Daily Cyber Threat Brief - Ep 1094

Mar 23’s Top Cyber News NOW!
Host: Dr. Gerald “Jerry” Auger, Simply Cyber Media Group
Date: March 23, 2026

Episode Overview

In this candid and lightly chaotic episode (broadcast live from a makeshift San Francisco mobile studio), Jerry Auger reviews the top cybersecurity news stories affecting practitioners, analysts, and leaders today. Despite technical mishaps, Jerry offers expert insights on current threats—from botnet takeovers, ransomware targeting municipalities, Azure Monitor phishing, and AI bloat, to practical career and skill-building advice during an energetic Jawjacking AMA. Jerry’s signature humor and actionable analysis help decipher what really matters behind the headlines and how to use that knowledge to reduce cyber risk for your stakeholders.

Key Discussion Points

Janky Broadcast: Setting the Stage (00:01–12:27)

• Jerry apologizes for major technical issues with the live stream/podcast (“This might be the most janky episode I’ve ever done…today it looks like we might be at 51%”).
• Emphasizes the value of the community, the learning experience from "demo God fails", and determination to deliver insightful analysis despite audio/video setbacks.
• Shoutout to community members and encouragement to participate for CPE credit (Continuing Professional Education).

Top Cybersecurity News Stories & Expert Analysis

1. Law Enforcement Seizes Multi-Million Device Botnets (12:27–18:56)

• What Happened: US, German, and Canadian authorities dismantled the infrastructure behind four major botnets (Isuru, Kimwolf, Jack Skid, Mossad), collectively built from ~3 million compromised IoT devices—mostly cameras, routers, DVRs.
• Analysis:
  • Jerry breaks down what a botnet is and how bulletproof hosting keeps them operating.
  • Quote (14:20): “If you have a four million device botnet, you could knock out a lot of things…power, energy sector, ISP, anything.”
  • Key point: Most bots result from unchanged default credentials, and consumers rarely notice their IoT devices are compromised since functionality stays the same until weaponized.
  • Call to Action: Vendors—not consumers—should require unique credentials for every device to reduce risk.
  • TLDR: Rely less on end-user behavior; advocate for secure-by-default and better vendor accountability.

2. Ransomware Cripples Foster City, CA & Hits LA Metro (18:56–23:59)

• What Happened: Ransomware attack shuts down public services in Foster City, CA, except 911. Similar issues reported at LA Metro.
• Analysis:
  • Local and state governments are frequent targets due to underfunding and resource constraints; emergency (911) services often isolated and therefore safer.
  • Jerry criticizes decision to cancel city Zoom meetings due to “ransomware impact,” calling the logic “100% dumb” as Zoom is cloud-based and independent of local infra.
  • Policy Note: While paying ransoms is strongly discouraged, there's legal ambiguity at the state level—so payment sometimes happens (“Federal authorities strongly discourage, but that just means ‘go ahead’ in practice.”)
  • Quote (20:39): “State and local municipalities are underfunded. There's typically like one IT person doing like five jobs. No surprise they got hit.”

3. Azure Monitor Abused in Legitimate-Looking Callback Phishing Attacks (23:59–31:59)

• What Happened: Threat actors are sending phishing emails directly from Microsoft Azure Monitor, leveraging the real “azure-no-reply@microsoft.com” address, urging recipients to call a number regarding suspicious account charges.
• Analysis:
  • The attack’s power comes from its legitimacy—DMARC/DKIM/SPF all clear because the email is truly from Microsoft. Attackers likely spin up their own Azure tenant to trigger these alerts.
  • User Defense:
    • Immediate workforce education recommended: “If you get that email—don't click, don't call; instead, check your account or alert IT.”
  • Broader Implication:
    • Microsoft may struggle to filter or prevent this style of abuse given the legitimate use of its services.
  • Quote (29:30): “The real crux of this attack is it’s coming from Microsoft itself. Threat actors—you're too good.”

4. Federal PSA: Russian-Linked Phishing Campaign Targets Signal Users (37:00–43:48)

• What Happened: FBI/CISA warn of Russian intelligence-affiliated actors phishing thousands of individuals to gain access to Signal messaging accounts of high-value targets (including US officials, journalists).
• Analysis:
  • The tech (Signal’s encryption) isn’t breached; threat actors succeed by tricking people into adding attacker devices to their own Signal account (“If you’re not hacking the technology, you’re hacking the people.”)
  • Actionable Take: Train users—especially VIPs—never to trust unsolicited “help desk” calls/messages; real support will never proactively contact individuals for sensitive actions.
  • Quote (38:00): “No one from Signal support is going to proactively call you and tell you there’s a problem.”

5. Critical Vulnerabilities in Quest KACE & Oracle Identity Manager (43:48–52:55)

• Quest KACE (Enterprise Endpoint Management)

  • What: Authentication bypass flaw, patched May 2025, but one active exploitation confirmed.
  • Analysis: Patch management is supreme—if you’re unpatched 10 months later, it’s symptomatic of foundational dysfunction.
  • Quote (46:00): “If it’s that important, we have to patch it. Because if it gets exploited, we’re going to be down for days. Is that something you like, Kevin?”
  • Also, Arctic Wolf (detection company) observed the incident.

