical, deployable security improvements. The United States must move beyond a reactive cyber posture to confront sustained threats from China and Russia, according to a new report from the McCrary Institute for Cyber and Critical Infrastructure Security. The analysis argues that US Cyber policy remains shaped by crisis response, while Beijing and Moscow treat cyberspace as a domain of constant strategic competition. China is described as the most deliberate adversary maintaining persistent access to US Critical infrastructure for potential coercion during crises. Russia, meanwhile, integrates cyber operations into military campaigns and regional conflicts. The report warns that incremental reforms risk ceding initiative to adversaries and highlights Friction between U.S. military and intelligence missions, including the dual hat relationship between the national security agency and U.S. cyber command. Researchers call for updated authorities, clearer roles and structures aligned with continuous cyber competition. Coming up after the break, Tim Starks from cyberscoop discusses the passage of the Defense authorization bill. And in high school, it's no Child Left Unscanned. Stick around.