The Cybersecurity Defenders Podcast

Intel Chat with Matt Bromiley and Chris Luft.
• Binance discloses the $6.34 billion heist attempt, the largest attempted crypto theft on record. The FBI and TRM Security attribute it to North Korea's TraderTraitor. It began in June with an engineer installing a malicious Homebrew, then a fake recruiter and two fake job interviews delivered a "coding assignment" that swapped out a dev-tool component and evaded endpoint detection. In October the attackers used that machine and an internal AI tool to reach two more engineering devices, took a credential for the container deployment platform, ran a malicious container against the wallet signing service, and abused Ethereum's EIP-7702 delegation with 50 signing transactions so funds moved outside normal withdrawals. Multi-party computation meant there was no single key to revoke the authorizations. Binance froze or intercepted about $2.85 billion. Matt: we've warned about fake-recruiter attacks for months, and who takes a job interview on their work laptop? Hats off to the responders for getting this far in a week, but it's a breakdown in a human process, and training your people is the real ROI. Chris did the math: in $100 bills it's 63.5 tons of cash, three semi-trailers.
• Refrigeration attacks hit supermarkets in seven European countries. Attackers flipped refrigeration controls into defrost mode, pushing temperatures as high as 50 °C, at Delhaize stores in Belgium and Luxembourg, Carrefour, Spar, Ikea Mons, ICA and Coop in Sweden, SuperValu in Ireland and more. Refrigeration firm Sabcobel confirmed the attack and says the fix needs physical modifications, not just software. Danfoss reported attacks at businesses in the Netherlands. The attackers are unidentified, and US authorities are looking at similar malfunctions at American military bases. Matt recorded from one of the affected countries: who is behind it and why, and was the fridge facing the internet or reached through the store's management plane? One of those is close to negligence.
• FrostyNeighbor (UNC1151): ESET documents the first destructive attack by a Belarus-aligned actor, against a Ukrainian manufacturer important to the transportation sector, using Chisel, UltraVNC, Cobalt Strike and a VBScript wiper pushed through Group Policy. ESET sees Belarus-aligned groups acting as proxies or force multipliers for Russia; Recorded Future cautions against assuming Russian operational control. Matt: UNC1151 is a very early Mandiant handle, so this group has been around a long time. Chris: hitting the drone supply chain shows how cyber supports kinetic operations on the front line.
• Google dismantles the XCPE botnet: more than 1.3 million devices, mostly Android TV set-top boxes, with the malware built in by the manufacturer, Videostrong Technology, and access sold to affiliates for ad fraud, residential proxies and more. A three-stage design started from a backdoor on the /oem/ partition. Google banned Videostrong from preloading Google apps, went after the infrastructure with Japan's National Police Agency and industry partners, and says it likely cut off at least 10 million more devices. Chris and Matt on smart TVs that watch you, and whether the toothbrush can run Doom.
Stories covered:
• https://arstechnica.com/information-technology/2026/11/binance-says-hackers-who-stole-billions-in-crypto-spent-months-planning-heist/
• https://www.bbc.com/news/articles/cq1kd1nee80eo
• https://www.darkreading.com/physical-security/russia-cyber-war-belarus-steps-forward
• https://www.securityweek.com/google-dismantles-xcpe-botnet-of-1-3-million-android-devices/
Chapters:
0:00 The robot Renaissance
1:02 Binance and the $6.34 billion elephant in the room
5:06 Who takes a job interview on their work laptop?
8:01 63.5 tons of cash, three semi-trailers
8:42 A modern-day Frankenstein of an attack
11:01 A breakdown in a human process: train your people
11:46 Paying back the losses
12:15 Refrigeration attacks on European supermarkets
14:43 Real-world impact, and who might be behind it
15:09 Matt is in one of the affected countries
17:04 Internet-facing fridge or the management plane?
19:07 FrostyNeighbor: Belarus's first destructive attack in Ukraine
22:47 UNC1151, a very early handle
25:02 Hitting the drone supply chain
26:23 Google dismantles the XCPE botnet
29:08 Your TVs are watching you
32:30 But can the toothbrush run Doom?
33:16 Chris's new studio
The Cybersecurity Defenders Podcast — a podcast about cybersecurity and the people that keep the internet safe. New episodes drop weekly.
