Transcript
A (0:02)
You're listening to the Cyberwire Network powered by N2K.
B (0:14)
From phishing to ransomware, cyber threats are constant. But with Nordlayer, your defense can be too. Nordlayer brings together secure access and advanced threat protection in a single seamless platform. It helps your team spot suspicious activity before it becomes a problem by blocking blocking malicious links and scanning downloads in real time, preventing malware from reaching your network. It's quick to deploy, easy to scale, and built on zero trust principles so only the right people get access to the right resources. Get 28% off on a yearly plan at nordlayer.com cyberwire daily with code CYBERWIRE28 that's nordlayer.com CyberWire Daily Code CYBERWIRE28 that's valid through December 10, 2025. Cloudflare's outage was rooted in an internal configuration error the Trump administration prepares a new national cyber strategy. CISA gives federal agencies a week to secure a new Fortinet flaw. MI5 warns that China is using LinkedIn headhunters and covert operatives to target lawmakers. Experts question the national security risks of TP link routers. The China aligned Plush Daemon threat Group hijacks software Updates. Researchers discover WhatsApp's entire global member directory accessible online without any protection. LG Energy Solution confirms a ransomware attack Shiny Spider makes its debut We've got Rotem Sadak, director of security ops and forensics at Varonis, sharing lessons learned from thousands of forensics investigations. And a judge says Google's claims to water use secrecy are all wet. It's Wednesday, November 19, 2025. I'm Dave Buettner and this is your Cyberwire Intel Brief. Thanks for joining us. It's great as always to have you with us here today. Yesterday, Cloudflare suffered its worst outage in six years after a routine database permissions change triggered a cascading failure across its global network. The issue began when the update caused the bot management system to generate an oversized configuration file that exceeded built in limits and crashed critical traffic routing software. The faulty file contained duplicate metadata that pushed the system past its 200 feature cap clusters alternated between healthy and broken states as machines produced conflicting configuration files every five minutes. The oversized file then propagated across the network, causing system panics and widespread errors. Engineers restored core traffic by replacing the file with an earlier version. The Trump administration is preparing to release a new national cyber strategy, according to National Cyber Director Shawn Cairncross, who said the effort is moving quickly and aims to provide a single, coordinated approach, unlike previous attempts. Speaking at the Aspen Cyber summit, Cairncross outlined six planned pillars, including a focus on shaping adversary behavior and improving public private partnerships. He argued the United States has not effectively signaled consequences to cyber adversaries, noting that ransomware responses remain fragmented and lack a long term government wide plan. Cairncross said the forthcoming strategy will be concise and paired with immediate action items and that his office is is modernizing federal processes, including technology, procurement and collaboration with national labs. Officials across government have already contributed input, according to FBI Assistant Director Brett Leatherman. Former acting National Cyber Director Kemba Walden emphasized that clear deliverables and aligned budgets are essential to make the strategy effect. CISA has ordered U.S. federal agencies to secure Fortinet Fortaweb devices within a week after discovering active exploitation of an OS command injection flaw. The vulnerability allows unauthenticated attackers to execute unauthorized code through crafted HTTP requests or CLI commands added to CISA's known exploited vulnerabilities catalog. The flaw must be remediated by November 25. CISA warned that such vulnerabilities are common attack vectors and pose significant risks to federal networks. Britain's MI5 warned that China's Ministry of State Security is using LinkedIn headhunters and covert operatives to target lawmakers, parliamentary staff consultants, economists and think tank researchers. The alert follows a collapsed espionage case involving two men accused of aiding Beijing. MI5 identified two China based headhunters as recruiters who approached targets under corporate cover to solicit geopolitical reports that feed wider intelligence efforts. China denied the allegations as fabrication. Security Minister Dan Jarvis called the activity a calculated attempt to interfere with UK affairs and announced new countermeasures, including 170 million pounds to upgrade government networks and expanded election security efforts and steps to protect universities from COVID influence, experts say. The U.S. house Select Committee on the Chinese Communist Party's request to investigate TP link for national security risks is built on weak evidence and selectively targets one Chinese manufacturer. The lawmakers cite open source reports, including work from former FCC Commissioner Michael O'Reilly at the Hudson Institute and research from Check Point's ITE Cohen, with neither showing TP link acting maliciously. O'Reilly notes past TP link vulnerabilities were patched and Cohen's findings show