Transcript
A (0:02)
You're listening to the Cyberwire Network powered by N2K.
B (0:10)
The world moves fast. Your workday even faster Pitching products, drafting reports, analyzing data Microsoft 365 copilot is your AI assistant for work built into Word, Excel, PowerPoint and other Microsoft 365 apps you use, helping you quickly write, analyze, create and summarize so you can cut through clutter and clear a path to your best work. Learn more@Microsoft.com M365 copilot. A senior FBI cyber official warns Salt Typhoon remains an ongoing threat Data protection authorities issue a joint statement raising serious concerns about AI image creation A Japanese semiconductor equipment maker confirms a ransomware attack New number formats seek to reduce AI overhead A low skilled Russian speaking threat actor compromised more than 600 Fortinet Fortigate firewalls. Spanish authorities have arrested four alleged members of anonymous CISA tags, a pair of round cube webmail flaws Cybersecurity stocks fell sharply on news of a new security feature in Claude AI we got your Monday business breakdown. Brandon Karpf and Maria Vermazes join me to discuss sovereignty in space and cyber and digital disruption Drains drumsticks. It's Monday, February 23rd, 2026. I'm Dave Buettner and this is your Cyberwire Intel Brief. Thanks for joining us here today on a snowy day here in the dmv. It's great to have you with us. A senior FBI cyber official warns that Salt Typhoon, the Chinese espionage group behind the 2024 compromise of US telecommunications infrastructure, remains an ongoing threat to both public and private sectors. Speaking at cyber Talks in Washington, D.C. michael Machtinger said organizations that engaged early with the FBI and CISA were most successful in limiting damage reporting. Previously found the telecom sector struggled with basic cybersecurity weaknesses and fragmented networks, which Salt Typhoon exploited for persistent access. Machtinger emphasized that simple vulnerabilities, not advanced zero day exploits, were the primary entry points. With phishing and legacy systems still common attack vectors, he urged organizations to adopt fundamental practices such as zero trust and least Privilege access. Salt Typhoon's campaign has reportedly affected more than 80 countries and continues to pose a significant threat. Data protection authorities from around the world, coordinated by the International Enforcement Cooperation Working Group, have issued a joint statement raising serious concerns about artificial intelligence systems that generate realistic images and videos of identifiable people without their consent. The signatories highlight that while AI image and video tools can offer benefits, they've also enabled non consensual intimate imagery, defamatory depictions and other harmful content, with particular risks for children and vulnerable groups. Organizations developing or deploying such technology are reminded to comply with applicable privacy and data protection laws and to implement strong safeguards to prevent misuse. The statement calls for meaningful transparency about system capabilities and risks, effective mechanisms for individuals to request removal of harmful AI generated content, and enhanced protections where children are depicted. It emphasizes that technological advancement should not come at the expense of privacy, dignity and safety. Japanese semiconductor equipment maker Advantest confirmed it suffered a ransomware attack after detecting unusual activity in its IT environment on February 15. The company said a third party may have accessed parts of its network and deployed ransomware. Advantest activated incident response protocols, isolated affected systems, and engaged external cybersecurity experts. The investigation remains ongoing, and it's unclear whether customer or employee data was impacted. The company has not reported significant operational disruptions and says it will provide updates as it assesses the full scope of the incident. Artificial intelligence has fueled a surge in new digital number formats as engineers seek to reduce computation time and energy use by shrinking bit counts. While AI systems can operate effectively with 16, eight or even fewer bits, scientific computing fields such as physics and engineering require far greater dynamic range and precision. In an interview in the IEEE newsletter, Laszlo Hunhold, an AI engineer at OpenChip, argues that traditional 64 bit standards are excessive for most tasks but still better suited for scientific workloads than many AI optimized formats. AI data tends to follow predictable distributions and tolerates lower precision, whereas scientific applications must accurately represent extremely large and small values. Hunholt developed a new format called Takum, inspired by Posits but redesigned to preserve dynamic range even when bits are reduced. He