Daily Cyber Threat Brief – Ep 1075 (Feb 24, 2026)

Podcast: Daily Cyber Threat Brief
Host: Dr. Gerald Auger (aka "Jerry") – Simply Cyber Media Group
Date: February 24, 2026
Episode Theme:
Staying up-to-date on the top cyber news stories impacting industry professionals, with expert breakdowns, real-world context, and a dash of community fun.

Episode Overview

This episode dives into current high-impact cyber threats and news stories relevant to security analysts, business leaders, and anyone working in or aspiring to work in cybersecurity. Dr. Auger (“Jerry”) offers real-time reactions and practical advice based on decades of experience in GRC. The topics include major data breaches, ransomware trends, AI/ML risks, supply chain attacks, threat actor arrests, and in-the-trenches response strategies. Co-host Eric Taylor joins during the "Jawjacking" Q&A, taking listener questions on career paths, technical reporting, remote work, and more.

Key Discussion Points & Insights

1. Massive U.S. Healthcare Data Breach (~13:19)

Story:

140,000+ affected by a data breach at South Carolina-based VCOR Scientific (now Vanta Diagnostics).
Everest Ransomware, via a third-party (Catalyst RCM), accessed payment information, medical records, etc.

Analysis:

Highlights persistent third-party risk in healthcare: “Healthcare is incredibly entangled... when one of them gets hit, it can have a ripple effect against all of them.” (14:09)
Industries most at risk for ransomware: healthcare & manufacturing
Tabletop exercises and cyber insurance are vital mitigating steps.
Discussed the U.S. HHS ‘Wall of Shame’ breach portal for HIPAA violations.

Notable Quote:

“I could bet you money, I’ll put $100 down, that there will be a ransomware attack tomorrow... and that’s easy money. Even FanDuel is not going to take that bet.” (14:09)

Timestamps:

Story Intro: 13:19
Risk Analysis & Mitigation: 14:09-21:40

2. Global Regulators Warn Against AI Replicating Humans (21:40)

Story:

Data regulators from 61 countries urge safeguards in generative AI to prevent creation of realistic images/videos of people without consent, in response to Grok chatbot abuses.

Analysis:

Challenges of AI-generated deepfakes for privacy and abuse (“AI is off the chain... you could take a picture of anyone and say, ‘take the clothes off this person,’ and it will do it.” 22:35)
Practical enforcement (e.g. UK proposing 10% of global revenue fines for not deleting non-consensual imagery in 48 hours) seems difficult to implement.
Real-world risks to ordinary people—not just celebrities.
Jerry tries to trademark his own likeness: “Guess what? You cannot trademark your likeness.” (26:50)

3. Sandworm_Mode – Supply Chain Worm Infects NPM, Targets AI Devs (27:53)

Story:

Researchers at Socket spot “Sandworm_mode” worm in 19 malicious NPM packages—uses typo-squatting, steals dev/API/CI secrets, targets AI tools.

Analysis:

“This is a hot, hot situation up in here” (28:48).
Typo-squatting basics explained (“Beautiful Soup” → “Beautiful Souop”).
Poisons AI dev environments—educate developers on package hygiene and auditing dependencies.
Risks extend to cloud credentials and API tokens.

Advice:

“Educate your engineering folks, your IT folks... anyone that’s really going to be screwing around with an IDE.” (32:10)

4. Spanish Police Detain Suspected Anonymous “Phoenix” Hacktivists (33:02)

Story:

Four suspected Anonymous members arrested for DDoS after Spain's “Dana” floods (2024).

Analysis:

Motivations of hacktivist groups like Anonymous; how events (floods, disasters) can spark cyber activism.
Skepticism: “If you’re going to do something, what is the goal?” (33:39)
Comments on evidence, ideological action, and recent group fluidity.

5. Roundcube Webmail Flaws Actively Exploited (42:38)

Story:

CISA adds two Roundcube vulnerabilities (RCE & XSS) to Known Exploited Vulnerabilities Catalog.
Over 46,000 exposed instances, widely used through cPanel.

