Transcript
A (0:02)
You're listening to the CyberWire network powered by N2K. AI is changing how enterprises operate and how they stay protected. It's time to eliminate risk and protect innovation. From March 23rd through the 26th, join Trend AI for actionable AI security insights. Catch impactful sessions at RSAC, then unwind and grab a bite at their lounge in Trapa. Sueno Experience industry leading AI security in person. Engage with the experts and get your chance to win $500,000. San Francisco lets AI fearlessly. Learn more@trendmicro.com RS. Iran's cyber ops stay resilient US lawmakers press big tech on EU rules Researchers expose a fancy bear server Japan moves toward offensive cyber CISA calls for cross agency teamwork New malware targets network infrastructure AI gets fooled by font based attacks Schneider Electric warns of critical flaws Quantum cryptography earns top honors Our guest is Braden Rogers, Chief customer officer at island, discussing how to make AI browsers safe for enterprises and smart glasses on the witness stand. It's Wednesday, march 18, 2026. I'm dave buettner and this is your cyberwire intel briefing. Thanks for joining us here today. It's great as always to have you with us. US and Israeli strikes on Iran reportedly killed two individuals tied to state backed cyber operations, but activity from affiliated hacking groups continues. Among those killed were Mohammed Mehdi Farhadi Ramin, charged by the Justice Department in 2020 for hacking U.S. aerospace and defense firms, and Syed Yaha Hosseini Panjaki and intelligence official linked by the FBI to cyber attacks and terror plots. Cybersecurity sources say Panjaki oversaw groups like handela. Despite this, HANDELA claimed a major attack on medical device company Stryker, alleging large scale data destruction. Stryker confirmed a Microsoft system compromise but said restoration is underway. Additional claims targeted Verifone, which reported no breach, while another MOIS linked group disrupted Albania's Parliament email systems. Iran's cyber operations appear resilient and decentralized. Groups continue operating despite leadership losses using tools like StarLink and possibly AI that suggest sustained cyber risk for Western organizations and allies. Even amid kinetic conflict, the House Judiciary Committee is pressing major tech firms to hand over communications with European Commission officials tied to enforcement of EU digital rules. In letters to companies including Alphabet, Meta, Microsoft, TikTok and X, chairman Jim Jordan said firms must preserve and produce records under February subpoenas, including messages set to auto delete. The request follows reports that EU officials, including Digital Services act enforcer Prabhat Agrawal, shifted to encrypted messaging apps like Signal with disappearing messages. The committee alleges potential censorship under the EU's Digital Services Act. While the commission denies the claims and says it aims to reduce user risk, the dispute highlights growing tension over platform regulation and data retention, with potential legal and compliance risks for global tech companies handling cross border communications. Researchers say an exposed server linked to Russia's Fancy Bear revealed a broad espionage campaign targeting government and military webmail across Eastern Europe and the Balkans. Building on Huntio's March 11 analysis, Control Alt intel says it found a second open directory on the same server containing command and control code payloads, telemetry logs and exfiltrated data. The researchers report more than 2,800 stolen emails, 240 credential sets, 140 forwarding rules and over 11,000 harvested contact addresses. Victims include entities in Ukraine, Romania, Bulgaria, Greece, Serbia and North Macedonia. The report also describes a previously unreported squirrel mail cross site scripting payload. According to the analysis, the same server had been tied to earlier Certua reporting and remained active for more than 500 days. The exposure shows both the reach and persistence of the operation. It also suggests that simple operational security failures can give defenders unusual insight into sophisticated state linked tradecraft. Japan will allow its Self Defense Forces to conduct offensive cyber operations beginning October 1, marking a notable shift in national security policy. Chief Cabinet Secretary Manuru Kahari said the move reflects a worsening threat environment and the growing impact of cyber attacks on daily life and the economy. A government cyber management committee will approve or reject operations if authorized. Police and the Self Defense Forces can attack and disable infrastructure used in cyber attacks with protections for citizen privacy. This expands Japan's interpretation of Self Defense into cyberspace and signals a more proactive posture against digital threats. A senior CISA official says the US Government should take a more flexible approach when leading cybersecurity efforts across critical infrastructure sectors. Speaking at an event Hosted by Auburn University's McCrary Institute, Acting CISA Director Nick Anderson said rigid adherence to sector risk management agency roles can slow effective response. Instead, agencies should defer to whichever organization has the strongest relationship with affected operators, whether that's cisa, the Department of Energy, the FBI or others. Anderson pointed to past coordination challenges, including responses tied to Guam incidents linked by