Transcript
Dave Bittner (0:02)
You're listening to the Cyberwire Network powered by N2K.
Interviewer/Host (0:12)
When cyber threats strike, minutes matter. Booz Allen brings the same battle tested expertise trusted to protect national security to defend today's leading global organizations. They safeguard their data, strengthen enterprise resilience and mobilize in minutes across energy, healthcare, financial services and medicine manufacturing. Their teams don't just respond, they anticipate, outthink and stay ahead of evolving threats. This is powerful protection for commercial leaders only. From Booz Allen. See how your organization can prepare today@booz allen.com Commercial. Israel claims a strike on Iran's cyber warfare headquarters the Trump administration releases a new national cyber strategy. DHS shakes up its IT and cybersecurity leadership. Velvet Tempest uses click fix to drop loaders and rats. Researchers uncover a Linux cryptocurrency clipboard hijacker. The DOJ brings a Ghanaian romance scammer to justice. Online advertising enables government tracking we got our Monday business breakdown. Our guest is John France, CISO from ISC2, sharing some insights and findings from their 2025 ISE2 Cybersecurity Workforce Study and an Apple II app gets audited by AI. It's Monday, march 9, 2026. I'm dave buettner and this is your cyberwire intel briefing. Thanks for joining us here today. It's great as always to have you with us. Happy Monday. Israel says it struck a Tehran compound that allegedly housed Iran's cyber warfare headquarters, the Intelligence Directorate and other key military units, including elements of the Islamic Revolutionary Guard Corps. The Israel Defense Forces announced the operation but provided few operational details beyond a digital illustration of the site. While the strike targeted facilities linked to Iran's cyber operations, its actual impact on Tehran's cyber capabilities remain unclear. Threat intelligence monitoring suggests cyber activity tied to Iran has continued despite the attack. Analysts note that cyber operations often rely on distributed infrastructure and remote operators, meaning physical facilities are not always critical to ongoing campaigns. Additionally, a nationwide Internet blackout in Iran following February 28 US Israeli strikes appears to have disrupted connectivity more than the destruction of the compound itself. Security researchers warn that Iranian state sponsored groups have already established access within regional networks before hostilities escalated. These pre positioned capabilities, along with externally operated infrastructure, could allow operations to continue even while domestic connectivity is degraded. The Trump administration released a new national cyber strategy Friday that emphasizes stronger offensive cyber operations, protection of federal networks and critical infrastructure, streamlined regulations and expanded use of emerging technologies like AI and post quantum cryptography. The document outlines six pillars, including shaping adversary behavior through both government and private sector cyber capabilities, modernizing federal systems with zero trust and advanced encryption, securing infrastructure and supply chains and building a stronger cybersecurity workforce. The strategy also promotes reducing regulatory burdens while encouraging coordination between government and industry. Separately, President Trump signed an executive order directing agencies to prioritize prosecution of cybercrime and fraud, including efforts against foreign backed criminal networks. Industry groups broadly welcome the strategy's focus on deterrence, innovation and regulatory reform. Though some lawmakers criticized it as vague and lacking a detailed implementation plan. The White House said more detailed guidance will follow in future policy documents. The Department of Homeland Security is undergoing a shakeup in its IT and cybersecurity leadership, with multiple senior officials departing amid a broader reorganization. Chief Information Security Officer Hemant Baiduan is expected to leave later this month following the February exit of Deputy CISO Amanda Day, who has joined Workday as vice president of cybersecurity and trust. Sources say the changes are part of a wider realignment led by DHS Chief information officer Antoine McCord, aimed at consolidating IT leadership across the department's component agencies under the central DHS CIO office. The effort reportedly includes placing headquarters personnel into key technology roles across agencies such as FEMA and cisa. The leadership churn coincides with other high level changes, including the departure of Homeland Security Secretary Kristi Noemi. Some officials warn the upheaval could risk a brain drain at DHS during a period of heightened geopolitical tensions and cyber threats. The ransomware group Velvet Tempest is using the ClickFix social engineering technique and built in Windows tools to deploy donut loader malware and the Castle Rat backdoor, according to researchers at Malbeacon. The activity was observed over 12 days in an emulated US nonprofit network with more than 3,000 endpoints. Attackers gained access through a malvertising campaign that presented a fake captcha and instructed victims to paste an obfuscated command into the Windows run dialog. The command launched nested command line processes that downloaded malware loaders, followed by PowerShell scripts used for reconnaissance code credential harvesting from Chrome and staging additional payloads, the intrusion ultimately deployed Donut Loader and retrieved Castle Rat, enabling persistent remote access. Although Velvet Tempest is known for deploying major ransomware strains such as rioc, Revil, Conti and Lockbit, researchers did not observe ransomware being executed in this case. Researchers at Sibyl Research and Intelligence Labs identified a new Linux malware strain called Clipx Daemon, an autonomous