Analysis & Advice:

“If you’re running Roundcube, you should know that you’re running Roundcube.” (43:16)
Urges regular scanning of internet-facing assets and patching—especially with history of previous exploitation by state-linked groups.
“If you have shadow IT... shut it down or make them get an exception.”

6. Fraud Investigation Reveals Python-Based Malware (44:41)

Story:

Python malware campaign abuses PowerShell, uses obfuscation, steals browser crypto wallets, deploys commercial C2 tools (Cobalt Strike, XWorm).

Analysis:

Utility of Python for malware due to scriptability/interpreted execution.
Key indicators: “If you see a terminal shell pop up and then it closes, that could be an indicator of compromise.”
Importance of logs: “If you’re not capturing logs, ...you could take your suspicion in a cup of coffee and move on down the street.” (45:33)
Likely initial vector is phishing or credential theft.

7. Ukrainian Sentenced for Facilitating North Korea IT Worker Fraud (50:43)

Story:

Ukrainian ran a service selling stolen U.S. identities to North Korean IT workers (remote job fraud), operating “laptop farms” and facilitating payments.
Sentenced to 5 years in U.S. prison, $1.4M forfeited.

Analysis:

Explains importance of not traveling to countries with extradition if committing cyber crime.
Describes “seeing business opportunities” in bridging illicit operations.
Moral complexity: being a Ukrainian criminal doesn’t exonerate due to larger conflict.

Notable Quote:

“If you were young, right... would you do five years of prison if when you got out you had like $4 million sitting in some Swiss bank account?” (51:35)

8. Air Côte d’Ivoire Confirms Ransomware Attack (55:24)

Story:

West African airline hit by INC ransomware gang, 208GB of data stolen, some flight-related systems affected but flights continue.

Analysis:

Airlines seem to suffer frequent cyber attacks relative to other transport sectors.
“With things like this guys, the plane itself... is safe. It’s not like they’re controlling the plane.” (56:04)
Most issues affect business operations, not operational technology (OT).

Memorable Moments & Community Highlights

“Wall of Shame” Demo: Jerry gives a lively walkthrough of HHS’s HIPAA breach portal. (20:05)
Trademarking Likeness Fails: “You cannot trademark your likeness... You can trademark like—Matthew McConaughey trademarked ‘alright, alright, alright’—you could trademark that crap, but you can’t trademark yourself. Facts.” (26:50)
Costco Lifehack: “The optimal time to go to Costco is Mondays between 6 and 8pm. Period, full stop.” (38:31)
‘Jawjacking’ Q&A: Eric Taylor answers practical listener questions on networking at expos, remote work, improving after bad performance reviews, compliance interview prep, and moving back into cyber after a shift to physical risk intelligence.
On Getting Criticism at Work: “If you’ve gotten a bad evaluation, take the criticism, say, thank you for that...come back in a couple weeks...‘How am I doing? Are you seeing improvement?’” (74:25)

Notable Quotes & Speaker Attributions

On ransomware odds:

“I could bet you money… there will be a ransomware attack tomorrow.”
— Dr. Gerald Auger (14:09)
On AI deepfakes:

“You could take a picture of anyone and say, ‘take the clothes off this person,’ and it will do it.”
— Dr. Gerald Auger (22:35)
On supply chain dev risk:

“This is a hot, hot situation up in here…”
— Dr. Gerald Auger (28:48)
On arresting hacktivists:

“If you’re going to do something, what is the goal? ...If you’re just flipping out for the sake of flipping out, fine, that’s your goal.”
— Dr. Gerald Auger (33:39)
On logs for IR:

“Logs are vital. If you’re not capturing logs... all you have is a cup of coffee and suspicion.”
— Dr. Gerald Auger (45:33)

Timestamps for Important Segments

[13:19] Healthcare breach & third-party risk
[21:40] Regulator warnings on AI & deepfakes
[27:53] Sandworm_mode supply chain worm
[33:02] Anonymous hacktivists arrested in Spain
[42:38] Roundcube vulnerabilities
[44:41] Python malware case study
[50:43] Ukrainian sentenced for aiding North Korea
[55:24] Air Côte d’Ivoire ransomware attack
[38:31 | 56:04] Community tidbits & practical advice
[62:07–88:34] “Jawjacking” Q&A with Eric Taylor

