Transcript
A (0:02)
You're listening to the Cyberwire Network powered by N2K.
B (0:12)
When cyber threats strike, minutes matter. Booz Allen brings the same battle tested expertise trusted to protect national security to defend today's leading global organizations. They safeguard their data, strengthen enterprise resilience and mobilize in minutes across energy, healthcare, financial services and medicine manufacturing. Their teams don't just respond, they anticipate, outthink and stay ahead of evolving threats. This is powerful protection for commercial leaders only. From Booz Allen, See how your organization can prepare today@booz allen.com Commercial. Iran threatens tech firms as hackers strike stryker the EU advances efforts toward digital sovereignty A foreign hacker stumbles upon the FBI's Epstein files Doge uses ChatGPT to cull humanities grants. Meta claims increased efforts against scams A Wisconsin ambulance provider discloses a data breach CISA shortens the patch deadline for a critical solar winds vulnerability. We Preview this year's RSAC 2026 Innovation Sandbo with Cecilia Marinet and Paul Coker and dangerous digital diets Miss the mark. It's Thursday, march 12, 2026. I'm dave bittner and this is your cyberwire intel brief. Thanks for joining us here. It's great to have you with us. Rising tensions in the Middle east are increasingly spilling into cyberspace. Iran has warned that major US Technology companies could become legitimate targets as regional tensions escalate amid the ongoing conflict involving Iran, the United States and Israel. The warning reportedly named firms such as Google, Microsoft, Amazon, Nvidia, IBM, Oracle and Palantir, with Iranian media listing offices and cloud infrastructure linked to those companies in Israel and Gulf countries. Iranian officials claim the facilities were identified because their technology is allegedly used for military purposes. The warning also extended to economic centers and banks connected to U.S. and Israeli entities. Authorities cautioned civilians to avoid areas near these locations as the conflict intensifies, signaling a possible expansion of targets beyond military assets to include technology infrastructure. Medical device manufacturer Stryker confirmed Wednesday that a cyber attack caused a global network disruption affecting its Microsoft environment. The Michigan based company said it has no indication of ransomware or malware and believes the incident is though teams are still assessing the impact. Stryker said business continuity measures remain in place to support customers and partners. Employees reported widespread disruptions, saying corporate laptops, phones and servers were wiped and access to email and internal applications was lost early Wednesday, some workers said login pages displayed the logo of the hacking group handela. The group claimed responsibility online, alleging it wiped more than 200,000 systems and stole 50 terabytes of data Handela previously linked to Iran based threat actors and destructive wiper attacks, said the operation was retaliation tied to the ongoing U S, Israel and Iran conflict. Researchers have uncovered a coordinated influence campaign linked to Iran's Islamic Revolutionary Guard Corps that used fake social media Personas to spread pro Tehran messaging. A Clemson University Media Forensics Hub report identified 62 accounts across X, Instagram and Blue sky posing as Scottish independent supporters, Irish nationalists and Latina women. The accounts used stolen or AI generated profile photos and tailored divisive content to match their fake identities, posting about issues like immigration, Scottish independence and British politics. After US And Israeli airstrikes in Iran, the accounts shifted focus to the war, sharing anti US and anti Israel messaging, alleged strike footage and AI generated images. Researchers say the tactic mirrors earlier troll operations designed to blend in to online communities and influence public opinion. The European Commission announced the Euro 3C initiative at Mobile World Congress 2026, a 75 million euro project funded through Horizon Europe to build Europe's first large scale federated telco edge cloud infrastructure. The platform will integrate telecom networks, edge computing and cloud services to deliver secure, high speed computing closer to users. The project aims to reduce Europe's reliance on non EU technology providers while supporting digital sovereignty. Euro3C will bring together 87 organizations including Telecom operators, cloud providers, equipment manufacturers, software developers and research institutions. The effort aligns with the proposed Digital Networks act and broader EU programs while supporting innovation in areas such as 6G artificial intelligence, cybersecurity and advanced telecom services. A foreign hacker accessed files tied to the FBI's investigation of Jeffrey Epstein after breaching a server at the bureau's New York field office in February 2023, according to a source and Justice Department documents reviewed by Reuters. The compromised server was located in the FBI's Child Exploitation Forensic lab and had reportedly been left vulnerable while an agent was handling digital evidence. Investigators later found signs the intruder had searched through files related to the Epstein case, though it remains unclear which materials were accessed or whether any data was downloaded. The FBI described the event as an isolated cyber incident and and said access was quickly restricted and the network secured. According to the source, the hacker appeared to be a cyber criminal rather than a government actor and reportedly did not realize the server belonged to the FBI until agents confirmed their identity during a video call. Court documents reveal that Officials from Elon Musk's Department of Government Efficiency DOGE used ChatGPT to help identify