Transcript
A (0:02)
You're listening to the Cyberwire Network powered by N2K. This episode is brought to you by Indeed. Stop waiting around for the perfect candidate. Instead, use Indeed sponsored Jobs to find the right people with the right skills fast. It's a simple way to make sure your listing is the first candidate. C According to Indeed data, Sponsored jobs have four times more applicants than non sponsored jobs. So go build your dream team today with Indeed. Get a $75 sponsor job credit@ Indeed.com podcast. Terms and conditions apply.
B (0:46)
The White House rolls out its AI legislative framework. The FBI warns Iranian actors are using Telegram for command and control while Russian operators fish signal users. Authorities dismantle a massive Fake CSAM Network Tycoon 2 FA rebounds after disruption, Void Stealer debuts a stealthy Chrome key theft trick, QNAP patches PWN to own flaws, and CISA orders urgent fixes for a critical Cisco firewall bug. We got our Monday business breakdown. Brandon Karp and Maria Vermazes ponder the practicality of orbital data centers and one radio to rule the range.
A (1:32)
Foreign.
B (1:38)
March 23, 2026 I'm Dave Bittner and this is your Cyberwire Intel Briefing. Thanks for joining us here today. We are coming to you from San Francisco, the city by the other bay, at the RSAC 26 conference, where the badges are large, the coffee is essential, and just about every booth appears to have discovered the life changing magic of agentic AI. This week we're attending presentations, walking the show floor to see what's new, what's improved, and what's now apparently autonomous, sitting down with industry leaders to hear what's actually changing beneath the buzzwords. We'll bring you interviews, insights, and a few field reports from cybersecurity's busiest gathering place. We're glad you're with us. Last Friday, the White House released their National Policy Framework for Artificial Intelligence Legislative recommendations. The document outlines proposals for Congress to balance innovation rights protections and national competitiveness through a unified federal AI strategy. The framework emphasizes stronger safeguards for children, including age assurance tools, limits on data use, and protections against exploitation and deepfake abuse. It calls for support for small businesses, infrastructure permitting reforms, and expanded federal technical capability to assess national security risks from advanced AI systems. The plan also addresses intellectual property by encouraging courts to resolve disputes over training on copyrighted material and considering licensing mechanisms and protections against unauthorized digital replicas. It promotes First Amendment protections by limiting government pressure on platforms to alter lawful content. Additional recommendations include regulatory sandboxes, expanded access to federal data sets, workforce training initiatives, and federal preemption of burdensome state AI laws to avoid fragmented regulation while preserving certain state authorities. The FBI warned that Iranian hackers linked to the Ministry of Intelligence and Security are using Telegram as command and control infrastructure in malware campaigns targeting journalists, dissidents and critics of the Iranian government worldwide. The activity is tied to the Hondala and Homeland justice threat groups, with Homeland justice linked to the Islamic Revolutionary Guard Corps. Attackers rely on social engineering to deploy Windows malware that steals screenshots and files, leading to intelligence collection, data leaks and reputational damage. The alert follows FBI seizures of four domains used to publish stolen data. Officials also highlighted a related handle attack on Stryker that wiped roughly 80,000 managed devices. Separately, the FBI and CISA warn that Russian linked actors are phishing signal users by impersonating the platform's support team. Attackers send urgent messages about suspicious activity to trick victims into sharing verification codes, clicking malicious links or scanning QR codes. This can give attackers full account access, exposing chats and contacts. Officials stress. The campaign relies on social engineering, not encryption flaws, and primarily targets journalists, activists and other sensitive information holders. An international law enforcement effort led by Europol and German authorities dismantled more than 373,000 dark websites tied to a cybercrime network built around the Alice with Violence CP platform. The operation, called Operation Alice, ran March 9 through March 19 of this year and involved agencies from 23 countries, investigators say. A single operator managed hundreds of thousands of Onion domains that posed as marketplaces for illegal material and cybercrime as a service offerings but primarily collected cryptocurrency without delivering services. Authorities seized over 100 