Transcript
A (0:02)
You're listening to the Cyberwire Network powered by N2K. These days, attackers rarely start with a bang. They start quietly. A leaked credential, a stolen session cookie, A lookalike domain that shouldn't exist. That's where Nord Stellar comes in. Nord Stellar is a threat exposure management platform that helps organizations see what attackers already know about them. Turns into an incident. It brings together data breach monitoring, dark web monitoring, attack surface management and cyber squatting detection in a single platform. That means visibility into leaked credentials and malware logs, insight into brand impersonation attempts, and a clear picture of exposed Internet facing assets and shadow it for CISOs. It's a way to reduce response costs, prioritize real risk and communicate clearly with the board. For security teams, it's real time alerts, contextual intelligence and faster investigations without the noise. Most companies only react after the damage is done. Don't wait until your data is already for sale. Protect your business today with Nord Stellar. Learn more@nordstellar.com CyberWire Daily don't forget to mention CyberWire 10 for an exclusive offer. Iran's muddy water breaches Multiple U.S. organizations the FBI probes a breach of wiretap management systems. A China linked threat actor targets South American telecoms, Cisco patches, critical firewall flaws, CISA flags actively exploited, bugs in hikvision cameras and and Rockwell industrial systems. The House Committee advances the controversial Kids Online safety bill. The FBI arrests a suspect accused of stealing millions in seized crypto from the US Marshals Service. Ben Yellen and Ethan Cook unpack the dispute between Anthropic and the Pentagon and a Wikimedia worm wreaks widespread Wiki woes. Foreign March 6, 2026 I'm Dave Bittner and this is your Cyberwire Intel Briefing. Thanks for joining us here today. It's great as always to have you with us. Iranian Advanced Persistent Threat Group Muddy Water has infiltrated multiple organizations in the United States and allied regions, according to researchers at Broadcom's Symantec and Carbon Black Threat Hunting Team. The activity targeted an aerospace and defense contractor, a US bank, an airport, a software company with operations in Israel, and a non governmental organization active in the US And Canada. Researchers say the intrusions continued in recent days amid escalating tensions following US And Israeli military strikes on Iran. During the campaign, the attackers deployed two backdoors, Dindor and Fakeset, both signed with certificates linked to the names Amy Scharn and Donald Gay, the latter previously associated with muddy water operations. The group also attempted to exfiltrate data from the software company's Israeli branch. Although the observed activity has been disrupted, researchers warn the attackers existing foothold on US And Israeli networks could enable further operations. Major technology firms and policy leaders are rallying behind AI developer Anthropic as its dispute with the Pentagon intensifies. The Information Technology Industry Council, which represents companies including Google, Apple and Microsoft, warned the Defense Department that labeling Anthropic a supply chain risk over a procurement disagreement could set a dangerous precedent for the tech industry and the defense industrial base. Separately, a bipartisan group of defense intelligence and technology policy experts urged Congress to investigate the Pentagon's actions, arguing Anthropic's stance against using AI for mass domestic surveillance is reasonable. The White House has ordered agencies to phase out anthropic technology within six months while seeking alternative AI providers willing to permit broader government use. Lawmakers including Senator Ron Wyden are also pressing AI companies about safeguards around government access to Americans. Data analysts warn the dispute could complicate government systems that already rely on Anthropic models. Later in the show, Ben Yellen and Ethan Cook dig into the details of this dispute. Stick around for that. The FBI confirmed it's investigating a breach involving systems used to manage surveillance and wiretap warrants. The agency said it detected suspicious activity on its networks and has since contained the incident, though officials declined to provide details about the scope or impact. According to reporting by cnn, the compromised systems are used to process court authorized wiretapping and foreign intelligence surveillance warrants. The FBI stated it used its technical capabilities to respond after identifying the activity, but did not say who may be responsible or whether sensitive information was accessed. Authorities have not confirmed whether the incident is linked to prior intrusions. In 2024, a Chinese state backed hacking group Salt Typhoon breached US government systems involved in handling lawful wiretap requests, though investigations have not tied that activity to the current case. A China linked threat actor tracked as UAT9244 has targeted telecommunications providers across South America since 2024, compromising Windows, Linux and Network Edge devices, according to Cisco Talos researchers. The activity cluster shows strong overlaps with tactics used by the famous Sparrow and Tropic Trooper groups, though researchers track it separately. The campaign deploys three previously undocumented malware families. Turn Door is a Windows backdoor delivered through DLL sideloading that enables