Podcasts about fortigate

On this week's show special guest co-host Rob Joyce joins Patrick Gray and James Wilson to discuss the week's cybersecurity news. Rob served as an advisor to Donald Trump during his first term as president and also served at NSA for 34 years. While at the agency, Joyce led Tailored Access Operations (TAO), and later became NSA's Director of Cybersecurity. They cover: The surprisingly well done Fortibleed campaign Stolen Klue OAuth tokens lead to Salesforce data theft OpenAI wants to patch the planet runZero gets acquired by Accenture, congrats HD Moore! Much, much more! This episode is also available on YouTube. Show notes FortiBleed campaign used custom FortiGate sniffer to steal credentials | BleepingComputer FortiBleed: Fortinet device credential compromise expands into broader credential-attack guidance | unit42.paloaltonetworks.com Cybercriminals allegedly hacked tens of thousands of Fortinet firewalls used by major companies all over the world | TechCrunch Security Klue OAuth breach linked to 'Icarus' Salesforce data theft attacks | BleepingComputer Polymarket (@Polymarket) on X | X (formerly Twitter) The Korean telecom giant at the center of Anthropic's Mythos controversy | wrd.cm Beyond Fable: Can a Local LLM Replace Cloud AI for Security Code Reviews - SRLabs Research | SRLabs OpenAI Launches Full-Scale Effort to Patch Open-Source Bugs as It Takes on Anthropic's Mythos | wired.com Sponsored: Trail of Bits and OpenAI patch the planet | Risky Bulletin Intel agencies: Frontier AI models will reshape cybersecurity faster than expected | cyberscoop.com Embedding Forbidden Text in Spyware to Discourage AI Analysis | Schneier on Security A new unpatchable flaw in Apple chips opens the door to an iPhone jailbreak | TechCrunch Security USB worm spreads crypto-stealing malware via Windows shortcut files | BleepingComputer Android verification is coming: Google confirms timeline and supported app stores | Ars Technica California water utility probes breach claim by Iran-linked actor | Cybersecurity Dive Suspected cyberattack triggers false emergency alerts across parts of Brazil | The Record Tesco moving 40,000 server workloads off VMware amid Broadcom's "abusive conduct" | Ars Technica Trump directs federal agencies to protect US data from quantum threats | therecord.media Accenture shells out $4.18B on three companies in big industrial cybersecurity push | cyberscoop.com

Five Eyes warns AI could supercharge cyberattacks within months. Tata Electronics confirms breach as stolen data allegedly includes Apple and Tesla documents. Researchers publish new analysis of FortiBleed. Gizmodo breach exposes readers to ClickFix malware campaign. BootROM exploit can bypass Apple's SecureROM. Scattered Spider members plead guilty in the UK. Attackers exploit Gravity SMTP flaw to harvest secrets From WordPress sites. Executive Order accelerates federal shift to post-quantum cryptography. Dave Bittner sits down with Ellen Boehm, the Senior Vice President of IoT Strategy & Operations at Keyfactor, to discuss NIST's progress in its PQC efforts. Keeping tabs on the tab-keepers. Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you'll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guest Today Dave Bittner sits down with Ellen Boehm, the Senior Vice President of IoT Strategy & Operations at Keyfactor, to discuss NIST's progress in its PQC efforts and where more effort needs to be made to get the U.S. and its critical infrastructure quantum-ready. Selected Reading 'Five Eyes' intelligence alliance warns that new AI models pose urgent cyber risk (Reuters) Intel agencies: Frontier AI models will reshape cybersecurity faster than expected (CyberScoop) Anthropic's Mythos AI broke into almost all NSA classified systems in hours (SecurityAffairs)  Tata Electronics, a major tech supplier to Apple and Tesla, confirms data breach (TechCrunch) FortiBleed campaign used custom FortiGate sniffer to steal credentials (BleepingComputer) Gizmodo readers hit with ClickFix malware prompts after account compromise (The Register) New Exploit Bypasses Apple's Boot Defenses, Affects Millions of iPhones (SecurityWeek) TFL Hackers Admit Carrying Out Cyberattack That Cost £39M (Law360) Attackers Actively Exploiting Sensitive Information Exposure Vulnerability in Gravity SMTP Plugin (Wordfence)  Trump Signs Executive Order Accelerating Post-Quantum Cryptography Migration (Security Week) Madison Square Garden Made Dossier on Activists Who Opposed Facial Recognition (404 Media) Share your feedback. What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show. Want to hear your company in the show? N2K CyberWire helps you reach the industry's most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices

Referências do EpisódioTURING DAY 2026 | 6ª EDIÇÃO - DIA 25/06A VBScript campaign distributed through WhatsApp deploying RMM softwareFortiBleed campaign used custom FortiGate sniffer to steal credentialsFrom Langflow to Monero: Inside CVE-2026-33017 CryptominerPixelSmash – Critical FFmpeg Vulnerability Turns Media Files into WeaponsDifyTap: Zafran discovers how attackers can silently wiretap AI data across tenants on a platform powering 1M+ appsRoteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

V nové epizodě CCTV NEWS se podíváme na rozsáhlý únik přístupových údajů k desítkám tisíc zařízení FortiGate označovaný jako FortiBleed a rozebereme, co o něm zatím skutečně víme. Vysvětlíme také virální tvrzení o modelu Mythos, který měl údajně proniknout do systémů NSA, a ukážeme, proč je důležitý kontext původního bezpečnostního testu. Dále se podíváme na nově zveřejněný exploit usbliter8, který zasahuje starší generace zařízení Apple a nelze jej opravit běžnou aktualizací. Na závěr přidáme krátkou aktualizaci k zranitelnosti RoguePlanet v Microsoft Defenderu, jejíž existenci Microsoft oficiálně potvrdil a pracuje na vydání opravy.

A special crossover episode of Cybersecurity Today and Hashtag Trending for June 19, 2026. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning after security researchers uncovered the FortiBleed dataset, exposing credentials tied to approximately 74,000 Fortinet firewall and SSL VPN devices across 194 countries. Researchers found the data on an exposed threat actor server containing attack tools, victim databases, logs, and thousands of verified usernames and passwords. Analysts report that tens of thousands of those credentials may still be active. Host Jim Love breaks down: • What FortiBleed is and how it was discovered • Why this affects roughly half of all internet-facing Fortinet devices • What CISA and Fortinet are telling organizations to do immediately • The potential risks of credential reuse and lateral movement attacks • Practical steps security teams should take right now The episode also includes an interview with Mike Sweeney of Silent Push on major international efforts targeting Southeast Asian scam compounds and criminal infrastructure during Operation Disruption Week. If your organization uses Fortinet firewalls, FortiGate appliances, or SSL VPNs, this is an episode you should not miss. #Cybersecurity #Fortinet #FortiBleed #CISA #CybersecurityToday #HashtagTrending #FortiGate #ThreatIntelligence #DataBreach #InfoSec

