Daily Cyber Threat Brief Podcast – Ep. 1046 – January 14, 2026

Episode Overview

Host: Dr. Gerald Auger (Simply Cyber Media Group)
Main Theme:
A rapid-fire, insightful breakdown of the top cybersecurity news stories for January 14, 2026, tailored for practitioners, analysts, and business leaders. Dr. Auger leverages his deep experience in GRC and community-building to give context, actionable takeaways, and candid reactions to the latest threats, vulnerabilities, and industry developments.

Key Topics & Insights

1. Go Brute Forcer Targeting Crypto & Blockchain Projects

[17:27]

• Details:
  • Check Point reports the resurgence of "Go Brute Forcer," a botnet targeting crypto/blockchain services hosted on exposed Linux platforms (FTP, MySQL, phpMyAdmin, PostgreSQL, etc.).
  • Attackers exploit weak/default credentials and AI-generated server builds lacking proper configuration.
  • Once in, attackers deploy web shells, IRC bots, and steal tokens from crypto wallets (notably Tron and BSC).
• Host Take:
  • Not sophisticated; mirrors the Mirai botnet approach from 2015.
  • AI is used to speed up scanning, not innovate new techniques.
  • Not exclusive to crypto—can pivot to target anyone with exposed, poorly secured services.
  • Memorable Quote:
    "This is like bolting on AI to make attack sequence efficient, not AI innovating a new attack sequence... If you’re scanning your attack surface and don’t have default creds exposed, this shouldn’t get you hot and bothered." [21:00]
  • Actionable Advice:
    • Regularly scan for exposed services (e.g., via Shodan).
    • Remove default/weak credentials.
    • Implement strong attack surface monitoring.

2. Android Accessibility Feature Bug

[23:03]

• Details:
  • Bug with Android's 'select to speak' feature causes volume buttons to adjust accessibility volume instead of media, disrupts camera shortcuts.
  • Google’s stopgap: advise users to disable the feature pending fix.
• Host Take:
  • Not a significant infosec issue—primarily a user annoyance and extremely low security risk.
  • "I have about 300,000 other things more important than this."
• Advice: Nearly negligible impact for security practitioners; deprioritize.

3. FCC Lets Verizon Tighten Phone Unlocking

[27:10]

• Details:
  • Verizon can now lock prepaid phones for a year, and postpaid devices until contracts are paid, replacing automatic 60-day unlocking.
  • Framed as a fraud deterrent, but consumer groups object.
• Host Reaction:
  • Sees the move as a cash grab, not true fraud prevention.
  • Memorable Quote:
    “This is straight Randy Moss all day. Verizon doesn’t want you to leave... This is a money maker.” [27:51]
  • No real security impact; corporate/consumer friction story.

4. US Military Cyber Leadership Turmoil

[30:06]

• Details:
  • Lt. Col. Jason Gargan (US Air Force) removed from Russia-focused National Mission Forces after a dispute with two-star Major General Lorna Moloch (Marine Corps), who is tipped for a top Cyber Command role.
  • Ongoing senior turnover; Command lacks confirmed leader for 9+ months.
• Host Analysis:
  • Highlights how senior military politics and disagreements lead to career derailment.
  • Good trivia on high-ranking female generals.
  • Stresses military command/duty structure.
  • Not directly threat-related, more industry insider context.

5. GOGS Git Server Vulnerability—Actively Exploited

[39:53]

• Details:
  • GOGS (self-hosted Git service) zero-day exploited; vulnerability allows attackers to overwrite files and execute code (tracked by CISA; patch not yet available).
  • Over 700 instances known compromised.
  • Symptoms: due to symlink handling in API; 100% known active exploitation.
• Host Guidance:
  • Only crucial for orgs using self-hosted GOGS.
  • Advice:
    • If Internet-facing, shut down or firewall immediately.
    • Disable open registration; review for suspicious repos (e.g., 8-char names).
    • Monitor for updates and detection rules.
  • Memorable Quote:
    “If you are running GOGS and it’s Internet-facing, I would shut it down... You’re riding dirty.” [45:56]

6. Advanced Web Skimming Operation (Credit Card Theft)

[46:32]

• Details:
  • Silent Push reports a sophisticated, long-running Magecart-style campaign, targeting checkout pages on WordPress and other e-commerce tech.
  • Obfuscated JavaScript skims credit card info, self-destructs if detected, creates fake Stripe forms, and deduplicates victims.
  • Hosted on a Dutch bulletproof service (surprisingly, given Dutch NATO status).
• Host Insights:
  • Technical admiration for threat actor sophistication, but firm condemnation.
  • Notes wide reach (all major card brands, even Diners Club).
  • Little end-user defense—relies on merchant vigilance and robust credit card fraud detection.

