Daily Cyber Threat Brief – Ep 1024

Date: December 11, 2025
Host: Jerry (Gerald Auger, Ph.D.) | Co-Host/Jawjacking Host: Daniel Lowry
Podcast: Daily Cyber Threat Brief by Simply Cyber Media Group

Overview

This episode dives into the day’s top 8 cyber news stories for cybersecurity insiders, practitioners, and leaders—providing expert analysis, candid commentary, and practical tips. Host Jerry (“Dr. Gerald Auger”) applies over two decades in GRC cybersecurity, breaking down incidents from executive fallout after breaches, critical vulnerabilities, OT infrastructure threats, record-breaking industry investment, and the evolving TTPs of ransomware actors. Daniel Lowry joins for the lively “Jawjacking” segment with career advice and community Q&A.

Top Stories & Key Insights

1. CEO of Retail Giant Coupang Resigns After Data Breach

[08:35 – 13:27]

• Incident: Coupang CEO in South Korea steps down after a data breach exposed 34 million customer records.
• South Korean authorities are investigating, including a raid and a probe involving a former Chinese employee.
• Jerry’s Analysis:
  • Cultural context: CEO resignations like this are rare, even after massive breaches; more common in some Asian corporate cultures, but a sign of internal political maneuvering as much as accountability.
  • “If I had to guess…there is most likely something else going on behind the scenes…almost never does the CEO quit, right, or get fired.” – Jerry [10:21]
  • Practical takeaway: Don’t use “CEO fired” scenarios as tabletop exercise injects—too political, not realistic in most Western organizations.
• Memorable Moment: Live fact-checking of other South Korean breaches (“No. Quit? No. Resign? No. Fired? No. Exactly.”) [12:24]

2. Pro-Russia Hacktivists Targeting US Critical Infrastructure

[14:08 – 22:17]

• Incident: Pro-Russian hacktivist groups (Car Z Pen Test, no name 05716, Sector 16) brute-force VNC connections to US water, food, and energy systems, accessing HMI devices and causing disruptions. CISA notes the attacks are crude but evolving.
• Practitioner Takeaways:
  • OT (Operational Technology) systems are old, infrequently updated, and often poorly secured—VNC connections especially vulnerable.
  • “If you’re not properly securing those VNC connections, anyone can remote in. …That is gross negligence.” – Jerry [18:29]
  • Practical advice:
    • Scan for open remote access services on your network/internet edge.
    • Implement MFA on all remote access.
    • Watch for shadow IT (users installing their own remote tools).
  • Personal vignette: Jerry recalls an engineer installing unauthorized remote access for ‘weekend productivity’—shows how business needs can create security gaps. [21:34]

3. Record Cyber Funding Flowing into Israeli Startups

[22:17 – 27:55]

• Headline: Israeli security startups raise $4.4B in 2025—a 9% jump, especially in AI security and endpoint tools.
• Implications:
  • “It took me a long time to understand why the business matters…Securing at a manufacturing company vs. a hospital—it’s not all the same.” – Jerry [22:55]
  • Israel remains a cybersecurity powerhouse; many Israeli-founded vendors brand themselves as “Silicon Valley” for broader marketability.
  • Link to macro trends: Surge in investment, especially in AI, is shaping the security landscape.
  • Resource tip: Mike Privette’s "Return on Security" newsletter covers funding and business trends. [26:34]

4. Aeroflot Breached via Third-Party Vendor

[27:55 – 31:24]

• Incident: Russian airline Aeroflot was compromised via a vendor without MFA, leading to AD takeover and widespread malware deployment, canceling 100+ flights.
• Jerry’s Take:
  • “How are you not using MFA on your Internet-facing resources?” [28:40]
  • Describes the “zombie” effect—once attackers get into AD, “they’re the captain now.”
  • Highlights recurring pattern: major breaches trace back to basics like lack of MFA and poor vendor controls.

