Transcript
A (0:02)
You're listening to the Cyberwire Network powered by N2K. These days, attackers rarely start with a bang. They start quietly. A leaked credential, a stolen session cookie, a lookalike domain that shouldn't exist. That's where Nord Stellar comes in. Nord Stellar is a threat exposure management platform that helps organizations see what attackers already know about them. Turns into an incident. It brings together data breach monitoring, dark web monitoring, attack surface management and cyber squatting detection in a single platform. That means visibility into leaked credentials and malware logs, insight into brand impersonation attempts, and a clear picture of exposed Internet facing assets and shadow it for CISOs. It's a way to reduce response costs, prioritize real risk and communicate clearly with the board. For security teams, it's real time alerts, contextual intelligence and faster investigations without the noise. Most companies only react after the damage is done. Don't wait until your data is already for sale. Protect your business today with Nord Stellar. Learn more@nordstellar.com CyberWire Daily don't forget to mention CyberWire 10 for an exclusive offer. Activist Activity Surges in the Middle East Defense tech firms distance themselves from Claude International law enforcement takes down the leak based Cybercrime forum. A pair of Cisco SD Wan vulnerabilities are under active exploitation. Google releases an urgent Chrome security update Age verification is put under the microscope. TikTok is leaving end to end encryption out of your DMs. Our guest is Daniel Barbou, Director of EMEA Security from Adobe, discussing fostering a human centered, enablement driven and collaborative approach to AI and clever code catches cardiac clues. Foreign March 5, 2026 I'm Dave Buettner and this is your Cyberwire Intel Briefing. Thanks for joining us here today. All this week we are coming to you from Zero Trust World in Orlando, Florida where we are joining security leaders and practitioners from across the industry. Our coverage here is made possible by our sponsors at ThreatLocker who brought the community together to talk all things Zero Trust, resilience and the future of cybersecurity. Our thanks to ThreatLocker for helping make it all possible. Following the launch of the U S Israeli military campaign against Iran on February 28, a parallel surge of hacktivist activity quickly emerged across the Middle East. According to a report from Radware, within nine hours of the first kinetic strikes under Operation Epic Fury, multiple hacktivist groups began launching retaliatory DDoS attacks targeting government and critical infrastructure across the region. Between February 28 and March 2, nine hacktivist groups claimed 107 attacks against 81 organizations in eight Middle east countries. The activity was heavily concentrated among a few actors. Two groups, Kimas plus and Dinet, accounted for nearly 70% of all attack claims. Government institutions were the primary targets, representing about 53% of attacks, followed by financial and telecommunications sectors. Geographically, Kuwait, Israel and Jordan absorbed more than three quarters of the activity. On March 2, the Russia aligned group Noname O5 716 joined the campaign, signaling a potential expansion of the conflict's cyber dimension. Overall, the surge highlights how geopolitical crises increasingly trigger rapid, coordinated hacktivist campaigns aimed at disrupting national infrastructure and amplifying political messaging in the digital domain. Palo Alto Network's Unit 42 is tracking more than 60 active hacktivist groups and Iran linked threat actors. But what does that actually mean for defenders? In a special edition of the Threat Vector, podcast, host David Moulton sits down with Unit 42 threat intelligence leaders Justin Moore and Andy Piazza to unpack their latest Iran threat brief. They break down what these groups are doing, how much of the activity is real versus noise and and what organizations should realistically prepare for. We'll be dropping that episode in your Cyberwire podcast feed. It's worth your time. Following the Trump administration's move to blacklist Anthropic and label its technology a supply chain risk, defense technology firms are rapidly distancing themselves from the company's AI model, Claude. Several startups working with the US Department of Defense have already begun replacing Claude with alternative models, often out of caution that a formal ban could soon take effect. Major contractors such as Lockheed Martin are also expected to remove Anthropic technology from their supply chains. The dispute stems from Anthropic's refusal to provide assurances that its AI would be used for fully autonomous weapons or mass domestic surveillance. While Anthropic argues the defense secretary may lack legal authority to impose such restrictions, multiple federal agencies have already begun phasing out the technology. Analysts warn the shift could cause short term disruptions, as Anthropic had been deeply integrated into sensitive defense and intelligence environments. Senator Ron Wyden criticized the Defense Department's dispute with Anthropic, warning that the fight raises serious concerns about potential mass surveillance of Americans, Wyden said vast amounts of personal data, including location, browsing, history and other sensitive information, can be purchased from largely unregulated data brokers and analyzed using AI. Wyden plans to push legislation aimed at limiting government access to commercially purchased personal data. The FBI and international law enforcement