Transcript
Dave Bittner (0:02)
You're listening to the Cyberwire Network powered by N2K. We've all been there. You realize your business needs to hire someone yesterday. How can you find amazing candidates fast? Well, it's easy. Just use Indeed when it comes to hiring, Indeed is all you need. Stop struggling to get your job post noticed Indeed. Sponsored Jobs helps you stand out and hire fast. Your post jumps to the top of search results so the right candidates see it first. And it works. Sponsored Jobs on indeed get 45% more applications than non sponsored ones. One of the things I love about Indeed is how fast it makes hiring. And yes, we do actually use Indeed for hiring here at N2K CyberWire. Many of my colleagues here came to us through Indeed. Plus with Sponsored Jobs. There are no subscriptions, no long term contracts. You only pay for results. How fast is Indeed? Oh, in the minute or so that I've been Talking to you, 23 hires were made on Indeed according to Indeed Data worldwide. There's no need to wait any longer. Speed up your hiring right now with Indeed and listeners to this show will get a $75 sponsored job credit. To get your jobs more visibility at indeed.com cyberwire just go to indee indeed.com cyberwire right now and support our show by saying you heard about Indeed on this podcast. Indeed.com cyberwire terms and conditions apply. Hiring Indeed is all you need. A new White House executive order overhauls U.S. cybersecurity policy the EU updates its cybersecurity blueprint. The Pentagon's inspector general investigates Defense Secretary Hegseth's signal messages. Chinese hackers target U.S. smartphones. A new Mirai botnet variant drops malware on vulnerable DVRs. 17 popular gluestack packages on NPM have been compromised. Attackers exploit vulnerabilities in fortigate security appliances to deploy Keelin ransomware. A Nigerian man gets five years in prison for a hacking infrastructure fraud scheme. Our guest is Tim Starks from cyberscoop discussing Sean Cairncross journey toward confirmation as the next National Cyber Director and Fire stick flicks spark a full on legal blitz. It's Monday, June 9th, 2025. I'm Dave Bittner and this is your Cyberwire Intel Brief. Thanks for joining us here today. It's great to have you with us. President Trump has issued a new executive order that overhauls U.S. cybersecurity policy, replacing earlier directives from Presidents Obama and Biden announced on June 6. The order narrows cyber sanctions to target only foreign malicious actors, reversing broader authorities that critics feared could be misused domestically. The order also scraps several Biden era initiatives, including requirements for software vendors to meet federal security standards, AI research for cyber defense and post quantum encryption readiness. Trump's directive eliminates the IoT security labeling program, eases supply chain restrictions, revises AI security rules and removes mandates for phishing resistant authentication in federal agencies. Instead, the new policy prioritizes secure software development, stronger network protections and AI use focused on vulnerability detection. The White House framed the shift as a move toward more focused professional cybersecurity practices, while removing what it called distracting issues introduced by the Biden administration shortly before Trump took office. The European Union has updated its cybersecurity blueprint to better coordinate responses to large scale cyber attacks, strengthening ties with national militaries and NATO. Approved by ministers meeting in Luxembourg, the plan clarifies which institutions will act during cyber crises across technical, operational and political levels. Poland, which reports about 700 daily cyber incidents, highlighted the need for collective preparedness. The new strategy includes establishing NATO contact points and launching joint cyber exercises starting in June of 2026 involving private sector players and countries like Ukraine and Moldova. The blueprint stresses the growing threat from geopolitical tensions and hybrid attacks that could disrupt the EU's security, economy and society. It also urges the EU to enhance secure communications, calling on the European Commission to propose crisis communication solutions by the end of 2026 and for governments to develop contingency plans for disrupted networks. The Pentagon's inspector general is investigating whether Defense Secretary Pete Hegseth's aides were told to delete signal messages possibly containing sensitive information about U.S. airstrikes in Yemen. The inquiry focuses on March 15 communications and whether they compromised military operations. One signal chat reportedly included Hegseth's family. Another included top officials and, inadvertently, a journalist. Hegseth denies sharing classified data, saying messages were informal and unclassified. The probe also examines access to Hegseth's phone and who posted strike details. Critics argue the posts risked pilot safety and would have led to