• Oracle Identity Manager

  • What: 9.8 CVSS, RCE, unauthenticated remote exploit, so far not seen exploited in the wild.
  • Analysis: Immediately prioritize patching any perimeter or security-heavy applications, “spend political capital” on the right battles (“You dilute the impact if you always go Chicken Little.”)
  • Quote (49:10): “Whenever a security technology or security-adjacent technology has a serious vulnerability, it’s a top priority. VPN, firewall, identity, money—don’t screw around with it.”

6. Microsoft Scales Back AI Copilot Bloat in Windows 11 (52:55–End of News)

• What: Microsoft dials back Copilot AI integrations in several native Windows apps after consumer pushback; more adults are concerned about AI than excited—according to recent Pew Research.
• Analysis:
  • Jerry draws parallels between today’s “AI bloat” and “bloatware” on early 2000s PCs—“clunky, obtrusive, and largely unwanted.”
  • Societal Note: Fears stem less from “Skynet” scenarios and more from anxiety about the pace of change and potential job loss.
  • Quote (53:47): “Copilot is like an AI version of Clippy…annoying and not very helpful.”

Community Engagement: Jawjacking AMA (60:30–End)

Key Topics & Notable Insights

• AI & Automation in Pentesting:

  • Discussion about TryHackMe’s AI-based “NoScope Pentesting” and whether AI can replace human pen testers.
  • Conclusion: AI augments, but can’t replace, creative human-driven pentesting—critical thinking, novel attacks, and client/business context matter.
  • Quote (73:00): “I do not think AI will replace pen testing...You’ll always need a human in the loop.”

• Solving Security Problems with Money vs. Developing People:

  • Leadership often prefers buying tools over staff training/development—easy to justify to the board and buys them “runway.”
  • Recommended strategies: Always ask about human resource commitments when adopting new tech and pitch cost–benefit arguments for internal training.

• GRC Skills and Resources for Beginners:

  • GRC career build advice—start with hands-on training (mentions Simply Cyber Academy and UNIX Guy’s GRC Mastery).
  • No one-stop “platform” for GRC labs/adversarial simulation yet.

• Soft Skills: Political Capital in Security:

  • Don’t overuse alarmist messaging (“Chicken Little”); save influence for critical hills.

• General Career Advice:

  • Encourage networking, leveraging faculty or employer support, and continued certification for career switchers.
  • For SOC analysts: learn red-team skills to better detect/defend (well-rounded defenders excel).

• Practical Life Tip:

  • Jerry’s favorite travel hack: Text your own phone number with your flight number, and smartphones will display flight status/arrival details—better than most airline apps!

• Community Shoutouts:

  • Recognition of community member “Sunshine” for key contributions to Simply Cyber’s local connections in San Francisco.

Memorable Quotes & Moments

• On Technical Snafus:
  • “If you’re new to the industry and you haven’t figured out what happens when you do demos in real life—no matter what you tested in advance—this is what a ‘demo God’ fail looks like!” (03:05)
• On Career Growth:
  • “You have to get some dirt under your fingernails before you come in talking about what’s a good idea or not.” (86:30)
• On the Overhyped AI Revolution:
  • “If you can lower expenses, that’s good for business, and your labor is the number one expense on any balance sheet. Spoiler alert.” (54:10)
• Humor:
  • “Copilot is like an AI version of Clippy. If you’re old enough to know Clippy, you know how annoying Clippy was!” (53:56)

Timestamps for Important Segments

• Technical Challenges, Episode Preface: 00:01–12:27
• Botnet Infrastructure Seized: 12:27–18:56
• Foster City/LA Ransomware Attacks: 18:56–23:59
• Azure Monitor Callback Phishing: 23:59–31:59
• Russian Signal Phishing PSA: 37:00–43:48
• Quest KACE/Oracle Vulnerabilities: 43:48–52:55
• AI/Windows Copilot Pushback: 52:55–End of News
• Jawjacking AMA: 60:30–End

Takeaways for Cybersecurity Practitioners

• Botnet Takedowns: Reinforce device credential hygiene, but also advocate for improved vendor default security.
• Municipal Ransomware: Prepare for ongoing attacks on thinly-resourced local governments; mind legal nuances about ransom payments.
• Azure/Callback Phishing: Heightened awareness and user training needed for new forms of legitimate-seeming phishing (cannot rely solely on email security checks).
• Signal Phishing: No support team should ever proactively ask for secret codes or device enrollments; security is still centered on trustworthy people.
• Critical Vulnerabilities: Patch anything enterprise/identity/security-related urgently; wield your internal influence wisely for highest-impact risks.
• AI Bloat: User pushback is real; don’t let tech enthusiasm overshadow end-user practicality or emerging societal/digital risks.
• Career Growth: Cross-train, network, and always advocate for internal skill-building—not just shiny new security tools.

Final Note:
Despite the “51% jank factor,” this episode delivered actionable, experience-rich summaries and advice for cybersecurity practitioners at all levels. Tune in live for future episodes, bring your coffee, and expect an honest, lively mix of news, analysis, and community Q&A.