Transcript
A (0:02)
You're listening to the Cyberwire Network powered by N2K.
B (0:12)
These days, attackers rarely start with a bang.
C (0:15)
They start quietly.
B (0:17)
A leaked credential, Stolen session cookie, A lookalike domain that shouldn't exist. That's where Nord Stellar comes in. Nord Stellar is a threat exposure management platform that helps organizations see what attackers already know about them. Turns into an incident. It brings together data breach monitoring, dark web monitoring, attack surface management and cyber squatting detection in a single platform. That means visibility into leaked credentials and malware logs, insight into brand impersonation attempts, and a clear picture of exposed Internet facing assets. And shadow it for CISOs. It's a way to reduce response costs, prioritize real risk and communicate clearly with the board. For security teams, it's real time alerts, contextual intelligence and faster investigations without the noise. Most companies only react after the damage is done. Don't wait until your data is already for sale. Protect your business today with Nord Stellar. Learn more@nordstellar.com CyberWire Daily don't forget to mention CyberWire 10 for an exclusive offer. A suspected US exploit kit shows up in global iOS attacks Facebook goes down briefly worldwide A critical help desk flaw enables remote code execution Juniper PTX routers face A major bug LastPass warns of phishing Telegram becomes a cybercrime marketplace Healthcare Healthcare groups fight relaxed it rules A
C (2:01)
stolen Gemini API kit runs up massive
B (2:04)
bills CISA's CIO departs our guest is
C (2:08)
Brian Long, CEO and co founder of Adaptive Security, discussing how AI is reshaping social engineering and the problem of posthumous profiles. Its Wednesday, March 4, 2026 I'm Dave Bittner and this is your Cyberwire Intel Briefing. Thanks for joining us here today. This week we are coming to you from Zero Trust World in Orlando, Florida. We're where we're joining security leaders and practitioners from across the industry. Our coverage here is made possible by our sponsors at Threatlocker, who brought the community together to talk all things zero trust, resilience and the future of cybersecurity. Thanks for listening. And thanks to ThreatLocker for helping make it possible. Researchers say a sophisticated exploit kit, possibly originating from a leaked US Government framework, is behind what may be the first mass scale attack against Apple's iOS. Google's Threat Intelligence Group and mobile security firm Iverify reported Tuesday that the tool, known as the Karuna Exploit Kit, uses zero day vulnerabilities and has already appeared in multiple campaigns across the cybercrime and espionage landscape. Google observed the kit being used over the past year in operations tied to a surveillance vendor's customer and in attacks against Ukrainian targets attributed to a suspected Russian espionage group. Investigators later recovered the full toolkit from a financially motivated cybercriminal group operating in China. Iverify estimates the campaign may have compromised at least 42,000 iOS devices, a significant figure for Apple's tightly controlled ecosystem. The spread of the toolkit resembles an eternal blue moment, referring to the leaked NSA exploit that fueled the global WannaCry NotPetya outbreaks in 2017. While evidence suggests possible US government origins, the exact path of the leak remains unclear. Apple previously issued patches related to the attacks, which researchers linked to the earlier Operation Triangulation campaign. Facebook experienced a global outage that prevented users from accessing their accounts and displaying a message that accounts were temporarily unavailable due to a site issue, according to Down Detector. The disruption began yesterday around 4:15pm Eastern Time and affected users worldwide. Meta's status page reported high disruptions affecting Facebook Ad Manager, Instagram Boost and the WhatsApp Business API. The outage was later resolved by 6:21pm Eastern Time, restoring access for users. Facebook has not yet provided details about the cause of the disruption. A critical vulnerability in the open source help desk platform freescout could allow attackers to execute remote code without user interaction. With a CVSS score of 10.0, the flaw bypasses a recent patch for another remote code execution bug, researchers at OX Security found. The bypass uses a zero width space character in a file name to evade validation checks designed to block malicious uploads. Because the invisible character passes the initial check and is later removed during sanitization, the file is ultimately saved as a valid dot file on the server. Attackers can exploit the issue by sending a malicious email to a free Scout mailbox requiring no authentication or user interaction. Successful attacks could allow full server compromise, data theft, and lateral movement. The flaw was patched in a recent version. A critical vulnerability in Juniper Network's Junos OS evolved could allow attackers to gain root level access to PTX series routers with a CVSS score of 9.3. The flaw stems from improper permission settings in the Onbox Anomaly