Daily Cyber Threat Brief Podcast – Ep 1096 (March 26, 2026)

Host: Dr. Gerald Auger
Podcast: Daily Cyber Threat Brief by Simply Cyber Media Group
Theme of Episode:
A speed-run breakdown of the top 8 cybersecurity news stories for March 25, 2026. The host delivers practical, sometimes opinionated analysis with career tips and an emphasis on the real-world impact of each story. Community engagement, both through live chat and shared anecdotes, infuses a sense of camaraderie, technical know-how, and a few laughs.

Episode Overview

Dr. Gerald Auger, broadcasting live from San Francisco, delivers a swift yet insightful rundown of the day's most relevant cyber news. The episode balances practical security implications for cyber professionals with real-time reactions, career guidance, and interactive community engagement. Notable for both its expert breakdowns and engaging asides, the episode covers topics including the FCC’s ban on foreign routers, kinetic attacks on cloud infrastructure, major breaches at Crunchyroll and AstraZeneca, the ongoing challenge of supply-chain attacks, and more.

Key Segments & Insights

1. [12:34] FCC Bans Foreign Routers – National Security Overreach?

• Story: The FCC updates its covered list, banning all foreign consumer-grade routers from entering the US market; existing devices are not affected.
• Host Analysis:
  • Gerald pushes back, arguing there’s no public technical evidence these routers (e.g., from TP-Link) contain malware or intentional backdoors:

    “There are so many people in our industry who do hardware hacking...you can dump the firmware and see if there is baked in malware or malicious intent.”
    [13:52]

  • Warns against policies cloaked as national security without technical backing and complains of potential negative market effects.
  • Quote:

    "This is the most ham-fisted, blunt policymaking I’ve seen in a while...This is puppycock. Complete hogwash."
    [16:44]

2. [18:19] AWS Data Center Disrupted by Physical Conflict

• Story: AWS Bahrain region disrupted due to drone activity related to the ongoing US-Israel/Iran conflict. AWS helps customers migrate to other regions.
• Implications:
  • Highlights how, for the first time, kinetic (physical) warfare directly impacts global cloud infrastructure:

    "This is at the physical layer. When you launch a kinetic explosive into a data center, it impacts the physical layer."
    [19:26]

  • Recommends organizations factor physical and environmental threats into BCDR (Business Continuity & Disaster Recovery) and risk assessment.
  • Cites NIST 800-53 physical/environmental controls.
• Memorable Moment:
  • OSI stack and Netflix as example for region redundancy.
• Quote:

  "Don't sleep on the physical environmental controls, okay? They are real controls. Shout out to NIST. I do love myself some NIST-firm."
  [23:37]

3. [24:43] Crunchyroll Support Data Leak – Ransom Rejected

• Story: Threat actor steals 100GB of customer support ticket data (~6.8 million users) from Crunchyroll via a Telus employee account; $5M ransom demand ignored.
• Host Analysis:
  • Breaks down why Crunchyroll could refuse the ransom, noting operational services were uninterrupted.
  • Uses this to underline the value of tabletop exercises for incident response readiness.
  • Pro Tip: Test your organization's ability to respond without your SME present.
• Quote:

  “You want to solve this gap and close it over tacos on a Tuesday in April—not when you’re getting punched in the mouth by Akira ransomware...”
  [28:12]

4. [30:08] US State Department Stands Up Bureau of Emerging Threats

• Story: Formal launch of a bureau to counter advanced threats (naming Iran, China, Russia, North Korea); will address cyber, quantum, AI, and space.
• Host Reaction:
  • Skeptical about need for a new bureau; feels this domain overlaps existing agency remits (NSA, DARPA, etc.).
  • Questions government allocation of resources:

    “I don’t know if we need the Department of Emerging Threats...That is the capability of the staff of DoD or the NSA.”
    [31:20]

  • Satirical aside about media press conferences and "buried headlines."

5. [41:36] Should Terrorism Risk Insurance Cover Cyber?

• Story: US Treasury seeks public comment on expanding TRIP (Terrorism Risk Insurance Program) to cover cyber-related terrorism losses.
• Host’s Take:
  • Highlights the blurry line between what counts as “terrorism” in cyber, citing examples like NotPetya, Change Healthcare, and ransomware gangs.
  • Warns that federal backstop could expose the US to enormous liability.
  • Quote:

    “These cyberattacks can scale at such a level – it exposes insurance companies to a lot of financial risk. I think the [private] insurance industry will be OK…”
    [44:18]

6. [46:52] AstraZeneca Breach Claimed by Lapsis

• Story: Lapsis claims to have stolen 3GB including credentials, tokens, application code, etc.; no ransom demand posted yet.
• Host Analysis:
  • Notes that “three gigs” is not massive, depends on data type.
  • Encourages listeners to use sector-specific breaches (e.g., pharma) to advocate for security investment.
  • Quote:

    "When there’s one that’s directly in your industry, absolutely grab that with both hands and don’t let go…"
    [50:37]

7. [53:02] K-12 EdTech Firm Infinite Campus Breached by Shiny Hunters

• Story: Salesforce account breach exposes some data; Infinite Campus insists no customer DBs were accessed; ransom deadline pending.
• Host Commentary:
  • Points out Shiny Hunters’ MO, likens them to a gang with shared tactics and tooling.
  • Emphasizes likelihood that only limited, non-student data stolen (Sales vs. operational/PII), and that reset credentials would resolve the event.
  • Quote:

    “If today was your first day in incident response, this would be a great one…it’s like, reset the creds and you won’t have PTSD from it.”
    [56:28]

8. [58:01] 81-Month Sentence for ‘Chewbacca Corp’ Ransomware Broker

• Story: Alexei Volkov, aka Chewbacca Corp, sentenced after pleading guilty to supporting Yan Lao Wang ransomware group; must pay $9.1M restitution.
• Host Reflection:
  • Applauds prosecution as a win, but doubts it will have a chilling effect on cybercrime as a whole.
  • Recaps the three main forms of ransomware approaches: encryption, data exfil, denial of service (or all three).
  • Anecdotal fun: Stories of prank voicemails with Wookiee sounds.
  • Quote:

    “More of this should happen. Let justice serve!”
    [59:05]

Career & Community Engagement

[35:19] Wayback Wednesday – Payphones & Cyber Lore

• Nostalgic aside about the days of payphones and “phreaking”—the hacking of telecom systems, referencing figures like Captain Crunch and Kevin Poulsen.
• Encourages community involvement and learning industry lore:

  “This will never be on a Security+ exam…but just know, attacking phones was called phreaking, P H R E A K I N G.”
  [37:45]

[65:00+ (Post News)] Jawjacking: Community AMA

• Wide-ranging Q&A highlights:
  • Reporting structure for CISOs (“Smaller orgs: report to CIO; larger orgs: general counsel or CEO...to avoid conflict of interest”—[80:30])
  • Perfectionism in cybersecurity: not efficient, breadth is more important than perfectionism for progress—[77:30]
  • Promotion timing: Don’t let “too soon” hold you back if leadership supports you—[75:20]
  • Tracking CPEs (Continuing Professional Education): Practical tips for alias users—[72:10]
  • AI video tool shutdown (OpenAI): Likely just resource allocation/business decision, not a sign of failure—[68:40]
  • Supply chain attacks via Python’s PyPI: Keep teams aware, monitor dependencies, have detection controls ready—[70:22]
• Memorable Moment: Multiple shoutouts to community members celebrating work anniversaries, new jobs, or “squad memberships.”

Notable Quotes

• FCC Ban on Routers: “What are you basing this law on?...Feels like authoritarian propaganda...Not a cyber story, guy.” [16:10]
• Cloud Physical Security: “Sometimes, it’s at the physical layer...you can’t restore that from backups!” [20:21]
• Tabletop Experiences: “You want to solve this gap...over tacos on a Tuesday in April—not in the middle of an Akira ransomware punch in the mouth.” [28:15]
• Emerging Threats Bureau: “Do we have budget to stand up several new bureaus?...Quantum’s almost solved already!” [33:05]
• Pharma Breach: “If you work in pharma, absolutely use this story to advocate for cybersecurity.” [50:37]
• Ransomware Broker Sentencing: “Let the system work. Let justice serve.” [59:13]

Timestamps for Key Segments

• 12:34 – FCC Bans Foreign Routers
• 18:19 – AWS Disruption by Drone Strike
• 24:43 – Crunchyroll Customer Data Breach
• 30:08 – Bureau of Emerging Threats Announced
• 41:36 – Treasury Considers Cyber Terror Insurance
• 46:52 – AstraZeneca Breach by Lapsis
• 53:02 – Infinite Campus Breach
• 58:01 – Chewbacca Corp Sentenced (Ransomware)

Jawjacking/AMA:

• 65:00+ – CISO Reporting, Perfectionism, CPEs, AI tools, Open Source Supply Chain Security, and more.

Summary

Episode 1096 brings a unique blend of skeptical industry analysis, technical guidance, and career mentorship. Dr. Auger’s hot takes on government policy and security practices are balanced by actionable advice—especially on risk assessment, incident readiness, and community engagement. The episode stands out for its real-time reactions, sector-specific tips, and the welcoming, supportive tone that is a hallmark of the Simply Cyber community.

Ideal for: Security professionals wanting quick, thoughtful takes on news, actionable career tips, and lively cybersecurity community vibes.