A (0:02)

You're listening to the Cyberwire Network powered by N2K.

B (0:12)

Ever wished you could rebuild your network from scratch to make it more secure, scalable and simple? Meet Meter, the company reimagining enterprise networking from the ground up. Meter builds full stack zero trust networks including hardware, firmware and software, all designed to work seamlessly together. The result? Fast, reliable and secure connectivity without the constant patching, vendor juggling or hidden costs. From wired and wireless to routing, switching, firewalls, DNS security and vpn, every layer is integrated and continuously protected in one unified platform. And since it's delivered as one predictable monthly service, you skip the heavy capital costs and endless upgrade cycles. Meter even buys back your old infrastructure to make switching effort, transform complexity into simplicity and give your team time to focus on what really matters, helping your business and customers thrive. Learn more and book your demo@meter.com cyberwire that's M E T E R.com cyberwire. Grok's non consensual imagery draws scrutiny from the European Commission Researchers link several major data breaches to a single threat actor. The UK unveils a new cyber action plan. A stealthy click fix campaign targets the hospitality sector. VVS stealer malware targets discord users. Covenant Health and Aflac report data leaks. Google silences a critical Dolby flaw Elana Cohen, Chief legal and policy officer at HackerOne, joins us to discuss what the SolarWinds dismissal really means for CISOs and UK students. Enjoy a digital snow day. Tuesday, January 6th, 2026. I'm Dave Bittner and this is your Cyberwire Intel Briefing. Thanks for joining us here today. It's great as always to have you with us. The European Commission is considering enforcement action against X Twitter after its artificial intelligence tool Grok was used to generate sexualized images of a minor. The issue surfaced after Grok responded to prompts to digitally remove clothing from images, including one involving a 14 year old actress, amid wider misuse to create non consensual sexual imagery of women. Commission spokesperson Thomas Rainier said officials are very seriously examining the matter, calling the outputs illegal and unacceptable in Europe. He noted this was not the first problematic incident involving Grok and referenced prior concerns, including the spread of Holocaust denying material. The Scrutiny follows a 120 million euro fine issued to X under the Digital Services act, which X criticized as political censorship. The controversy has intensified tensions between the EU and the United States over platform regulation. Meanwhile, investigations are also underway in France and the UK regulator Ofcom has warned that creating non consensual intimate images is a criminal offense and is assessing X's compliance with UK law security firm Hudson Rock reports that several major data breaches are linked to a threat actor known as Zestix, also associated with the Persona centap. The actor functions as an initial access broker, using stolen credentials harvested by information stealing malware to break into enterprise networks, exfiltrate data and sell both data and system access on underground forums. Hudson Rock says the credentials were collected from infected employee devices, sometimes sitting in logs for years before being exploited. Weak protections, particularly the absence of multi factor authentication on file sharing services, enabled repeated compromises. Victims span aerospace, government, healthcare, legal and robotics sectors with stolen data sets reportedly sold for up to $150,000. The findings highlight the long running infostealer problem where malware as a service has commoditized cybercrime and made large scale credential theft easier, faster and harder to detect. The UK government has unveiled a new cyber action plan that includes a centralized cyber unit and a software security ambassador scheme to strengthen public sector cyber resilience. The measures follow Several high profile 2025 Cyber incidents affecting organizations such as Jaguar, Land Rover, Marks and Spencer and the Co Op, as well as a recent attack on a supplier to the National Health Service. Backed by 210 million pounds in funding, the plan aims to raise baseline security standards and improve coordinated incident response. The new government cyber unit, housed within the Department for Science, Innovation and Technology, will oversee cross department risk management. The Ambassador scheme promotes a voluntary software security code of practice to reduce supply chain risk. While widely welcomed, some experts warn the funding may fall short of the challenges scale Security firm Securonix warns of a stealthy click fix phishing campaign targeting the hospitality sector to deliver remote access trojans. The attack uses fake booking.com cancellation emails that lure victims to impersonation sites with deceptive captcha and fake blue screen messages. Victims are tricked into running PowerShell commands that deploy a customized DC RAT. The malware disables defenses, establishes persistence and uses resilient command and control techniques designed to survive infrastructure takedowns. Researchers at Palo Alto Networks unit 42 have disclosed details of VVS Stealer, a Python based malware targeting discord users active since at least April 2025. The malware is distributed as a PI installer package, allowing it to run easily on Windows systems. Its primary goal is to steal discord authentication tokens, giving attackers access to private messages, accounts and potentially billing data. VVS Stealer uses fake error messages to trick users into rebooting, then performs a discord injection that modifies application files to monitor activity in real time. It also harvests credentials from major browsers, captures screenshots and exfiltrates data via webhooks. Unit 42 reports the malware is sold as a subscription service on Telegram, highlighting the continued commercialization of credential stealing malware nearly 478,000 patients of Covenant Health are being notified that their data may have been stolen in a May 2025 cyberattack. The incident, claimed by the Keelin Ransomware Group, initially appeared limited but was later found to have a far wider impact. Potentially exposed data includes personal insurance and medical information. Covenant says it shut down systems to contain the attack and has since strengthened security, though details remain limited. Aflac is notifying 22.6 million people that their personal and health information may have been stolen in a June 2025 cyber attack. The insurer says the incident was quickly contained and did not involve ransomware, but compromised data may include Social Security numbers and health details. The breach could become the largest US health data incident reported in 2025. Aflac is offering credit monitoring while multiple class action lawsuits have been filed amid speculation unconfirmed by the company that Scattered Spider was involved. Google has patched a critical vulnerability affecting the Android implementation of Dolby software. The flaw is a buffer overflow in multiple Dolby UDC versions. According to Wiz, the issue stems from improper buffer allocation when processing evolution data, leading to out of bounds writes and potential data leakage. Dolby rated the bug as moderate severity, noting it typically causes media player crashes. Google, however, classifies it as critical warning that combined with other Android flaws, it could have greater impact, particularly on Pixel devices. The vulnerability has now been fixed through Android security updates. Coming up after the break, my conversation with Alana Cohen, Chief legal and Policy Officer at HackerOne and UK students enjoy a digital snow day. What's your 2am Security worry? Is it do I have the right controls in place? Maybe? Are my vendors secure? Or the one that really keeps you up at night? How do I get out from under these old tools and manual processes? That's where Vanta comes in. Vanta automates the manual work so you can stop sweating over spreadsheets, chasing audit evidence and filling out endless questionnaires. Their trust management platform continuously monitors your systems, centralizes your data and simplifies your security at scale. And it fits right into your workflows, using AI to streamline evidence collection, flag risks and keep your program audit ready all the time. With Vanta, you get everything you need to move faster, scale confidently, and finally get back to sleep. Get started at vanta.com cyber that's V-A-N-T A.com cyber. Most environments trust far more than they should, and attackers know it. ThreatLocker solves that by enforcing default fault deny at the point of execution. With Threat Locker allow listing, you stop unknown executables cold. With ring fencing, you control how trusted applications behave. And with Threat Locker DAC defense against configurations, you get real assurance that your environment is free of misconfigurations and clear visibility into whether you meet compliance standards. Threat Locker is the simplest way to enforce zero trust principles without the operational pain. Its powerful protection that gives CISOs real visibility, real control, and real peace of mind. ThreatLocker makes zero trust attainable even for small security teams. See why thousands of organizations choose ThreatLocker to minimize alert fatigue, stop ransomware at the source, and regain control over their environments. Schedule your demo@threatlocker.com N2K today, Elana Cohen is Chief Legal and policy officer at HackerOne. She joins me to discuss what the SolarWinds dismissal really means for CISOs.