Cybersecurity at Machine Speed

Episode transcript

Transcript provided for accessibility and search. Minor transcription errors may remain.

SPEAKER_00 0:01

Each week we break down the biggest cybersecurity stories: emerging threats, new technologies, and the changes that matter to you. What happened, why it matters, and what to do next. This is What Matters in Cyber with your host Steve.

SPEAKER_01 0:22

Hi, I'm Steve, and welcome to What Matters in Cyber, the weekly look at the cybersecurity stories worth paying attention to, why they matter, and what I think we should learn from them. If you strip away the company names and the technical details, this week's stories are really about speed. Attackers are scanning faster, they are testing stolen credentials faster, they are using AI agents to automate work that once required much more time and expertise. But inside many organizations, the defensive process still moves at the speed of a change request, a maintenance window, and occasionally a meeting to decide whether another meeting is needed. This week we have an FBI breach reportedly linked to a security patch that was not applied. We have a global campaign targeting 40 net devices with previously stolen credentials. We have an AI agent being used in attacks against South Korean financial institutions, and on the more positive side, the Justice Department and FBI have disrupted tools used by a Chinese state-linked hacking operation. We will also look at a social engineering attack against ASOS and finish with the Monday patch list, which includes important updates from Citrix, Sonic Wall, and Cisco. So let's get into what matters this week. The first story is a particularly uncomfortable one, because the victim was the FBI. Reuters reported that the FBI removed an Accenture contractor after a breach exposed sensitive personal information belonging to thousands of Bureau employees. According to a statement from the FBI's Cyber Chief, the incident resulted from a security failure on a platform managed by a third party after a contractor failed to apply a patch that had been explicitly issued to secure it. Sources speaking to Reuters identified the affected platform as Oracle People Soft, used in connection with the FBI's job site. The Shiny Hunters group claimed it used a PeopleSoft vulnerability to gain access. The reported information exposed was not limited to names and business email addresses. It included detailed descriptions of counterintelligence roles, home addresses associated with human intelligence operatives, and medical and psychiatric records of bureau employees. That is not simply a privacy incident. It can create personal safety risks, counterintelligence risks, and opportunities for extortion or harassment. There was also a development on the law enforcement side. The FBI announced on Friday that it had arrested another suspected member of Shiny Hunters, although the person's identity and any specific charges had not been disclosed when this episode was prepared. Here is what matters. Third party responsibility does not transfer organizational accountability. You can outsource the operation of a system, you can outsource patching, you can outsource monitoring, but you cannot outsource the consequences when it fails. The right question is not simply, did the vendor say they patched it? The better questions are, what was the required completion date? What evidence confirms the patch was installed? Was the vulnerable version independently detected? And who accepted the risk while the system remained exposed? A spreadsheet with a green status box is not evidence. A scan result, a built number, and a verified control are evidence. And when the system contains information capable of putting people in danger, that distinction matters enormously. The FBI and Secret Service issued a new warning about the campaign known as 40 Bleed. The campaign targets internet facing 40Net, 40 gate firewalls, and VPN gateways. More than 86,000 exposed devices across 194 countries were reportedly identified as compromised or targeted within the operation. The important detail is that this is not being described as a new Fortinet vulnerability. Attackers are reusing credentials obtained through earlier incidents, then combining credential stuffing, password spraying, and automated scanning to identify systems they can still access. Once they get in, they may create new accounts, change passwords, or remove legitimate administrators. Some victims have reportedly found themselves locked out of their own security appliances. Access obtained through the campaign has also been connected with brokers who sell entry into organizations to ransomware affiliates. That makes this a useful reminder about something organizations often get wrong after a security incident. Patching the original vulnerability may close the door, but it does not remove someone who already copied the key. If an edge device was previously exposed or compromised, the response needs to include credential rotation, session termination, account review, configuration comparison, and checks for lateral movement. Simply installing the latest firmware and declaring victory may leave the attacker's access intact. For Fortinet customers, the practical actions are straightforward. Review every administrative and VPN account, terminate active sessions, reset credentials, enforce multi-factor authentication, look for newly created or renamed accounts, restrict external management access, and compare the current configuration with a known good version. The broader lesson applies to every firewall, VPN gateway, and remote access platform. Identity is part of the recovery process. If you fix the software but leave the stolen identity behind, you have only completed half the job. Now to the story I suspect we will be talking about for some time. CrowdStrike reported that an attacker used an AI-driven penetration testing tool called R-Tex, together with large language models and clawed code sessions in attacks against South Korean financial organizations. At least nine South Korean banks have disclosed or been reported as targets since late September. Investigators are still working to establish the complete scope, so some details may change. CrowdStrike's analysis came from attacker-controlled infrastructure that exposed configuration files, AI session histories, and memory files. The evidence showed the attacker using AI tools alongside more traditional offensive techniques to identify targets, test vulnerabilities, and support data theft. What makes this story important is not that AI invented a completely new form of attack. It did not. The attacker still needed reachable systems, exploitable weaknesses, and somewhere to send stolen data. The underlying security failures remain very familiar. The change is that an AI agent can help a relatively ordinary attacker perform more tasks more quickly, with fewer gaps in their knowledge, it can explain an error message, suggest another technique, rewrite a command, translate documentation, keep track of progress, and continue working without becoming bored at 3 in the morning. Attackers apparently have finally found the employee who never takes annual leave. The developer of RTEX said the project had been intended for legitimate security testing. Following reports of its misuse, the developer removed the public GitHub page and said future versions would become closed source. That response is understandable, but