CyberWire Daily

This week, we are joined by Ondrej Kubovič, Security Awareness Specialist from ESET, discussing their work on "FrostyNeighbor: Fresh mischief and digital shenanigans." Ondrej walks us through ESET's latest research into FrostyNeighbor, a long-running Belarus-aligned cyberespionage group that has continued to target Ukrainian government organizations with increasingly sophisticated spearphishing campaigns.

We discuss how the group uses malicious PDF lures, server-side victim validation, and an updated JavaScript-based malware chain to selectively deploy espionage tools, demonstrating its ongoing efforts to evade detection while compromising high-value targets across Eastern Europe.

The research and executive brief can be found here:

⁠FrostyNeighbor: Fresh mischief and digital shenanigans

Laundry Bear snuffles through unpatched Zimbra Collaboration servers. The State Department puts visa restrictions on cybercriminals. Oracle drops a record 1,449 security patches. Researchers disclose a critical vulnerability in OpenAI’s ChatGPT Workspace Agents. A new benchmark evaluates frontier AI model malware reverse engineering. LunchPoke uses the Notepad++ application to establish persistence. A Swiss rail manufacturer refuses to pay the ransom. Dave Bittner sits down with Maria Varmazis, host of T-Minus Space Cyber Briefing, to discuss the show's evolution into CyberWire's weekly space cyber briefing. The AI goes to space.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Dave Bittner sits down with Maria Varmazis, host of T-Minus Space Cyber Briefing, to discuss the show's evolution into CyberWire's weekly space cyber briefing. Maria shares why space cybersecurity deserves more attention, how the new format allows for deeper conversations on topics like GPS security and European space sovereignty, and why every cybersecurity professional should be paying attention to the growing role of space in cyber. You can hear part one here.

Selected Reading

Russian hackers exploit Zimbra zero-click flaw for email theft (Bleeping Computer)

State Department imposes visa restrictions on foreign cyber scammers (The Record)

Oracle drops 1,449 security patches like it's the new normal (The Register)

OpenAI Fixes ChatGPT Agent Flaw That Could Let Attackers Forge an AI Insider (SecurityWeek)

Nuclear-Sabotage Malware Benchmark Trips Up Most Frontier AI Models (SecurityWeek)

Hackers abuse Notepad++ plugins to stealthily install malware (Bleeping Computer)

Swiss train maker Stadler refuses Everest $12 million ransomware demand (The Record)

If you pay a hacker's ransom, chances are that they'll come back for more (TechCrunch)

NASA Puts Google’s Gemma Large Language Model in Orbit (IEEE Spectrum)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Google gets a billion dollar fine from the EU. The White House considers sanctions against Chinese AI developers. The GAO criticizes overlap in cyber reporting regulations. The Feds warn of Iranian agents targeting OT systems. Researchers disclose a high-severity Linux kernel vulnerability. Dolphin X uses AI profiling to find high-value victims. A new backdoor routes C2 through the browser. Check Point confirms a critical zero-day. A lawsuit accuses ChatGPT of unauthorized medical advice. Ben Yelin explains how political campaigns attempt to influence LLMs. Baseball benches the bots.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today we are joined by Ben Yelin from University of Maryland Center for Cyber Health and Hazard Strategies talking about how "Politicians Are Trying to Change What Chatbots Say About Them." If you enjoyed this conversation, be sure to check out Ben on Caveat every week.

Selected Reading

Google Hit With $1 Billion Fine for Abusing Its Power in Europe (New York Times)

US Eyes Sanctions on Chinese AI Firms Over Distillation (GovInfo Security)

Most federal cybersecurity reporting rules are duplicative, study finds (CyberScoop)

Federal agencies broaden alert on Iran-linked OT attacks (The Record)

New RefluXFS Linux flaw lets attackers gain root privileges (Bleeping Computer)

New Dolphin X Stealer Employs AI Profiling to Prioritize Targets (Infosecurity Magazine)

New msaRAT malware uses Chrome, Edge browsers to route C2 traffic (Bleeping Computer)

