Transcript
A (0:02)
You're listening to the CyberWire network powered by N2K. And now a word from our sponsor arcova. Formerly Morgan Franklin Cyber, arcova is a global cybersecurity and AI consulting firm built by practitioners who've been in the seat. They work directly with enterprise teams to solve complex security challenges, building secure by design programs that hold up as technology and threats evolve. From focused engagements to long term partnership, arcova delivers outcomes that endure because no one should navigate complexity alone. Learn why leading Global Enterprises Trust arcova@www.arcova.com that's a R C O V A.com. CISA warns of actively exploited Lang Flow vulnerability CISA flags critical PTC Windchill vulnerability Phishing activity surges amid war in Iran Google moves up their post Quantum timeline Alleged Redline infosteeler developer faces 30 years in a US prison Bearlify hacktivists launch disruptive ransomware campaign in Russia FCC moves to crack down on robocallers and foreign call centers Anti piracy group takes down anime Play streaming platform I talk with Dave Vitner as we look back on the biggest breaches in the last 10 years and what happens when hackers call the game. Today is Friday, March 22nd, 7th, 2026 and I am Maria Varmazes in for Dave Bittner who is recuperating from RSA and This is your CyberWire intel briefing. Thanks for joining me on this lovely Friday. Hope you're having a good one. Let's get into it. According to a report from Bleeping Computer, the US Cybersecurity and Infrastructure Security Agency, better known as CISA or, warns of active exploitation of a critical flaw affecting the Lang Flow framework for building AI agents. The vulnerability is a code injection flaw that can lead to remote code execution. Researchers at Sysdig observed exploitation of the flaw about 20 hours after its disclosure on March 17. The researchers state attackers built working exploits directly from the advisory description and began scanning the Internet for vulnerable instances. Exfiltrated information included keys and credentials, which provided access to connected databases and potential software supply chain compromise. Users are advised to update langflow as soon as possible and audit their systems for compromise. Germany's Federal Cyber Agency and police took the unusual step of directly warning organizations about a newly disclosed critical vulnerability in PTC, windchill and FlexPLM on underscoring the seriousness of the threat. The flaw, tracked as CVE2026 4681, involves unsafe deserialization that could allow remote unauthenticated attackers to execute arbitrary code on affected systems. The US Cybersecurity and Infrastructure Security Agency has also issued an ICS advisory on the flaw signaling Heightened concern for organizations running the widely used product lifecycle management platforms. While patches are still in development, PTC has released mitigations and indicators of compromise to help defenders detect possible exploitation attempts. Bitdefender is tracking a surge in phishing and malware activity targeting Gulf countries amid the war in Iran, with malicious emails spiking approximately 130% since the conflict began on February 28, Bitdefender states quote, within days activity doubled and at peak reached nearly four times the baseline levels, signaling a sustained and coordinated spike rather than a one off campaign. This clearly suggests that phishing and malware delivery campaigns are being deployed and adjusted in real time, with attackers capitalizing on heightened regional sensitivity and business disruptions. And while state sponsored cyber operations are accompanying the war, much of this phishing activity is financially motivated, with criminal threat actors exploiting fear and uncertainty across the region, Google has accelerated its timeline for transitioning to post quantum cryptography, warning organizations that they may need to be ready by 2029 instead of the previously expected mid-2030s. The shift reflects growing concern that advances in quantum computing and improvements in error correction and algorithms could allow future machines to break today's encryption much sooner than anticipated. The company is prioritizing protections for authentication systems and digital signatures and is already working to deploy quantum resistant cryptography across products like Chrome, Android and its cloud platforms. An Armenian national accused of developing the popular Redline info stealer has been extradited to the United States, where he faces up to 30 years in prison, according to a new report from the Record. The defendant, Hambar Minassian, allegedly worked with co conspirators to maintain Redline's infrastructure, including C2 servers and administrative panels, and collected payments from the malware's affiliates, the US Justice Department states. The indictment alleges that Minastian registered two private servers to host portions of Redline's infrastructure, as well as two Internet domains in support of the Redline scheme. He also allegedly created repositories on an online file sharing site that were used to distribute Redline to affiliates. In November 2021, he allegedly registered a cryptocurrency account that was used to receive payments from Redline affiliates. An international law enforcement effort disrupted the redline operation in October 2024, and the Justice Department unsealed charges against one of Minasian's alleged co conspirators, Maxim Rudimetov. Rudimetov is also facing a maximum of 30 years. A pro Ukraine hacking group known as Bearlify has carried out more than 70 cyber attacks against Russian companies over the past year and is escalating its campaign with newly developed ransomware, according to researchers. Unlike traditional profit driven ransomware gangs, Bearlify appears to be motivated by disruption and political signaling tied to Russia's war in Ukraine. The group has targeted organizations across sectors including energy, telecommunications and finance, sometimes wiping systems rather than negotiating payment. Analysts say that the activity reflects a broader trend of hacktivist style operations, increasingly adopting advanced tooling once associated with state actors or criminal syndicates. The campaign highlights how cyber operations linked to geopolitical conflicts continue to blur the lines between activism, espionage and sabotage, raising the risk of spillover effects beyond the immediate battlefield. The Federal Communications Commission has voted to advance new rules that are aimed at cracking down on illegal robocalls and limiting the role of foreign call centers in handling sensitive U.S. communications. The proposals would tighten certification requirements for obtaining phone numbers, making it harder for scammers to acquire legitimate numbers, and require telecom providers to disclose more information about callers on their networks. Regulators are also exploring restrictions on routing certain customer service calls overseas, particularly those involving sensitive personal data. Officials say many robocall investigations involve resold numbers and offshore infrastructure, creating enforcement gaps. The measures now move to a public comment phase and could reshape how telecom providers manage numbering resources and customer support operations. Ace, or the alliance for Creativity and Entertainment, has shut down the piracy streaming app Anime Play, a platform with more than 5 million users that hosted roughly 60 terabytes of anime content. The coalition sees the app's infrastructure, including 15 domains, backend servers, databases, advertising tools and 29 GitHub repos containing its source code, effectively preventing operators from relaunching the service. Most users were reportedly based in Indonesia. Ace, backed by major studios including Disney, Netflix and Warner Brothers, said the takedown is part of its broader campaign to dismantle large scale piracy networks worldwide. The action highlights how coordinated industry led enforcement operations are increasingly targeting not just websites, but the full technical ecosystems that are supporting illicit streaming platforms. And as we close out the RSAC 2026 week, we thank our ever faithful intern Kevin and treat you to his sign off.