servers, identified about 440 users and issued an arrest warrant for a China based suspect who allegedly earned more than €345,000, officials warn. The case shows how automation and anonymized hosting enable rapid scaling of dark web crime networks. The phishing as a service platform Tycoon2FA has quickly recovered after a coordinated disruption effort by Europol, Microsoft and partners, according to CrowdStrike. Active since 2023, the subscription service enables attackers to bypass multi factor authentication and conduct large scale phishing campaigns. It accounted for 62% of phishing attempts blocked by Microsoft in 2025, generating more than 30 million malicious emails monthly and affecting roughly 96,000 victims. Authorities seized 330 domains in early March, briefly reducing activity to about 25% of normal levels, but operations soon return to prior volumes. The platform's tactics remain unchanged, supporting business email compromise, session cookie theft and cloud account takeover, researchers say the disruption likely slowed customers temporarily but but did not significantly weaken the service long term. A new version of voidstealer is the first observed in the wild Malware to bypass Google Chrome application bound encryption using a debugger based technique that extracts the browser's V20 master key directly from memory. Unlike earlier methods, the approach avoids system level privilege escalation and browser code injection, reducing detection risk while still exposing cookies and credentials. The malware attaches to a hidden browser instance as a debugger, sets hardware breakpoints and intercepts the key during normal decryption. It then decrypts protected data offline from browser databases, effectively undermining ABE protections for that profile. Researchers note the technique builds on open source tooling and may spread to other infostealers. Defenders can detect activity by monitoring debugger attachments to browser processes, unusual memory read behavior and hidden browser launches from untrusted parents, which remain uncommon in legitimate environments. QNAP released patches for multiple vulnerabilities across its products, including four flaws in SD WAN routers demonstrated at Pone ta' Oan Ireland 2025. The issues range from privilege escalation, requiring physical access to information disclosure and administrator level code execution risks. Researchers from Team DDoS Chained related bugs to gain root access during the contest. QNAP also fixed critical flaws in qnet Switch and QVR Pro that could enable remote access or arbitrary code execution, the company said. No active exploitation has been reported. CISA ordered federal agencies to urgently patch a critical remote code execution flaw in Cisco's Secure Firewall Management Center. The vulnerability allows unauthenticated attackers to execute Java code as root and has been exploited as a zero day by the Interlock Ransomware Group. CISA added it to the known Exploited vulnerabilities catalog with a three day remediation deadline, Amazon Web Services reported. Attackers used the flaw for persistence, credential access and lateral movement. Turning to our Monday business breakdown, several cybersecurity startups announced major funding rounds and acquisitions, highlighting continued investor interest in AI driven security platforms. Surf AI raised $57 million, led by Excel to expand product development and enterprise adoption. Native secured $42 million, including a $31 million Series A LED by Ballistic Ventures, while Bold Security and Onyx security each raised 40 million. Kevlar AI added $30 million and Tracebit raised $20 million for product expansion. KLFI secured 12 million euros and Manifold closed an $8 million seed round. Separately, K2 Integrity acquired Leviathan Security Group and Connectus Business Solutions acquired i7 Technologies to expand regional support. There's much more in our business brief on our website, which is Part of CyberWire Pro do check it out. Coming up after the break, Brandon Karp and Maria Ramasas ponder the practicality of orbital data centers and one radio to rule the range. Stay with us. No, it's not your imagination. Risk and regulation really are ramping up. And these days, customers expect proof of security before they'll even do business. That's where Vanta comes in. Vanta automates your compliance process and brings compliance, risk and customer trust together on one AI powered platform. So whether you're getting ready for a SoC2 or managing an enterprise governance risk and compliance program, Vanta helps keep you secure and keeps your deals moving. Companies like Ramp and RYTR spend 82% less time on audits. With Vanta, that means less time chasing paperwork and more time focused on growth. For me, it comes down to over 10,000 companies, from startups to large enterprises trust Vanta to help prove their security. Get started@vanta.com cyber.