Transcript
Maria Vermazes (0:02)
You're listening to the Cyberwire Network powered by N2K.
Dave Bittner (0:12)
If securing your network feels harder than it should be, you're not imagining it. Modern businesses need strong protection, but they don't always have the time, staff or patience for complex setups. That's where Nord layer comes in. Nordlayer is a toggle ready network security platform built for businesses. It brings VPN access control and threat protection together in one place. No hardware, no complicated configuration. You can deploy it in minutes and be up and running in less than 10. It's built on zero trust principles so only the right people can get access to the right resources. It works across all major platforms, scales easily as your teams grow and integrates with what you already use. And now Nordlayer goes even further through its partnership with CrowdStrike, combining Nordlayer's network security with Falcon Endpoint protection for small and mid sized businesses. Enterprise grade security made manageable try Nordlayer risk free and get up to 22% off yearly plans plus an extra 10% with the code CYBERWIRE10. Visit nordlayer.com cyberwire daily to learn more. Microsoft granted the FBI access to laptops encrypted with BitLocker. The EU opens an investigation into Grok's creation of sexually explicit images. Glimmers of access pierce Iran's Internet blackout. Coy security warns NPM fixes fall short against package gate exploits. Some Windows 11 devices fail to boot after installing the January patch Tuesday updates. CISA warns of active exploitation of multiple vulnerabilities across widely used enterprise and developer software. E said researchers have attributed the attack on Poland's energy sector to Russia's Sandworm. We got your business brief. Brandon Karpf joins us to talk space and Cyber and CISA sits out RSAC. It's Monday, january 26, 2026. I'm dave bittner and this is your cyberwire intel brief. Thanks for joining us here today. It's great as always to have you with us. A recent court case in Guam highlights a little known privacy tradeoff in Windows security. During a federal investigation into alleged COVID 19 relief fraud, the Federal Bureau of Investigation accessed encrypted laptops protected by BitLocker without breaking the encryption. Instead, investigators obtained the recovery keys directly from Microsoft after securing a warrant. The reason this was possible is that many Windows users choose to back up their BitLocker recovery keys to their Microsoft accounts. For convenience. When those keys are stored in the cloud, Microsoft can legally provide them to authorities. Microsoft says it fulfills about 20 such requests a year. The case underscores a familiar trade off between convenience and control. Users who want maximum privacy can store recovery keys offline rather than in the cloud, ensuring only they can unlock their data. The European Commission has opened a new investigation into X over concerns that its generative AI model, Grok, enabled the creation of sexually explicit images, including sexualized images of children. The probe is being conducted under the Digital Services act, which requires platforms to assess and mitigate systemic risks such as illegal content and serious harm to users. The commission says GROK may have exposed the EU citizens to significant harm and will assess whether X met its legal obligations. X says it has zero tolerance for child sexual exploitation and has taken steps to restrict image generation, including limiting it to paying users. The investigation could lead defines of up to 6% of X's global turnover and expands existing DSA proceedings. Already underway after more than 17 days of a near total Internet blackout, some Iranians are gaining brief, sporadic online access amid a violent crackdown on nationwide protests. These short windows have allowed people to reassure families and share videos and testimony with journalists and rights groups, offering new insight into the scale of repression. Human rights organizations now believe deaths may far exceed earlier estimates of about 5,200. The shutdown, imposed as protests escalated and calls to overthrow the Islamic Republic, has severely limited reporting by outlets such as the New York Times. Experts at netblocks and the digital rights group Mian say the fleeting access likely reflects government experiments with tightly controlled, tiered Internet access. The blackout remains the longest and most extensive Iran has imposed. Security Researchers have identified weaknesses in defenses introduced after the Shai Hulud supply chain attacks that allowed attackers to ByPass protections in JavaScript Package managers using Git based dependencies. The issues, dubbed package Gate, were discovered by researchers at Coy Security and affect multiple tools. The findings stem from mitigations added after Shai Hulud compromised hundreds of packages and exposed hundreds of thousands of developer secrets. While measures such as disabling lifecycle scripts with ignore scripts were recommended, Coy found that NPM installs from Git repositories can be abused by via malicious configuration files to achieve full code execution, even when scripts are disabled. The researchers say this technique