CyberWire Daily

Iran threatens tech firms as hackers strike Stryker. The EU advances efforts toward digital sovereignty. A foreign hacker stumbles upon the FBI’s Epstein files. DOGE used ChatGPT to cull humanities grants. Meta claims increased efforts against scams. A Wisconsin ambulance provider discloses a data breach. CISA shortens the patch deadline for a critical SolarWinds vulnerability. We preview this year’s RSAC 2026 Innovation Sandbox with Cecilia Marinier and Paul Kocher. Dangerous digital diets miss the mark. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

On our Industry Voices segment, we share a RSAC 2026 Conference innovation preview with Cecilia Marinier and Innovation Sandbox judge Paul Kocher talking about this year's Top 10 Finalists.

Selected Reading

Iran-linked hackers claim responsibility for attack on US medical device maker Stryker (Reuters)

'Legitimate targets': Iran issues warning to US tech firms including Google, Amazon, Microsoft, Nvidia (The Times of India)

Iranian trolls are flooding social media with pro-Tehran, anti-war propaganda (MS Now)

Commission announces €75 million EURO-3C Project to build a federated Telco-Edge-Cloud infrastructure for digital sovereignty (European Commission)

Hacker broke into FBI and compromised Epstein files, report says (TechCrunch)

When DOGE Unleashed ChatGPT on the Humanities (The New York Times)

Meta says it culled millions of scam ads amid accusations that it profits from them (The Record)

Bell Ambulance Ransomware Attack Impacts Over 237,000 Individuals (Beyond Machines)

CISA Mandates Emergency Patching for SolarWinds Web Help Desk Vulnerabilities (Beyond Machines)

AI Chatbots Are Giving Teens Absolutely Terrible Diet Advice, Study Warns (Gizmodo)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.
Learn more about your ad choices. Visit megaphone.fm/adchoices

In this episode of the Microsoft Threat Intelligence Podcast, host⁠ ⁠⁠Sherrod DeGrippo is joined by Greg Schlomer and Vlad Honyanyy to discuss new research on Jasper Sleet, a North Korean–aligned threat actor incorporating AI into active operations. 

The conversation examines how AI is being integrated across the attack lifecycle — from highly tailored phishing lures and fabricated job applicant personas to accelerating malware development and refining operational workflows. Rather than treating AI as a novelty, Jasper Sleet is using it to increase speed, scale, and adaptability while reducing many of the friction points that once slowed campaigns. 

They also explore what this shift means for defenders. As AI compresses iteration cycles and lowers barriers to entry, traditional attribution signals evolve, influence operations become more convincing, and defensive teams must tighten the loop between intelligence, detection, and response. This is less about experimentation and more about the operationalization of AI as part of modern tradecraft. 

In this episode you’ll learn:      


How AI is changing the speed at which cyber operations evolve 


Why jailbreaking AI models is often trivial for motivated adversaries 


 The strategic implications of AI leveling the playing field between threat actors 

Some questions we ask:     


Is there resistance among experienced malware authors to adopting AI? 


Are we seeing fully AI-written malware in the wild? 


What stands out about Jasper Sleet’s use of AI? 

 

Resources:  

View Greg Schloemer on LinkedIn  

View Sherrod DeGrippo on LinkedIn  

 

Related Microsoft Podcasts:                   


Afternoon Cyber Tea with Ann Johnson 


The BlueHat Podcast 


Uncovering Hidden Risks     

Discover and follow other Microsoft podcasts at microsoft.com/podcasts  

Get the latest threat intelligence insights and guidance at Microsoft Security Insider 

 

The Microsoft Threat Intelligence Podcast is produced by Microsoft, Hangar Studios and distributed as part of N2K media network. 
Learn more about your ad choices. Visit megaphone.fm/adchoices

In this episode of the Microsoft Threat Intelligence Podcast, host⁠ ⁠⁠Sherrod DeGrippo is joined by Greg Schlomer and Vlad H. to discuss new research on Jasper Sleet, a North Korean–aligned threat actor incorporating AI into active operations. 

The conversation examines how AI is being integrated across the attack lifecycle — from highly tailored phishing lures and fabricated job applicant personas to accelerating malware development and refining operational workflows. Rather than treating AI as a novelty, Jasper Sleet is using it to increase speed, scale, and adaptability while reducing many of the friction points that once slowed campaigns. 

They also explore what this shift means for defenders. As AI compresses iteration cycles and lowers barriers to entry, traditional attribution signals evolve, influence operations become more convincing, and defensive teams must tighten the loop between intelligence, detection, and response. This is less about experimentation and more about the operationalization of AI as part of modern tradecraft. 