Detection Framework, which runs as root and is enabled by default. Researchers at Watchtower discovered the issue. If exposed through certain configurations, attackers could exploit it without authentication and gain full control of affected routers. Juniper has advised restricting access via firewalls or access lists and plans to release a patch. LastPass is warning users about a new phishing campaign designed to steal master passwords. The emails impersonate LastPass by spoofing the display name, a tactic that can hide the real sender address. In many email clients, especially on mobile devices, messages claim there's been suspicious activity, such as unauthorized access or a master password change, and urge recipients to act quickly. Links in the emails lead to a fake LastPass login page that harvests credentials. LastPass has published indicators of compromise, including malicious URLs, IP addresses and sender details, and is working with partners and hosting providers to take down the phishing sites. Researchers at Cipherma say Telegram has increasingly become a central hub for cybercriminal activity, replacing many traditional dark Web forums. Unlike Tor based marketplaces that could disappear when law enforcement shut them down, Telegram channels can quickly reappear if banned, allowing criminal communities to maintain operations with minimal disruption, according to the analysis. Hackers use Telegram as a fast, automated marketplace where bots help sell stolen credentials, malware subscriptions and initial access to corporate networks. Channels also host large databases of stolen login data and serve as platforms for ransomware groups to pressure victims by posting leak previews and countdowns. The platform is also used by hacktivist groups to coordinate distributed denial of service attacks and promote campaigns. Although Telegram has increased cooperation with law enforcement, including sharing user data in hundreds of investigations, researchers say cyber criminal activity on the platform continues to grow. Healthcare industry groups are warning that proposed changes to US Healthcare IT certification rules could weaken privacy and security protections. The Office of the National Coordinator for Health it, part of the Department of Health and Human Services, has proposed reducing certification criteria to ease regulatory burdens on software developers and encourage innovation. However, organizations including the College of Healthcare Information Management Executives and the American Hospital association argue that removing requirements such as authentication, access controls and authorization would shift responsibility for cybersecurity and HIPAA compliance from vendors to healthcare providers, they warn. This change could increase costs and expose hospitals to greater cyber risk, particularly as the healthcare sector remains a frequent ransomware target. Industry groups also raised concerns about removing patient matching requirements tied to care transitions, saying it could increase patient misidentification risks and undermine data security. A startup developer says their company was hit with over $82,000 in unauthorized charges after a stolen Google Gemini API key was abused within 48 hours. The small Mexico based firm normally spends about 180 bucks a month on cloud services, but attackers used the compromised key to generate heavy usage of Gemini 3 Pro image and text models. After revoking the key and contacting support, the developer said, Google cited its shared responsibility model, meaning customers must secure their own credentials. Researchers at Truffle security also found 2,800 publicly exposed Google API keys that could be used to access Gemini services, potentially allowing attackers to access stored data and generate costly AI requests. The issue stems partly from older API keys that were originally meant as public project identifiers but now also function as Gemini credentials. Google says it's working on fixes and mitigation measures. Robert Costello, chief information officer at the Cybersecurity and Infrastructure Security Agency, announced Tuesday that he's stepping down after nearly five years in the role and 18 years with the Department of Homeland Security. In a LinkedIn post, Costello describes serving as CISA's CIO as one of the greatest privileges of his career, highlighting the agency's progress in strengthening cybersecurity defenses, modernizing critical systems, and building lasting capabilities. During his tenure, Costello championed improved technology to help recruit talent, supported responses to emerging vulnerabilities, and promoted the use of artificial intelligence to enhance CISA's mission. He also frequently represented the agency at industry events and in public discussions about cybersecurity. Costello expressed deep gratitude for the public servants he worked alongside across dhs, CISA and in the US Air Force. His departure comes amid broader leadership changes at the agency. We wish him well. Coming up after the break, Brian Long, CEO and co founder of Adaptive Security Security, discusses how AI is reshaping social engineering and the problem of posthumous profiles. Stay with us.