Additional Resources & Community Interactions

CPE Instructions: Each episode offers ½ a CPE (screenshot, file, count later for audit).
Community inclusivity: Newcomers (“first-timers”) welcomed—“No gatekeeping, no stupid questions.”
Sponsor Resource Highlights: AntiSiphon training, Flare Academy CTFs, Material Security AI/identity protection.
Live “Tidbit Tuesday” lifehacks and music/dancing segment for community bonding.
Interactive “Jawjacking” Q&A session on cybersecurity roles, conference tips, reporting, team feedback, and more.
Encouragement to leverage free live skills workshops and participate in Discord/LinkedIn community.

Takeaways

Ransomware and third-party vendor risks remain top challenges for critical sectors.
Generative AI presents new threat vectors for privacy and reputation; regulatory efforts are ramping up but face implementation headwinds.
Supply chain and open-source package corruption is a growing risk; developer education is key.
Law enforcement is increasingly able to identify and arrest threat actors across borders.
The community-centric, supportive learning approach helps individuals progress in the industry.

Closing Note:
“Stay secure. Ever wonder what it takes to break into cybersecurity? Join us every weekday...live, unfiltered and totally free. Let’s level up together.” (60:04)

This summary centers on actionable intelligence and keeps to the energetic, practical, and humorous tone of the Simply Cyber community and hosts.

Daily Cyber Threat Brief – Ep 1075 (Feb 24, 2026)

Episode Overview

Key Discussion Points & Insights

1. Massive U.S. Healthcare Data Breach (~13:19)

Story:

140,000+ affected by a data breach at South Carolina-based VCOR Scientific (now Vanta Diagnostics).
Everest Ransomware, via a third-party (Catalyst RCM), accessed payment information, medical records, etc.

Analysis:

Highlights persistent third-party risk in healthcare: “Healthcare is incredibly entangled... when one of them gets hit, it can have a ripple effect against all of them.” (14:09)
Industries most at risk for ransomware: healthcare & manufacturing
Tabletop exercises and cyber insurance are vital mitigating steps.
Discussed the U.S. HHS ‘Wall of Shame’ breach portal for HIPAA violations.

Notable Quote:

“I could bet you money, I’ll put $100 down, that there will be a ransomware attack tomorrow... and that’s easy money. Even FanDuel is not going to take that bet.” (14:09)

Timestamps:

Story Intro: 13:19
Risk Analysis & Mitigation: 14:09-21:40

2. Global Regulators Warn Against AI Replicating Humans (21:40)

Story:

Data regulators from 61 countries urge safeguards in generative AI to prevent creation of realistic images/videos of people without consent, in response to Grok chatbot abuses.

Analysis:

Challenges of AI-generated deepfakes for privacy and abuse (“AI is off the chain... you could take a picture of anyone and say, ‘take the clothes off this person,’ and it will do it.” 22:35)
Practical enforcement (e.g. UK proposing 10% of global revenue fines for not deleting non-consensual imagery in 48 hours) seems difficult to implement.
Real-world risks to ordinary people—not just celebrities.
Jerry tries to trademark his own likeness: “Guess what? You cannot trademark your likeness.” (26:50)

3. Sandworm_Mode – Supply Chain Worm Infects NPM, Targets AI Devs (27:53)

Story:

Researchers at Socket spot “Sandworm_mode” worm in 19 malicious NPM packages—uses typo-squatting, steals dev/API/CI secrets, targets AI tools.

Analysis:

“This is a hot, hot situation up in here” (28:48).
Typo-squatting basics explained (“Beautiful Soup” → “Beautiful Souop”).
Poisons AI dev environments—educate developers on package hygiene and auditing dependencies.
Risks extend to cloud credentials and API tokens.

Advice:

“Educate your engineering folks, your IT folks... anyone that’s really going to be screwing around with an IDE.” (32:10)

4. Spanish Police Detain Suspected Anonymous “Phoenix” Hacktivists (33:02)

Story:

Four suspected Anonymous members arrested for DDoS after Spain's “Dana” floods (2024).