it does not solve the larger issue. Other agentic security tools already exist, and more will follow. A tool designed to automate penetration testing can also automate parts of a real intrusion when placed in the wrong hands. So the defensive response cannot be to hope these tools disappear. Organizations need to assume that external discovery, credential testing, and exploitation attempts will happen more frequently and with less warning. That increases the value of basic controls such as rapid patching, strong identity protections, network segmentation, rate limiting, useful logging and detection of unusual tool behavior. AI is not making the fundamentals irrelevant. It is making the cost of ignoring them much higher. There was some good news this week. The Justice Department and FBI announced the seizure of infrastructure connected with two tools called Microscan and Fish Hub. The tools were allegedly operated by people associated with Integrity Technology Group, a Chinese company with government contracts and links to the group commonly known as Flax Typhoon. Microscan was used for large-scale reconnaissance and vulnerability scanning, including through a botnet of compromised internet-connected devices. The reported targets included airports, universities, energy organizations, and other critical infrastructure. One of the targets was a power company in South Carolina, which makes this story feel rather less distant for those of us living here. Fish Hub supported spear phishing and the delivery of additional malware after an initial compromise. That malware could provide remote access or search for and remove selected files. This is the second public disruption of integrity tech infrastructure in two years. In 2024, authorities disrupted a botnet containing more than 200,000 compromised consumer devices. These operations matter because cyber defense is not only about helping each organization protect itself. Governments can also impose costs by seizing domains, dismantling botnets, exposing infrastructure, and forcing operators to rebuild. It will not eliminate the threat. Flax Typhoon and similar groups can create new infrastructure. But rebuilding costs money, creates delays, and can expose more of the operation to investigators. Disruption is not the same as victory, but making an attacker's work slower, more expensive, and less reliable is still worthwhile. British online retailer ISOS disclosed a breach this week after an attacker impersonated a trusted contact and obtained an employee's login credentials. Those credentials were then used to access information held on third-party platforms. The company said names and contact information were exposed, but its initial investigation found no payment card information or account passwords had been accessed. The website and app remained available. This is a smaller story than some of the others, but it is a very useful one. The attacker did not need a zero-day vulnerability. They needed an employee to believe they were speaking with someone familiar, and they needed credentials that worked on an external platform. That is why phishing resistant authentication matters. Training can reduce mistakes, but technical controls should prevent one convincing conversation from becoming sufficient authorization to access sensitive data. Trust is a human shortcut. Attackers understand that very well. Now for the Monday patch list. Three items deserve immediate attention this week. First, Citrix released updates for a critical Netscaler vulnerability identified as CV2026-107-406. The flaw can lead to remote code execution or denial of service on affected Netscaler ADC and Netscaler Gateway appliances, configured for certain SAML identity provider or service provider roles. Citrix says the issue applies to customer managed appliances. Citrix managed cloud services are being updated by the vendor. There were no public reports of active exploitation when the advisory was issued, but the affected devices frequently sit at important access points, so this is not one to leave until the next convenient quarterly window. Second, Sonic Wall patched several vulnerabilities in the SMA 1000 series. The most serious CVE 2026-102-255 carries a maximum severity score and can allow an unauthenticated attacker to cause the appliance to make requests to internal services and potentially perform unauthorized actions. Sonic Wall initially said it had no evidence of exploitation. By Friday, however, a security researcher reported seeing activity in honeypots, consistent with attempts to exploit the floor. That is not yet the same as a complete vendor-confirmed campaign, but it is more than enough reason to move quickly. Affected SMA 1000 customers should install the current hotfix and review whether the workplace interface is exposed to the internet. Remember that SonicWall's firewall products and the older SMA 100 product line are not affected by this specific issue. Third, Cisco published a substantial security hardening release for NXOS. The update addresses six vulnerability groups affecting Nexus switches, MDS switches, and several UCS fabric interconnects. Two of the issues carry severity scores of 9.8, and Cisco says there are no workarounds. Upgrading to a fixed release is the remedy. Cisco says the vulnerabilities were found through internal testing and are not known to be actively exploited. There is an interesting detail here. Cisco said the issues were discovered using its existing testing processes, together with frontier AI models. That provides a useful counterpoint to the South Korean bank story. The same class of technology that helps attackers move faster can also help defenders find weaknesses before they're exploited. The value of AI depends heavily on who is directing it, what access it has, and what controls surround it. Rather like every other powerful technology we have ever invented. My take this week is that cybersecurity has developed a speed mismatch. Attackers can scan thousands of systems, test credentials, and use AI to work through technical problems in minutes. Defenders may still need several approvals to patch an internet-facing appliance, that does not mean change control should disappear. Recklessly updating critical systems can cause its own problems. But the process has to reflect the risk. An exposed VPN appliance with a critical vulnerability cannot follow the same timetable as a low-risk internal application. A vendor-managed platform containing highly sensitive employee data cannot be governed by a monthly status report and an assumption that someone else handled the patch. And an organization recovering from a compromised edge device cannot treat installing new firmware as the end of the incident. We need faster verification, not simply faster activity. Can we prove the patch is installed? Can we prove old credentials no longer work? Can we identify every administrative account? Can we detect changes to the configuration? Can we make a high-risk security decision without waiting for the next committee meeting? Because AI may be helping attackers move at machine speed, but most of the openings they are using are still created by very human delays. That is what matters in cyber this week. If you found this useful, subscribe to What Matters in Cyber and share the episode with someone who needs a practical view of what is happening in cybersecurity and why it matters. I'm Steve. Thanks for listening, and I'll see you next week.