cryptocurrency clipboard hijacker targeting x11 based environments delivered through a loader structure previously linked to shadow HS activity. The malware appears unrelated to that campaign, with both likely using the same open source bincryptor encryption framework independently. Clipx daemon operates without command and control infrastructure or external communication. Instead, it monetizes victims by monitoring the system clipboard and replacing copied cryptocurrency wallet addresses with attacker controlled ones. The malware targets multiple currencies including Bitcoin and Ethereum. The attack chain uses a three stage an encrypted loader, a memory resident dropper and and a persistent on disk ELF payload. It employs stealth techniques such as process masquerading, demonization and avoidance of Wayland sessions operating only in X11 environments. Researchers say the campaign reflects a shift toward autonomous user focused financial malware on Linux systems. A Ghanaian national, Derek Von Yebo, pleaded guilty to participating in a global fraud scheme involving romance scams, scams and business email compromise. According to the US Justice Department. The Ghana based operation caused more than $100 million in losses, with about $10 million attributed to Van Yebal. Prosecutors say he posed as romantic partners to gain victims trust and convince them to send money, and also impersonated business executives or suppliers in BEC scams to redirect corporate payments. He additionally helped launder proceeds from the fraud. Van Yebo pleaded guilty to conspiracy to commit wire fraud, which carries a maximum 20 year prison sentence, and agreed to pay more than $10 million in restitution and forfeiture. New reporting shows U.S. customs and Border Protection has used location data drawn from the online advertising ecosystem to track people's phones without warrants. Documents obtained by 404 Media confirm the agency relied partly on data generated through real time bidding, the advertising process that auctions ad space on websites and apps. RTB broadcasts user information such as device identifiers and location data to thousands of companies during ad auctions, allowing data brokers to collect and sell that information. Law enforcement agencies have purchased this data to track individuals movements, often bypassing traditional warrant requirements. Privacy advocates warn the practice exposes how surveillance based advertising systems can enable government monitoring. Experts urge stronger privacy laws, limits on precise location data in ad systems and restrictions on the sale of sensitive data to authorities. Individuals can reduce exposure by disabling advertising IDs and limiting apps location permissions. Turning to our Monday business breakdown, several cybersecurity startups announced major funding rounds as investors continue backing AI driven security platforms and resilience technologies. Upguard raised $75 million in a series C round to expand its AI powered cyber risk posture management platform and pursue acquisitions. Israeli firms Gambit Security and Fig Security emerged from stealth with $61 million and $38 million, respectively, to develop cyber resilience and SecOps platforms. Jetstream Security launched with $34 million for AI governance and security tools, while Threat Aware secured $25 million to expand its cyber asset management platform. Armor code raised $16 million to advance its AI exposure management platform, and SecFix obtained $12 million to grow its compliance automation services. In mergers and acquisitions, Zurich Insurance Group plans to acquire UK cyber insurer Beasley for about $11 billion to expand cyber risk coverage. Other deals include Echo acquiring ot security firm Datalogix, Myriad 360 buying technology provider Advisex and Bastion Security Group acquiring Australian security engineering firm Astralis. Be sure to check out our weekly business briefing that's on our website and is part of Cyberwire Pro. Coming up after the break, my conversation with jon France from ISC2 with some of the insights and findings from their cybersecurity workforce study and An Apple II app gets audited by AI Stick around. AI is changing how enterprises operate and how they stay protected. It's time to eliminate risk and protect innovation. From March 23rd through the 26th, join Trend AI for actionable AI security insights. Catch impactful sessions at RSAC, then unwind and grab a bite at their lounge in Troposweno. Experience industry leading AI security in person. Engage with the experts and get your chance to win $500,000. San Francisco lets AI fearlessly. Learn more at trend micro.com RSA. If you're defending a network today, there's a simple question worth asking. What does the attacker see when they look at your organization? Nord Stellar helps answer that. Nord Stellar is a threat exposure management platform that gives security teams visibility into external risks, including leaked credentials, active session tokens, impersonation attempts and exposed assets across the surface web and the dark web. It's built to help organizations detect the consequences of breaches early, before attackers turn access into action. From monitoring for infostealer malware logs to identifying cybersquatting and brand abuse, Nord Stellar helps teams focus on the threats that actually matter. Executives get clear, actionable insights tied to business risk. Security teams get real time alerts and one of the largest deep and dark web intelligence pools in the industry. Cybercriminals may already be looking for your weak spots. Don't make it easy for them. Be the one that's prepared. Defend your business with Nordstellar. Use the code CYBERWIRE10 to unlock your exclusive discount. Go to nordstellar.com cyberwire daily and learn more. John France is chief Information security officer at ISC2. I recently caught up with him for insights and findings from their 2025 ISC2 Cybersecurity Workforce Study.