7. JP Morgan/Godman Sachs Investor Data Breach via Law Firm

[53:57]

• Details:
  • Data breach at law firm Fried Frank exposes names, contact info, account numbers, SSNs, passport/Gov ID numbers of 659 private equity investors.
  • JP Morgan/Goldman: their systems untouched, but affected due to third-party exposure.
  • Fried Frank contained incident, called in external experts, law enforcement, and faces lawsuits.
• Host Take & Advice:
  • Highlights the criticality of third-party/partner risk.
  • Recommends integrating supply chain breach scenarios into tabletop exercises.
  • Memorable Quote:
    "JP Morgan did nothing at all in this, yet they’re being dragged into the mud because they're a huge name." [54:42]
  • Action point: Prepare PR and incident response for third-party breaches.

8. Betterment Crypto Scam—Third-Party Marketing Compromise

[59:18]

• Details:
  • Hackers compromised a marketing provider Betterment used, sent legitimate-looking phishing emails offering to "triple your deposit" from Betterment’s subdomain.
  • Resulted in theft/scams but no core Betterment system compromise.
  • PR and client anger hits Betterment, not the marketing firm.
• Host Analysis:
  • “Perfect case study” of how third-party risk is nearly impossible to stamp out.
  • Ideal for job interviews/tabletop exercises regarding residual risk and third-party compromise.
  • Memorable Quote:
    “Betterment did nothing wrong, but because of third-party risk, all the phone calls, bad pub, flaming Twitter comments... they're all going to Betterment.” [59:54]

Memorable Quotes & Perspectives

• “This is just AI-enabled brute force scanning... It’s not the Russians putting their top talent on it.” (On Go Brute Forcer) [20:30]
• “If you’re running GOGS and it’s not Internet-facing, keep an eye out, maybe put some detections around it—shields up!” (On GOGS mitigation) [45:56]
• “Credit card theft used to be the hotness in the early 2000s; now it’s coming back like a rash.” (On SilentPush skimming op) [47:18]
• “Anytime you switch vendors for managed services, it is a project. But, yeah, I’d probably transition [away from Kaseya]. It’s pretty gross.” (On legacy RMM risk) [90:00]
• “What’s the best way to get better at riding a bike? Get on the bike and pedal.” (On rebuilding confidence in GRC) [89:00]

Community, Education & Engagement

• Worldwide Wednesday Farewell – Fun chat segment highlighting the global audience (final one due to Daft Punk copyright).
• CPE Opportunity – Each episode counts for half a CPE for certification holders.
• Jawjacking Q&A [Post-show, ~01:03:00+]
  • Covered topics: building an IAM career, job interview strategies, vendor/AI risk assessments, balancing career and life, GRC confidence resets, handshake etiquette (!), industry entry-level misnomer.

Timestamps for Key Segments

• Go Brute Forcer botnet – 17:27
• Android bug story – 23:03
• Verizon unlocking policy – 27:10
• US Military cyber command change – 30:06
• GOGS vulnerability warning – 39:53
• Web skimming attack – 46:32
• JP Morgan / Fried Frank breach – 53:57
• Betterment marketing compromise – 59:18
• Jawjacking Q&A begins – ~01:03:00

Notable Moments

• Host’s playful, community-first approach (welcoming newcomers, running sound effects).
• Frequent use of pop-culture and sports metaphors (“Randy Moss” emoji for cash grabs; “Gordon Ramsay measuring flour” for wasted AI use).
• Candid, sometimes irreverent opinions (“Verizon: this is a cash grab, not a security play!”).
• Honest risk triage: spotlighting what’s truly urgent versus what’s FUD or distraction.

Overall Tone & Takeaways

Consistently energetic, humorous, and practical. Dr. Auger blends solid technical acumen with relatable analogies and direct advice, all while fostering an inclusive, career-focused security community.

Main Message:
The technical threats are real, but your best tools remain vigilance, community, and pragmatic risk management—not panic!

For further engagement:

• Join the daily live stream: https://simplycyber.io/streams
• Explore resources, replays, and social channels at https://simplycyber.io