A special crossover episode of Cybersecurity Today and Hashtag Trending for June 19, 2026. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning after security researchers uncovered the FortiBleed dataset, exposing credentials tied to approximately 74,000 Fortinet firewall and SSL VPN devices across 194 countries. Researchers found the data on an exposed threat actor server containing attack tools, victim databases, logs, and thousands of verified usernames and passwords. Analysts report that tens of thousands of those credentials may still be active. Host Jim Love breaks down: • What FortiBleed is and how it was discovered • Why this affects roughly half of all internet-facing Fortinet devices • What CISA and Fortinet are telling organizations to do immediately • The potential risks of credential reuse and lateral movement attacks • Practical steps security teams should take right now The episode also includes an interview with Mike Sweeney of Silent Push on major international efforts targeting Southeast Asian scam compounds and criminal infrastructure during Operation Disruption Week. If your organization uses Fortinet firewalls, FortiGate appliances, or SSL VPNs, this is an episode you should not miss. #Cybersecurity #Fortinet #FortiBleed #CISA #CybersecurityToday #HashtagTrending #FortiGate #ThreatIntelligence #DataBreach #InfoSec

Merium Khalid, director of SOC offensive security at Barracuda Every year, security vendors publish threat reports. Most say variations of the same thing. But Barracuda’s Managed XDR Global Threat Report stands out for a reason that matters to MSPs: it’s built on operational data from a managed SOC that protects the kinds of organizations MSPs actually serve. More than two trillion IT events. Nearly 600,000 security alerts. Over 300,000 protected endpoints, firewalls, servers, and cloud assets. This isn’t a survey of sentiment. It’s a record of what actually happened. Merium Khalid, director of SOC offensive security at Barracuda, joins the podcast to walk through the findings. The headline stat — that 90 per cent of ransomware incidents exploited firewalls through unpatched vulnerabilities or compromised accounts — sets the tone, but the conversation goes deeper, including why the most commonly detected vulnerability dates back to 2013. Merium explains how attackers are abusing the same tools MSPs rely on every day — ScreenConnect, RDP, PowerShell, and in one case, Datto RMM — to move laterally while mimicking normal IT operations. As Help Net Security noted, attackers keep finding the same gaps, and Merium makes a compelling case that the 100 per cent rogue endpoint finding is fundamentally an asset management problem that doesn’t get the attention it deserves. We also cover the growing role of supply chain risk, with 66 per cent of incidents now involving a third party (up from 45 per cent the year before), and what that means for MSPs who are themselves the trusted third party for their clients. We close with Merium’s practical advice for resource-constrained security teams. Read Full Transcript Robert Dutt: Hello and welcome to In The Channel from ChannelBuzz.ca, bringing news and information to the Canadian IT solution provider community for the last 16 years now. I’m Robert Dutt, editor of ChannelBuzz.ca, and as always, your host for the show. Last month, Barracuda released its Managed XDR Global Threat Report, drawing on more than 2 trillion IT events from 2025 to map how attackers are actually getting into networks and what’s making it easier for them. Some of the numbers were striking. 90% of ransomware incidents exploited firewalls. The fastest case went from breach to encryption in three hours. And every single incident the team responded to involved at least one unprotected or rogue device on the network. Today I’m sitting down with Merium Khalid, director of SOC Offensive Security at Barracuda, to dig into what the data actually means for MSPs and the customers they protect. We’re talking about why firewalls keep failing despite years of the same advice, what it looks like when attackers hide inside the legitimate tools MSPs use every day, and where the blind spots are that most organizations don’t even know they have. So let’s get right into it. My chat with Barracuda’s Merium Khalid. Robert Dutt: Merium, thanks for joining us. Merium Khalid: Thanks, Rob. Thanks for having me. Robert Dutt: The report’s been out there for about a month or so, I guess. From your vantage point, running offensive security and in the SOC at Barracuda, what conversations has it sparked with MSPs and with their customers? What’s resonating and what are people still not taking seriously enough? Merium Khalid: Yeah, great question, Rob. So in terms of the key findings, I think that’s really what the report is focusing on, and that is really what is resonating to our MSPs and our customers and our core customers, is that there is at least one rogue device involved in any of the security incidents that we’ve worked on. And what I mean by a rogue device, it’s basically a device that’s unprotected, unmonitored within your environment. So that kind of becomes like a home or a ground for the threat actor to kind of stay and go under the radar. And I think a lot of our MSPs are finding that interesting. And I think it was one of the most shocking findings as well for us too. It’s the asset management. I don’t think asset management and making sure you are aware of all the assets in your environment, I don’t think that is emphasized enough. And I think that this report kind of makes that in the forefront. Robert Dutt: A couple of things that can certainly shape customer conversations. Merium Khalid: Yeah, for sure. Robert Dutt: One of the headline stats is that 90% of ransomware incidents exploited firewalls, often through old vulnerabilities. The most common detected vulnerability in the report dates back more than a decade, 2013. So this isn’t new advice, but why does this keep happening? Is it a tooling problem? Is it a process problem? Is it a human prioritization problem? Why do we keep running up against these old flaws as current foes? Merium Khalid: I think it’s both. I think it is a human problem, resource problem, resource gap. It’s also not having proper policies in place. It’s also just the advancements with AI as well. Being able to, threat actors are using it, being able to exploit firewalls at a faster level. And essentially what’s happening here is firewall exploitation is very, very common because it is kind of the low hanging fruit in terms of it’s usually the first public-facing asset in a customer’s environment. So you have people working remotely, so they’re VPNing into their organization’s environment. They’re using some sort of SSL VPN. And SSL VPN, I found, is to be one of the biggest root causes for ransomware attacks because we don’t have the proper tools in place. So there’s no MFA in place, or maybe there is a leaked password out there on the dark web where the account is still active, so no, there isn’t proper account management. So I think it’s not one thing that you can point at like, hey, this is a root cause and this is causing all the problems. I think it’s a combination of people, process, and technology. Robert Dutt: So if I’m an MSP and I can’t patch everything overnight, especially in multiple customers and complex environments, where should I be triaging firewall risk more intelligently? Merium Khalid: Well, prioritizing. Prioritizing what are your critical vulnerabilities? If you have a FortiGate firewall, if you have a SonicWall firewall, and there is a zero-day out there, there’s a new vulnerability out there, that is something you want to prioritize right away. But again, you need visibility for that. You need to know that there is a vulnerability out there. So with XDR, what we do is we actually release advisories. So if there is something critical out there, we try to inform our customers as soon as possible. And we have also released a managed vulnerability service as well. So we will scan your environment for any critical or low-medium vulnerabilities and prioritize it in order and give you a report of what you need to patch and how you need to patch it. So having some sort of vulnerability scanning, quarterly, monthly, yearly is very, very important, but also having some sort of visibility as well. Robert Dutt: In the report, the fastest ransomware case went from breach to encryption in about three hours, if I recall correctly, and 96% of incidents involved lateral movement that ended up in ransomware deployment. What does that timeline say about how realistic it is for an MSP security team to detect, contain, mitigate an attack manually? Merium Khalid: Even the three hours, I would say, is sufficient time because you don’t want to detect a ransomware attack after the three hours. You want to detect a ransomware attack in the beginning of the attack life cycle. So in the initial act, if they’re trying to brute force your firewall or you’re seeing some sort of suspicious login within your SSL VPN, before they even start moving laterally, you want to detect that before it happens. But again, with XDR, what I think what stands out the most for us is that we have detections across each of the attack phases. So if there is lateral movement, we want to be able to detect that. If they are using some sort of remote code execution or some sort of PsExec tool or some sort of tool to move laterally across the network, we want to be able to detect that with our endpoint detection or our server monitoring. So the three hours may seem like a short time, but it’s actually not. I think most important is detecting early on. So prior to the three hours, detecting at the first phase of the attack rather than the threat actor being there and encrypting. Robert Dutt: And those things you talked about were the earliest reliable signals that something’s going wrong, but we aren’t to the encryption point yet. Or is there another, this is the thing you should watch for first? Merium Khalid: Yeah. I mean, again, you want to watch for early signs, right? You want to watch for any sort of privilege