Transcript
A (0:02)
You're listening to the CyberWire network, powered by N2K. And now a word from our sponsor arcova. Formerly Morgan Franklin Cyber, arcova is a global cybersecurity and AI consulting firm built by practitioners who've been in the seat. They work directly with enterprise teams to solve complex security challenges or building secure by design programs that hold up as technology and threats evolve. From focused engagements to long term partnership, arcova delivers outcomes that endure because no one should navigate complexity alone. Learn why leading Global Enterprises Trust arcova@www.arcova.com that's a R C O V A.com.
B (1:08)
Iran linked hackers claim a breach of the FBI Director's personal email Shiny Hunters hit The European Commission F5 and Citrix warn of actively exploited flaws A WordPress plugin exposes hundreds of thousands of sites Infinity stealer targets macOS users A Russian APT adopts a new iOS exploit kit treasury weighs a cyber insurance backstop DHS clears suspended CISA staff Our guest is Brian Long, CEO and co Founder of Adaptive Security, discussing deepfake job hires and the new identity attack surface and bureaucrats bless a black box behemoth. Foreign. It's Monday, march 30, 2026. I'm dave bittner and this is your cyberwire intel briefing. Thanks for joining us here today. It is great to be back home after an eventful RSAC conference. We are appreciative to everyone who stopped by to say hello while we were in San Francisco. We gathered up a ton of interviews and we will be sharing those with you over the next couple of weeks. Thanks for joining us. Iran linked hackers calling themselves Handela Hack Team claim they breached FBI Director Kash Patel's personal Gmail account and published photos and more than 300 emails online. The FBI confirmed the account was targeted, but said the material was historical and contained no government information. Reuters could not independently verify the emails, though the address matches one previously tied to Patel in earlier breaches. Handela, widely assessed by Western researchers as a front for Iranian cyber intelligence activity, has recently claimed additional attacks, including against medical device firm Stryker and alleged data exposure involving Lockheed Martin employees. Analysts say the Patel leak fits a broader Iranian strategy to embarrass U.S. officials and Signal reach during ongoing tensions with the United States and Israel. These sorts of intrusions into officials personal accounts are not unusual and resemble earlier incidents involving senior U.S. figures. Intelligence assessments suggest Iran may continue low level cyber operations as part of retaliatory pressure. The European Commission confirmed a data breach affecting its Europa EU web platform after an attack claimed by the Shiny Hunters extortion group. Investigators say at least one Amazon Web Services account tied to the platform was compromised, though internal Commission systems were not affected and public websites remained operational. Officials believe some data was taken and are notifying potentially impacted EU entities while continuing to assess the scope of the incident. Shiny Hunters claims it stole more than 350 gigabytes of data, including databases, mail server content contracts and other sensitive files, and has posted a 90gb archive on its leak site. The commission has not verified the full extent of these claims, but says it is monitoring the situation and strengthening security measures. F5 Networks has upgraded the severity of a vulnerability in its Big IP Access Policy Manager from a denial of service flaw to a critical remote code execution issue warning it is actively exploited to deploy web shells on unpatched systems. The bug allows unauthenticated attackers to execute code on affected devices configured with access policies on virtual servers. F5 says earlier patches still address the risk but urges organizations to review logs, disks and terminal histories for signs of compromise. CISA added the flaw to its catalog of actively exploited vulnerabilities and ordered federal agencies to secure systems immediately. With more than 240,000 Big IP instances exposed online, the vulnerability presents a significant enterprise risk. Security researchers have confirmed active exploitation of a critical vulnerability in Citrix, netscaler, ADC and netscaler Gateway that can allow unauthenticated attackers to leak sensitive memory data. The flaw affects only customer managed systems configured as SAML identity providers, honeypot Telemetry from Watchtower and defused observed attackers sending crafted SAML requests to trigger data exposure. Citrix and agencies, including the UK's National Cybersecurity Centre, urge immediate patching, warning that exploitation began within days of disclosure and is ongoing in the wild. A vulnerability in the Smart Slider 3 WordPress plugin installed on more than 800,000 websites, allows authenticated users with subscriber level access to read arbitrary files from affected servers. The flaw stems from missing capability and file validation checks in the plugin's Ajax export function, enabling access to sensitive files such as wpconfig php, which contains database credentials and cryptographic keys. Although rated medium severity because authentication is required, the issue poses significant risk for sites with user accounts. The bug affects