Microsoft to Volt. Typhoon lawmakers have also questioned CISA's capacity following telecom focused activities attributed to another group, Salt Typhoon. Effective incident response may depend less on formal roles and more on trusted partnerships, especially as threats grow in scale and complexity. New malware samples highlight a growing trend of threat actors targeting network infrastructure to gain access and scale attacks. Researchers at Eclipsium identified two previously undocumented strains. One, a condibot variant derived from the Mirai botnet, turns compromised Linux devices into DDoS nodes. The other, Monaco brute forces secure shell credentials to deploy crypto mining malware across servers, routers and IoT devices, the report says. These tools are multi architecture and not limited to specific vendors. Supporting data from Verizon and Google indicate a sharp rise in exploitation of network devices, often with little delay between vulnerability disclosure and attack. Network infrastructure offers attackers persistent low visibility access and a foothold for broader compromise across enterprise environments. Researchers say A simple custom font technique can trick AI assistants into missing malicious instructions hidden in web pages. LayerX demonstrated a proof of concept where harmless text appears in the underlying HTML, while browser rendered content shows instructions leading to a reverse shell. The attack uses custom fonts and CSS to alter visible meaning without changing the document object model that AI tools analyze. In testing, multiple assistants failed to detect the threat and judge the page safe. The technique requires no exploits or JavaScript and relies on a gap between what AI systems parse and what users see. Attackers can exploit AI assisted workflows for social engineering, potentially leading to harmful user actions or data exposure. Schneider Electric has issued a critical advisory for a vulnerability affecting its SCADA Pack, Remote terminal units and Remote Connect software. With a CVSS score of 9.8. The flaw involves improper input validation in modbus TCP communications. The company says attackers can exploit it with crafted network packets to execute arbitrary code with system level privileges or cause denial of service and data compromise. Multiple versions and products are affected. Schneider Electric urges immediate updates and recommends network segmentation and access controls where patching is delayed. Charles Bennett and Gilles Brossard have been awarded the Turing Award for developing quantum cryptography, a breakthrough that's helped redefine how sensitive data is protected. Their work in the 1980s included the BB84 protocol, which uses photons to generate encryption keys that reveal any interception attempt. Because measuring quantum particles changes their state, eavesdropping leaves detectable traces. The researchers later expanded into quantum teleportation, demonstrating secure data transfer using entanglement. At the time, these ideas were largely theoretical. Today, they're gaining traction as companies like Google and Microsoft advance quantum computing, which experts believe could break widely used encryption methods developed in the 1970s. Experts say organizations may need to transition to quantum resistant approaches. Quantum cryptography offers a model where security is rooted in physics, not computational difficulty. The threat landscape evolves. Coming up after the break, my conversation with Braden Rogers from Island. We're discussing making AI browsers safe for enterprises. And smart glasses on the witness stand. Stay with us. No, it's not your imagination. Risk and regulation really are ramping up. And these days customers expect proof of security before they'll even do business. That's where Vanta comes in. Vanta automates your compliance process and brings compliance, risk and customer trust together on one AI powered platform. So whether you're getting ready for a SoC2 or managing an enterprise governance risk and compliance program, Vanta helps keep you secure and keeps your deals moving. Companies like Ramp and RYTR spend 82% less time on audits. With Vanta, that means less time chasing paperwork and more time focused on growth. For me, it comes down to this. Over 10,000 companies, from startups to large enterprises, trust Vanta to help prove their security. Get started@vanta.com cyber. Most environments trust far more than they should, and attackers know it. ThreatLocker solves that by enforcing default deny at the point of execution. With ThreatLocker allow listing, you stop unknown executables cold. With ring fencing, you control how trusted applications behave. And with ThreatLocker DAC defense against configurations, you get real assurance that your environment is free of misconfigurations and clear visibility into whether you meet compliance standards. ThreatLocker is the simplest way to enforce zero trust principles without the operational pain. It's powerful protection that gives CISOs real visibility, real control, and real peace of mind. ThreatLocker makes zero trust attainable even for small security teams. See why thousands of organizations choose threat Locker to minimize alert fatigue, stop ransomware at the source, and regain control over their environments. Schedule your demo@threatlocker.com N2K today, Braden Rogers is chief customer officer at island, and in today's sponsored Industry Voices segment, we discuss making AI browsers safe for enterprises.