remote code execution and persistence through scheduled tasks and registry changes. PeerTime is a multi architecture Linux backdoor that uses the BitTorrent protocol for command and control communications and appears designed for telecom and embedded systems. Brute Entry is a scanning and brute force tool that converts compromised machines into proxy nodes to search for new targets. Researchers say the activity shares victim profiles with the China linked Salt Typhoon group, though no confirmed operational link has been established. Cisco has released security updates addressing 48 vulnerabilities across several firewall platforms, including Cisco Secure Firewall Adaptive Security Appliance, Secure Firewall Management center and Secure Firewall Threat Defense. The advisories include two critical flaws, both with a maximum CVSS score of 10, affecting the secure Firewall Management center management platform. One vulnerability allows authentication bypass through crafted HTTP requests, potentially granting root access. The second involves insecure deserialization that could enable remote code execution. Cisco also patched 15 high severity and 31 medium severity flaws. The company says no workarounds exist and organizations should update to the patched versions immediately. Two long standing vulnerabilities affecting hikvision cameras and Rockwell Automation Logix industrial systems are now high priority risks after being added to CISA's known exploited vulnerabilities catalog. The first flaw, with a CVSS score of 10, allows authentication bypass on certain Hikvision IP cameras, potentially exposing device credentials, configurations and images. The second, with a CVSS score of 9.8, enables attackers with network access to impersonate trusted engineering workstations in Rockwell Logix environments. CISA's Kev listing indicates active exploitation in the wild. Security teams are urged to patch vulnerable hikvision devices, reduce Internet exposure, and apply network segmentation and other compensating controls for affected industrial control system environments. The House Energy and Commerce Committee advanced the Kids, Internet and Digital Safety act in a party line vote, triggering sharp debate over how aggressively Congress should regulate online platforms. Republicans say the bill would strengthen protections by empowering parents and requiring platforms to disable recommendation algorithms for minors by default. Democrats criticize the measure as too weak, arguing it lacks a duty of care that would force companies to proactively mitigate online harms and includes a knowledge standard that could allow tech firms to avoid responsibility. They also warned that provisions preempting some state laws could could undermine ongoing legal actions against companies such as Meta and roblox. The committee also advanced Sammy's Law, which would alert parents to serious risks to children online, and the App Store Accountability act, requiring parental consent for downloads by minors. Critics say the proposals could threaten privacy and free expression. John Dea was arrested in St. Martin for for allegedly stealing more than $46 million in seized cryptocurrency from the U.S. marshals Service, according to the FBI. FBI Director Cash Patel said the arrest was carried out with assistance from France's GIGN tactical police unit. Authorities described Dagita as a government contractor, though blockchain investigators Zach XBT claims he's the son of Dean Dit, head of Command Services and Support, a contractor managing seized assets for the Marshall Service. Investigators have not publicly explained how the cryptocurrency was transferred, but ZacxBT says the activity was uncovered after a dispute on Telegram revealed wallet addresses linked to Dagita. The funds may include cryptocurrency seized after the 2016 Bitfinex hack. Following the revelations, CMDSS removed its website and social media presence while authorities launched an investigation. Coming up after the break, Ben Yellen and Ethan Cook unpack the dispute between Anthropic and the Pentagon and a Wikimedia worm wreaks widespread wiki woes. Stay with us. Maybe that's an urgent message from your CEO. Or maybe it's a deep fake trying to target your business. Doppel is the AI native social engineering defense platform fighting back against impersonation and manipulation. As attackers use AI to make their tactics more sophisticated, Doppel uses it to fight back from automatically dismantling cross channel attacks to building team resilience and more Doppel outpacing what's next in social engineering? Learn more@doppel.com that's d o p p e l.com foreign. No, it's not your imagination. Risk and regulation really are ramping up and customers expect proof of security before they'll sign that deal. That's where Vanta comes in. Vanta automates your compliance process and brings compliance, risk and customer trust together on one AI powered platform. Whether you're preparing for SoC2 or managing an enterprise governance risk and compliance program, Vanta helps keep you secure and keeps your deals moving. Companies like Ramp and RYTR spend 82% less time on audits with Vanta. That's not just faster compliance, that's more time for growth. Take it from me, if you're thinking about compliance, take the time to check out Vanta. Get started at vanta.com/cyber. Ben Yellen is my co host on the Caveat podcast where we cover all things law and policy. He's joined by our N2K lead analyst Ethan Cook to unpack the fallout between the Pentagon and Anthropic.