5. Fortinet Patch Round: Critical Auth Bypass on SSO

[37:17 – 42:55]

• Alert: Fortinet issues fixes for 18 bugs, including critical authentication bypass in FortiCloud SSO. Vulnerability can let attackers sidestep SAML authentication.
• Practical Guidance:
  • Most FortiCloud SSO instances are off by default, but some get enabled during registration.
  • “If you’re running Fortinet, you probably have a recurring calendar reminder that says ‘patch Fortinet’.” – Jerry [38:26]
  • Risk assessment: CVSS high, but exploit likelihood currently modest—patch within regular cycle, and verify/disable SSO if not needed.
  • Reinforces principle: “If you don’t need it, don’t enable it.” [42:36]

6. Ransomware Broker (Storm-0249) Abusing EDR Tools

[42:55 – 48:29]

• Threat Trend: Storm-0249 (MSFT’s naming for unknown/“in development” APTs) using legitimate EDR agents and living-off-the-land techniques to persist undetected as ransomware access brokers.
• Insights:
  • Modern attackers “blend in” by abusing trusted tools and fileless attacks.
  • Behavioral monitoring & EDR baselining are crucial—signature-based detection is insufficient.
  • Quick pivot on Microsoft’s threat naming conventions:
    • “Storm” = unknown, “Typhoon” = China, “Blizzard” = Russia, etc. [44:33-45:53]
  • Memorable: Jerry shares the “Pyramid of Pain”—TTPs are hardest for APTs to change, informing attribution confidence. [47:03]

7. Zero-Day in Gogs Git Server—700+ Instances Compromised

[48:29 – 52:22]

• Alert: Zero-day lets authenticated Gogs users overwrite files and achieve RCE. Over 700 out of 1,400 internet-exposed instances compromised.
• Immediate Actions:
  • No patch yet: disable open registration, put servers behind VPN, monitor for new repos with random 8-char names.
  • Tip: “You’ll never be able to 100% know whether you got compromised—only levels of confidence.” – Jerry [49:59]
  • Best practice: Don’t expose self-hosted dev tools to the Internet unless necessary.

8. AI-Powered Malware Delivery (“Click Fix” Attacks)

[52:22 – 56:32]

• Threat Trend: Stealer malware targeting Macs now delivered through SEO-poisoned AI chat (e.g., ChatGPT/Grok), users tricked into pasting malicious commands.
• Advice:
  • User awareness is the #1 defense—“Educate your end users what click fix looks like.” – Jerry [53:16]
  • The real risk isn’t advanced AI, but that AI-provided web results are quickly becoming the most trusted link and the top attack vector.
  • “It cracks me up…If threat actors just didn’t commit crime, they’d probably be really high-paying marketing executives because of their ability to get people to click on stuff.” [55:09]
  • Side prediction: paid placement in AI search results is inevitable.

Meme of the Week

[35:15 – 37:17 & 56:32 – 57:13]

• Feature: A “Clop Ransomware” hockey jersey mock-up by Dan Reardon — lampooning the notoriety and ‘brand power’ of the Clop gang.
• Jerry: “If I were to turn dark side, Clop would be my dream school. This meme is phenomenal.” [35:15]

Practitioner Guidance & Jerry's Signature Wisdom

• Patch rigorously—especially Fortinet and any remote-access tools.
• Audit and lock down remote access, especially in OT environments.
• MFA is non-negotiable—on every internet-facing and privileged access path.
• Vulnerability triage: Not all CVSS 9.x bugs are equal; check EPSS and context for practical exploitability (e.g., Fortinet auth bypass).
• Business skills matter: Understanding funding, industry trends, and “where the money is” will take you farther than pure technical skills.
• OT vs. IT: Recognize and respect the unique challenges, risks, and bad habits of operational tech environments.
• Tabletop realism: Keep your incident simulations politically smart—don’t invent CEO firings that won’t happen.