says Takums are specifically tailored to scientific computing, addressing limitations in existing low bit formats. A low skilled Russian speaking threat actor used commercial generative AI tools to compromise more than 600 Fortinet Fortigate firewalls across 55 countries, according to an AWS security blog. The financially motivated campaign ran from January 11 through February 18 and relied on scanning Internet exposed management interfaces and credential reuse rather than exploiting new vulnerabilities. The actor used AI to generate attack plans, write Python and go tooling and automate reconnaissance, lateral movement and credential theft using well known open source tools. AWS assessed the activity as opportunistic, noting the attacker often failed against patched systems or closed ports. No AWS infrastructure was involved. Amazon Threat Intelligence expects continued AI adoption by lower skilled actors and recommends strong patching, credential hygiene, network segmentation and improved post exploitation detection as primary defenses. Spanish authorities have arrested four alleged members of Anonymous Fenix for launching distributed denial of service attacks against government ministries, political parties and public institutions following the 2024 Dana floods. Guardia Civil detained two suspects last week, adding to two earlier arrests in May of last year. The group claimed the targeted entities were responsible for the flood tragedy. A court ordered the seizure of its X and YouTube accounts and the closure of its Telegram channel. Police said several attacks were successful. Those specific targets were not disclosed. CISA has added two round cube webmail flaws to its known Exploited Vulnerabilities catalog, citing active exploitation and ordered federal agencies to patch within three weeks. The first is a critical remote code execution bug flagged as exploited shortly after its June 2025 patch. The second, patched in December of last year, allows unauthenticated cross site scripting via SVG animate tags. CISO warned the vulnerabilities pose significant risks to federal networks and set a March 13 remediation deadline. Cybersecurity stocks fell sharply after Anthropic introduced a new security feature in its Claude AI model that scans code bases for vulnerabilities and suggests patches. CrowdStrike dropped 8%, CloudFlare fell 8.1%, SailPoint slid 9.4% and Okta declined 9.2%, while the Global X Cybersecurity ETF sank 4.9% to its lowest level since November 2023. Investors worry that AI native tools could reduce demand for traditional security software by enabling users to generate and secure code themselves. Broader software shares have also struggled with the iShares Expanded Tech Software Sector ETF down more than 23% this year. Analysts say AI may ultimately benefit cybersecurity, but near term volatility is likely as AI provider expand into security focused offerings and compete for budget dollars. Many of these stocks seem to have rebounded in early pre market trading today. Turning to our Monday business breakdown, RRSA conference named 10 finalists for its Innovation Sandbox contest, awarding each $5 million to accelerate growth. The cohort spans fraud prevention, AI code security, identity governance and application security startups across the us, Israel, Canada and the uk. Funding momentum continues across the sector with major raises including Cogent Security at $42 million, Venice at 33 million, Segura and Volnchek at 25 million each Lima AI and Opaque at $24 million and Compliance at $20 million. Smaller rounds went to Olyro, Varialabs and Sydelfi. Mergers and acquisitions also surged, with Palo Alto Networks planning a $400 million acquisition of Israeli AI security startup COI. Check Point acquired three AI focused firms for over $150 million. While Proofpoint, Kicard, Endor Labs and Quantum Leap each announced strategic buys. The deals signal strong investor appetite for AI driven security, governance and agent focused protection platforms. Coming up after the break, my conversation with Brandon Karf and Maria Vermazes about sovereignty in space and cyber and digital disruption. Drains drumsticks. Stay with us. No, it's not your imagination. Risk and regulation really are ramping up and customers expect proof of security before they'll sign that deal. That's where Vanta comes in. VANTA automates your compliance process and brings compliance, risk and customer trust together on one AI powered platform. Whether you're preparing for SoC2 or managing an enterprise governance risk and compliance program, Vanta helps keep you secure and keeps your deals moving. Companies like Ramp and RYTR spend 82% less time on audits with Vanta. That's not just faster compliance, that's more time for growth. Take it from me, if you're thinking about compliance, take the time to check out Vanta. Get started@vanta.com cyber.