escalation that’s happening, any sort of logins from suspicious locations, any sort of spike in your baseline behavior, any sort of brute force activity. I think those are the early signs you want to watch for. But I think the main thing I would say is monitoring. Make sure all your assets, you have server monitoring, EDR monitoring in place. Because a lot of the times, this is actually very important to the data in the report, is these customers that did get hit with Akira or RansomHub or Cactus, they had some sort of gap in the monitoring. So they did not have the full XDR suite deployed. It’s just like protecting a house. You don’t want to just protect the front door. You want to protect the back door and the windows as well. So there was some sort of gap in the monitoring, which then led to the threat actor going undetected. So the first thing you want to do is actually make sure you are monitoring everything, that you have comprehensive monitoring across your environment. And that’ll make it a lot easier to detect the threat actor in the early phases. Robert Dutt: One of the themes that stood out to me and something that I feel like I’m hearing a lot more recently is the theme of attackers abusing legitimate tools. ScreenConnect, RDP, PowerShell, even to your monitoring point, RMM tools in some cases. And these are tools that MSPs are invested in and living in every day. How should MSPs be thinking about what normal IT behavior looks like in their own network and on their clients’ networks? Merium Khalid: Yeah, I think that’s a really, really good point. So when it comes to using legitimate tools, you always want to look at who is initiating the usage of a tool. Is it an admin account or is it a service account that’s dedicated to this sort of activity for their regular operations? Usually when it’s associated with some sort of admin account, that can be indicative of malicious activity, but also you want to look at activity before and after, right? So if you have brute force activity, you have privilege escalation, any sort of activity that’s not in the norm, and then you’re seeing the use of like PsExec, RMM tools, RDP, then that could indicate some sort of attack. So I think, yes, it is a kind of tricky area or a blurry area, but that’s where your intelligence and different tactics and techniques come into play, right? So threat actors are known for using these tools so they could go under the radar. But because of that, we’ve learned from all the incident response that we’ve done the different tactics and techniques that they use. So we know what to look for and we know what is suspicious and what is maybe normal business operations. Robert Dutt: And those are the kinds of things that they should see and kind of immediately see, okay, that’s a red flag. We should drop everything and deal with this urgently. Merium Khalid: Yeah. Yeah. And I think that’s where you want to make sure you have the right skillset and the right people in place looking at your environment, right? Maybe someone from IT might not have the knowledge or the skillset to identify something that’s malicious or normal. So it’s important to have like a 24/7 SOC in place. It’s important to have your security tools in place so you have people with the right knowledge or the right experience looking at your environment. Robert Dutt: We touched earlier on the number about basically every incident involving at least one unprotected rogue endpoint. And also this report talked a lot about the number of attacks that had third party involvement, that was two thirds or so, up from less than half a year ago. Along the same note as the tools, MSPs themselves are a trusted third party to their clients. How should they be thinking about the risk that they themselves are introducing into the equation and the risk their clients’ other vendors are introducing, especially in situations where it’s a complex network? Merium Khalid: Yeah. I think when you are using a vendor, or I mean, everyone is bound to use some sort of vendor or third party tool, right? I think when you are incorporating that in your environment, it’s very, very necessary to make sure you have the right legal and compliance process to make sure that they have, they are doing the best security practices. So making sure they’re SOC 2 audited, making sure they have the right policies in place. So when you’re picking a vendor, I would say, have your legal team involved, have your compliance team involved and do a very comprehensive security review before you kind of incorporate them in your environment. Because yes, like the risk is not just for your organization, the risk carries over to how well is your third party vendor actually practicing the best security practices. Robert Dutt: For the MSP listening to this and feeling like, okay, my tools are potentially compromised, I could be introducing risks, third parties could be introducing risks. What are two or three changes that an MSP can make in what they do or how they do what they do, that would meaningfully reduce risk without blowing up their own mode of operation basically? Merium Khalid: Yeah. Yeah. So I think when it comes to key recommendations from the report, of course, there’s a long list of things you could do, but I think what’s going to have the most impact on your environment is having an audit. So auditing all your active accounts, disabling those that are no longer in use, because as I said, that could become a home for threat actors to kind of make their ground and to move laterally. Also audit devices, right? Having a strong asset management policy is very, very important. This will reduce the number of rogue devices that you have. Also having a patch management policy. So as I mentioned before, 96% of incidents that happened with ransomware, it had some sort of vulnerability or exploitation. I think if you have a patch management policy in place, you can reduce that. And I’m not saying to wait for a vulnerability or a zero-day to then implement it. I think having some sort of patch management policy on a weekly or quarterly basis is really important. And someone who’s dedicated to that in your environment. And then also, I think one of the most important things is having a robust security program to prevent these complex threats. Essentially what that means is having that full coverage across your environment. So across endpoints, servers, cloud, network appliances, email appliances, all your Microsoft 365 environments. So the top three things is auditing accounts and devices, patch management, and having visibility and a security program in place to prevent this. Robert Dutt: The report covers a lot of territory. I think we’ve walked through a lot of the areas that I was kind of most taken by. Any other major takeaways especially for this audience that you’d like to surface in terms of what you found and what it means for the solution provider or MSP? Merium Khalid: Yeah, sure. So I think one of the things I want to talk about is the report is derived from real life data. So we actually, XDR in 2025 logged more than 2 trillion IT events. And this report is derived from real life data from our customers. So 600,000 security alerts issued to our customers. And then from the 600,000, we had 53,000 high severity alerts that led to an automated threat response. So what that means is we had 53,000 high alerts that led to either blocking a firewall, disabling an account, isolating a network. So we blocked 53,000 high severity incidents that could have led to a very high scale attack in their environment. I think that’s a really important thing to emphasize. And we also protected 230,000 endpoints in 2025. So I think just one of the main things here is the data, the report is derived from real life data and real life findings and from real life engineers and analysts that are right in the forefront of these attacks. Robert Dutt: It always blows me away when we talk about security metrics and you have these sample sizes of trillions of alerts, of occurrences. It certainly adds to my awareness of that sense of potential for alert fatigue and just the overwhelm of there is so much going on. One last question for me. If MSPs remember three things from this report, from this conversation, what should they be? Merium Khalid: So three main takeaways is understanding the severity of ransomware. How devastating it can be in your environment. It could literally take your business out if it is a severe enough ransomware. Second, the importance of patch management, making sure all your assets are patched, making sure if you do have public-facing assets in your environment, prioritize that, make that your number one priority. And third, have a security monitoring solution in place. I think that really makes or breaks having the right practices. Robert Dutt: All right. I appreciate that. Thanks again for taking the time to talk through this and go through some of these results as it relates to the channel community. Greatly appreciate it. Merium Khalid: Thanks, Rob. Thanks for having me. Robert Dutt: There you have it, my chat with Merium Khalid from Barracuda. I’d like to thank Merium for sharing the findings of the report and her insights from life in the SOC. If there’s a thread running through this conversation, it’s that the threats aren’t getting more exotic, they’re getting faster. Three hours from breach to encryption, 96% of lateral movement ending in ransomware, and every single incident the team responded to involved at least one device that nobody was watching. The basics still matter. And this report makes a pretty compelling case that audit, patch, and monitor is still where it all starts. Tomorrow on In The Channel, I’m talking to Jeff Collins, CEO of WanAware, about a related problem. The blind spots that form in modern networks as AI workloads and hybrid architectures quietly reshape how traffic moves. If you’ve ever felt that you can’t quite see everything that’s happening inside a customer’s environment, that’s probably a conversation for you. Thanks for listening. I’m Robert Dutt for ChannelBuzz.ca, and I’ll see you in the channel.