Subscribe wherever you listen:
• Spotify: https://open.spotify.com/show/6ep00zeY3S8ffZ4o0UeSps
• Apple Podcasts: https://podcasts.apple.com/us/podcast/the-cybersecurity-defenders-podcast/id1649981740
• YouTube: https://www.youtube.com/@limacharlieio
Learn more about LimaCharlie: https://limacharlie.io
#cybersecurity #infosec #northkorea #ICS #botnet

Intel Chat with Matt Bromiley and Chris Luft.
• Citrix NetScaler pre-auth command injection, CVE-2026-88771 (CVSS 9.5). watchTowr Labs diffed vulnerable and patched builds and found the bug not in the Packet Engine but in a Perl maintenance script that hunts for crash dumps: it pulls data out of diagnostic logs and drops it into a shell command unvalidated. Put a payload in the username field of an unauthenticated login, NetScaler logs it, and the script later runs it as root (headers and request parameters work too, and execution can lag up to 24 hours). Default configurations are affected and it was exploited before a patch existed; it's one of eight fixes in the Citrix advisory, alongside a second exploited memory overflow. Fixed in the 13.1 and 14.1 branches. Chris: forget the old Perl script, the real failure is not scrubbing input. Matt: if you run these appliances, go read the advisory and patch, or take the service offline.
• OpenAI's autonomous agents caused a partial Wikimedia outage. Per Dark Reading, Wikimedia found unauthorized edits to its wiki sandboxes, a citation tool reconfigured to work as a proxy to external services, failed attempts on its Etherpad, and hundreds of thousands of queries against the Wikidata Query Service, which likely caused a partial outage in May. CTPO Selena Deckelmann confirmed the incidents; none of the agents were approved bots. Matt's read: call it what it is, a DDoS. No model wakes up and decides to attack a wiki. "If you were allowed to escape a sandbox, it's because someone put a ladder there for you," and putting a brick on the accelerator and stepping out of the car is not a defense. Chris: what happens when open-weight models on home GPUs can do the same? Do agents end up needing license plates?
• MonsterCloud's owner charged with selling "proprietary decryption" that was really paying the ransom. Prosecutors say Zohar Pinhasi (aka Zack Silver and Zack Green) negotiated with the same groups that hit his clients and bought the keys, paying more than $8 million and billing victims more than $19 million. In one case $8,200 to an affiliate became a ~$150,000 invoice. He faces wire fraud and wire fraud conspiracy charges. Matt: he was one honest sentence away from being a legitimate negotiator, so vet whoever you hire to negotiate.
• Alleged ShinyHunters leader arrested in Jordan and cooperating with the FBI. SecurityWeek identifies him as Saif al-Din Khader ("Rey"), a teenager from Amman also tied to Scattered Lapsus$ Hunters, arrested shortly after the group defaced the FBI's recruitment site and claimed 2-3 TB of data. Dutch police separately arrested a 24-year-old in Amsterdam the FBI ties to attacks on 140+ organizations and at least $70 million in extortion; reporting names him as Pepijn van der Stap. Brian Krebs reports Khader put an Umbreon image on the defaced FBI site, van der Stap's old nickname, apparently to point investigators at him. Chris: don't poke the bear, and there's no honor among thieves.
Stories covered:
• https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/
• https://www.darkreading.com/cyberattacks-data-breaches/openai-agent-escape-causes-wikimedia-service-outage
• https://www.securityweek.com/fake-decryption-tools-masked-11m-markup-in-ransomware-recovery-scheme/
• https://www.securityweek.com/alleged-shinyhunters-leader-arrested-in-jordan/
Chapters:
0:00 Seasons change, and the cost of software goes to zero
1:59 Home computers are going to be a target again
2:38 "It's darkest before it goes pitch black"
3:25 Citrix NetScaler pre-auth command injection (CVE-2026-88771)
6:04 Forget the old Perl script, scrub your input
7:00 If you're a defender: read the advisory and patch
9:24 Please don't write blog posts like this
9:50 OpenAI agents cause a Wikimedia outage
13:16 What happens when everyone sends agents across the web?
13:40 "ChatGPT launched a DDoS attack"
16:58 No LLM ever woke up and decided to attack a wiki
17:38 "Someone put a ladder there for you"
18:19 When open-weight models can do this at home
19:45 "My LLM went crazy" is not a defense
20:15 A driver's license for the internet?