Chinese APT malware could just as easily infect routers from Cisco or netgear. Additional claims about Volt Typhoon overlook that DOJ removals involved Cisco and Netgear devices, not TP Link researchers, including Cohen and KnowBefore's Roger Grimes stress that all routers are broadly vulnerable because users rarely patch them. Critics argue focusing on TP link distracts from larger risks tied to widespread dependence on China made technology. Researchers from ESET detail how the China aligned Plush Daemon Threat Group uses its previously undocumented edgestepper network implant to hijack software updates through through Adversary in the middle attacks, EdgeSteper redirects all DNS queries on compromised network devices to a malicious DNS node, which reroutes legitimate update traffic to attacker controlled servers. From there, victims receive little daemon followed by the daemon Logistics Downloader, which ultimately deploys the group's slow stepper backdoor Active since at least 2018, Plushdaemon has targeted individuals and organizations across China, Taiwan, Hong Kong, Cambodia, South Korea, the United States and New Zealand. ESET's analysis shows the group compromising routers or servers, exploiting weak credentials or vulnerabilities, and hijacking updates for software to deliver malware. Austrian Researchers discovered that WhatsApp's entire global member directory, more than 3.5 billion accounts, was accessible online without protection, allowing them to download phone numbers, profile data, public keys and profile photos at scale Meta ignored their warnings for a year before responding, ultimately calling the issue a scraping problem and saying no private messages or non public data were exposed. The data set revealed sensitive information such as workplace details, political or sexual orientation, links to social profiles and device usage patterns. Researchers also identified millions of active accounts in countries where WhatsApp was banned, creating potential safety risks for users. Roughly 57% of users had publicly visible profile photos, enabling large scale facial recognition mapping between faces and phone numbers. LG Energy Solution confirmed a ransomware attack on one of its overseas facilities after the Akira gang listed the company on its leak site. The group claims to have stolen 1.7 terabytes of data, including corporate documents, financial records, SQL databases with employee information, confidential projects and partner data. LG says the affected site has been restored and that headquarters and other facilities were not impacted. The company has not disclosed how many individuals were affected and and has launched an investigation. Shiny Spider, a new ransomware as a service platform developed by threat actors tied to Shiny Hunters, Scattered Spider and Lapsus, has surfaced through early builds uploaded to VirusTotal. Researchers found the group is shifting from using others encryptors to building its own from scratch. Analysis by Coveware shows the Windows encryptor includes event logging, evasion for process killing, network propagation. Anti analysis features shadow copy deletion and ChaCha20 encryption with RSA 2048 protected keys. Each file receives a unique extension and metadata rich header. Victims get hard coded ransom notes and a warning wallpaper shiny Hunter says Linux ESXI and a faster Lightning version are in development, with the operation to run under the scattered Lapsus Hunters brand. Coming up after the break, Rotem Sadak from Varonis shares lessons learned from thousands of forensic investigations, and a judge says Google's claims to water use secrecy are all wet. Stay with us. At Thales they know cyber security can be tough and you can't protect everything, but with Thales, you can secure what matters most. With Thales industry leading platforms, you can protect critical applications, data and identities anywhere and at scale with the highest roi. That's why the most trusted brands and largest banks, retailers and healthcare companies in the world rely on Thales to protect what matters most applications, data and identity. That's Thales T H A L E S learn more@thalesgroup.com cyber foreign. Ever wished you could rebuild your network from scratch to make it more secure, scalable and simple? Meet Meter, the company reimagining enterprise networking from the ground up. Meter builds full stack zero trust networks including hardware, firmware and software, all designed to work seamlessly together. The result? Fast, reliable and secure connectivity without the constant patching, vendor juggling or hidden costs. From wired and wireless to routing, switching, firewalls, DNS security and vpn, every layer is integrated and continuously protected in one unified platform. And since it's delivered as one predictable monthly service, you skip the heavy capital costs and endless upgrade cycles. Meter even buys back your old infrastructure to make switching effortless, transform complexity into simplicity, and give your team time to focus on what really matters, helping your business and customers thrive. Learn more and book your demo@meter.com cyberwire that's M E T E R.com cyberwire. Rotem Sadak is director of security, Operations and Forensics at Veronis. In today's sponsored Industry Voices segment, he shares lessons learned from thousands of forensic investigations, a rather small oversight that has.