Synopsis Dans l'épisode 0x288, Patrick, Richer, Francis, Steve et Jacques reçoivent Dominique Sigouin. Le fil conducteur de la discussion, c'est une vague de cyberattaques qui frappe des organisations québécoises, avec des impacts très concrets sur les opérations, la continuité des services et la préparation réelle des équipes. On revient notamment sur des incidents qui touchent une station de radio, le milieu scolaire et des entreprises, avec un constat simple: quand la préparation est faible, le retour au papier, les interruptions et les décisions improvisées reviennent vite au premier plan. L'équipe échange aussi sur l'évolution des menaces, l'automatisation de certaines attaques et la facilité avec laquelle des vulnérabilités nouvellement publiées peuvent être exploitées. En parallèle, l'épisode couvre aussi la hausse du jackpotting des guichets automatiques selon le FBI, l'exploitation active d'une faille BeyondTrust dans des attaques ransomware, ainsi que des enjeux de sécurité dans des applications Android manipulant des données sensibles. Invité Dominique Sigouin Crew Patrick Mathieu Richer Dinelle Francis Coats Steve Waterhouse Jacques Sauvé Liens et ressources Patrick Article choisir fournisseur sécurité pour les PMEs Video tiger team Francis Tuerie de Tumbler Ridge : des employés d'OpenAI ont envisagé d'alerter les autorités après des échanges troublants – entrevue Fin de la permanence à vie des fonctionnaires : Drainville, le futur Trump du Québec, selon les syndicats 20260220 - FBI Reports 1,900 ATM Jackpotting Incidents Since 2020, $20M Lost in 2025 Jacques Du vinaigre: Une véritable vague de cyber incidents! Cyberattaque au CSS du Fer: retour forcé au papier et au crayon dans les écoles Le groupe Abbatiello, propriétaire des restaurants Salvatore, victime d'une cyberattaque AI-assisted threat actor compromises Android mental health apps with 147M installs filled with security flaws Get started in cybersecurity with 53 training course deal Learn ethical hacking with this hands-on hacking course deal Train for CompTIA AWS Cisco and more with this 40 course deal This 20 CISSP course bundle helps you study for this grueling certification Steve La délocalisation de 20 000 emplois décriée par les syndicats Poland restricts Chinese-made cars at protected military sites Microsoft error sees confidential emails exposed to AI tool Copilot FIRST - AI-augmented threat actor accesses FortiGate devices at scale CISA: BeyondTrust RCE flaw now exploited in ransomware attacks Proof-of-concept (PoC) exploits for CVE-2026-1731 became available shortly after, and in-the-wild exploitation started almost immediately. Shamelessplug Join Hackfest/La French Connection Discord #La-French-Connection Join Hackfest us on Masodon POLAR - Québec - 29 Octobre 2026 Hackfest - Québec - 29-30-31 Octobre 2026 Crédits Montage audio par Hackfest Communication Music par Ender - Fierce Equanimity - Shields Up Locaux virtuels par Streamyard

AI is reshaping both sides of the cybersecurity battlefield — and fast. In this episode, we break down five stories that prove it: the first Chrome zero-day of 2026 (CVE-2026-2441), a near-perfect CVSS 9.9 in Microsoft's Semantic Kernel SDK (CVE-2026-26030), a supply chain attack on AI coding assistant Cline that silently installed autonomous agents on thousands of developer machines, the first-ever Android malware using Google's Gemini AI at runtime (PromptSpy), and a Russian-speaking threat actor who used commercial AI tools to breach over 600 FortiGate firewalls across 55 countries in just five weeks. Whether you're a developer, security professional, or just someone who uses a browser — this one's worth your time.

If you like what you hear, please subscribe, leave us a review and tell a friend!

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community.GitLab's Threat Intelligence Team published detailed findings on North Korean activity associated with the Contagious Interview campaign and broader IT worker operations.A financially motivated, Russian-speaking threat actor used generative AI tools to compromise more than 600 Fortinet FortiGate firewall instances between January and February, according to Amazon Web Services.Cisco has released emergency patches for a critical zero-day vulnerability in its Catalyst SD-WAN products that has been actively exploited in the wild.Citrini Research presents a forward-looking scenario framed as a June 2028 macro memo describing a “Global Intelligence Crisis” triggered by abundant AI-driven intelligence.Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.This podcast is brought to you by LimaCharlie, maker of the SecOps Cloud Platform, infrastructure for SecOps where everything is built API first. Scale with confidence as your business grows. Start today for free at limacharlie.io.

