Transcript
A (0:02)
You're listening to the Cyberwire Network, powered by N2K.
B (0:10)
The world moves fast. Your workday even faster Pitching products, drafting reports, analyzing data Microsoft 365 copilot is your AI assistant for work built into Word, Excel, PowerPoint, and other Microsoft 365 apps you use, helping you quickly write, analyze, create and summarize so you can cut through clutter and clear a path to your best work. Learn more@Microsoft.com M365 copilot.
C (0:48)
SolarWinds patches 4 Critical Remote Code execution vulnerabilities A ransomware attack on Conduit puts the data of over 25 million Americans at risk. Rogue pilot enables GitHub repository takeovers Zero Day Rat targets Android and iOS devices North Korea's Lazarus Group deploys Medusa ransomware attackers breakout times drop to under half an hour. CISA maintains its mission despite staffing challenges. Russian satellites draw fresh scrutiny. Two South Korean teenagers are charged with breaching Seoul's public bike service. Krishna Tsai, CTO at SolarWinds, discusses why leaders should focus less on speculating about the AI bubble and more about how to quantify AI's tangible contributions. And the Pope pushes prayerful priests past predictable programs. It's Tuesday, february 24th, 2026. I'm dave buettner and this is your cyberwire intel brief. Thanks for joining us here today. It's great to have you with us. SolarWinds has released updates to address four critical remote code execution vulnerabilities in its Serv U file transfer software, which runs on Windows and Linux systems. The most severe flaw is a broken access control issue that allows attackers with high privilege to create a system administrator account and execute arbitrary code with root or administrative permissions. SolarWinds also patch 2 type confusion vulnerabilities and an insecure direct object reference or IDOR flaw, each of which could also enable root level code execution. Importantly, all four vulnerabilities require attackers to already have elevated access, limiting exploitation to scenarios involving stolen credentials or chained privilege escalation. Serv U remains an attractive target due to its role in transferring sensitive Data. More than 12,000 Internet exposed instances are indexed by Shodan, while Shadow Server estimates fewer than 1200. A major data breach at Conduent has exposed the sensitive personal information of at least 25.9 million Americans following a ransomware attack attributed to the SafePay group. According to reporting by CSN, attackers maintained unauthorized access to Conduent's network from October 21, 2024 through January 13, 2025. During that time, they exfiltrated approximately eight terabytes of data, including names, Social Security numbers, dates of birth, medical records and health insurance information. The breach primarily affects government service recipients in Texas and Oregon, where conduent processes Medicaid, SNAP and Child Support services. Texas alone accounts for 15.4 million impacted residents, while Oregon reports 10.5 million records exposed victims are now being notified and urged to place fraud alerts on their credit files. The combination of Social Security and medical data creates long term identity theft risk. Orca Security has disclosed a GitHub Codespaces vulnerability dubbed Rogue Pilot that could have enabled repository takeovers through malicious Copilot instructions embedded in GitHub issues. According to Orca, attackers could inject hidden prompts into an issue description, causing the in environment copilot assistant to exfiltrate a privileged GitHub token. The attack chain combines symbolic links, automatic JSON schema downloads and CoPilot's deep integration in code spaces to leak tokens without user approval. Because the token provides read and write repository access, compromise could lead to full takeover. GitHub patched the issue after responsible disclosure, Orca reports. Zero Day Rat, a new mobile spyware platform is being marketed on Telegram as a subscription based malware malware as a service offering that targets Android and iOS devices, according to research from Cyberthint. Researchers say the platform uses SMS phishing, fake app stores and links shared via WhatsApp and Telegram to infect victims. Promotional materials show multi stage redirection chains including abuse of GitHub pages to mask malicious links. Once installed, the malware connects to a web based control panel that enables GPS tracking, screen recording, keystroke logging and remote camera and microphone access. It also includes financial theft features such as cryptocurrency, wallet scanning, clipboard injection and attempts to capture credentials for digital payment services. Cyberthint noted inconsistencies in the seller's materials, raising questions about the platform's authenticity. Hackers linked to North Korea's Lazarus group have deployed Medusa ransomware in financially motivated attacks against organizations in the US and the Middle east, according to Symantec. Researchers attributed the activity to Lazarus, likely its Andariel subgroup, based on the use of custom backdoors malware and a Chrome password extractor previously tied to the group. Medusa operates as a ransomware as a service platform allowing affiliates to share ransom proceeds, Symantec notes. This marks the first observed use of Medusa by Lazarus, which previously used strains such as Maui. US Authorities have tied earlier Maui attacks to North Korean operators, including Rim Jong Hyeok, who was indicted in 2024. The shift underscores growing overlap between nation state actors and criminal ransomware Ecosyste. CrowdStrike's latest global threat report finds attackers moving faster and operating across more groups, with breakout times dropping to an average of 29 minutes in 2025, according to CrowdStrike. The fastest observed breakout time fell to 27 seconds, down from 51 seconds a year earlier. The company tracked 281 threat groups by the end of 2025, including 24 newly named actors. Cloud focused attacks rose 37% year over year, with a 266% surge tied to nation state groups. 82% of detected intrusions were malware free, relying instead on valid credentials and legitimate tools. Zero day exploitation increased 42%, particularly targeting Edge devices such as firewalls and virtual private networks. An analysis from the New York Times says President Trump, who established the Cybersecurity and Infrastructure Security agency during his first term, has scaled back key parts of the agency in his second, including dismantling its election security work. Staffing has fallen from about 3,400 employees in January 2025 to fewer than 2,400, and a department of Homeland Security funding lapse has furloughed roughly 60% of the remaining workforce, leaving under 1,000 on duty. The agency is operating without a Senate confirmed director, as nominee Sean Plenke's confirmation has stalled. Lawmakers including Representative Bennie Thompson have warned that deep staffing cuts and lost institutional knowledge threaten CISA's mission. Acting Director Madhu Ghatamukala has said essential operations will continue but acknowledged increased strain. Officials and former employees say morale has declined amid departures, reassignments and uncertainty, raising concerns about readiness in the event of a major cyber attack. Russian inspector satellites are drawing fresh scrutiny after a new report found they've spent years maneuvering alongside Western commercial spacecraft in geostationary orbit. European officials now worry the mission may extend beyond signals intelligence, raising concerns about potential interference with critical communications infrastructure. For more on what these satellites are doing and why it matters, here's our own Maria Vermazes.