Transcript
A (0:02)
You're listening to the Cyberwire network. Powered by n2k.
B (0:11)
Identity is a top attack vector. In our interview with Kavitha Mariapan from Rubrik, she breaks down why 90% of security leaders believe that identity based attacks are their biggest threat. Throughout this conversation we explore why recovery times are getting longer, not shorter, and what resiliency will look like in this AI driven world. If you're struggling to get a handle on identity risk, this is something you should tune into. Check out the full interview@thecyberwire.com Rubrik. Maybe that's an urgent message from your CEO, or maybe it's a deepfake trying to target your business. Doppel is the AI native social engineering defense platform fighting back against impersonation and manipulation. As attackers use AI to make their tactics more sophisticated, Doppel uses it to fight back from automatically dismantling cross channel attacks to building team resilience and more Doppel outpacing what's next in social engineering? Learn more@doppl.com that's.p p e l.com. Global leaders call for collaboration at the Munich Cybersecurity Conference. Phishing campaigns exploit fake video conference invitations. Italian authorities say cyber attacks on the Winter Olympics have met overall mitigation. AI reshapes the economics of ransomware attacks CISA tags a critical Microsoft Configuration Manager vulnerability Foxvale is a new malware loader targeting legitimate platforms Researchers examine macOS info stealers California finds Disney $2.75 million for violating the Consumer Privacy Act Maria Vermazes, host of the T Minus Space Daily, and Cyberwire producer Liz Stokes preview their coverage of the NATO Cyber Coalition 2025 Cyber Exercise from Tallinn, Estonia. And when pull requests get personal. It's Friday, february 13, 2026. I'm dave bittner and this is your cyberwire intel brief. Thanks for joining us here today. It's great as always to have you with us. At the Munich Cybersecurity Conference, US National Cyber Director Shawn Cairncross called for deeper collaboration between the United States, its allies and industry partners to confront escalating cyber threats. Leading a delegation representing nearly every branch of the U.S. government, Cairncross said an America first approach does not mean America alone, emphasizing that shared adversaries, including nation state actors, espionage groups, ransomware operators and scam centers require coordinated action. He argued that while these threats have scaled and intensified, governments and companies have not yet delivered a unified strategic response capable of shifting adversaries risk calculations. Cairncross said the Trump administration is elevating cyber as a standalone strategic domain a forthcoming national cyber strategy will align with the broader national security strategy and apply a whole of government approach that integrates diplomacy, law enforcement, and national security tools. He stressed that resilience alone is insufficient, describing it as absorbing shots and instead called for proactive efforts to raise the costs of malicious activity and shape adversary behavior. He also underscored the private sector's central role in defending critical infrastructure and called for stronger information sharing. At the same time, he criticized European regulatory approaches that he said place blame on companies after attacks. Addressing broader geopolitical tensions, Cairncross advocated for a clean technology stack rooted in US and allied systems, sharply distinguishing Western technologies from Chinese systems. Meanwhile, Swedish defense official Lisa Gustafsson warned that cyber and hybrid threats are now a permanent feature of Europe's security environment. She outlined Sweden's total defense model, which integrates military, civilian and private sector efforts to ensure society can function under sustained pressure. Netscope Threat Labs is tracking phishing campaigns that exploit fake video conference invitations from platforms such as Zoom, Microsoft Teams and Google Meet attackers, create pixel perfect landing pages often hosted on typo squatted domains, and display fake participant lists to enhance credibility. When victims attempt to join, they're told a mandatory software update is required. The update is actually a digitally signed remote monitoring and management tool. By using legitimate signed software rather than custom malware, attackers can bypass signature based security controls and blend into normal corporate traffic. Once installed, these RMM agents grant full administrative access, enabling data theft, lateral movement, or mass malware deployment. Netscope warns this technique can turn a single compromised endpoint into a broader corporate breach. The 2026 Milan Cortina winter Olympics have drawn heightened cyber and physical security risks, with Intel 471 reporting a surge in pro Russian hacktivist activity since the games opened February 6th. Groups including Noname, O5716BD, Anonymous, Z Pentest alliance, and Server Killers claimed distributed denial of service attacks against Italian infrastructure, Olympic national teams and European Olympic committees. Some of these groups have alleged ties to Kremlin linked entities, including Russia's GRU military intelligence service. Italian authorities said they mitigated the attacks without significant impact. The activity follows historical Russian targeting of Olympic organizations after athlete bans and geopolitical disputes. Though recent operations appear driven largely by hacktivists rather than advanced persistent threat groups. Beyond cyber activity, Italy has faced protests, violent demonstrations, and a suspected railway sabotage incident. The convergence of hacktivism, unrest and transport