Transcript
Maria Vermazes (0:02)
You're listening to the Cyberwire Network powered by N2K.
Dave Bittner (0:12)
When cyber threats strike, minutes matter. Booz Allen brings the same battle tested expertise trusted to protect national security to defend today's leading global organizations. They safeguard their data, strengthen enterprise resilience and mobilize in minutes across energy, healthcare, financial services and medicine manufacturing. Their teams don't just respond, they anticipate, outthink and stay ahead of evolving threats. This is powerful protection for commercial leaders only. From Booz Allen. See how your organization can prepare today@booz allen.com Commercial. Europol dismantles the SOX Escort proxy service Cyber operations highlight imbalance in the war in Iran Google rushes Chrome Zero day patches Veeam fixes critical backup flaws A former incident responder faces ransomware charges Thomson Reuters staff push back on an ICE contract Attackers abuse backup tools for data theft CISA flags a critical N8N vulnerability Maria Vermazes is joined by Jack Bialik, engineer and author, to discuss the hidden risks of a fully digital society and talk about his book in Lost in our Forgotten and Vanishing Knowledge and A phony photo fuels a phantom flight fiasco. It's Friday, March 13, 2026. I'm Dave Buettner and this is your Cyberwire Int briefing. Thanks for joining us here today and Happy Friday. It's great as always to have you with us. This week, Europol and international partners launched Operation Lightning to dismantle the criminal proxy service SOX Escort. Working with authorities from Austria, France, the Netherlands, the United States, and Eurojust, investigators seized 34 domains and 23 servers across seven countries and froze $3.5 million in cryptocurrency. The service relied on a botnet of more than 369,000 compromised routers and IoT devices in 163 countries, primarily residential modems infected through exploited vulnerabilities. Customers paid for access to these hijacked IP addresses, allowing them to conceal their identities while conducting crimes such as ransomware attacks, DDoS campaigns, and the distribution of child sexual abuse material. Europol supported the investigation with intelligence analysis, crypto tracing, and coordination, highlighting the importance of international cooperation in disrupting cybercrime infrastructure. An analysis from the International Institute for Strategic Studies looks at the first week of the war between Israel, the United States, and Iran, highlighting a significant imbalance in cyber capabilities. Public reports describe Israeli and US Cyber operations that supported military actions, including hacking Tehran's traffic cameras to time a strike on Iranian leadership, disrupting telecommunications to hinder command and control, and briefly taking over a popular prayer app to spread anti regime messages. Analysts note that these publicly known operations likely represent only a small portion of the broader cyber campaign, with many capabilities remaining undisclosed. Israel and the US are expected to prioritize cyber operations for intelligence gathering and information operations, occasionally integrating them with kinetic strikes. Iran, by contrast, has relied heavily on proxy groups and hacktivists conducting DDoS attacks, website defacements, and hack and leak campaigns. While disruptive, these activities are often more symbolic than strategic. Governments worldwide have warned organizations to strengthen defenses as Iranian actors and proxies may target countries beyond Israel and the U.S. google has issued emergency security updates for Chrome to fix two high severity vulnerabilities which are already being exploited in the wild. The first flaw involves an out of bounds write in the Skia graphics library that could allow attackers to crash the browser or execute code. The second affects the V8 JavaScript and WebAssembly engine. Google patched the issues within two days and released updates for Windows, macOS and Linux. Users are advised to update their browsers as rollout may take time. Veeam has patched multiple vulnerabilities in its backup and replication software, including four critical remote code execution flaws. Three of the vulnerabilities allow low privilege domain users to execute code on vulnerable backup servers, while another enables a backup viewer to gain code execution as the postgres user. Additional high severity bugs could allow privilege escalation, ssh, credential extraction or manipulation of files on backup repositories. Veeam urges administrators to update quickly as backup servers are frequent ransomware targets and attackers often reverse engineer patches to exploit unpatched systems. The U.S. department of justice has charged Angelo Martino, a former employee of an incident response firm, for allegedly participating in a ransomware extortion scheme linked to the Black cat group between April 2023 and April 2025. Martino reportedly acted as a direct affiliate, working with two other former cybersecurity professionals to exploit their trusted roles and and demand