humanities grants to cancel at the National Endowment for the Humanities in 2025. The chatbot was prompted to determine whether projects were related to diversity, equity and inclusion, using brief online summaries rather than full proposals. The process flagged hundreds of grants, including projects on black newspapers, Holocaust history, indigenous language archives and American music scholarship. Doge ultimately recommended terminating over 1,400 grants approved during the Biden administration, reclaiming more than $100 million, nearly half the agency's budget. Acting Chairman Michael McDonald approved the cancellations, describing the move as creating a clean slate aligned with the Trump administration's America First Priorities. Academic organizations have filed lawsuits arguing the cuts were politically motivated and violated constitutional protections, claiming the process targeted scholarship involving race, gender and marginalized communities. Meta says it removed 159 million scam ads in 2025 and shut down 10.9 million Facebook and Instagram accounts tied to scam operators as the company promotes new efforts to combat online fraud. It says most fraudulent ads were detected automatically before users reported them, and that it's increasingly targeting entire scam networks. The announcement comes amid growing scrutiny from US Lawmakers who've questioned whether Meta's business model gives it sufficient incentive to police scam advertising. A Reuters investigation previously suggested that a significant share of the company's ad revenue could come from ads linked to scams or banned goods, a claim Meta disputes. Many fraud operations originate from organized compounds in Southeast Asia running pig butchering investment scams. Critics say. The scale of the problem highlights how easily scammers continue to exploit social media platforms. Bell Ambulance, Wisconsin's largest ambulance provider, disclosed a data breach affecting over 237,000 people following a ransomware attack attributed to the Medusa Group. Attackers accessed the company's network between February 7th and 14th, 2025, and demanded a $400,000 ransom, which the company reportedly refused to pay. The group later published the stolen data on a Dark Web leak site. Compromised information includes names, birth dates, Social Security numbers, driver's license numbers, financial account details, medical records and health insurance information. Although some victims were notified in April of last year, the company said the full scope of the breach was not confirmed until this past February. Bell Ambulance is offering affected individuals 12 months of credit monitoring and identity theft protection. CISA has shortened the patch deadline for a Critical vulnerability in SolarWinds web help desk after reports of active exploitation by cybercriminals and nation state actors. Federal civilian agencies must remediate the flaw by today. The vulnerability allows remote attackers to compromise the IT service management platform, potentially exposing sensitive data such as network architecture, user credentials and security tickets while enabling lateral movement within networks. This marks the third emergency patch directive in a month for the same SolarWinds tool, underscoring the urgency for organizations to apply the latest security updates. Coming up after the break, we've got a preview of this year's RSAC 2026 Innovation Center Sandbox and Dangerous Digital Diets. Miss the mark. Stay with us. AI is changing how enterprises operate and how they stay protected. It's time to eliminate risk and protect innovation. From March 23rd through the 26th, join Trend AI for actionable AI security insights. Catch impactful sessions at RSAC, then unwind and grab a bite at their lounge in tropes. When you experience industry leading AI security in person, engage with the experts and get your chance to win $500,000. San Francisco lets AI fearlessly. Learn more@trendmicro.com RSA. If you're defending a network today, there's a simple question worth asking. What does the attacker see when they look at your organization? Nord Stellar helps answer that. Nord Stellar is a threat exposure management platform that gives security teams visibility into external risks, including leaked credentials, active session tokens, impersonation attempts, and exposed assets across the surface web and the dark Web. It's built to help organizations detect the consequences of breaches early, before attackers turn access into action. From monitoring for infostealer malware logs to identifying cybersquatting and brand abuse, Nord Stellar helps teams focus on the threats that actually matter. Executives get clear, actionable insights tied to business risk, security teams get real time alerts and one of the largest deep and dark web intelligence pools in the industry. Cybercriminals may already be looking for your weak spots. Don't make it easy for them. Be the one that's prepared. Defend your business with Nordstellar. Use the code CYBERWIRE10 to unlock your exclusive discount. Go to nordstellar.com cyberwire daily and learn more. N2K CyberWire are proud media partners of the RSAC Conference, and today we've got a conversation with Cecilia Marinier, Cybersecurity Advisor for Strategy, Innovation and Scholars at RSAC Conference, along with Paul Kocher, who's one of the judges of this year's Innovation Sandbox. Cecilia Paul, welcome. It's a real pleasure to have you back and it's one of my favorite times of the year as we sort of get on board the excitement leading up to RSA Conference. And this year is no different. And one of the most exciting things for me is of course the Innovation Sandbox. And this year we've got quite a group lined up for us. Before we dig into the names though, can we just start with a little background here? Cecilia for people who aren't Familiar with this program. What's it all about?
