Transcript
Dave Bittner (0:02)
You're listening to the CyberWire network. Powered by N2K.
Narrator/Host (0:14)
The DMV has established itself as a top tier player in the global cyber industry. DMV Rising is the premier event for cyber leaders and innovators to engage in meaningful discussions and celebrate the innovation happening in and around the Washington, D.C. area. Join us on Thursday, September 18th to connect with the leading minds shaping our field and experience firsthand why the Washington D.C. region is the beating heart of cyber innovation. Visit DMVRising.com to secure your spot. Risk and compliance shouldn't slow your business down. Hyperproof helps you automate controls, integrate real time risk workflows and build a centralized system of trust so your teams can focus on growth, not spreadsheets. From faster audits to stronger stakeholder confidence, Hyperproof gives you the business advantage of Smarter compliance. Visit www.hyperproofio to see how leading teams are transforming their GRC programs. The FBI shares revelations on Salt Typhoon's reach Former NSA and FBI directors sound alarms on infrastructure cybersecurity gaps. Google is launching a new Cyber Disruption unit. A new report highlights cyber risks to the maritime industry. A Pennsylvania health care provider suffers a data breach affecting over 600,000 individual Citrix patches, a critical vulnerability under active exploitation. The US Sanctions a North Korea linked fraud network Ransomware is rapidly evolving with generative AI. Our guest is Brandon Karpf speaking with T Minus host Maria Vermazes, connecting three seemingly disparate stories. And who needs a tutor when you've got root access?
Brandon Karp (2:33)
Foreign.
Narrator/Host (2:37)
August 28, 2025 I'm Dave Bittner and this is your Cyberwire Intel Briefing. Thanks for joining us here today. Great to have you with us. The Wall Street Journal reports that the China linked cyber campaign known as Salt Typhoon reached far beyond US telecom carriers, hitting more than 80 countries and compromising sensitive data on a scale investigators hadn't grasped until recently, FBI Cyber chief Brett Leatherman told the Journal. The intrusion gave Chinese intelligence access to more than 1 million call records as well as systems used by law enforcement for court approved wiretaps, a development that he called among the most consequential breaches in U.S. history. The operation also swept up private calls and texts from over 100Americans and allowed potential tracking of citizens movements worldwide. U.S. officials say the campaign, active since at least 2019, was more sweeping and indiscriminate than typical espionage operations. While Beijing denies involvement, the FBI has issued new technical details to companies and allies aimed at spotting Salt Typhoon's lingering presence in networks. The nsa, along with US and foreign partners, has issued a joint cybersecurity advisory warning that Chinese state sponsored hackers are targeting telecommunications, government, transportation, lodging and military networks worldwide. The advisory ties the activity overlapping with reporting on groups like Salt Typhoon to several China based firms providing services to the Ministry of State Security and the People's Liberation Army. The report, titled Countering Chinese State Sponsored Compromise of Networks Worldwide Defeat Global Espionage Systems, details the hackers tactics, techniques and procedures including methods for exploitation, persistence, data collection and exfiltration. It also lists exploited vulnerabilities and indicators of compromise. The Global Cyber Innovation Summit recently hosted an exclusive security briefing at One World Trade center on national security threats to US Critical infrastructure. The invitation only event gathered executives from former national security leaders, technologists and policy experts for a discussion on rising cyber risks and defense strategies. Bob Ackerman, GCIS founder, opened the event, followed by McKinsey's Ida Christensen, who highlighted a projected $31.1 billion global risk from OT breaches in the coming year. A panel featuring former NSA Director General Paul Nakasone, former FBI Director Christopher Wray, AEP CEO Bill Fuhrman and Dragos CEO Robert M. Lee explored how threat actors increasingly target industrial systems through IT to OT pivots. Keynote speaker Thomas Fanning stressed the need for collaboration across it, OT and executive leadership. Speakers underscored that cyberattacks on infrastructure risk not just data, but public safety. Google is launching a new cyber disruption unit aimed at proactively interfering with malicious online operations, a move that comes as US Policymakers and industry leaders debate the future of offensive cyber strategies. Sandra Joyce, vice president of Google Threat Intelligence Group, said the effort will focus on legal and ethical disruption and invited partners to join. The initiative reflects a broader conversation about the balance between active defense tactics such as honeypots and more aggressive measures like hacking back, which remain legally restricted. At a