Transcript
Dave Bittner (0:02)
You're listening to the Cyberwire Network powered
Jake Braun (0:04)
by N2K
Home Depot Announcer (0:09)
now at the Home Depot. Receive 12 months special financing and free basic installation on carpet projects with LifeProof LifeProof with PET proof technology Home Decorators collection and traffic Master carpets bring a new look to your floors or give them a durable surface that stands up to life's tough messes. Get 12 months special financing on installed carpet projects right now at the Home Depot offer Valley March 12 through March 29, 2026. Exclusions and additional charges may apply for licenses. See homedepot.com License numbers.
Narrator / Host (0:48)
RSAC Spotlights Public Private partnership Gaps Dark sword leaks to GitHub the FCC blocks new foreign made routers Citrix patches a critical netscaler flaw the DOE rolls out an energy sector cyber canister worm spreads through NPM researchers flag suspected case SMA exploitation QualDURM reports a 3.1 million record breach a Russian access broker gets 81 months intern Kevin checks in from RSAC. Maria Ramazis speaks with Jake Braun, longtime DEF CON organizer and former White House official, about the Defcon 33 Hackers Almanac and Slow down, you vibe too fast. It's Tuesday, march 24, 2026. I'm dave buettner and this is your cyberwire intel brief. Foreign thanks for joining us here today as we come to you from RSAC 2026 here in beautiful San Francisco. It's great to have you with us. Yesterday at RSAC 2026, panelists highlighted persistent gaps in real time information sharing between government and private industry. Using the cybercrime group Scattered Spider as a case study, former FBI cyber official Dave Scott recalled that officials once proposed a joint coordination cell to exchange intelligence with private partners in real time, but legal and approval barriers prevented it. Years later, phone based social engineering has become the second most common initial access method and the leading tactic for cloud intrusions. Underscoring the missed opportunity, a panel originally focused on China's Volt and Salt typhoon campaigns proceeded without FBI or NSA participation, leaving an empty chair on stage and reinforcing concerns about public private coordination. Speakers stressed that private companies often detect activity first because attacks frequently target privately operated infrastructure. They argued that timely intelligence sharing, especially as AI accelerates threat activity, is increasingly crit. Still, the absence of government voices at a major security forum signaled lingering coordination challenges. A newer version of the iPhone hacking toolkit DarkSword spyware has been leaked to GitHub, raising concerns that attackers can easily target devices running outdated Apple operating systems. Researchers at Iverify warned the tool requires little technical expertise to deploy and can exfiltrate contacts, messages, changes, call history and keychain data from vulnerable devices. A security hobbyist reported successfully exploiting an iPad mini running iOS 18 using circulating samples. Apple said updated devices are not affected and issued emergency patches for older systems unable to run newer versions. Researchers estimate hundreds of millions of devices may remain exposed. The leak follows earlier reporting that Dark Sword infrastructure was linked to activity attributed to Russian government hackers targeting Ukrainian users. The Federal Communications Commission has added all foreign made consumer routers to its covered list under the Secure Networks act, citing national security risks tied to supply chain exposure. The move blocks approval of new models but does not affect existing authorized devices already in use or on the market. The decision follows an Executive branch assessment aligned with national security Strategy priorities to reduce dependence on foreign infrastructure components. Officials argue routers have been exploited in campaigns such as Volt Typhoon, Flax Typhoon and Salt Typhoon. Critics note most routers, including those from Cisco and Netgear, are manufactured abroad, leaving few domestic alternatives beyond Starlink WI FI router. The policy may pressure vendors to shift production to the United States, though exemptions remain available through National Security Review. Citrix has released patches for a critical NetScaler ADC and NetScaler Gateway flaw affecting deployments configured as security Assertion Markup language identity providers. The bug allows potential sensitive memory disclosure and could be exploited by unauthenticated attackers. A second issue may cause user session mix ups. No active exploitation is confirmed, but researchers warn attacks are likely once exploit code appears. Because SAML configurations are common in single sign on environments, organizations are urged to patch immediately. The US Department of Energy has released its first comprehensive five year strategy to strengthen cybersecurity across the nation's energy infrastructure, translating White House priorities into operational guidance. Developed by the Office of Cybersecurity, Energy Security and Emergency Response, the plan focuses on three advancing cybersecurity technologies for operational technology environments, hardening grid and supply chain infrastructure and improving incident response and recovery coordination. Officials say the strategy clarifies DOE's role as sector risk manager and emphasizes a resilience first approach. However, analysts warn execution risks remain, citing reduced funding and reliance on partners such as cisa, which has lost staffing capacity. The plan promotes voluntary security practices and highlights persistent capability gaps among smaller utilities. A malware campaign dubbed Canister Worm is rapidly spreading through developer ecosystems after attackers seeded malicious code into more than 45 npm packages. Researchers at Aikido Security link the activity to stolen credentials from an earlier compromise of Aqua Security's Trivey scanner, enabling attackers to hijack maintainer accounts and publish infected updates within minutes. The worm steals authentication tokens and SSH keys to propagate across systems and distribute additional malicious packages. The campaign uses a decentralized command system hosted on the ICP blockchain, complicating disruption efforts. Behavior varies by environment. On Kubernetes networks in Iran, it deploys destructive wiping malware, while elsewhere it installs a backdoor. Researchers warn the attack demonstrates rapid supply chain propagation and unusually resilient command infrastructure. Arctic Wolf observed suspected exploitation of a vulnerability in publicly exposed Quest Software Kace systems management appliance instances beginning March 9. The critical authentication bypass flaw enables attackers to impersonate users and gain full administrative control. Observed activity included remote command execution, credential harvesting with mimikats, creation of admin accounts, and lateral movement into backup systems and domain controllers. No public proof of concept is known. Defenders are urged to patch affected versions and and remove Internet exposure of SMA appliances. Healthcare management firm Qualm Partners is notifying more than 3.1 million individuals that personal, medical and insurance data was stolen during a December 2025 network intrusion lasting two days. Exposed information includes names, contact details, medical records, diagnoses, insurance data and in some cases, government ID numbers. The incident was reported to the U.S. department of Health and Human Services breach portal the company says it contained the activity notified authorities and is offering 12 months of identity theft and credit monitoring services while its investigation continues. Alexei Volkov, a Russian initial access broker linked to the Yanlang ransomware gang, has been sentenced to 81 months in prison for helping breach US organizations and enable ransomware attacks. Prosecutors said Volkov identified network vulnerabilities and sold access to co conspirators who deployed ransomware against banks, telecommunications providers and engineering firms across multiple states. The campaign caused more than $9 million in losses and involved ransom demands exceeding $24 million. Volkov was arrested in Rome and extradited to the United States, where he pleaded guilty in federal cases in Indiana and Pennsylvania. Investigators also found he communicated with members of the Lockbit ransomware Group. As part of sentencing, he agreed to pay restitution and forfeit equipment used in the attacks. Kevin McGee is global director of cybersecurity startups at Microsoft, but this week at rsac, he's better known as Intern Kevin.