Transcript
A (0:02)
You're listening to the Cyberwire Network, powered by N2K.
B (0:11)
Most environments trust far more than they should, and attackers know it. ThreatLocker solves that by enforcing default deny at the point of execution. With ThreatLocker allow listing, you stop unknown executables cold. With ring Fencing, you control how trusted applications behave, and with threatlocker DAC defense against configurations, you get real assurance that your environment is free of misconfigurations and clear visibility into whether you meet compliance standards. ThreatLocker is the simplest way to enforce zero trust principles without the operational pain. It's powerful protection that gives CISOs real visibility, real control, and real peace of mind. ThreatLocker makes zero trust attainable even for small security teams. See why thousands of organizations choose Threat Locker to minimize alert fatigue, stop ransomware at the source, and regain control over their environments. Schedule your demo@threatlocker.com N2K today. Who turned out the lights in Venezuela? The European Space Agency confirms a series of cyber attacks. Dutch police nab the alleged operator of a notorious malware testing service. The U.S. and allies issue new guidance on OT security. Researchers warn of automated exploitation of a critical Hewlett Packard Enterprise oneview flaw Tampered chef cooks up Trojanized PDF documents A Bluetooth vulnerability puts devices at risk. Cisco patches a maximum severity zero day Jenn Easterly heads up rsac. Our guest is Zach Casas from Ohio State University, discussing GPS alternatives and Vintage phones face modern problems. It's Friday, january 16, 2020. Dave I'm dave buettner, and this is your cyberwire intel briefing. Thanks for joining us here today. Happy Friday. It's great as always to have you with us. A January 3rd US cyber operation briefly cut power across Caracas and disrupted Venezuelan radar, enabling American military helicopters to enter the country undetected and capture Venezuelan President Nicolas Maduro, now facing drug charges in the U.S. officials said the operation demonstrated precise offensive capabilities, including the ability to quickly restore electricity and limit collateral damage. Most residents lost power only briefly, and hospitals relied on backup generators with no reported fatalities. The mission, known as Operation Absolute Resolve, was publicly acknowledged by U.S. cyber Command, though details remain classified. The operation surfaced during Senate hearings for Joshua M. Rudd as lawmakers reviewed Cyber Command's role. President Trump alluded to the cyber attack, calling it dark and deadly, while Venezuela has a long history of blaming US Cyber interference for past blackouts without evidence, the European Space Agency has confirmed a series of cyber attacks that resulted in sensitive data, including staff email credentials appearing on dark Web forums. The breaches began in mid December of last year and affected external servers used for unclassified collaborative engineering work. Attackers claim to have exfiltrated roughly 200 gigabytes of data, allegedly including source code, access tokens and configuration files, some of which are being offered for sale. ESA said the attackers remained undetected for about a week and stressed that core mission systems and classified operations were not compromised. Cybersecurity researcher Clement Poure of ETH Zurich warned that leaked credentials could enable follow on attacks through credential reuse. ESA has launched a forensic investigation isolated affected infrastructure and is cooperating with law enforcement, underscoring broader concerns about cyber risks facing the space sector. Dutch police have arrested a 33 year old man at Schiphol Airport, alleging he was the operator of AvCheck, a malware testing service used by cybercriminals. Authorities say AvCheck allowed attackers to test malware against antivirus tools and modify it until detection failed, helping criminals steal data unnoticed. The suspect was detained upon returning from the United Arab Emirates. The arrest is part of Operation Endgame, a multinational effort that has dismantled major malware infrastructure in recent years. Dutch police worked with the FBI and Finnish authorities, tracing evidence from servers seized when Avcheck was taken offline in mid-2025. Investigators also identified two Amsterdam based companies allegedly linked to the service. The suspect remains in custody while seized devices are examined for ties to other criminal groups. The US and allied cyber agencies warned that insecure connectivity remains one of the fastest ways for threat actors to disrupt operational technology or OT environments. New guidance from the FBI, the Cybersecurity and Infrastructure Security Agency, the UK National Cybersecurity center and partners across the Five Eyes and Europe outlines eight secure connectivity principles. The agencies said growing links between OT IT networks, cloud platforms and third parties have expanded opportunities for cyber intrusions to cause physical disruption. They urged organizations to treat every new connection as a risk based business decision, limit inbound access by default and use brokered gateways where external access is required. The guidance also warns that legacy devices, flat networks and fragmented remote access increase exposure while centralized, well segmented connectivity improves visibility and resilience. Check Point reports large scale automated exploitation of a critical hewlett Packard Enterprise OneView flaw now linked to the Rondo Docs botnet. The maximum severity remote code execution bug affects OneView's centralized control of servers and networking. Researchers observed tens of thousands of exploit attempts after the flaw was added to CISA's actively exploited list, confirming a shift from proof of concept to real world attacks. Activity was global and largely automated, underscoring the risk of delayed patching for high privilege management platforms. Researchers at Sophos have detailed a long running malvertising campaign dubbed Tampered Chef that uses Trojanized PDF documents to deliver backdoor malware and infostealers. The campaign has expanded across Europe, with organizations in Germany, the UK and France. Most frequently affected attackers target sectors that rely on specialized technical equipment, exploiting users, searches for instruction manuals or PDF tools. Malicious ads placed prominently in search results direct victims to fake download sites, leading to credential theft and persistent network access. Sofo said the operation uses layered evasion tactics including staged payloads, abuse of code signing certificates and a 56 day dormancy period. To avoid detection, the firm recommends avoiding ad based downloads, restricting approved sources and enforcing multi factor authentication to limit impact. Academic researchers have disclosed a critical flaw in Google Fast Pair that allows attackers to forcibly connect to vulnerable Bluetooth audio accessories. The issue stems from improper pairing checks in some Fast Pair implementations. The attack, dubbed Whisper Pair by researchers at KU Leuven, enables attackers within 14 meters to seize control of earbuds or headphones, play audio or record sound without consent. In some cases, attackers could also track users through Google's Device Finding Network. Google has issued updates for Pixel devices, but researchers warn users must also install firmware patches from accessory manufacturers to mitigate the risk. Cisco has patched a maximum severity async os0day, exploited since November against Secure Email Gateway and Secure Email and Web Manager appliances with exposed spam quarantine features. Cisco said the flaw allows remote command execution with root privileges. Cisco Talos attributes the attacks to a China linked group tracked as UAT 9686, which deployed persistent backdoors and tunneling tools. CISA added the bug to its Exploited Vulnerabilities catalog, urging rapid patching and compromise checks. Jen Easterly has been appointed chief executive officer of the RSA conference, taking charge of the event's global programming innovation initiatives and professional platforms. Easterly previously led the Cybersecurity and Infrastructure Security Agency, where she advanced Secure by design principles, launched the known Exploited Vulnerabilities catalog and strengthened public private coordination on ransomware. A former NSA White House and Morgan Stanley executive, Easterly steps into the role as RSAC prepares for its March 2026 conference in San Francis, expected to draw more than 40,000 attendees worldwide. We wish Jen Easterly all the best. Coming up after the break, our guest is Zach Casas from Ohio State University discussing GPS alternatives. Stay with us. Zach Casas is a professor at Ohio State University. He recently caught up with my N2K colleague Maria Vermazes from the T Minus Space Daily podcast to discuss GPS alternatives.