Transcript
Cyberwire Network Announcer (0:02)
You're listening to the Cyberwire Network, powered by N2K.
Indeed Sponsor Announcer (0:10)
This episode is brought to you by Indeed. Stop waiting around for the perfect candidate. Instead, use Indeed sponsored Jobs to find the right people with the right skills fast. It's a simple way to make sure your listing is the first candidate. C According to Indeed data, sponsored jobs have four times more applicants than non sponsored jobs. So go build your dream team today with Indeed. Get a $75 sponsor job credit@ Indeed.com podcast. Terms and conditions apply.
Dave Bittner (0:46)
The Feds take down major IoT botnets, the FBI seizes hacktivist infrastructure A data breach hits Kaplan while a hacker claims to access millions of law enforcement tips. Fake zoom calls deliver malware, A crypto security tool turns out to be spyW critical AI framework flaw gets exploited in hours, an insider extortion case ends in conviction, and a streaming scam pulls in over 10 million bucks. A look back at 10 years of CyberWire podcasts Intern Kevin gets ready for RSAC and a cyber attack leaves breathalyzers offline.
Focus Features Sponsor Announcer (1:35)
Foreign
Dave Bittner (1:38)
March 20, 2026 I'm Dave Bittner, and this is your Cyberwire Intel Briefing. Thanks for joining us here today. It's great as always to have you with us. The US Government has disrupted four major Internet of Things botnets tied to some of the largest distributed denial of service attacks ever recorded, including traffic exceeding 30 terabits per second. In coordination with Germany and Canada, the Department of Justice targeted the command and control infrastructure of the Isuru, Kimwolf, Jackschid, and Mossad botnets. These networks compromised more than 3 million devices, including routers and cameras. Officials link them to hundreds of thousands of attacks, some targeting Department of Defense systems and decriminal services like ddos for hire and extortion. The operation removes active control of powerful botnets but leaves millions of vulnerable devices still infected. That persistent exposure continues to fuel the cybercrime economy and enables rapid rebuilding of similar attack networks. The FBI has seized two websites used by the Handela hacktivist group after a destructive cyber attack on Stryker wiped roughly 80,000 devices. The domains were taken under a warrant from the U.S. district Court in Maryland, with authorities stating they supported malicious cyber activity tied to a foreign state. Actor Handela, described as an Iranian linked group, reportedly compromised administrative accounts and used Microsoft Intune to issue device wipe commands across Windows and mobile systems. The attack impacted both corporate and employee managed devices. The action disrupts part of the group's public infrastructure, but the scale of the attack highlights how enterprise device management tools can be abused for widespread damage. It also underscores ongoing risks from state linked hacktivist activity targeting critical sectors. Kaplan North America, a provider of educational and professional training services, has disclosed a data breach affecting nearly 195,000 individuals involving the theft of sensitive personal information from internal systems. The intrusion occurred over three weeks between October and November 2025, with attackers accessing and exfiltrating files containing names, Social Security numbers and driver's license data. The company completed its investigation in February 2026 and began notifying affected individuals in March, offering credit monitoring and identity protection services. The exposure of high value identity data increases the risk of fraud and long term identity theft. It also highlights the impact of prolonged unauthorized access before detection. A hacker claims to have breached a US Law enforcement tip platform, stealing data tied to more than 8 million confidential reports. The actor, calling themselves Internet Yif Machine, alleges they accessed P3 Global intel, part of Navigate360, and exfiltrated 93 gigabytes of data. The company says it's investigating a potential incident with third party support. According to the hacker, access came through social engineering and a vulnerability. Reuters could not independently verify the claims, though another outlet reported limited corroboration of leaked data. Tip platforms handle sensitive submissions tied to law enforcement and public safety. A breach could expose informants and undermine trust in reporting systems if confirmed. Attackers are using a fake interactive zoom call to trick users into installing malicious software disguised as a routine update. According to Sublime, the campaign uses AI generated JavaScript to simulate a glitchy zoom meeting, complete with clickable controls and audio issues. Victims arrive via phishing emails and are guided through a fake security check before being prompted to install a zoom update. The downloaded file installs legitimate Screen Connect remote monitoring and management software, giving attackers device access. Researchers say the attack can be easily customized for specific targets. Realistic interactive phishing lures lower user suspicion and increase compromise rates. It also highlights how legitimate administrative tools can be abused for unauthorized access. Researchers have dismantled ShieldGuard, a malicious browser extension that posed as a crypto security tool but was designed to steal sensitive user data, Okta Threat Intelligence reports. The extension used social media promotion and token airdrop incentives to lure users. Once installed, it targeted platforms like Binance, Coinbase and Metamask, collecting account data, transaction histories and browsing activity. The malware used obfuscation and a custom JavaScript interpreter to evade Chrome protections and dynamically execute code. Researchers also identified links to a broader campaign known as Radex. Attackers are increasingly disguising malware as security tools, exploiting trust in the crypto ecosystem. This also highlights the risks of browser extensions as a vector for large scale data theft. Threat actors exploited a critical langflow vulnerability within 20 hours of disclosure, building working attacks directly from the advisory description. The flaw is an unauthenticated remote code execution vulnerability with a CVSS score of 9.3. It allows arbitrary Python execution on exposed systems with a single request. Sysdig observed attackers scanning for targets, deploying custom scripts, and harvesting credentials including API keys and database access. No public proof of concept code was available at the time. Exploitation timelines are shrinking faster than patch cycles. Organizations often take weeks to remediate, leaving a wide exposure window as attackers rapidly weaponize newly disclosed flaws. A North Carolina contractor has been found guilty of extorting a technology company using sensitive data he accessed during his employment. According to the Justice Department, Cameron Curry exploited his role as a data analyst to steal payroll and employee information from Brightly software. After his contract ended in December 2023. He sent more than 60 extortion emails demanding $2.5 million, threatening to leak personal and compensation data. The company ultimately paid a smaller amount in Bitcoin before reporting the incident. Authorities later seized evidence from Curry's residents. It's a reminder that insider threats remain a significant risk, especially when employees retain access to sensitive systems. It also highlights how stolen corporate data can be weaponized for extortion. A different North Carolina man has pleaded guilty to orchestrating a large scale streaming fraud that generated over $10 million in illicit music royalties. According to court documents, Michael Smith used AI generated music and automated bot accounts to inflate streaming numbers across platforms including Spotify, Apple Music, Amazon Music and YouTube Music. Prosecutors say the scheme ran from 2017 to 2024, using VPNs and hundreds of thousands of tracks to evade detection. At its peak, over 1,000 bots streamed billions of plays, diverting royalties from legitimate artists. Smith has agreed to forfeit more than $8 million. AI and automation are lowering barriers for fraud at scale, challenging detection systems, and undermining trust in digital revenue models. Coming up after the break, a look back at 10 years of CyberWire podcasts Intern Kevin gets ready for RSAC and a cyber attack leaves breathalyzers offline. Stay with us. No, it's not your imagination. Risk and regulation really are ramping up, and these days customers expect proof of security before they'll even do business. That's where Vanta comes in. Vanta automates your compliance process and brings compliance, risk and customer trust together on one AI powered platform. So whether you're getting ready for a SoC2 or managing an enterprise Governance, risk and compliance program. Vanta helps keep you secure and keeps your deals moving. Companies like Ramp and RYTR spend 82% less time on audits with Vanta. That means less time chasing paperwork and more time focused on growth. For me, it comes down to this. Over 10,000 companies, from startups to large enterprises, trust Vanta to help prove their security. Get started@vanta.com cyber.