AWS Morning Brief for the week of March 2nd, with Corey Quinn. Links:Amazon Aurora DSQL launches Playground for interactive database exploration Amazon Redshift Serverless introduces 3-year Serverless ReservationsAmazon S3 now provides AWS source region information in server access logs AWS Compute Optimizer now applies AWS-generated tags to EBS snapshots created during automationAWS Lambda Durable Execution SDK for Java now available in Developer PreviewAWS Trusted Advisor now delivers more accurate unused NAT Gateway checks powered by AWS Compute Optimizer6,000 AWS accounts, three people, one platform: Lessons learnedPetabyte-Scale Cost Optimization: How a Video Hosting Platform Saved 70% on S3Transform live video for mobile audiences with AWS Elemental Inference Migrate Amazon EC2 to ECS Express Mode using Kiro CLI and MCP servers AI-augmented threat actor accesses FortiGate devices at scaleAWS posts “correct the record” piece on AI bot outage

Parce que… c'est l'épisode 0x716! Shameless plug 31 mars au 2 avril 2026 - Forum INCYBER - Europe 2026 14 au 17 avril 2026 - Botconf 2026 20 au 22 avril 2026 - ITSec Code rabais de 15%: Seqcure15 28 et 29 avril 2026 - Cybereco Cyberconférence 2026 9 au 17 mai 2026 - NorthSec 2026 3 au 5 juin 2026 - SSTIC 2026 19 septembre 2026 - Bsides Montréal 1 au 3 décembre 2026 - Forum INCYBER - Canada 2026 24 et 25 février 2027 - SéQCure 2027 Notes IA Confrontation DoW et Anthropic Anthropic digs in heels in dispute with Pentagon, source says Anthropic to Pentagon: Robo-weapons could hurt US troops Anthropic CEO says it cannot ‘accede' to Pentagon's demands for AI use Sam Altman says OpenAI shares Anthropic's red lines in Pentagon fight Trump admin blacklists Anthropic; AI firm refuses Pentagon demands Our agreement with the Department of War Statement on the comments from Secretary of War Pete Hegseth Anthropic Folie d'utilisation du IA Kevin Beaumont: “The incredible thing about thi…” - Cyberplace Tech Firms Aren't Just Encouraging Their Workers To Use AI. They're Enforcing It. Kevin Beaumont: “Accenture are firing people wh…” - Cyberplace Le grand remplacement IBM Shares Crater 13% After Anthropic Says Claude Code Can Tackle COBOL Modernization Infosec community panics over Anthropic Claude Code Security Long Before Tech CEOs Turned To Layoffs To Cover AI Expenses, There Was WorldCom Microsoft execs worry AI will eat entry level coding jobs AI gets good at finding bugs, not as good at fixing them Rapid AI-driven development makes security unattainable Claude Code Security Shows Promise, Not Perfection OpenClaw Google Antigravity falls to Earth under compute burden Malicious OpenClaw Skills Used to Trick Users into Manual Password Entry for AMOS Infection A Meta AI security researcher said an OpenClaw agent ran amok on her inbox The OpenClaw Hype: Analysis of Chatter from Open-Source Deep and Dark Web Sandboxes Won't Save You From OpenClaw This AI Agent Is Designed to Not Go Rogue AWS says 600+ FortiGate firewalls hit in AI-augmented attack Why the EU's AI Act is about to become every enterprise's biggest compliance challenge Detecting and preventing distillation attacks Anthropic Is AI Good for Democracy? Identity-First AI Security: Why CISOs Must Add Intent to the Equation Microsoft adds Copilot data controls to all storage locations AI models suck slightly less at math than they did last year Canadian government demands safety changes from OpenAI WA drivers reeling after passengers caught out by AI-powered safety cameras Souveraineté ou tout ce que je peux faire sur mon terrain Sovereignty in a System Prompt - POP RDI; RET; Danish government agency to ditch Microsoft software in push for digital independence US orders diplomats to fight data sovereignty initiatives Privacy ou tout ce qui devrait rester à la maison Enough Is Enough Five security lessons from the FBI's Washington Post raid Banning children from VPNs and social media will erode adults' privacy EU lawmakers propose that youth under 16 be barred from social media without parental consent Instagram to start alerting parents when children search for terms relating to self-harm Red ou tout ce qui est brisé Ransomware gangs advancing Moscow's geopolitical aims, Romanian cyber chief warns Android mental health apps with 14.7M installs filled with security flaws Discord pushes back age verification debut to 2H'26 Ransomware payment rate drops to record low as attacks surge Blue ou tout ce qui améliore notre posture Identity Prioritization isn't a Backlog Problem - It's a Risk Math Problem Windows 11 KB5077241 update improves BitLocker, adds Sysmon tool The Case for Why Better Breach Transparency Matters Some Linux LTS Kernels Will Be Supported Even Longer, Announces Greg Kroah-Hartman Collaborateurs Nicolas-Loïc Fortin Crédits Montage par Intrasecure inc Locaux réels par Intrasecure inc

On this week's show, Patrick Gray, Adam Boileau and James WIlson discuss the week's cybersecurity news. They cover: Low skill actors compromise 600 Fortinets with AI-generated playbooks Anthropic calls out Chinese AI firms over model distillation Meta's director of AI safety tells her ClawdBot not to delete her mail… so of course it does Peter Williams cops 7 years in jail for selling L3 Harris Trenchant's exploits to Russia Ivanti got hacked in 2021 via… bugs in Ivanti This episode is sponsored by line-rate network capture system Corelight. CEO Brian Dye joins to discuss what AI can do for defenders, and what it can't. This episode is also available on Youtube. Show notes AI-augmented threat actor accesses FortiGate devices at scale "this reads to me like: they ran existing tools.... but with a cool dashboard :D" Anthropic accuses Chinese labs of trying to illicitly take Claude's capabilities | CyberScoop Detecting and preventing distillation attacks Hegseth warns Anthropic to let the military use the company's AI tech as it sees fit, AP sources say Anthropic Rolls Out Embedded Security Scanning for Claude AWS's AI Coding Bot Kiro Caused a 13-Hour Outage Running OpenClaw safely: identity, isolation, and runtime risk Former Adobe, Cisco and Salesforce CISO talks AI pentesting History Repeats: Security in the AI Agent Era Meta Director of AI Safety Allows AI Agent to Accidentally Delete Her Inbox Microsoft says Office bug exposed customers' confidential emails to Copilot AI | TechCrunch The (tangential) fix: Microsoft adds Copilot data controls to all storage locations Ex-L3Harris executive sentenced to 87 months in prison for selling zero-day exploits to Russian broker Treasury Sanctions Exploit Broker Network for Theft and Sale of U.S. Government Cyber Tools Risky Bulletin: Russia starts criminal probe of Telegram founder Pavel Durov Ukraine pushes tighter Telegram regulation, citing Russian recruitment of locals The watchers: how openai, the US government, and persona built an identity surveillance machine that files reports on you to the feds Persona emails customers saying they don't work with ICE or DHS amid ‘surveillance' claims Inside the Fix: Analysis of In-the-Wild Exploit of CVE-2026-21513 Ivanti hacked in 2021 via its own product Fed agencies ordered to patch Dell bug by Saturday after exploitation warning | The Record from Recorded Future News From BRICKSTORM to GRIMBOLT: UNC6201 Exploiting a Dell RecoverPoint for Virtual Machines Zero-Day

If you like what you hear, please subscribe, leave us a review and tell a friend!