ransom payments from victims. Prosecutors allege the group targeted at least 10 US organizations across sectors including healthcare, finance, manufacturing and retail, threatening to leak stolen data unless payments were made. In one case, a Tampa based medical device manufacturer reportedly paid about $1.2 million in cryptocurrency. Investigators say the conspirators shared roughly 20% of ransom proceeds with Black Cat Administrat. The case highlights the growing risk of insider threats within the cybersecurity and incident response industry. More than 200 Thomson Reuters employees are urging the company leadership not to renew a $22.8 million contract with U.S. immigration and Customs Enforcement that provides investigative software capable of gathering public and private data and tracking license plates. The protest is concentrated among employees in Minnesota, where ICE operations under Operation Metro Surge directly affected local communities. Workers say arrests, intimidation and violence linked to enforcement actions have made the issue personal, prompting concerns that the company's tools could be used to identify or harass individuals. The internal push gained momentum after an online post listed companies working with ice, sparking internal discussions and organizing among staff. Thomson Reuters said it supports investigations related to national security and public safety while maintaining safeguards to ensure lawful use of its products. Employee groups and some shareholders are calling for stronger human rights oversight. Huntress SOC analysts investigated a ransomware incident in which attackers use the backup tool restic to to stage and exfiltrate data before deploying ink ransomware. The threat actor accessed a compromised endpoint in February, mapped a network share, elevated privileges with PSEXEC, and created a scheduled task to execute a PowerShell script. The script configured AWS credentials and a Wasabi S3 repository, then ran a renamed copy of Restic to backup selected files for exfiltration. Limited visibility hindered early detection because the Huntress agent was not fully deployed and the victim lacked a SIM system. On 25 February, the attacker removed security tools, disabled Windows Defender, and launched the ransomware. Analysts noted similar activity in an earlier February incident and referenced comparable findings reported by Cyber Centaurs, suggesting a repeatable attacker technique. CISA has added a critical remote code execution vulnerability in the open source workflow automation platform N8N to its known exploited vulnerabilities catalog. The flaw allows authenticated attackers to execute arbitrary code with the same privileges as the N8N process, potentially leading to full system compromise. The vulnerability affects multiple versions. Proof of concept Exploits show attackers can abuse JavaScript expressions in workflows to run system commands. Federal agencies must patch the issue by March 25. Researchers previously identified over 100,000 potentially exposed instances, with tens of thousands still vulnerable earlier this year. Coming up after the break, Maria Vermazes speaks with Jack Bialik, engineer and author, to discuss the hidden risks of a fully digital society and a phony photo fuels a phantom flight fiasco. Stick around. AI is changing how enterprises operate and how they stay protected. It's time to eliminate risk and protect innovation. From March 23rd through the 26th, join Trend AI for actionable AI security insights. Catch impactful sessions at RSAC, then unwind and grab a bite at their lounge in troposweno. Experience industry leading AI security in person. Engage with the experts and get your chance to win $500,000 San Francisco lets AI fearlessly. Learn more@trendmicro.com RSA. If you're defending a network today, there's a simple question worth asking. What does the attacker see when they look at your organization? Nord Stellar helps answer that Nord Stellar is a threat exposure management platform that gives security teams visibility into external risks, including leaked credentials, active session tokens, impersonation attempts, and exposed assets across the surface web and the dark web. It's built to help organizations detect the consequences of breaches early, before attackers turn access into action. From monitoring for infostealer malware logs to identifying cybersquatting and brand abuse, Nord Stellar helps teams focus on the threats that actually matter. Executives get clear, actionable insights tied to business risk. Security teams get real time alerts and one of the largest deep and dark web intelligence pools in the industry. Cybercriminals may already be looking for your weak spots. Don't make it easy for them. Be the one that's prepared. Defend your business with Nordstellar. Use the code CYBERWIRE10 to unlock your exclusive discount. Go to nordstellar.com cyberwire daily or and learn more. Jack R. Bialik is an engineer and author. Our contributing host Maria Vermazes recently caught up with him to discuss his book in Lost in Our Forgotten and Vanishing Knowledge. Here's their conversation.