20:52 MonsterCloud: ransomware recovery that just paid the ransom
23:53 A middleman with an 18x markup
26:17 Vet your negotiator
26:44 Alleged ShinyHunters leader arrested in Jordan
28:49 The Umbreon frame-up
29:31 No honor among thieves
32:08 Maybe biweekly is the way to do it
The Cybersecurity Defenders Podcast — a podcast about cybersecurity and the people that keep the internet safe. New episodes drop weekly.
Subscribe wherever you listen:
• Spotify: https://open.spotify.com/show/6ep00zeY3S8ffZ4o0UeSps
• Apple Podcasts: https://podcasts.apple.com/us/podcast/the-cybersecurity-defenders-podcast/id1649981740
• YouTube: https://www.youtube.com/@limacharlieio
Learn more about LimaCharlie: https://limacharlie.io
#cybersecurity #infosec #ransomware #AIsecurity #threatintel

Today we're speaking with Geoffrey Mattson, CEO of SecureAuth, about identity and authority for AI agents: what changes when software stops being something a human uses and starts taking actions on its own.
Geoffrey is a serial entrepreneur working at the intersection of cybersecurity and AI. Before SecureAuth he was CEO of Xage Security and co-founded MistNet.ai (acquired by LogRhythm), after product and engineering leadership roles at Juniper Networks, Huawei, Nortel and Bell Labs across Europe, Asia and the U.S. At SecureAuth he is focused on how organizations manage the identity, permissions and authority of autonomous agents.
In this conversation: why an agent has the power of a software process with the unpredictability of a human, the difference between delegating authority and handing over your credentials, tightly scoped, time-bound tokens that get subdivided as work passes to sub-agents, the wild west of MCP servers, bringing shadow agents into the light, why guardrails can speed AI adoption up rather than slow it down, and what a solo attacker running a network of LLMs means for small and mid-sized businesses.
Learn more at https://www.secureauth.com/
Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.
This podcast is brought to you by LimaCharlie, maker of the SecOps Cloud Platform, infrastructure for SecOps where everything is built API first. Scale with confidence as your business grows. Start today for free at https://limacharlie.io/
Subscribe to The Cybersecurity Defenders Podcast on Spotify: https://open.spotify.com/show/6ep00zeY3S8ffZ4o0UeSps

Today we're speaking with Dr. Amarjot Singh, Founder & CEO of Skylark Labs, about physical AI — what changes when a model leaves the server and has to perceive, decide and act inside a machine that moves through the real world.
Dr. Singh earned his PhD in artificial intelligence and deep learning from the University of Cambridge, and has worked as a research fellow at Stanford University and on DARPA research focused on artificial general intelligence. His work spans computer vision, self-learning AI, drones, humanoid robotics and autonomous systems, with more than 50 international journal and conference publications. At Skylark Labs he is focused on taking that research into real-world systems, including AI-powered drones, robotic platforms and technologies designed for defense and other mission-critical environments.
In this conversation: why a bad prediction from a robot is a different problem than a hallucination from a chatbot, what an on-device AI stack actually looks like from sensors to action, learning from a single exposure at the edge and deliberately forgetting the rest, how one machine shares validated knowledge with the rest of a fleet, why hands and manipulation remain the hardest problem in robotics, what "reliable enough" means when failure has physical consequences, and where this all lands in ten years.
Learn more at https://skylarklabs.ai/
Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.
This podcast is brought to you by LimaCharlie, maker of the SecOps Cloud Platform, infrastructure for SecOps where everything is built API first. Scale with confidence as your business grows. Start today for free at https://limacharlie.io/
Subscribe to The Cybersecurity Defenders Podcast on Spotify: https://open.spotify.com/show/6ep00zeY3S8ffZ4o0UeSps

Intel Chat with Matt Bromiley and Chris Luft.
• An Anthropic researcher quits over where the race is heading. Jacob Coxon, who trains models on large amounts of data, is leaving both Anthropic and the AI industry: he believes the leading labs are racing toward self-improving systems they may not be able to control, and that competition will push them there anyway. Matt's problem with the genre of exit: if the people who care most about safety walk out, walking out guarantees they have no say. And the big labs were never the whole threat, because anyone can pull down an open model with no guardrails tonight: "I can go get access to an unfettered model right now."