Analysis:

Motivations of hacktivist groups like Anonymous; how events (floods, disasters) can spark cyber activism.
Skepticism: “If you’re going to do something, what is the goal?” (33:39)
Comments on evidence, ideological action, and recent group fluidity.

5. Roundcube Webmail Flaws Actively Exploited (42:38)

Story:

CISA adds two Roundcube vulnerabilities (RCE & XSS) to Known Exploited Vulnerabilities Catalog.
Over 46,000 exposed instances, widely used through cPanel.

Analysis & Advice:

“If you’re running Roundcube, you should know that you’re running Roundcube.” (43:16)
Urges regular scanning of internet-facing assets and patching—especially with history of previous exploitation by state-linked groups.
“If you have shadow IT... shut it down or make them get an exception.”

6. Fraud Investigation Reveals Python-Based Malware (44:41)

Story:

Python malware campaign abuses PowerShell, uses obfuscation, steals browser crypto wallets, deploys commercial C2 tools (Cobalt Strike, XWorm).

Analysis:

Utility of Python for malware due to scriptability/interpreted execution.
Key indicators: “If you see a terminal shell pop up and then it closes, that could be an indicator of compromise.”
Importance of logs: “If you’re not capturing logs, ...you could take your suspicion in a cup of coffee and move on down the street.” (45:33)
Likely initial vector is phishing or credential theft.

7. Ukrainian Sentenced for Facilitating North Korea IT Worker Fraud (50:43)

Story:

Ukrainian ran a service selling stolen U.S. identities to North Korean IT workers (remote job fraud), operating “laptop farms” and facilitating payments.
Sentenced to 5 years in U.S. prison, $1.4M forfeited.

Analysis:

Explains importance of not traveling to countries with extradition if committing cyber crime.
Describes “seeing business opportunities” in bridging illicit operations.
Moral complexity: being a Ukrainian criminal doesn’t exonerate due to larger conflict.

Notable Quote:

“If you were young, right... would you do five years of prison if when you got out you had like $4 million sitting in some Swiss bank account?” (51:35)

8. Air Côte d’Ivoire Confirms Ransomware Attack (55:24)

Story:

West African airline hit by INC ransomware gang, 208GB of data stolen, some flight-related systems affected but flights continue.

Analysis:

Airlines seem to suffer frequent cyber attacks relative to other transport sectors.
“With things like this guys, the plane itself... is safe. It’s not like they’re controlling the plane.” (56:04)
Most issues affect business operations, not operational technology (OT).

Memorable Moments & Community Highlights

“Wall of Shame” Demo: Jerry gives a lively walkthrough of HHS’s HIPAA breach portal. (20:05)
Trademarking Likeness Fails: “You cannot trademark your likeness... You can trademark like—Matthew McConaughey trademarked ‘alright, alright, alright’—you could trademark that crap, but you can’t trademark yourself. Facts.” (26:50)
Costco Lifehack: “The optimal time to go to Costco is Mondays between 6 and 8pm. Period, full stop.” (38:31)
‘Jawjacking’ Q&A: Eric Taylor answers practical listener questions on networking at expos, remote work, improving after bad performance reviews, compliance interview prep, and moving back into cyber after a shift to physical risk intelligence.
On Getting Criticism at Work: “If you’ve gotten a bad evaluation, take the criticism, say, thank you for that...come back in a couple weeks...‘How am I doing? Are you seeing improvement?’” (74:25)

Notable Quotes & Speaker Attributions

On ransomware odds:

“I could bet you money… there will be a ransomware attack tomorrow.”
— Dr. Gerald Auger (14:09)
On AI deepfakes:

“You could take a picture of anyone and say, ‘take the clothes off this person,’ and it will do it.”
— Dr. Gerald Auger (22:35)
On supply chain dev risk:

“This is a hot, hot situation up in here…”
— Dr. Gerald Auger (28:48)
On arresting hacktivists:

“If you’re going to do something, what is the goal? ...If you’re just flipping out for the sake of flipping out, fine, that’s your goal.”
— Dr. Gerald Auger (33:39)
On logs for IR:

“Logs are vital. If you’re not capturing logs... all you have is a cup of coffee and suspicion.”
— Dr. Gerald Auger (45:33)

Timestamps for Important Segments

[13:19] Healthcare breach & third-party risk
[21:40] Regulator warnings on AI & deepfakes
[27:53] Sandworm_mode supply chain worm
[33:02] Anonymous hacktivists arrested in Spain
[42:38] Roundcube vulnerabilities
[44:41] Python malware case study
[50:43] Ukrainian sentenced for aiding North Korea
[55:24] Air Côte d’Ivoire ransomware attack
[38:31 | 56:04] Community tidbits & practical advice
[62:07–88:34] “Jawjacking” Q&A with Eric Taylor

Additional Resources & Community Interactions

CPE Instructions: Each episode offers ½ a CPE (screenshot, file, count later for audit).
Community inclusivity: Newcomers (“first-timers”) welcomed—“No gatekeeping, no stupid questions.”
Sponsor Resource Highlights: AntiSiphon training, Flare Academy CTFs, Material Security AI/identity protection.
Live “Tidbit Tuesday” lifehacks and music/dancing segment for community bonding.
Interactive “Jawjacking” Q&A session on cybersecurity roles, conference tips, reporting, team feedback, and more.
Encouragement to leverage free live skills workshops and participate in Discord/LinkedIn community.

Takeaways

Ransomware and third-party vendor risks remain top challenges for critical sectors.
Generative AI presents new threat vectors for privacy and reputation; regulatory efforts are ramping up but face implementation headwinds.
Supply chain and open-source package corruption is a growing risk; developer education is key.
Law enforcement is increasingly able to identify and arrest threat actors across borders.
The community-centric, supportive learning approach helps individuals progress in the industry.

Closing Note:
“Stay secure. Ever wonder what it takes to break into cybersecurity? Join us every weekday...live, unfiltered and totally free. Let’s level up together.” (60:04)

This summary centers on actionable intelligence and keeps to the energetic, practical, and humorous tone of the Simply Cyber community and hosts.

wavePod

🔴 Feb 24’s Top Cyber News NOW! - Ep 1075

Powered by Wave AI

Summary

Daily Cyber Threat Brief – Ep 1075 (Feb 24, 2026)

Episode Overview

Key Discussion Points & Insights

1. Massive U.S. Healthcare Data Breach (~13:19)

2. Global Regulators Warn Against AI Replicating Humans (21:40)

3. Sandworm_Mode – Supply Chain Worm Infects NPM, Targets AI Devs (27:53)

4. Spanish Police Detain Suspected Anonymous “Phoenix” Hacktivists (33:02)

5. Roundcube Webmail Flaws Actively Exploited (42:38)

6. Fraud Investigation Reveals Python-Based Malware (44:41)

7. Ukrainian Sentenced for Facilitating North Korea IT Worker Fraud (50:43)

8. Air Côte d’Ivoire Confirms Ransomware Attack (55:24)

Memorable Moments & Community Highlights

Notable Quotes & Speaker Attributions

Timestamps for Important Segments

Additional Resources & Community Interactions

Takeaways

Summary

Daily Cyber Threat Brief – Ep 1075 (Feb 24, 2026)

Episode Overview

Key Discussion Points & Insights

1. Massive U.S. Healthcare Data Breach (~13:19)

2. Global Regulators Warn Against AI Replicating Humans (21:40)

3. Sandworm_Mode – Supply Chain Worm Infects NPM, Targets AI Devs (27:53)

4. Spanish Police Detain Suspected Anonymous “Phoenix” Hacktivists (33:02)

5. Roundcube Webmail Flaws Actively Exploited (42:38)

6. Fraud Investigation Reveals Python-Based Malware (44:41)

7. Ukrainian Sentenced for Facilitating North Korea IT Worker Fraud (50:43)

8. Air Côte d’Ivoire Confirms Ransomware Attack (55:24)

Memorable Moments & Community Highlights

Notable Quotes & Speaker Attributions

Timestamps for Important Segments

Additional Resources & Community Interactions

Takeaways