In this episode you’ll learn:      


How AI is changing the speed at which cyber operations evolve 


Why jailbreaking AI models is often trivial for motivated adversaries 


 The strategic implications of AI leveling the playing field between threat actors 

Some questions we ask:     


Is there resistance among experienced malware authors to adopting AI? 


Are we seeing fully AI-written malware in the wild? 


What stands out about Jasper Sleet’s use of AI? 

 

Resources:  

View Greg Schloemer on LinkedIn  

View Sherrod DeGrippo on LinkedIn  

 

Related Microsoft Podcasts:                   


Afternoon Cyber Tea with Ann Johnson 


The BlueHat Podcast 


Uncovering Hidden Risks     

Discover and follow other Microsoft podcasts at microsoft.com/podcasts  

Get the latest threat intelligence insights and guidance at Microsoft Security Insider 

 

The Microsoft Threat Intelligence Podcast is produced by Microsoft, Hangar Studios and distributed as part of N2K media network. 
Learn more about your ad choices. Visit megaphone.fm/adchoices

Rudd takes the helm at NSA and Cyber Command. A watchdog probes alleged Social Security data mishandling. Patch Tuesday lands. Governments brace for cyber fallout from Iran. BeatBanker spreads via a fake Starlink app. InstallFix targets developers. ZombieZIP hides malware in archives. And DHS reassigns CBP officials in a FOIA secrecy dispute. Ben Yelin unpacks Anthropic’s lawsuit against the Pentagon. AI eyewear leads to awkward exposures.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Our guest today is Ben Yelin from University of Maryland Center for Cyber Health and Hazard Strategies and Caveat cohost talking about Anthropic suing the Pentagon. You can read more on the topic here. 

Selected Reading

Senate approves Joshua Rudd as dual-hat leader of Cyber Command, NSA (POLITICO)

Whistleblower claims ex-DOGE member says he took Social Security data to new job (Washington Post)

Microsoft Patches 83 Vulnerabilities (SecurityWeek)

Adobe Patches 80 Vulnerabilities Across Eight Products (SecurityWeek)

Fortinet, Ivanti, Intel Patch High-Severity Vulnerabilities (SecurityWeek)

ICS Patch Tuesday: Vulnerabilities Fixed by Siemens, Schneider, Moxa, Mitsubishi Electric (SecurityWeek)

Iran war will bring wave of 'low-level cyber activity,' says intelligence group (StateScoop)

New BeatBanker Android malware poses as Starlink app to hijack devices (Bleeping Computer)

Fake Claude Code install guides push infostealers in InstallFix attacks (Bleeping Computer)

New 'Zombie ZIP' technique lets malware slip past security tools (Bleeping Computer)

DHS Ousts CBP Privacy Officers Who Questioned ‘Illegal’ Orders (WIRED)

Meta sued over AI smart glasses' privacy concerns, after workers reviewed nudity, sex, and other footage (TechCrunch)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.
Learn more about your ad choices. Visit megaphone.fm/adchoices

Russian hackers target Signal and WhatsApp. Permit scammers impersonate local officials. Anthropic sues over a Pentagon blacklist. The White House moves to restore fraud victims. ShinyHunters target Salesforce data. Ericsson reports a breach. macOS users face ClickFix malware. AWS credentials are phished. And CISA warns of an exploited Ivanti flaw. Our guest is Brian Baskin, Threat Researcher at Sublime Security, discussing tax season employee impersonation scams. Who fact-checks the fact-checkers? 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Our guest today is Brian Baskin, Threat Researcher at Sublime Security, discussing how tax season employee impersonation scams are conducted and what to look out for as we prepare our returns.

Selected Reading

Russia targets Signal and WhatsApp accounts in cyber campaign (AIVD)

FBI warns of phishing attacks impersonating US city, county officials (Bleeping Computer)

Anthropic sues Trump administration over Pentagon blacklist (CNBC)

White House floats Victims Restoration Program for millions affected by cyber fraud (The Record)

CybercrimeHundreds of Salesforce Customers Allegedly Targeted in New Data Theft Campaign (SecurityWeek)

Ericsson US discloses data breach after service provider hack (Bleeping Computer)

Fake CleanMyMac Site Uses ClickFix Trick to Install SHub Stealer on macOS (Hackread)

Behind the console: Active phishing campaign targeting AWS console credentials (Datadog Security Labs)

CISA: Recently patched Ivanti EPM flaw now actively exploited (Bleeping Computer)

AI fake-news detectors may look accurate but fail in real use, study finds (Tech Xplore)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show. 

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.
Learn more about your ad choices. Visit megaphone.fm/adchoices