Transcript
Sponsor/Ad Voice (0:02)
You're listening to the Cyberwire Network, powered by N2K.
Sponsor/Ad Voice (0:09)
It's not just something you made, it's the privilege that you get to work with your hands. It's building something that serves a purpose, proof that you have the grit to keep going. At Timberland, we understand you take your craft seriously, and we do too, which is why our products are built to the highest quality. We put in the work so you can perfect yours with purpose, in every detail, and crafted with intention. Timberland built on craft. Visit timberland.com to shop.
Dave Bittner (0:48)
RSAC Wraps CISL warns shutdown furloughs are weakening cyber defenses China linked actors burrow into global telecom infrastructure Iran's pay to key research surfaces India probes suspected Pakistan linked CCTV spying Florida suspends a firm over offshore medical data exposure Cisco patches fresh flaws Russian police arrest the alleged leak base operator intern Kevin files his latest man on the street report and Google gets grabby with your homepage. Foreign it's Thursday, march 26, 2026. I'm dave buettner and this is your cyberwire intel briefing. As RSAC 2026 winds down here in San Francisco, we want to take a moment to say thanks. It's been a busy week of conversations, interviews, hallway run ins and late night events, and we're grateful to everyone who took the time to connect with us along the way. Special thanks to our teammates back home who kept everything running smoothly while much of the crew was on the road. Conferences bring energy and opportunity, but they also bring a little extra chaos. We appreciate the teamwork that makes it all possible and we're glad you are with us here today. Experts warn artificial intelligence agents are rapidly reshaping cyber risk, but defenders still lack a clear threat model for how to counter them. At the RSAC cryptographers panel, researchers said AI agents can already identify zero day vulnerabilities in open source software and may soon generate most new code. Panelists also warned large language models enabled personalized spear phishing, rapid exploit use after disclosure and large scale traffic analysis, though no new cryptographic weaknesses have yet been found. Defenders face faster automated attacks and unclear assumptions about cryptographic safety, while patching delays and expanding agent access to sensitive data increase organizational exposure across environments, according to the panelists. Assessments of current risks and emerging operational realities Former National Security Agency leaders say the threshold for a US Military response to cyber attacks remains undefined and ultimately rests with the president. Here at the RRSA conference, retired General Paul Nakasone said the decision to respond kinetically, meaning with physical force such as missile strikes should remain flexible. Former NSA Director Admiral Mike Rogers argued instead for clearer criteria, including loss of life or damage to critical infrastructure. Panelists noted destructive incidents like North Korea's Sony Pictures attack helped shape earlier debates, but no consensus red line emerged. Uncertainty about response thresholds complicates deterrence strategy While officials also warned the US is falling behind adversaries amid persistent intrusions, ransomware growth and workforce strain across government cyber defense efforts, RSAC CEO Jen Easterly says cybersecurity has reached an inflection point where AI is now inseparable from modern cyber defense and operations. Speaking with the Register here at the RSA conference, Easterly said AI is already enabling stronger code development, vulnerability detection and legacy system modernization at scale. She warned threat actors are using AI for highly personalized phishing, but said she's not yet observed entirely new cyber risks emerging from the technology. Her first conference as CEO drew about 43,000 attendees, though federal agencies including the FBI, NSA and CISA were absent from panels. Easterly argues AI could significantly reduce cyber risk and improve software quality, while stronger public private collaboration remains essential as most critical infrastructure stays privately operated and global participation shapes security outcomes elsewhere. CISA's acting director warns a Department of Homeland Security shutdown is weakening federal cyber defense as most agency staff remain furloughed. Acting Director Nick Anderson told the House Homeland Security committee that about 60% of CISA's workforce is sidelined, forcing the agency into a reactive posture. Core services continue, including its 247 operations center and incident information sharing, but proactive programs, industry coordination, incident response capacity and cyber policy work such as incident reporting rules have slowed or paused, Anderson warned. Reduced coordination and delayed directives create openings for adversaries targeting critical infrastructure, while staffing shortages and retention losses could further erode long term national cyber readiness if disruptions continue. Rapid7 reports a China linked threat actor has implanted stealth back doors deep inside global telecommunications backbone infrastructure to enable long term espionage access. Researchers observed passive backdoors and kernel level implants including the Linux based BPF Door short for Berkeley Packet Filter Door, alongside credential harvesters and command frameworks such as CrossC2 and Tiny Shell. Attackers gained entry through public facing applications and valid accounts targeting avanti, Cisco, Fortinet, VMware, Palo Alto Networks and Apach Struts systems. Newer BPF door variants use encrypted HTTPs triggers and packet level filtering to evade detection. Rapid7 says the campaign focuses on underlying telecom platforms rather than individual servers, creating persistent access layers inside critical communications infrastructure that could support long duration intelligence collection against government and network environments, researchers warn. The Iran linked pay to key ransomware group has returned with enhanced evasion, execution and anti forensics capabilities following renewed U S Iran tensions, according to Halcyon and Beasley Security. A recent attack on a US healthcare provider showed attackers using TeamViewer for access credential harvesting tools including Mimikats and Lazang and Active directory utilities for lateral movement. The group deployed ransomware via a self extracting archive and encrypted infrastructure within 3 hours. Faster execution and anti forensic techniques may reduce defenders response windows and complicate investigations into destructive ransomware activity tied to state aligned actors. Indian authorities have ordered a nationwide audit of CCTV systems after police uncovered cameras allegedly installed by Pakistan backed operatives near rail stations and other infrastructure, according to Indian media reports. Suspects recruited locally deployed solar powered cameras that streamed footage over cellular networks, possibly using stolen SIM linked accounts, officials warned. The case highlights limits in device registration controls and concerns that insecure Internet connected cameras could enable broader surveillance activ. Potential compromise of widely deployed CCTV systems raises risks to critical infrastructure visibility and national security monitoring. Florida regulators suspended Mira Health after finding the firm unlawfully offshored sensitive Medicare enrollee data to companies in India and the Philippines without authorization. The Florida Office of Insurance Regulations said more than 23,000 Medicare Advantage beneficiaries were affected, including patients in chronic condition special needs plans. Officials warned the company failed to obtain required approvals before delegating services and exposed vulnerable residents protected health information to unlicensed offshore entities. Improper handling of regulated health data can increase breach risk and trigger compliance exposure for organizations responsible for safeguarding patient information, even when services are outsourced internationally. Cisco released patches for multiple iOS and iOS XE vulnerabilities, including flaws that attackers could chain to trigger persistent denial of service conditions on network switches. The updates address a dozen high and medium severity issues. Four publicly disclosed defects affect Catalyst 9300 series switches, where attackers could combine two flaws to escalate privileges and force maintenance mode requiring physical access to recover. Cisco said none of the vulnerabilities have been exploited in the wild. Russian authorities arrested a suspect believed to have operated the leak based cybercrime forum weeks after an international law enforcement operation dismantled the platform, according to Russia's Interior Ministry and state news agency tass. The Taganrog resident apparently created and administered Leakbase, a forum with more than 142,000 users trading stolen data, exploits and hacking services after breached shutdown in 2023. The FBI and partners in 14 countries seized the site in March during operation leak, conducting roughly 100 enforcement actions worldwide and targeting dozens of active users. Investigators say seized forum databases, including private messages and IP logs, may support further cybercrime prosecutions and disrupt remaining marketplace activity tied to stolen data ecosystems. Coming up after the break, intern Kevin files his latest man on the street report and Google gets grabby with your homepage Stick around.