Transcript
A (0:02)
You're listening to the Cyberwire Network powered by N2K. Cyber threats strike in minutes. Your analysis can't take weeks. That's where Velox Reverser from Booz Allen comes in. It's an autonomous malware reverse engineering and threat intelligence product that turns weeks of painstaking manual analysis into into minutes of AI powered insights. With Velox Reverser security teams can perform deep analysis to learn how malware works and how to stop it. It's an advanced product that works at machine speed if you need to outpace evolving adversaries and strengthen your defense at scale. Request a demo or start your 30 day free trial of Velox Reverser today at Boozallen.com Reverser. A China linked group exploits a critical Dell zero day for 18 months a Microsoft 365 copilot bug risk sensitive email oversharing A new Linux botnet leans on old school IRC for command and control Switzerland tightens critical infrastructure rules with mandatory cyber reporting astarion Iran Rat emerges as a custom post exploitation implant Researchers find serious flaws in popular PDF platforms A suspected Iranian aligned campaign targets protest supporters Notepad rolls out a double lock update fix A Spanish court orders NordVPN and ProtonVPN to block illegal football streams Our guest is Keith Milarski, former FBI Special Agent and Chief Global Ambassador at Q Intel, Reflecting on the 25th anniversary of notorious spy Robert Hanssen's arrest and Dutch defense flaunt F35 firmware freedom. It's Wednesday, february 18th, 2026. I'm dave buettner and this is your cyberwire intel brief. Thanks for joining us here today. It's great as always to have you with us. Google researchers say a China linked threat group has exploited a critical del0day for at least 18 months, deepening a long running espionage campaign. Google Threat Intelligence Group and mandiant report that UNC 6201, which overlaps with UNC 5221 or Silk Typhoon, exploited a vulnerability in Dell recover point for virtual machines since mid-2024. The flaw stems from a hard coded administrator password pulled from Apache Tomcat and carries a 10.0 CVSS severity score. Researchers say attackers used it for unauthenticated remote access with root level persistence. The group previously deployed Brickstorm malware, then replaced it with the more advanced Grim Bolt backdoor. Dell released a patch Tuesday. Officials warn the actors likely remain active in unpatched systems. Long dwell times, often exceeding 400 days, gave attackers room for sustained espionage. CISA, the NSA and Canadian Authorities have released detection guidance, but researchers caution the full scope remains unknown. Microsoft says a bug in Microsoft 365 copilot has been causing the AI assistant to summarize confidential emails since late January, bypassing organizations data loss prevention policies. The issue was first detected January 21st and affects the Copilot work tab chat feature. According to a service alert seen by bleeping computer, Copilot incorrectly read and summarized emails stored in Users Sent Items and Drafts folder, including messages with sensitivity labels meant to restrict automated access. Microsoft confirmed that a code issue allowed labeled items to be processed despite DLP policies. The company began rolling out a fix in early February and says it's monitoring deployment and contacting some affected users. Microsoft has not disclosed how many organizations were impacted or provided a final remediation timeline. The incident is currently classified as an advisory, suggesting limited scope, though the investigation remains ongoing. Security researchers have identified a new Linux botnet dubbed SSH Stalker that uses Internet Relay Chat for command and control. The research team at Flare discovered the operation through an SSH honeypot over a two month period. According to its report, SSH Stalker chains an SSH scanner with rapid staging to enroll compromised systems into IRC channels, enabling centralized control. The botnet exploits legacy Linux kernel vulnerabilities and appears optimized for scale. Flare observed nearly 7,000 fresh SSH scan results in January. Most activity originated from cloud hosting providers across the U.S. europe and Asia Pacific, suggesting opportunistic automation rather than dedicated nation state infrastructure. Researchers say the botnet maintains dormant persistence. It establishes access without launching distributed Denial of Service attacks or crypto mining. Despite having those capabilities, quiet footholds can signal staging for future operations. Flare recommends monitoring build tools, scanning for malware and reviewing cron jobs. Switzerland's National CyberSecurity center says 2025 marked a major shift driven by mandatory cyber attack reporting for critical infrastructure. According to its annual report for 2025, the NCSC processed nearly 65,000 voluntary incident reports and 222 mandatory reports after the new requirement took effect April 1. Under the revised Information Security act, organizations must report attacks within 24 hours. The Cybersecurity Hub, or CSH, expanded to about 1600 members and added multilingual reporting and secure information sharing. The agency also exchanged Data on over 4,600 incidents through the Malware Information Sharing platform and led cybersecurity operations for major national events. Parliament approved budget increases beginning in 2026. Mandatory reporting and expanded information sharing improve early warning and coordinated defense across critical sectors. NCSC says the measures strengthen Switzerland's National Cyber Strategy and Long Term Resilience. Huntress responded to a February 2026 intrusion that began with a click fix social engineering attack, a technique that surged last year. According to Huntress, ClickFix tricks users into copying and pasting malicious commands, bypassing traditional email security controls. In this case, it delivered Matanbukas 3.0, a malware as a service loader first advertised in 2021 and now priced up to $15,000 per month for a stealth DNS variant, Huntress says Matanbukas deployed a previously undocumented custom implant they named astarion Rat. The remote access Trojan used RSA encrypted command and