multiple versions. Researchers estimate roughly half a million sites may still be vulnerable. No act of exploitation has been confirmed, but administrators are urged to update promptly. Infinity Stealer is a newly identified macOS information stealing malware delivered through a fake Cloudflare CAPTCHA using the ClickFix social engineering technique. Victims are prompted to paste a base64 encoded curl command into Terminal, which installs a python based payload compiled into a native macOS binary using the Nootka compiler. According to Malwarebytes, this marks the first observed campaign combining click fix delivery with a NUCA compiled macOS info stealer. Once installed, the malware performs anti analysis checks and steals browser credentials, macrosos keychain data, cryptocurrency, wallets, screenshots and developer secrets before exfiltrating them to command and control infrastructure. Researchers say the native binary format complicates detection and analysis, highlighting increasingly sophisticated threats targeting macOS users. Russian state linked threat group Star Blizzard has adopted the Dark Sword iOS exploit kit in a new campaign targeting Apple devices and iCloud accounts, according to Proofpoint. The activity observed March 26 uses Atlantic Council themed phishing emails sent from compromised accounts and marked a shift to link based delivery. Evidence suggests the group is using darksord for credential harvesting and intelligence collection. Targets included government, financial, legal, academic and think tank organizations indicating expanded operational scope. The US Treasury Department is seeking public comment on whether catastrophic cyber incidents should qualify for coverage on under the Terrorism Risk Insurance Program trip, signaling renewed debate over a possible federal cyber insurance backstop originally created after 9 11. TRIP supports insurers facing large terrorism related losses, but cyberattacks remain difficult to classify under the program due to challenges around attribution, intent and scale. Officials are examining whether this ambiguity leaves critical infrastructure operators exposed to to major cyber disruptions that private insurers may not be able to absorb. Researchers say discussions remain exploratory, with no immediate policy changes expected, even as cyber risks continue to grow. Experts warn that events such as large cloud outages or attacks on power grids could exceed current insurance limits. Insurers often structure policies to avoid correlated systemic losses, increasing concern that a severe cyber incident could create economic damage beyond what the private market can cover. The Department of Homeland Security has ended an investigation into seven cybersecurity and infrastructure security Agency staff members who were placed on leave after arranging a counterintelligence polygraph exam that former acting SISA Director Madhu Gadamukkala failed in July 2025, officials said. The probe was closed about a week ago and the staff were cleared of wrongdoing. At least five career employees and one contractor had their security clearances suspended following their involvement in scheduling or approving the exam, which was required for access to a sensitive intelligence program. Lawmakers on the House Homeland Security Committee welcomed the decision, calling the action a correction after employees were penalized for performing their duties. It remains unclear whether all affected staff will return, and CISA continues to operate without permanent leadership. Coming up after the break, my conversation with Brian Long, CEO and co founder of Adaptive Security. We're discussing deep fake job hires and the new identity attack surface and bureaucrats bless a black box behemoth. Stick around. Maybe that's an urgent message from your CEO. Or maybe it's a deep fake trying to target your business. Doppel is the AI native social engineering defense platform fighting back against impersonation and manipulation. As attackers use AI to make their tactics more sophisticated, Doppel uses it to fight back from automatically dismantling cross channel attacks to building team resilience and more Doppel outpacing what's next in social engineering? Learn more@dopl.com that'S-O-P p e l.com. Ever wished you could rebuild your network from scratch to make it more secure, scalable and simple? Meet Meter, the company reimagining enterprise networking from the ground up. Meter builds full stack zero trust networks including hardware, firmware and software, all designed to work seamlessly together. The result? Fast, reliable and secure connectivity without the constant patching, vendor juggling or hidden costs. From wired and wireless to routing, switching, firewalls, DNS security and vpn, every layer is integrated and continuously protected in one unified platform. And since it's delivered as one predictable monthly service, you skip the heavy capital costs and endless upgrade cycles. Meter even buys back your old infrastructure to make switching effortless, transform complexity into simplicity, and give your team time to focus on what really matters, helping your business and customers thrive. Learn more and book your demo@meter.com cyberwire that's M E T E R.com cyberwire. Brian Long is CEO and co Founder of Adaptive Security. I caught up with him Last week at RSAC 2026 for this sponsored Industry Insights conversation.