Referências do EpisódioDetecting and preventing distillation attacksDeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement LearningOpenAI suddenly thinks intellectual property theft is not cool, actually, amid DeepSeek's riseAI-augmented threat actor accesses FortiGate devices at scale | Amazon Web ServicesAI-augmented threat actor accesses FortiGate devices at scaleRoteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

V této epizodě SecurityCastu rozebíráme vyšetřování platformy X kvůli nástroji Grok, který měl generovat sexualizované obrázky skutečných osob. Podíváme se také na AI-asistovaný útok, při kterém bylo bez použití zero-day kompromitováno přes 600 FortiGate firewallů, na kritickou zranitelnost CVE-2026-22769 v Dell RecoverPoint s maximálním skóre 10.0 a na problém s tím, že přibližně 40 % Android telefonů už nedostává bezpečnostní aktualizace. Nechybí ani novinka od Anthropic, která nasazuje AI nástroj pro hledání zranitelností v kódu.

Is AI-Generated Code Secure? Xavier used the free static code analysis tool Bandit to review code he wrote with heavy AI support. https://isc.sans.edu/diary/Is%20AI-Generated%20Code%20Secure%3F/32648 Malicious Configuration Changes On Fortinet FortiGate Devices via SSO Accounts Arctic Wolf summarized some of the attacks it is seeing against FortiGate devices via the insufficiently patched SSL vulnerability. https://arcticwolf.com/resources/blog/arctic-wolf-observes-malicious-configuration-changes-fortinet-fortigate-devices-via-sso-accounts/ ISC BIND DoS vulnerability in Drone ID Records HHIT and BRID records, which are used as part of Drone ID, can be used to crash named if their length is 3 bytes. https://marlink.com/resources/knowledge-hub/isc-bind-vulnerability-discovered-and-disclosed-by-marlink-cyber/ SmarterTools SmarterMail Password Reset Vulnerability SmarterTools recently patched a trivial vulnerability in SmarterMail that would allow anybody without authentication to reset administrator passwords. https://labs.watchtowr.com/attackers-with-decompilers-strike-again-smartertools-smartermail-wt-2026-0001-auth-bypass/

Referências do EpisódioPurpleBravo's Targeting of the IT Software Supply ChainNew Phishing Campaign Targeting LastPass CustomersCisco Unified Communications Products Remote Code Execution VulnerabilityArctic Wolf Observes Malicious Configuration Changes On Fortinet FortiGate Devices via SSO AccountsRoteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Beyond RC4 for Windows authentication Microsoft outlined its transition plan to move away from RC4 for authentication and published guidance and tools to facilitate this change. https://www.microsoft.com/en-us/windows-server/blog/2025/12/03/beyond-rc4-for-windows-authentication FortiCloud SSO Login Vuln Exploited Arctic Wolf observed exploit attempts against vulnerable FortiGate appliances. https://arcticwolf.com/resources/blog/arctic-wolf-observes-malicious-sso-logins-following-disclosure-cve-2025-59718-cve-2025-59719/ FrePBX Vulnerability Horizon3.ai identified three distinct vulnerabilities in FreePBX. In particular, the authentication by-pass issue should be of concern, but default FreePBX installs do not use the vulnerable web authentication feature. https://horizon3.ai/attack-research/the-freepbx-rabbit-hole-cve-2025-66039-and-others/

If you like what you hear, please subscribe, leave us a review and tell a friend!

Wel talk about our latest integration with Wiz, more management features you may not be using, various tips and tricks related to VPNs, and an invitation to Check Point's Usability Lab.Video: Wiz + Check Point: Cloud Security Integration | Visibility + Prevention in ActionUnifying Cloud Risk and Network Defense: Wiz and Check PointThis Month's Spotlight - 3 Features You Should Start Using Today - September 2025PSA: Check Point and Palo Alto - GCM Phase 1HowTo: Configure a VPN between FortiGate & Check Pointsk108600: VPN Site-to-Site with 3rd partyBlock VPN Traffic by CountryIssue with DNS resolution in browser when connected via Check Point Mobile clientCheck Point Usability Lab

A new White House executive Order overhauls U.S. cybersecurity policy. The EU updates its “cybersecurity blueprint”. The Pentagon's inspector general  investigates Defense Secretary Hegseth's Signal messages. Chinese hackers target U.S. smartphones. A new Mirai botnet variant drops malware on vulnerable DVRs. 17 popular Gluestack packages on NPM have been compromised. Attackers exploit vulnerabilities in Fortigate security appliances to deploy Qilin ransomware. A Nigerian man gets five years in prison for a hacking and fraud scheme. Our guest is Tim Starks from CyberScoop, discussing Sean Cairncross' journey toward confirmation as the next National Cyber Director. Fire Stick flicks spark a full-on legal blitz. Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you'll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guest Today we are joined by Tim Starks from CyberScoop, to discuss Sean Cairncross, who's bringing a focus on policy coordination if confirmed as the next National Cyber Director. Selected Reading Trump Administration Revises Cybersecurity Rules, Replaces Biden Order (Infosecurity Magazine) Europe arms itself against cyber catastrophe (Politico) Pentagon watchdog investigates if staffers were asked to delete Hegseth's Signal messages (Associated Press) Chinese hackers and user lapses turn smartphones into a 'mobile security crisis' (Associated Press) iMessage Zero-Click Attacks Suspected in Targeting of High-Value EU, US Individuals (SecurityWeek) New Mirai botnet infect TBK DVR devices via command injection flaw (Bleeping Computer) Malware found in NPM packages with 1 million weekly downloads (Bleeping Computer) Hackers Actively Exploiting Fortigate Vulnerabilities to Deploy Qilin Ransomware (Cyber Security News) Nigerian Involved in Hacking US Tax Preparation Firms Sentenced to Prison (SecurityWeek) Hacked Fire Sticks now come with more than just malware – a possible jail sentence (Cybernews) Want to hear your company in the show? You too can reach the most influential leaders and operators in the industry. Here's our media kit. Contact us at cyberwire@n2k.com to request more info. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices

The Department of the Interior removes top cybersecurity and tech officials. The DOJ looks to block foreign adversaries from acquiring sensitive personal data of U.S. citizens. Microsoft issues emergency updates to fix an Active Directory bug. Hackers are installing stealth backdoors on FortiGate devices. Researchers warn of a rise in “Dangling DNS” attacks. A pair of class action lawsuits allege a major adtech firm secretly tracks users online without consent. Google is fixing a 20-year-old Chrome privacy flaw. The Tycoon2FA phishing-as-a-service platform continues to evolve. My guest is Tim Starks from CyberScoop, discussing the latest from CISA and Chris Krebs. Slopsquatting AI totally harshes the supply chain vibe.  Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you'll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guest Today we are joined by Tim Starks from CyberScoop, and he is discussing the latest with CISA and Chris Krebs. Selected Reading Interior Department Ousts Key Cyber Leaders Amid DOGE Spat (Data Breach Today) US Blocks Foreign Governments from Acquiring Citizen Data (Infosecurity Magazine) Microsoft: New emergency Windows updates fix AD policy issues (Bleeping Origin) Fortinet Issues Fixes After Attackers Bypass Patches to Maintain Access (Hackread) Dangling DNS Attack Let Hackers Gain Control Over Organization's Subdomain (Cyber Security News) Two Lawsuits Allege The Trade Desk Secretly Violates Consumer Privacy Laws (AdTech) Chrome 136 fixes 20-year browser history privacy risk (Bleeping Computer) Tycoon2FA phishing kit targets Microsoft 365 with new tricks (Bleeping Computer) AI Hallucinations Create a New Software Supply Chain Threat (SecurityWeek) Share your feedback. We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show.  Want to hear your company in the show? You too can reach the most influential leaders and operators in the industry. Here's our media kit. Contact us at cyberwire@n2k.com to request more info. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices

We appreciate the elegance of subnets as well as the power of custom benchmarking, Xboxes will support large amounts of external storage, why it's not looking great for bcachefs, malware and remote desktops, and our thoughts on Fortigate network gear.   Plugs Support us on patreon and get an ad-free RSS feed with early episodes […]

We appreciate the elegance of subnets as well as the power of custom benchmarking, Xboxes will support large amounts of external storage, why it's not looking great for bcachefs, malware and remote desktops, and our thoughts on Fortigate network gear.   Plugs Support us on patreon and get an ad-free RSS feed with early episodes... Read More

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.From earlier this week, The Docker Systems Status page reports an ongoing issue affecting Docker Desktop on macOS, where malware alerts are triggered by macOS identifying com.docker.vmnetd or com.docker.socket as potential threats. SafeBreach Labs has released a proof-of-concept (PoC) exploit for CVE-2024-49113, a critical vulnerability in the Lightweight Directory Access Protocol (LDAP) that impacts unpatched Windows Servers, including Active Directory Domain Controllers (DCs).The Halcyon RISE team has uncovered a novel ransomware campaign targeting Amazon S3 buckets, exploiting AWS's Server-Side Encryption with Customer-Provided Keys (SSE-C).A recent campaign has been targeting Fortinet FortiGate firewalls with exposed management interfaces, likely exploiting a zero-day vulnerability to gain unauthorized administrative access. Sophos recently reported on two distinct ransomware campaigns utilizing unique techniques to pressure victims and evade detection.

Cybersecurity Today: Stolen Credentials, Firewall Leaks, and Energy Sector Risks In this episode of Cybersecurity Today, host Jim Love discusses the alarming sale of thousands of credentials from leading cybersecurity vendors on the dark web, a massive leak of FortiGate firewall configuration files impacting nearly 5,000 organizations, and a major breach at education technology provider PowerSchool exposing sensitive data for millions. The episode also examines the increasing threats facing the U.S. energy sector, urging immediate action to modernize aging infrastructure and enhance cybersecurity measures. Tune in to learn more about these critical issues and how to safeguard against them. 00:00 Introduction to Cybersecurity Threats 00:16 Dark Web Credentials for Sale 01:56 FortiGate Firewall Configuration Leak 03:16 PowerSchool Data Breach 04:33 Rising Threats in the Energy Sector 06:42 Conclusion and Final Thoughts

Forecast: TikTok storm clears out as critical infrastructure takes a hit from FortiGate downpours. ‍ In this episode of Storm⚡️Watch, we explore the dramatic conclusion of TikTok's presence in the United States and its unexpected return. The saga, which began in 2019 with initial government scrutiny, culminated in a series of significant events in January 2025, including the Supreme Court's unanimous decision to uphold the federal ban law and TikTok's brief operational shutdown. We'll discuss the emergence of alternative platforms like Xiaohongshu (REDNote) in the U.S. market and examine recent security concerns, including Remy's investigation into potential backdoor vulnerabilities. The conversation then shifts to a major cybersecurity operation where the Justice Department and FBI successfully removed malware deployed by China-backed hackers using PlugX. We'll share insights from CISA Director Jen Easterly's recent comments on the Salt Typhoon campaign and their approach to tracking cyber threats. A significant portion of our discussion focuses on the FortiGate configuration leak incident. The Belsen Group's release of sensitive data from over 15,000 FortiGate devices has exposed critical infrastructure vulnerabilities across multiple countries. The leak, stemming from a 2022 authentication bypass vulnerability (CVE-2022-40684), primarily affected devices in Mexico and the UAE, with configuration files containing firewall rules, VPN credentials, and digital certificates being exposed. We wrap up with an analysis of recent Volt Typhoon activities and their implications for global cybersecurity, along with some suspicious thoughts from GreyNoise. This episode provides crucial insights into the evolving landscape of international cyber threats and the continuous challenges faced by security professionals worldwide. Storm Watch Homepage >> Learn more about GreyNoise >>  

Cybersecurity Today: High-Speed Go Library Exploits & Major Data Breaches In today's episode, host Jim Love covers recent cybersecurity threats including the exploitation of a high-speed Go library to target Microsoft 365 accounts, North Korea's Lazarus Group's new tactics to lure developers with AI-enhanced job scams, and the leak of sensitive data from over 15,000 FortiGate devices by the Belson Group. Learn more about these threats and how to protect your systems. 00:00 Hackers Exploit High-Speed Go Library to Target Microsoft 365 02:07 North Korea's Lazarus Group Targets Developers with Job Scams 04:09 Belson Group Leaks Sensitive Data from FortiGate Devices 05:58 Conclusion and Contact Information

In this episode, we start with some interesting actions by the SEC, which has been fining individuals and organizations for irresponsible disclosure practices. We'll discuss the implications of these fines and what they mean for the industry. Next, we turn our attention to another Fortigate exploit that's making headlines. We'll break down what happened, how it affects users, and what steps can be taken to mitigate the risks. We'll also cover some fascinating insights from the latest ISC2 Security Congress, where nation-state activities and their impact on global cybersecurity were hot topics. We'll share key takeaways and what they mean for cybersecurity professionals. Finally, we'll highlight the importance of co-oping and interning in the cybersecurity field. We'll explore how these experiences can shape careers, provide valuable hands-on learning, and help build a strong foundation for future success. Hosts: Ryan Hamrick & Chris DeBrunner Editor & Producer: Lance Hart Executive Producers: Gabby Scott & Jana Korfhagen Contact email: nmspod@protonmail.com  

