Transcript
A (0:02)
You're listening to the Cyberwire Network powered by N2K.
B (0:14)
No, it's not your imagination. Risk and regulation really are ramping up, and these days customers expect proof of security before they'll even do business. That's where Vanta comes in. Vanta automates your compliance process and brings compliance, risk and customer trust together on one AI powered platform. So whether you're getting ready for a SoC2 or managing an enterprise governance risk and compliance program, Vanta helps keep you secure and keeps your deals moving. Companies like Ramp and RYTR spend 82% less time on audits with Vanta. That means less time chasing paperwork and more time focused on growth. For me, it comes down to this. Over 10,000 companies, from startups to large enterprises, trust Vanta to help prove their security. Get started@vanta.com cyber. Iran Linked hackers signal cyber attacks will continue despite the ceasefire Microsoft restores access after suspending open source developer accounts John Deere settles its right to repair fight Suspected Adobe Reader Zero Day surfaces Palo Alto Networks and Sonicwall patch high severity flaws New macOS malware targets Crypto wallets A threat cluster abuses Live chat to bypass MFA CISA orders Urgent Ivanti patching researchers Track a stealthy DDoS for hire botnet Our guest is Edgar Captivieli, CEO of Nozomi Networks, sharing insights on threats posed by nation states and AI on OT security and Mac OS has a 49 day time limit. It's Thursday, April 9, 2026. I'm Dave Buettner and this is your Cyberwire Intel Briefing. Thanks for joining us here today. It's great as always to have you with us. Pro. Iranian hacker groups say a fragile ceasefire involving Iran, the United States and Israel will not stop their cyber operations, warning that digital retaliation will continue despite reduced military tensions. One group, handela, said it's pausing attacks on US Targets for now, but will keep targeting Israel and may resume operations against America later. US Authorities also warned that Iran linked hackers have already infiltrated programmable logic controllers used in critical infrastructure such as ports, power plants and water systems. Security agencies urged organizations to strengthen defenses immediately. Experts caution that cyber activity may actually increase during a ceasefire as threat actors shift attention toward U.S. companies connected to the war effort, including data centers and defense contractors. So far, many attacks appear more symbolic than destructive, but analysts warn they still highlight persistent vulnerabilities and the growing role of cyber operations as a lasting feature of modern conflict. Microsoft suspended developer accounts used to maintain several widely used open source Windows projects, temporarily preventing them from publishing updates and security patches. Affected software included Wireguard, Veracrypt, Memtest86 and Windscribe. Developers said they received no warning or clear explanation and were unable to reach human support, raising concerns about delayed responses to potential security vulnerabilities affecting Windows users. After public reporting, Microsoft said the suspensions resulted from missed mandatory account verification requirements in the Windows hardware program, which partners had been notified about since October of last year. Accounts that failed verification within 30 days were automatically suspended. Microsoft executives later acknowledged communication gaps and said the company is reviewing its notification process. Some accounts began moving toward reinstatement after media attention prompted direct outreach from Microsoft leadership. Farmers reached a landmark settlement with John Deere in a long running right to repair dispute, securing $99 million for plaintiffs who paid authorized dealers for major equipment repairs since 2018. Court documents indicate participants may recover 26 to 53% of alleged overcharged dam, well above typical class action recoveries. The agreement also requires Deere to provide digital tools needed for maintenance diagnostics and repairs on tractors and combines for 10 years, addressing long standing restrictions that previously forced some farmers to modify equipment software themselves. The settlement still requires judicial approval. Deere also continues to face a separate lawsuit from the Federal Trade Commission, which alleges the company unlawfully restricted repair access, a case that could influence broader right to repair efforts across multiple industries. Researcher Hai Fei Li reports a likely actively exploited zero day in Adobe Reader after detecting a malicious PDF through his Xmon sandbox system. The file can collect system data and may enable remote code execution and sandbox escape. Though the full