cybersecurity policy conference, former officials and industry leaders debated whether the private sector should play a larger role in offensive cyber operations. While legislation to authorize private companies remains stalled, some argue U.S. deterrence requires more direct action. Experts cautioned that any shift must ensure measurable impact while avoiding uncontrolled escalation. The maritime industry, which underpins 80% of global trade, is modernizing with automation, remote monitoring and advanced energy systems. But those innovations are opening new cyber risks. A new report from HelpNet Security says ships and ports now face threats ranging from ransomware to espionage, with vulnerabilities in operational technology, navigation systems and software supply chains. Incidents such as the 2017 NotPetya attack on Maersk, which shut down 76 terminals and recent ransomware hits on ports in Europe highlight the stakes. State actors from Russia, Iran and China are also accused of targeting maritime infrastructure, while interference with satellite navigation and AI powered cyber attacks present growing dangers, with only 17% of shipyards reporting in house. Cybersecurity expertise, expert stress workforce training, continuous risk assessments and stronger industry collaboration to build resilience across the global maritime sector. Healthcare Services Group, a Pennsylvania based healthcare support services provider, has disclosed a data breach affecting over 624,000 individuals nationwide. Attackers gained unauthorized access between September 27 and October 7 of 2024, stealing sensitive data including names, Social Security numbers, driver's licenses, state IDs, financial details and account credentials. HSGI reported the breach to the SEC in October of 2024, later confirming stolen data in June of this year. Notifications began Aug. 25 with victims offered 12 to 24 months of credit monitoring and identity theft protection. A Citrix vulnerability is being actively exploited, leaving more than 28,000 NetScaler, ADC and Gateway instances exposed worldwide, according to CISA and Citrix. The flaw patched yesterday allows remote code execution and was abused as a zero day. Most vulnerable systems are in the us, Germany and the uk. Citrix urges immediate upgrades as no mitigations exist. Two other high severity flaws were also disclosed. CISA has added the vulnerability to its known Exploited Vulnerabilities catalog, requiring federal patching by August 28th. The US treasury has sanctioned a North Korean linked fraud network that placed hackers in U.S. companies by posing as job seekers. Once hired, the operatives stole data, extorted employers and funneled wages to Pyongyang, generating at least $1 million for the regime. The treasury says North Korea launders stolen funds, often via cryptocurrency, to support its nuclear program. Companies are now legally barred from engaging with the sanctioned parties. New research shows ransomware is rapidly evolving with generative AI, lowering barriers for cybercriminals and making attacks more effective. Anthropic reports that hackers are using its AI models, including CLAUDE and Claude Code, to write malware, craft extortion notes and run ransomware as a service schemes. One group, GTG5004, used Claude to develop ransomware sold for between $400 and $1,200 despite lacking technical expertise. Separately, ESET identified PromptLock, the first proof of concept AI powered ransomware. While not yet deployed, it demonstrates how attackers can exploit AI to automate intrusions. Experts warn that AI assisted ransomware is still emerging, but the trend points to faster, more sophisticated attacks with global implications. Coming up after the break Brandon Karp speaks with T Minus host Maria Ramazes about three seemingly disparate stories and who needs a tutor when you've got root access? Stay with us. Compliance regulations, third party risk, and customer security demands are all growing and changing fast. Is your manual GRC program actually slowing you down? If you're thinking there has to be something more efficient than spreadsheets, screenshots, and all those manual processes, you're right. GRC can be so much easier, and it can strengthen your security posture while actually driving revenue for your business. You know, one of the things I really like about Vanta is how it takes the heavy lifting out of your GRC program. Their trust management platform automates those key compliance, internal and third party risk, and even customer trust so you're not buried under spreadsheets and endless manual tasks. Vanta really streamlines the way you gather and manage information across your entire business. And this isn't just theoretical. A recent IDC analysis found that compliance teams using Vanta are 129% more productive. That's a pretty impressive number. So what does it mean for you? It means you get back more time and energy to focus on what actually matters, like strengthening your security posture and scaling your business. Vanta GRC Just imagine how much easier trust can be. Visit vanta.com cyber to sign up today for a free demo. That's V A n t a dot com Cyber.
