CyberWire Daily Podcast Summary

Episode Title: Legislating in the shadow of hackers
Date: November 7, 2025
Host: Dave Bittner (N2K Networks)
Guest: Ben Nunez (Evercoast)

Overview

This episode explores the intersection of cybersecurity, legislative processes, and the evolving threat landscape. It covers a range of current events, including high-profile breaches, regulatory changes, state responses to ransomware, and the rise of sophisticated cybercriminal alliances. The episode also features a conversation with Ben Nunez, CEO and co-founder of Evercoast, fresh from winning the 8th annual DataTribe Challenge, offering insights on innovation in robotics and data integrity.

Key Discussion Points & Insights

1. Hack on the Congressional Budget Office (CBO)

• Incident & Implications

  • The CBO, Congress’s nonpartisan fiscal analyst agency, was breached by a suspected foreign actor, raising alarms about risks to legislative data and sensitive communications.
  • Exposure included potential access to internal emails, chats, and lawmaker correspondence.
  • Prompt containment actions were implemented, with ongoing investigations and a pause in email contact with some Congressional offices.
  • The CBO’s role as an independent economic analyst makes it a key target.
  • (00:52)

• Expert Commentary:

  • “Experts warn that budget cuts and restructuring under President Trump’s administration have weakened U.S. cybersecurity defenses, leaving the nation and economy more vulnerable to attack.” — Dave Bittner (01:26)

2. Broader Cybersecurity Weaknesses & Regulatory Shifts

• Policy and Budget Concerns

  • Reductions in federal funding and staff, plus legislative lapses, are weakening national cybersecurity.
  • There's a decline in progress toward key cyber goals, with diminished coordination between government and private sector.
  • Shift in responsibility from federal to state and industry partners increases exposure.

• Evolution of Regulation

  • Regulatory frameworks like the EU’s DORA, Secure by Design, and new SEC rules are shifting expectations from compliance to daily accountability.
  • “The focus has moved from bureaucracy to behavior, embedding accountability into design, operations and communication.” — Dave Bittner (03:37)

3. Technical Threats: ClickFix Attacks & Phishing Campaigns

• Emergence of ClickFix on macOS
  • Attackers are advancing social engineering via fake Cloudflare popups, exploiting user trust to install malware.
  • Recent campaigns show heightened sophistication and minimal steps for execution.
  • Defense hinges on user vigilance.
  • Phishing Incident: Booking.com partners targeted; attackers trick victims into running PowerShell commands, leading to malware (Pure RAT) deployment.
  • “User awareness remains the strongest defense as attackers continue adapting.” — Dave Bittner (05:10)
  • (04:23–06:07)

4. Cybercrime Alliances: The Rise of ‘Scattered LapsesHunters’

• Federated Cybercrime Alliance
  • Major groups—Scattered Spider, Shiny Hunters, and Lapsus—have teamed up to provide “extortion-as-a-service” under “Scattered LapsesHunters” (SLH).
  • Skillsets combine social engineering, lateral movement, and data theft, creating high risks for enterprises.
  • Plans to develop their own ransomware (Shiny Spider) and increase coordination with other criminal clusters.
  • “Experts describe this merger as the evolution of cybercrime into coordinated business-style operations…” — Dave Bittner (06:31)

5. Geopolitics & 6G: Lawmakers vs. Chinese Tech Influence

• Congressional Scrutiny
  • Congressional leaders urge more transparency in strategies to counter China’s influence, particularly in 6G networks.
  • Calls for strengthened international alliances and standards, and lessons learned from the U.S. 5G rollout missteps.
  • Bipartisan agreement on securing next-generation communications as a national priority.
  • (07:21–08:26)

6. Sector Responses: EdTech and Ransomware

• Illuminate Education Settlement

  • $5.1 million penalty and security reforms after a 2021 data breach affecting millions of students.
  • Failures included poor access controls and misleading statements about compliance.

• Nevada’s Ransomware Response

  • Nevada did not pay ransom after an August attack that disrupted government systems.
  • The state restored 90% of data in 28 days, incurred $1.6 million in recovery costs, and pledged improved segmentation and cybersecurity.
  • “Governor Joe Lombardo praised teams for restoring payroll and essential services without paying criminals…” — Dave Bittner (09:34)

Featured Interview: Ben Nunez (Evercoast) — DataTribe Challenge Winner

Segment: [14:11–18:02]

Main Takeaways:

• Excitement and Community

  • “We’re just excited to be part of this community… DataTribe is an incredible organization to help us get to that next level.” — Ben Nunez (14:13)

• What Evercoast Does

  • “We help train robots to do their jobs… It’s not just about imitation learning… it’s really about ongoing monitoring and maintenance of robots to understand their performance.” — Ben Nunez (14:37)

• Team Background

  • “We’ve got 14 people… a lot of them are PhDs, masters, senior engineers… a lot of this technology actually came out of Hollywood. So we’ve got guys from Pixar, Weta Digital…” (15:15)

• Business Relevance

  • The company solves data integrity issues in physical AI and robotics: “The next cyber battlefield is not virtual, it is embodied. And… we’re just here to make sure that it’s rooted in ground truth and not guesswork.” — Ben Nunez (16:38)

• Advice for Entrepreneurs

  • “Anytime an entrepreneur has an opportunity to get up in front of a few hundred people and pitch their company, I don’t care what it is—get up and do it… DataTribe Challenge is an incredible opportunity to do that.” (17:30)

Notable Quotes & Memorable Moments

• On weakened federal cyber posture:

  • “Experts say this death by a thousand paper cuts erodes visibility into nation-state threats like China’s Volt Typhoon campaign…” — Dave Bittner (01:41)

• On regulatory change:

  • “Transparency and preparedness are emerging as competitive advantages rather than regulatory burdens.” — Dave Bittner (03:59)

• On cybercrime as a business:

  • “The coalition combines elite skills in social engineering, lateral movement and data exfiltration, posing a major threat to enterprises.” — Dave Bittner (06:34)

Other News & Final Notes

• FBI Targets Archive Today
  • The FBI issued a subpoena to Archive Today’s registrar, seeking to unmask its operators—a move the site publicly revealed in its trademark defiance. Described as “the Internet’s attic,” the site is an infamous tool for journalists, researchers, and paywall-evaders, and remains shrouded in mystery. (18:02)
    • “No one quite knows who runs it. Rumor has it a solitary Russian with a soft spot for dead links. The FBI, it seems, would very much like to know more.” — Dave Bittner

Timestamps for Key Segments

• CBO hack & US cyber policy: 00:52 – 02:26
• Regulatory change & behavioral accountability: 03:01 – 04:12
• ClickFix, macOS malware, Booking.com campaign: 04:23 – 06:07
• Cybercrime group merger: 06:13 – 07:20
• 6G, geopolitics, and congressional action: 07:21 – 08:26
• Illuminate, Nevada ransomware responses: 08:36 – 10:48
• Interview: Ben Nunez (Evercoast): 14:11 – 18:02
• FBI & Archive Today: 18:02 – end

Tone and Style

The conversation focuses on actionable intelligence, regulatory shifts, business risk, and technological innovation. Dave Bittner’s tone is conversational yet urgent, especially when discussing national risks, regulations, and emerging cyber threats. Ben Nunez is animated and inspirational, emphasizing innovation and community.

This summary provides a comprehensive guide to the episode’s core themes, expert insights, and feature interview. It’s structured for easy reference by practitioners, policy makers, and technologists alike.