attack chain remains unconfirmed, evidence suggests exploitation may have been ongoing for at least four months, with some samples using Russian language lures tied to oil and gas topics. Adobe is reviewing the findings after receiving disclosure details. In early April, Palo Alto Networks and Sonicwall released patches for multiple vulnerabilities, including two high severity flaws affecting enterprise security platforms. Palo Alto Networks fixed a vulnerability in Cortex xsoar and XSIM integrations with Microsoft Teams, which could allow attackers to tamper with protected resources, along with additional Windows Agent and chromium related issues. Sonicwall addressed an issue in SMA 1000 firewalls, which could enable privilege escalation, plus flaws exposing VPN credentials or bypassing authentication. Neither company reports active exploitation but urges prompt updates. Researchers at Moonlock Lab identified not null OS x, a new macOS malware strain designed to steal cryptocurrency from high value victims with balances above $10,000. First detected on March 30. Activity has been observed in Vietnam, Taiwan and Spain the malware uses social engineering, including fake Google Docs errors and a Trojanized wall space app to trick users into running malicious terminal commands and granting full disk access. It can read sensitive data and maintain persistent remote control. A feature called Replace app swaps legitimate wallet tools such as Ledger Live and Trezor with malicious versions to capture seed phrases. Researchers attribute the platform to a developer known as OXFF and warn its modular design could support broader future targeting. Google Threat Intelligence Group Researchers warn that a financially motivated threat cluster tracked as UNC6783 is targeting business process outsourcers and large enterprises through Help Desk and Live Chat social engineering to enable data theft and extortion. Principal analyst Austin Larson said attackers direct employees to spoofed Okta login pages using deceptive Zendesk style domains that capture credentials and clipboard based multi factor authentication data, allowing persistent access. The group also distributes fake security updates that install remote access malware and and later sends ransom notes via protonmail after exfiltration. Researchers say the tactics resemble earlier Help Desk focused extortion campaigns and urge organizations to deploy Phishing resistant authentication to monitor chat channels and audit newly enrolled MFA devices. Researchers at Trellix report that the Majesu botnet has operated continuously since 2023 and as a stealth focused DDoS for hire platform targeting routers, gateways and other IoT devices across multiple processor architectures. Marketed primarily through Telegram, the service supports large scale tcp, UDP and HTTP flooding and claims attack volumes reaching hundreds of gigabits per second. The malware spreads by scanning for known vulnerabilities in devices from vendors such as D Link, gpon and Netgear while using XOR based obfuscation, cron persistence and process spoofing to evade detection. It also avoids block listed government IP ranges to reduce scrutiny. Updated samples show expanded command and control redundancy and broader device targeting, underscoring the botnet's evolution into a resilient, commercially operated extortion and disruption platform. CISA has ordered federal agencies to patch a critical vulnerability in Ivanti Endpoint Manager Mobile within four days after confirming active exploitation since January. The flaw allows unauthenticated remote code execution on exposed systems. Avanti previously warned only a limited number of customers were affected, but nearly 950 Internet facing instances remain visible. CISA added the issue to its known Exploited Vulnerabilities catalog and urged all organizations to prioritize patching immediately due to ongoing risk. Coming up after the break, my conversation with Edgar Captivieli, CEO of Nozomi Networks. We're talking about threats posed by nation states and AI on OT security and macOS has a 49 day time limit. Stay with us. Maybe that's an urgent message from your CEO, or maybe it's a deepfake trying to target your business. Doppel is the AI native social engineering defense platform fighting back against impersonation and manipulation. As attackers use AI to make their tactics more sophisticated, Doppel uses it to fight back from automatically dismantling cross channel attacks to building team resilience and more. Doppel outpacing what's next in social engineering. Learn more@dopl.com that's d o p e l.com. Edgard Captivieli is CEO of Nozomi Networks. I recently sat down with him at the RSAC 2026 conference for this sponsored Industry Insights conversation about threats posed by nation states and AI on OT security.