Transcript
A (0:02)
You're listening to the Cyberwire Network powered by N2K. Cyber threats strike in minutes. Your analysis can't take weeks. That's where Velox Reverser from Booz Allen comes in. It's an autonomous malware reverse engineering and threat intelligence product that turns weeks of painstaking manual analysis into into minutes of AI powered insights. With Velox Reverser security teams can perform deep analysis to learn how malware works and how to stop it. It's an advanced product that works at machine speed if you need to outpace evolving adversaries and strengthen your defense at scale. Request a demo or start your 30 day free trial of Velox Reverser today at Boozallen.com Reverser. Starkiller represents a significant escalation in phishing infrastructure A blockchain lender breach affects nearly a million users the Kimwolf botnet disrupts a peer to peer privacy network. Researchers identify vulnerabilities in the widely used Visual Studio code extensions. DEFCON bans three men named in the Epstein files Texas sues TP link over supply chain Security experts question the impact of cyber versus Kinetic damage in Venezuela, African law enforcement arrest hundreds of suspected scammers Tim Starks from Cyberscoop explains CISA's upcoming town hall meetings over ICS reporting rules and Warsaw walls off WI Fi Wired Wheel. Foreign. February 19, 2026 I'm Dave Bittner and this is your Cyberwire Intel Briefing. Thanks for joining us here today. It's great as always to have you with us. A new phishing toolkit called Starkiller represents what researchers describe as a significant escalation in phishing infrastructure discovered by security firm Abnormal. The platform operates as a proxy that serves genuine login pages through attacker controlled infrastructure rather than relying on static HTML clones. It launches a headless Chrome instance to mirror legitimate sites in real time, allowing victims to authenticate directly with the real service through the attacker's proxy. Because users interact with the live site, any multi factor authentication codes or session tokens are forwarded to the legitimate service instantly, enabling attackers to bypass mfa. Starkiller can impersonate major brands including Google, Microsoft and financial institutions, and provides real time session monitoring and key logging. Sold as a subscription service on the dark web, starkiller includes updates and support, increasing its potential longevity and impact. Nearly 1 million users were affected by a data breach at Figure Technology Solutions, a Nasdaq listed blockchain lender. The company confirmed an employee fell victim to a social engineering attack, allowing attackers to access a limited number of files. The Shiny Hunters group claimed responsibility and published 2.4 gigabytes of alleged stolen data on its Tor leak site. Have I Been Pwned? Identified about 967,000 exposed records, including names and contact details. Shiny Hunters linked the incident to a broader voice phishing campaign targeting Okta Single sign on accounts the Kim Wolf Internet of Things botnet has disrupted the Privacy Network i2p after attempting to use it to evade takedown efforts. Krebs on security reports around February 3rd, i2P users reported outages as tens of thousands of new routers flooded the network. Kim Wolf operators later acknowledged on Discord that they had tried to connect roughly 700,000 infected devices to i2P, overwhelming a network that typically supports between 15,000 and 55,000 nodes. The incident amounts to a Sybil attack where one actor controls large numbers of fake identities to destabilize a peer to peer system. Researchers say Kimwolf is experimenting with i2P and Tor as resilient command and control channels. I2P remains operational at reduced capacity, while reports suggest the botnet's size has recently declined. Significant Researchers at OX Security have identified four vulnerabilities in widely used Visual Studio code extensions warning they could enable serious cyber attacks. Three flaws, which have been assigned CVEs by MITRE, affect extensions including Live Server, Markdown, Preview Enhanced and Code Runner, with combined downloads exceeding 128 million. The most severe, rated 9.1, could allow remote attackers to exfiltrate files from a developer's machine. Another enables arbitrary JavaScript execution and local network scanning, while a third permits remote code execution through social engineering. A fourth issue in Microsoft Live Preview was silently patched in September 2025. Aux Security said the flaws expose a critical blind spot in developer environments and warned that a single Comprom extension could enable broader organizational breaches. DEFCON has banned three technology figures named in the Epstein files, despite no accusations of criminal wrongdoing. The individuals were cited by organizers for their documented contact with Jeffrey Epstein. Emails show past professional interactions, including introductions, funding, discussions and