has already been used in proof of concept attacks. Other package managers patched similar flaws. NPM rejected the report, saying the behavior works as expected. Parent company GitHub said it is scanning for malware and urged stronger supply chain security practices, according to reporting by Bleeping Computer. Microsoft is investigating reports that some Windows 11 devices fail to boot after installing the January 2026 patch. Tuesday updates. The issue triggers an unmountable boot volume stop error during startup. Affected physical devices cannot boot into Windows and require manual recovery, while virtual machines appear unaffected. Microsoft has asked users to submit reports via Feedback Hub and says it is still determining whether the problem is update related. According to reporting first noted by Ask Woody, CISA has warned that attackers are actively exploiting multiple vulnerabilities across widely used enterprise and developer software, adding them to its known exploited vulnerabilities catalog. The flaws affect products from Versa, Zimbra, the Veit JavaScript framework, and the Prettier Code Formatter. Exploitation includes authentication bypasses, improper access controls, and supply chain attacks involving malicious NPM packages. CISA also flagged a separate critical heap overflow vulnerability in VMware VCenter server that enables remote code execution and has no workaround beyond patching. Federal civilian agencies are required to apply fixes or mitigations by mid February. CISA has not disclosed details about the attacks or their connection to ransomware. Researchers at ESET have attributed a major late 2025 cyberattack on Poland's energy sector to the Russia aligned Advanced Persistent Threat Group Sandworm. The incident, described as Poland's largest cyber attack in years, involved data wiping malware that ESED has dubbed DynamicNowiper detected as Win32 KillFiles NMO based on malware analysis and overlapping tactics, techniques and procedures. ESET says it made the attribution with medium confidence, though it found no evidence the attack caused a successful disruption. The timing is notable, coming during the 10th anniversary of Sandworm's 2015 attack on Ukraine's power grid, the first malware induced blackout. ESET says Sandworm continues to regularly target critical infrastructure, particularly in Ukraine, using destructive wiper attacks. Looking at our business brief last week the global cybersecurity sector saw a wave of funding and consolidation with multiple startups raising capital and a surge of mergers and acquisitions across five countries. Belgium based developer security firm Akido led funding with a $60 million Series B, while Post Quantum Security Startup Project 11 raised 20 million. Additional funding rounds supported firms focused on human risk management, cyber intelligence, software security and digital forensics across Europe, the US and India. M and A activity was equally strong with 10 announced deals. Notable transactions include Infoblox acquiring exposure management firm Axor, Delinea buying strong DM and Thinkst Canary acquiring Deceptiq. The deals reflect continued investment in identity security, managed services, AI governance and proactive threat detection as the market matures. Be sure to check out our weekly business briefing on our website. It's all part of Cyberwire Pro. Coming up after the break, Brandon Karp joins us to talk space and cyber and SISA sits out rsac. Stick around. What's your 2am Security worry? Is it do I have the right controls in place? Maybe are my vendors secure or the one that really keeps you up at night? How do I get out from under these old tools and manual processes? That's where Vanta comes in. Vanta automates the manual work so you can stop sweating over spreadsheets, chasing audit evidence and filling out end their trust management platform continuously monitors your systems, centralizes your data and simplifies your security at scale and it fits right into your workflows. Using AI to streamline evidence collection, flag risks and keep your program audit ready all the time. With Vanta, you get everything you need to move faster, scale confidently and finally get back to sleep. Get started@vanta.com cyber that's V A N T A dot com cyber. When it comes to mobile application security, good enough is a risk. A recent Survey shows that 72% of organizations reported at least one mobile application security incident last year and 92% of responders reported threat levels have increased in the past two years. Guard Square delivers the highest level of security for your mobile apps without compromising performance, time to market or user experience. Discover how Guard Square provides industry leading security for your Android and iOS apps at www.guardsquare.com. Brandon Karpf is leader of International Public Private Partnerships at NTT and before that he was one of our colleagues here at the Cyberwire. I recently sat down with him and Maria Vermazes from the T Minus Space Daily Podcast to talk space and cyber. So I want to talk about space safety and who's keeping track of what's where in orbit. Maria, is it fair for me to start with you to give us the little TLDR on how we track things in orbit and where to begin with this?