disciplinary action if done by lower ranking personnel. Hegseth is also under scrutiny for installing an unsecured Internet line in his office amid the fallout. Hegseth has limited press engagements and faces congressional testimony next week. The investigation, requested by Senate Armed Services leaders, could release unclassified findings to the public. A recent cyber attack targeting smartphones of U.S. officials and professionals in politics, tech and journalism has raised alarms among cybersecurity experts. Investigators at Iverify linked the unusual crashes to a zero click hack likely by Chinese hackers that allowed access to phones without user interaction. Victims had ties to fields of interest to China's government. Experts say smartphones, often less protected than other systems, are becoming key targets for espionage. Devices belonging to Donald Trump's campaign and top aides were also reportedly targeted. Lawmakers fear Chinese state owned firms could exploit their tech presence in global networks. The US Is responding with new initiatives like a cyber trust mark for secure connected devices. Still, officials warn that even the most secure device is vulnerable if users ignore basic precautions. Cyber lapses like misconfigured apps or unsecured connections remain a serious national security risk. A new Mirai botnet variant is exploiting a command injection flaw in TBK DVR models to hijack them for cyber attacks. Discovered by researcher netsec fish in April 2024, the vulnerability allows shell command execution via a crafted post request. Kaspersky has confirmed active exploitation using this method, with the botnet dropping ARM32 malware to connect infected DVRs to a command and control server. These compromised devices are then used for DDoS attacks and malicious traffic routing. Around 50,000 DVRs remain exposed, primarily in China, India and several other countries. The devices have been rebranded under multiple names, complicating patch management. It's unclear if TBK Vision has issued a fixed A major supply chain attack has compromised 17 popular Gluestack native Aria packages on NPM, affecting over 1 million weekly downloads. NPM, short for Node Package Manager, is the default package Manager for Node JS, a popular JavaScript runtime. The attack began on June 6. Inserting obfuscated remote access Trojan code. The malware connects to a command and control server and can execute shell commands, upload files, and hijack Python paths to silently run malicious binaries. Cybersecurity firm Akito discovered the attack and linked it to the same group behind recent NPM compromises. Affected packages span across UI components used in React native apps. Despite attempts to contact gluestack, there was initially no response. Gluestack has now revoked the access token used in the attack and deprecated the compromise packages, redirecting users to safe versions. A new wave of cyberattacks is exploiting vulnerabilities and fortigate security appliances to deploy Keelin ransomware across critical infrastructure. The campaign marks a shift in ransomware tactics targeting network security devices rather than traditional phishing methods. Threat actors are exploiting vulnerabilities to gain initial access and maintain persistence inside enterprise networks. Keelin, also known as Agenda Ransomware, is a sophisticated ransomware as a service operation featuring strong encryption and evasion capabilities. The malware uses advanced obfuscation and anti analysis techniques to avoid detection. Security researchers warn that these attacks bypass perimeter defenses, giving attackers privileged access to internal systems. This evolution highlights the growing threat to network infrastructure, increasing the risk of operational disruption, regulatory penalties and reputational damage. Analysts stress the urgent need for organizations to patch vulnerabilities and strengthen defenses against infrastructure based ransomware attacks. A US Court has sentenced Nigerian national Kingsley Ukelu Utulu to over five years in prison for his role in a hacking and fraud scheme targeting US tax preparation companies. Since at least 2019. Utulu and Co conspirators stole personal data from tax firms in Texas and New York to file fraudulent tax returns, seeking $8.4 million and successfully obtaining $2.5 million. They also used stolen identities to fraudulently claim $819,000 through the Small Business Administration's disaster loan program. Uthulu was extradited from the UK and must pay over $3.6 million in restitution and forfeit $290,000. The case is linked to others who face similar charges for participating in the same cybercrime ring. US Authorities continue to pursue justice against international cybercriminals exploiting financial and government systems. Coming up after the break, my conversation with Tim Starks from cyberscoop discussing Sean Cairncross's journey toward confirmation as the next National Cyber Director. And Fire Stick flicks spark a full on legal blitz. Stay with us.