offers of conference tickets. DEFCON said the bans apply to all future events. The conference rarely publicizes bans, with only a handful disclosed since 2017. Texas has sued TP Link Systems, alleging the networking company misled consumers about security and supply chain origins while exposing devices to exploitation. Attorney General Ken Paxton claims TP Link marketed routers as secure and labeled them made in Vietnam despite sourcing most components from China. The lawsuit argues this creates national security risks, citing Chinese laws that could compel data sharing. The complaint references firmware vulnerabilities allegedly exploited by Chinese state backed hackers and a botnet tracked by Microsoft as Quad 7 or Covert Network 1658 built largely from compromised TP link routers. Federal agencies have also flagged actively exploited flaws in TP link devices. Texas seeks civil penalties and disclosure requirements. TP Link denies the allegations, calling them meritless and stating US User data is stored domestically. Public reporting has framed the January 3 Caracas power outage during the mission targeting Nicolas Maduro as a precision cyber attack. But videos, photos and expert analysis suggest visible physical damage to multiple substations could alone explain the disruption. Imagery showed destroyed equipment, bullet impacts, oil leaks and fires at facilities including Panamericana and Fuerte Tiuna. Experts told cyberscoop the kinetic damage appeared sufficient to cause localized outages, raising doubts about a cyber only narrative. Officials have not publicly confirmed a cyber cause, despite early statements referencing cyber layering effects. Analysts say cyber operations may have supported the mission by reducing situational awareness or identifying weak points, but likely did not act alone. How the incident is characterized matters a cyber only framing could distort policy decisions, overstating digital capabilities while underestimating physical grid vulnerabilities that experts say remain critical. African law enforcement agencies arrested 651 suspects and recovered more than $4.3 million during Interpol's Operation Red Card 2.0, targeting investment fraud, mobile money scams and fake loan schemes conducted across 16 countries between December 8 and January 30. The operation identified over 1,200 victims linked to over $45 million in losses. Authorities seized over 2,300 devices and dismantled over 1400 malicious websites and servers. Nigeria, Kenya and Cote d' Lvoie reported major arrests tied to fishing rings, fraudulent investment platforms and abusive loan apps. Interpol officials emphasize the importance of cross border cooperation against organized cybercrime networks. Separately, Nigerian national Matthew Akonde was sentenced in the United States to eight years in prison for hacking tax firms, stealing client data with warzone remote access malware and filing fraudulent returns seeking $8.1 million in refund. Coming up after the break, Tim Starks from Cyberscoop explains CISA's upcoming town hall meetings over ICS reporting rules and Warsaw walls off WI Fi wired wheels. Stick around. When it comes to mobile application security, good enough is a risk. A recent Survey shows that 72% of organizations reported at least one mobile application security incident last year, and 92% of responders reported threat levels have increased in the past two years. Guard Square delivers the highest level of security for your mobile apps without compromising performance, time to market or user experience. Discover how Guard Square provides industry leading security for your Android and iOS apps at www.guardsquare.com. Most Security Conferences Talk about Zero Trust Zero Trust World puts you inside this is a hands on cybersecurity event designed for practitioners who want real skills, not just theory. You'll take part in live hacking labs where you'll attack real environments, see how modern threats actually work, and learn how to stop them before they turn into incidents. But Zero Trust World is more than labs. You'll also experience expert led sessions, practical case studies and technical deep dives focused on real world implementation. Whether your Blue team, Red team or responsible for securing an entire organization, the content is built to be immediately useful. You'll earn CPE credits, connect with peers across the industry and leave with strategies you can put into action right away. Join us March 4th through the 6th in Orlando, Florida. Register now at ztw.com and take your zero trust strategy from theory to execution. And joining me once again is Tim Starks. He is a senior reporter at cyberscoop. Tim, welcome back. Good to be back looking at this report that you recently published. This is about cisa. Looking to host some feedback sessions, some town halls if you will, about some cyber incident reporting regulations. Can we start with a little bit of the background here, the legislation that makes this something that Cisil wants to pursue?