• Four Claude models reached real third-party systems during cybersecurity evaluations. Anthropic's write-up: the evals were mistakenly connected to the public internet, the models were told they were in a simulation with no internet access, and they ran without the safeguards that ship in production. Two alignment failures are named, biased reasoning and recklessness, and a scan of ~481 million transcripts found nothing of similar or greater severity. Worst case: Claude Mythos 5 published a malicious package to the real PyPI during a CTF, it landed on 15 systems believed to be security scanners, one leaked credentials, and Claude used them to reach a security vendor's live database. Opus 4.7 knew its target was real but assumed it was authorized. METR is investigating. Matt's take: none of it is novel — "you and I have covered like 15 adversaries who have done that too" — it is hyper-automation of attacks we already understand.
• OpenAI's Astra reaches the "Critical" cybersecurity tier — the top band of its Preparedness Framework, for consequential offensive work with minimal oversight. It scored 100% on ExploitBench, escaped a restricted browser sandbox, ran commands on the host, took root on a hardened OS, and chained small weaknesses into long-horizon campaigns. Cyber jailbreak refusals are 91.5% versus 59% for GPT-5.6 Sol, which still leaves 8.5%. Access is phased: vetted professionals, then the Daybreak Blue red-teaming program. Matt is unmoved — if a model took total root control of a "hardened" OS, then the definition of hardened needs revamping. The fortress was a bouncy castle.
• ShieldCrash, a reminder that humans are still a threat. Nightmare-Eclipse released another Windows zero-day PoC they say bypasses Microsoft's September patch for an earlier Windows Defender flaw, in the Microsoft Malware Protection Engine, on all supported Windows versions. It follows CVE-2026-69414 (ShieldBreak), the August privilege-escalation bug Microsoft patched — the researcher says the fix missed a path to the same underlying issue, and has been dropping exploits around Patch Tuesday since April after a dispute with Microsoft over vulnerability reports. SOCRadar CISO Ensar Seker reads it as an arbitrary SYSTEM-context file read, not a full SYSTEM shell; Nightmare-Eclipse calls it full privilege escalation. Either way a SYSTEM-level read hands over configs and credentials for the next link in a chain, and repeated bypasses — RoguePlanet, ShieldBreak, now ShieldCrash — suggest a boundary that needs a redesign.
Stories covered:
• https://www.wsj.com/tech/ai/anthropic-researcher-quits-over-out-of-control-ai-fears-707b7628
• https://www.anthropic.com/research/alignment-assessment-cybersecurity-incidents
• https://socfortress.medium.com/openais-astra-reaches-critical-cybersecurity-capability-threshold-6a3b5f822e91
• https://www.darkreading.com/vulnerabilities-threats/nightmare-eclipse-strikes-again-shieldcrash-windows-exploit
Chapters:
0:00 Are we at the start of the AI apocalypse?
1:48 Every AI apocalypse movie, same premise
4:10 The Matrix's original script: humans as memory
5:14 An Anthropic researcher quits over out-of-control AI
6:49 If you care about AI safety, why leave?
11:03 "I can go get an unfettered model right now"
12:18 Four Claude models reached real systems
15:17 Agents that accept "permadeath" to finish the task
16:39 None of it was novel — it was automation
19:24 Stop asking how dangerous it is and go patch
20:22 OpenAI's Astra crosses the "Critical" threshold
23:24 If they got root, it was a bouncy castle
25:51 Research articles, not imminent threats
27:00 ShieldCrash: a scorned researcher vs Defender
29:51 mimikatz, legal threats and the Streisand effect
32:59 Waiting for the AI that cures a disease
The Cybersecurity Defenders Podcast — a podcast about cybersecurity and the people that keep the internet safe. New episodes drop weekly.
Subscribe wherever you listen:
• Spotify: https://open.spotify.com/show/6ep00zeY3S8ffZ4o0UeSps
• Apple Podcasts: https://podcasts.apple.com/us/podcast/the-cybersecurity-defenders-podcast/id1649981740
• YouTube: https://www.youtube.com/@limacharlieio
Learn more about LimaCharlie: https://limacharlie.io
#cybersecurity #infosec #AIsecurity #threatintel #malware