disruption reflects a broader hybrid threat environment surrounding high profile global events. Recent advances in artificial intelligence are not fundamentally changing ransomware attacks, but they are reshaping the economics of attacks by lowering barriers and accelerating workflows, according to new research from Halcyon. Ransomware groups remain cautious about fully automating operations due to risks of failure or detection. Instead, they're using generative AI to speed up discrete tasks such as phishing, translation, vulnerability analysis, and code modification. AI use is most prominent in initial access. Attackers are creating more convincing phishing campaigns, fake websites, and deepfake audio or video to impersonate trusted individuals. Large language models also help analyze newly disclosed vulnerabilities, compressing the time between disclosure and exploitation. Some groups are experimenting with AI for network mapping, credential harvesting, and data analysis, though results remain incremental and sometimes error prone. Overall AI is reducing friction across the attack chain, enabling faster iteration and more scalable campaigns. Defenders should prioritize rapid patching, strong identity controls, and behavior based detection to counter shorter lead times and increasingly sophisticated social engineering. CISA has ordered U.S. federal agencies to patch a critical Microsoft Configuration Manager vulnerability now actively exploited in attacks. The flaw, a SQL injection bug reported by Synactive, allows unauthenticated remote attackers to execute arbitrary commands with highest level privileges on affected servers. Although Microsoft initially assessed exploitation as less likely after releasing a patch in October 2024, proof of concept code was later published. Agencies must remediate by March 5, and CISA urged all organizations to apply mitigations promptly. Cato Networks has identified a malware loader dubbed Foxvale that abuses legitimate platforms, including that abuses legitimate platforms including Discord, Cloudflare, and Netlify to stage payloads and blend into normal traffic. Active since August of last year, Foxvale retrieves donut generated shellcode and executes it in memory to evade detection. One variant pulls payloads from cloudflare and Netlify, while another uses short lived discord attachments. Foxvale version 1 injects malicious code into a suspended process impersonating svchost exe using Earlybird asynchronous procedure call injection and establishes persistence as a Windows service. Version 2 self injects and attempts to alter Microsoft Defender settings, though with errors. The malware also mutates high signal strings at runtime to evade analysis. CATO recommends behavior based detection to identify suspicious process chains and shellcode injection. Infostealers such as Atomic, macOS, Stealer, or Amos function less as standalone malware and more as data collection engines within a mature cybercrime economy, according to researchers at Flare. Once executed, AMOS rapidly harvests browser credentials, session cookies, crypto wallet data, SSH key, and sensitive files, then exfiltrates them for sale as stealer logs. These logs fuel account takeovers, fraud and follow on intrusions, creating a multi stage monetization pipeline. First advertised in 2023 as a subscription based malware as a service offering, AMOS has since evolved through opportunistic social engineering campaigns. Recent operations include the Claw Havoc supply chain attack targeting an AI assistant Marketplace, SEO poisoned GitHub repositories impersonating major brands and malvertising campaigns abusing ChatGPT content rather than relying on exploits. Distributors emphasize brand impersonation and user executed installation tricks. This industrialized adaptive model makes infostealers a scalable and reliable entry point across today's threat landscape. California has fined Disney $2.75 million for violating the California Consumer Privacy act, alleging the company made it excessively difficult for users to opt out of data sharing and sales. Attorney General Rob Bonta said Disney's opt out tools failed to stop data sharing across all devices and streaming services tied to a user's account. Toggles applied only to specific services or devices and web form requests did not fully halt data sharing with certain third party ad tech companies. Disney did not admit liability under the proposed settlement, which also requires it to implement a comprehensive privacy program and report compliance progress. The fine is the largest issued under the CCPA and follows a separate $10 million Federal Trade Commission penalty in September over child privacy violations. Coming up after the break, Maria Vermazes from the T Minus Space Daily and our Cyberwire producer Liz Stokes preview their coverage of the NATO Cyber Coalition 2025 Cyber Exercise from Tallinn, Estonia. And when pull requests get personal, Stay with us. What's your 2am Security worry? Is it do I have the right controls in place? Maybe? Are my vendors secure or the one that really keeps you up at night? How do I get out from under these old tools and manual processes? That's where Vanta comes in. Vanta automates the manual work so you can stop sweating over spreadsheets, chasing audit evidence and filling out endless questionnaires. Their trust management platform continuously monitors your systems, centralizes your data and simplifies your security at scale and it fits right into your workflows. Using AI to streamline evidence collection, flag risks and keep your program audit ready all the time. With Vanta, you get everything you need to move faster, scale confidently and finally get back to sleep. Get started at vanta.com cyber that's V-A-N-T a.com cyber.