New Check Point Zero-Day Vulnerability Exploited in the Wild (SecurityWeek)

Lawsuit Claims ChatGPT Dished Out Dangerous Health Advice (GovInfo Security)

MLB bans using dugout iPads for AI-powered in-game strategy calls (Engadget)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

GPT escapes the sandbox and hacks Huggingface. SolarWinds patches multiple critical flaws. CISA orders patching of a critical Langflow AI vulnerability. A Paidwork breach affects over 23 million users. A recently patched SharePoint vulnerability is under active exploitation. Oracle patches over 1,400 vulnerabilities. Apps turn Smart TVs into residential proxies. The FCC considers expanding direct to satellite communications. German and U.S. authorities dismantle a major phishing-as-a-service (PhaaS) platform. Our guest is Jimmy McNary, Deputy Federal CTO at Semperis, discussing comprehensive identity security assessments for Microsoft GCC. AI models can’t resist bending the rules.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

On our Industry Voices segment, we are joined by Jimmy McNary, Deputy Federal CTO at Semperis, discussing how Purple Knight now delivers comprehensive identity security assessments for Microsoft GCC high environment.

Selected Reading

OpenAI Claims Its AI Models Went Rogue and Hacked Another Company (Infosecurity Magazine)

SolarWinds Serv-U Update Fixes 15 Critical Vulnerabilities Enabling Remote Code Execution as Root (GB Hackers)

CISA orders urgent action on actively exploited Langflow RCE flaw (Bleeping Computer)

Paidwork breach exposes data of 23 million users: Check if you're affected (Malwarebytes)

Fourth SharePoint Vulnerability Exploited in Past Month's Wave of Attacks (SecurityWeek)

Oracle Patches Over 1,400 Vulnerabilities With Quarterly Security Updates (SecurityWeek)

Chairman Carr Proposes to Expand Direct-to-Device Satellite Broadband Connectivity to Unlicensed Wireless Devices (FCC)

LG to Ban Residential Proxies from Smart TV Apps (Krebs on Security)

Police dismantle Kratos phishing platform, arrest developer (Bleeping Computer)

AI's cheatin' heart will make you weep (The Register)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Trump's latest AI leader resigns. The Army burns through its AI tokens. Scammers impersonate IC3 personnel.HollowGraph malware uses a compromised Microsoft 365 calendar for C2. Qilin ransomware targets a critical Palo Alto Networks flaw. A North Korean campaign targets Web3 and cryptocurrency professionals through fake job recruitment scams. Zimbra patches multiple critical bugs. Shadow AI creates regulatory headaches. Hackers wipe Romania’s land registry database. Our guest is Errol Weiss, Chief Security Officer at Health-ISAC, setting the record straight on ransomware trends. Patching the automotive security system you didn’t know you had.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today we have Errol Weiss, Chief Security Officer at Health-ISAC, joining us to discuss ransomware trends in the healthcare industry. We also discuss findings from the Health-ISAC 2026 CISO Benchmarking Report and Health-ISAC's 2nd Quarter Heartbeat Report, which examine the current threat landscape facing the health sector.

Selected Reading

Trump's latest AI czar has already resigned (TechCrunch)

The Army Is Burning Through Its AI Tokens (WIRED)

Fake FBI Agents Use IC3 Complaints to Target Scam Victims (Hackread)

New HollowGraph Malware Abuses Microsoft 365 Calendar for C&C Communication (SecurityWeek)

Critical Palo Alto VPN bug now exploited by Qilin ransomware gang (Bleeping Computer)

Researchers Uncover North Korean 'ClickFake' Campaign Targeting Web3 Pros (Infosecurity Magazine)

Zimbra Update Patches Critical Vulnerabilities (SecurityWeek)

Shadow AI Is Rewriting Cyber Disclosure Risk (BankInfoSecurity)

Risky Bulletin: Hacker wipes Romania's entire land registry database (Risky.Biz)

A Device Hidden in Cars Across the US Leaves Them Vulnerable to Hacking and Paralysis. Patch It Now (WIRED)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.