control traffic disguised as telemetry and supported credential theft, SOX5 proxying, port scanning and reflective code loading. The operator moved laterally within 40 minutes, targeting a Windows server and domain controllers using PSEXEC rogue accounts and defender exclusions. Huntress assesses with medium confidence the goal was ransomware or data theft. Researchers have uncovered 16 vulnerabilities in PDF platforms from Foxit and Apprise that could have enabled account takeover and data theft. The flaws were identified by pen testing startup Novi in Aprise Webviewer and Foxit's PDF cloud services. According to Nov, the issues included one critical and four high severity bugs along with multiple medium severity findings. Vulnerability types ranged from cross site scripting and server side request forgery to path traversal and operating system command injection. Researchers demonstrated that specially crafted documents, URLs or messages could trigger arbitrary code execution and data exfiltration or persistent compromise, particularly when PDF viewers were embedded in authenticated enterprise applications. Both vendors say the vulnerabilities were responsibly disclosed and have been patched. Novi warns that widely embedded PDF components can become high impact attack surfaces if left unexamined. Researchers have uncovered a suspected Iranian aligned cyber espionage campaign targeting protest supporters with custom malware. A Cronus threat research unit says the campaign, dubbed Crescent Harvest, began shortly after January 9th and uses malicious Windows shortcut files disguised as protest images and videos. The files include Farsi language content framed as updates from Iran's rebellious cities. When executed, the malware uses DLL sideloading through a signed Google binary to deploy a remote access Trojan and information stealer. Capabilities include key logging, browser credential theft, telegram session exfiltration and command execution over HTTPs using JSON based command and control infrastructure links to a Latvia hosted server. Though attribution remains low confidence, Acronis assesses the campaign likely targets Farsi speaking Iranians supportive of protests as well as activists and journalists politically themed lures continue to enable long term surveillance of at risk communities. Notepad has strengthened its update security with a new double lock verification system following a recent supply chain compromise introduced in the latest version. The mechanism verifies both the signed installer hosted on GitHub and and a digitally signed XML file from notepadplusplus.org using XML digital signature. The update follows a six month campaign attributed to the China linked Lotus Blossom Group, which compromised the software's hosting provider starting in June of last year and redirected select users to malicious servers, Rapid7 reported the attackers deployed a custom backdoor called Chrysalis. Additional hardening steps include removing libcurl DLL to prevent DLL sideloading, eliminating insecure Curl SSL options, restricting plugin execution to trusted certificates, switching hosting providers and rotating credentials. Users are urged to upgrade and download installers only from the official website. A Spanish Court has ordered NordVPN and ProtonVPN to block 16 websites of illegally streaming football matches. The precautionary measures requested by La Liga and broadcaster Telefonica were issued without a hearing for the VPN providers and allowed no opportunity for appeal. The ruling applies to a dynamic list of IP addresses in Spain. La Liga argued that VPN services fall under the EU Digital Services regulation and facilitate access to pirated content by masking users geographic locations. The Court reportedly found VPNs to be an effective means of bypassing regional restrictions. ProtonVPN and NordVPN say they were not notified of the proceedings and question the lack of due process. NordVPN also argued that blocking domains is ineffective and that enforcement should target hosting providers and illegal content sources. Inst. Coming up after the break, Keith Milarsky reflects on the 25th anniversary of notorious spy Robert Hansen's arrest and Dutch defense flaunt F35 firmware freedom. Stay with us foreign. When it comes to mobile application security, good enough is a risk. A recent Survey shows that 72% of organizations reported at least one mobile application security incident last year and 92% of responders reported threat levels have increased in the past two years. Guard Square delivers the highest level of security for your mobile apps without compromising performance, time to market or user experience. Discover how Guard Square provides industry leading security for your Android and iOS apps at www.guardsquare.com. Most security conferences talk about zero TR0 Trust World puts you inside this is a hands on cybersecurity event designed for practitioners who want real skills, not just theory. You'll take part in live hacking labs where you'll attack real environments, see how modern threats actually work, and learn how to stop them before they turn into incidents. But Zero Trust World is more than labs. You'll also experience expert led sessions, practical case studies, and technical deep dives focused on real world implementation. Whether your blue team, red team, or responsible for securing an entire organization, the content is built to be immediately useful. You'll earn CPE credits, connect with peers across the industry, and leave with strategies you can put into action right away. Join us March 4th through the 6th in Orlando, Florida. Register now@ZTW.com and take your Zero Trust strategy from theory to execution. Today marks the 25th anniversary of the arrest of Robert Hanssen, broadly known as the worst spy in the FBI's history. Keith Milarsky is a former FBI special agent and now chief global Ambassador at Q Intel, and he was present at Robert Hanson's arrest. Well, Keith, welcome back. It's always great to have you join us here. I want to start off with just a little history lesson for folks who may not be familiar with the saga of Robert Hanssen and your part in it. Let's start with the history. What are we talking about here?