agencies have dismantled Leakbase, a major cybercrime forum used to buy and sell stolen credentials, personal data and software exploits. The coordinated effort, called Operation Leak, targeted the platform's infrastructure and users across more than a dozen countries. Authorities conducted about 100 law enforcement actions against 45 targets, resulting in 13 arrests, 32 searches and interviews with 33 suspects. Investigators also seized Leakbase's domains and captured the forum's full database. Operating since 2021, Leakbase had more than 142,000 members and sold access to compromised data, often obtained through attacks on vulnerable Web applications. Officials say the marketplace posed a growing threat because it facilitated access to US Networks and potential critical infrastructure. Investigators are now analyzing the sea's data to identify victims and additional criminal actors. Cisco has warned customers that two recently patched Catalyst SD WAN vulnerabilities are being actively exploited. The flaws allow authenticated attackers to gain elevated privileges or overwrite files on vulnerable systems. Cisco disclosed patches for five vulnerabilities in February and updated its advisory on March 5 after detecting exploitation. The activity follows reports of another exploited Zero day, which can bypass authentication and grant admin access. Security agencies say that flaw has been chained with an older vulnerability to escalate privileges and maintain persistence, possibly linked to threat actor UAT8616. Google has released an urgent Chrome security update addressing 10 vulnerabilities and including three critical and seven high severity flaws that could allow attackers to execute arbitrary code or compromise systems. The Update, rolled out March 3, fixes issues such as integer overflows in the Angle and Skia graphics engines and an object lifecycle flaw in PowerVR. Google is limiting technical details until most users update to reduce exploitation risk. Users and organizations are urged to update immediately. An article from techdirt argues that mandatory online age verification systems create large, centralized databases of sensitive biometric data that are highly vulnerable to breaches. The concern resurfaced after Researchers discovered over 2,400 publicly accessible files tied to Persona, a company Discord planned to use for age verification. The exposed code suggested the system performs extensive identity checks, analyzing facial images, government IDs, device fingerprints and other personal data, potentially storing it for years. Discord has since said it will not proceed with Persona. Critics say the incident reflects a broader pattern. Governments mandate age verification companies adopt third party identity vendors, and those systems later suffer security or privacy issues. Because these platforms collect immutable data like faces and ID numbers, breaches can cause permanent harm. Researchers and privacy advocates warn that such systems both threaten user privacy and often fail to effectively prevent underage access online. TikTok says it will not adopt end to end encryption for direct messages, arguing the technology could make users less safe. While most major platforms use end to end encryption to ensure only message senders and recipients can read conversations, TikTok says the feature would prevent safety teams and law enforcement from investigating harmful activity when necessary. The company says its messages are still protected with standard encryption and can only be accessed by authorized staff in limited circumstances, such as responding to reports or legal requests. Supporters of the decision, including child safety organizations, say avoiding end to end encryption could help detect abuse and illegal content, particularly given TikTok's large youth audience. However, privacy experts note the move places TikTok out of step with industry norms and may raise additional concerns about user privacy and data protection. Coming up after the break, my conversation with Daniel Barbou, Director of EMEA Security at Adobe. We're discussing fostering a human centered, enablement driven and collaborative approach to AI and clever codes. Catch cardiac clues. Stay with us. Maybe that's an urgent message from your CEO, or maybe it's a deep fake trying to target your business. Doppel is the AI native social engineering defense platform fighting back against impersonation and manipulation. As attackers use AI to make their tactics more sophisticated, Doppel uses it to fight back from automatically dismantling cross channel attacks to building team resilience and more Doppel outpacing what's next in social engineering? Learn more@doppl.com that'S-O-P p e l.com. No, it's not your imagination. Risk and regulation really are ramping up and customers expect proof of security before they'll sign that deal. That's where Vanta comes in. Vanta automates your compliance process and brings compliance, risk and customer trust together on one AI powered platform. Whether you're preparing for SOC 2 or managing an enterprise governance risk and compliance program, Vanta helps keep you secure and keeps your deals moving. Companies like Ramp and RYTR spend 82% less time on audits with Vanta. That's not just faster compliance, that's more time for growth. Take it from me, if you're thinking about compliance, take the time to check out Vanta. Get started at vanta.com/cyber. Daniel Barbou is Director of EMEA Security at Adobe and in today's sponsored Industry Voices segment we discuss fostering a human centered, enablement driven and collaborative approach to AI.