“Jawjacking” with Daniel Lowry – Career Q&A

[60:06 – end (~90:14)]

A lively, candid Q&A on career growth, job hunting, skill-building, and the state of the industry:

Key Advice:

• Network like your job depends on it: The most valuable advantage for breaking into cybersecurity is building relationships—not just technical know-how. “The biggest hurdle is trust—you gotta have an insider who can vouch for you.”
• Level up without in-house mentorship:
  • Build home labs and simulate business networks.
  • Take certifications; train broad and deep.
  • Consider development (e.g., building exploit POCs) or freelance for hands-on experience.
  • You may need to switch employers for more challenge/mentorship: “I loved my job, but I still jumped to a different org because it was a good career move.”
• Soft skills outweigh technical surprises:
  • “It was being able to talk to people…Make them feel like you’re on their side because—you are.”
• Job application wisdom: Don’t share your previous salary—no good reason for companies to ask, unless (generously) they’re benchmarking.
• Choosing a specialization:
  • Forensics is more niche, great for law enforcement or CSIRT paths; web security is ubiquitous, a bit crowded but always in demand.

Notable Quotes:

• “We’re basically Ferengi at this point, just reading the Rules of Acquisition in the bathroom every morning.” – Daniel [76:16]
• “If companies invested in their people, people would return it—but now, to level up, you have to jump.” – Daniel [76:24]
• “It’s not about greed, it’s about providing value and being rewarded for it.” – Daniel [78:12]

Memorable Moments & Lighter Touches

• Multiple metaphors and pop culture nods (e.g., comparing AD takeovers to “The Last of Us” cordyceps zombies, Ferengi obsessions, the Clop hockey jersey derby).
• “If you’re new here, I’m old. Anytime I make an ‘80s/early ‘90s reference, take a drink—but don’t really, or you’ll be pissed drunk by the end of the show.” – Jerry [36:47]
• Call-and-response with live chat, welcoming first-timers and frequent (humorous) interruptions for super chats, celebrations, and channel memes.
• Dan Reardon’s Meme of the Week received enthusiastic applause from the community.

Actionable Summary by Topic

| Topic | Action or Takeaway | |------------------------------|-----------------------------------------------------------------------------------| | Data Breaches | Cultural/political impact differs by country; Board/CEO shakeups rare after breach| | OT/ICS Security | Audit for remote services, force MFA, patch rigorously, don’t trust “default secure” | | Cyber Startup Funding | Israel/AI are leading—watch industry funding trends for product/career relevance | | Third-party Vendor Risk | Enforce MFA, restrict vendor access, monitor for lateral movement via AD | | Patching & Vulnerabilities | Automate patch cycles, don’t wait for headlines—be proactive | | EDR Abuse & Initial Access | Baseline endpoint behavior; signatures alone won’t stop modern ransomware brokers | | DevSecOps/Hosted Tools | Don’t expose dev tools to internet; disable open registration; monitor for signs of compromise | | User Education | Teach “click fix” (malware via AI/SEO) awareness, restrict unnecessary powers | | Career Growth | Build labs, network relentlessly, consider job switches for mentorship, hone soft skills | | Job Search/Entry Level | Human connections remain the biggest edge in a competitive market | | Choosing Specialization | Forensics offers niche routes; web security is broad and evergreen |

Final Thoughts

• Jerry & Daniel’s ethos: Deliver up-to-the-second practical guidance, build inclusive community, and encourage learning with laughter.
• Tune in again: Daily at 8 AM ET for more cyber news—and join Jawjacking for on-the-spot answers and camaraderie.

Notable Quotes Table

| Time | Speaker | Quote | |-----------|---------|--------------------------------------------------------------------------------------------------------------| | 10:21 | Jerry | “There is most likely something else going on behind the scenes…almost never does the CEO quit, right, or get fired.” | | 18:29 | Jerry | “If you’re not properly securing those VNC connections, anyone can remote in. … That is gross negligence.” | | 22:55 | Jerry | “It took me a long time to understand why the business matters…Securing at a manufacturing company vs. a hospital—it’s not all the same.” | | 28:40 | Jerry | “How are you not using MFA on your Internet-facing resources?” | | 35:15 | Jerry | “If I were to turn dark side, Clop would be my dream school. This meme is phenomenal.” | | 53:16 | Jerry | “Educate your end users what click fix looks like.” | | 76:16 | Daniel | “We’re basically Ferengi at this point, just reading the Rules of Acquisition in the bathroom every morning.” | | 78:12 | Daniel | “It’s not about greed, it’s about providing value and being rewarded for it.” |

For more practical advice and industry updates, tune in live at simplycyber.io/streams, and join the community conversation.