In today's podcast we cover four crucial cyber and technology topics, including: 1.        Crypto firm extorted after data breach 2.        Fortigate dealing with Zero Day 3.        VMware pushes patch after incomplete fix 4.        US Gov proposes rule to limit data transfers internationally  I'd love feedback, feel free to send your comments and feedback to  | cyberandtechwithmike@gmail.com

In today's episode, we delve into how AI-enhanced software Meliorator was used to spread Russian disinformation on X (formerly Twitter), as detailed by the US Justice Department (DoJ). We also discuss the ViperSoftX malware disguising as eBooks on torrents, uncovered by Trellix security researchers, and examine how the new EstateRansomware group exploited a Veeam Backup Software vulnerability to launch attacks. Lastly, we cover Check Point and Morphisec's findings on zero-day vulnerabilities CVE-2024-38112 and CVE-2024-38021, and the urgency of applying Microsoft's recent patches. Video Episode: https://youtu.be/ZeL8oo0HRBY Original URLs: https://www.helpnetsecurity.com/2024/07/10/russian-disinformation-x/ https://thehackernews.com/2024/07/vipersoftx-malware-disguises-as-ebooks.html https://thehackernews.com/2024/07/new-ransomware-group-exploiting-veeam.html https://www.helpnetsecurity.com/2024/07/10/cve-2024-38112-cve-2024-38021/ Sign up for digestible cyber news delivered to your inbox: news.thedailydecrypt.com Thanks to Jered Jones for providing the music for this episode. https://www.jeredjones.com/ Logo Design by https://www.zackgraber.com/ Tags: Russian disinformation, AI-enhanced software, Meliorator, social media bot farms, US Justice Department, domain seizure, digital army, fake personas, propaganda, ViperSoftX, malware, eBooks, torrent sites, Common Language Runtime, AutoIt, PowerShell commands, EstateRansomware, Veeam Backup & Replication, FortiGate firewall, vulnerability, ransomware attack, Check Point Research, Windows, CVE-2024-38112, Microsoft, patch, remote code execution, deceptive .url files, cyber threats. Search Phrases: Russian disinformation bot farms AI-enhanced software in social media How Meliorator spreads fake news Protect against ViperSoftX malware Ransomware exploiting Veeam vulnerability FortiGate firewall security flaw Latest cyber threats Check Point Research CVE-2024-38112 vulnerability details Microsoft's latest security patch Prevent remote code execution attacks

Episode 0x79 We have no idea what's going on either... But we're going to keep doing this as long as we can manage to schedule the appointment in our calendars and also show up... Upcoming this week... Lots of News Breaches SCADA / Cyber, cyber... etc. finishing it off with DERPs/Mailbag (or Deep Dive) And there are weekly Briefs - no arguing or discussion allowed And if you've got commentary, please sent it to mailbag@liquidmatrix.org for us to check out. DISCLAIMER: It's not that explicit, but you may want to use headphones if you're at work. ADDITIONAL DISCLAIMER: In case it is unclear, this is the story of 5 opinionated infosec pros who have sufficient opinions of their own they don't need to speak for anyone except themselves. Ok? Good. In this episode: News and Commentary Apple's AI Announcements - Private Cloud Compute But is it ok that there's no money going back and forth... so we are the product? Snowflake to Close Hacking Probe Into Attack Targeting Clients Breaches Chinese hackers breached 20,000 FortiGate systems worldwide DERP Major Data Breach New Section: Jamie Yells at Clouds PLG motion with Enterprise Customers and pushing your AI Feature Set - I'm tired of getting the requests to turn it on and it comes with vague pricing issues. Seriously... so tired. If you want to sell to your Enterprise Customers, how about you have a conversation with the person who signs the OF instead of the people who can't. ARGH. Briefly -- NO ARGUING OR DISCUSSION ALLOWED Bambu Lab Second Anniversary Sale - join us in the melty plastic revolution! Medical-Targeted Ransomware Is Breaking Records After Change Healthcare's $22M Payout China state hackers infected 20,000 Fortinet VPNs, Dutch spy service says Upcoming Appearances:  -- more gratuitous self-promotion Dave: - In will be speaking at the CIO Summit in Toronto James: - Still the forest. I need a break so bad, July can't get here soon enough. Matt:  - Europe - I'M ON A BREAK -- then Vegas... Closing Thoughts Seacrest Says: Have you made your plans for the Solstice? Go long or go short - depends on your latitude. Creative Commons license: BY-NC-SA

We kick off with a report from BleepingComputer about Ov3r_Stealer malware, a devious program disseminated through Facebook job ads, illustrating the ever-present dangers lurking on social media. Then, we pivot to a strategic cyber assault attributed to Chinese hackers exploiting a FortiGate vulnerability to breach Dutch military defenses, as detailed by The Hacker News. Wrapping up, we delve into the Linux world, confronting a dire remote code execution flaw in the shim bootloader that threatens every distribution supporting Secure Boot, a saga reported by Dark Reading and the NVD. Tune in to decrypt the complexities of cybersecurity in our digital age. Ov3r_Stealer Malware Alert: Read more at BleepingComputer Dutch Military Cyber Breach: Read more at The Hacker News Linux Bootloader Vulnerability Exposed: NVD CVE-2023-40547 & Dark Reading Article

Ryan from Bishop Fox joins to describe their work on "Building an Exploit for FortiGate Vulnerability CVE-2023-27997." After Lexfo published details of a pre-authentication remote code injection vulnerability in the Fortinet SSL VPN, Bishop Fox worked up a proof of concept demo. This research share how they were able to create that proof-of-concept exploit, step by step. The researchers state "Our debugging environment consisted of a FortiGate 7.2.4 virtual machine which we modified to disable some self-verification functionality. After bypassing these integrity checks, we were able to install an SSH server, BusyBox, and debugging tools such as GDB." The research can be found here: Building an Exploit for FortiGate Vulnerability CVE-2023-27997

In this episode of Conf T with your SE, host Bryan Young welcomes special guest Steve Staurovsky from Fortinet. They start by discussing their previous meeting at the CT NUG event and the wide range of products in Fortinet's portfolio. The importance of interoperability and collaboration with other vendors in the industry is highlighted. Steve emphasizes the need for securing operational technology (OT) environments, especially in industrial and healthcare settings, where secure access and data transmission are crucial. The conversation then shifts to the challenges of securing and updating machines in the manufacturing industry that are connected to the network but cannot be easily updated due to their age. The speakers stress the importance of keeping these assets online and the difficulties in finding replacements or compatible hardware. They also discuss the lack of interaction between IT and OT, the vulnerabilities created by preventative maintenance schedules and legacy applications, and the increasing sophistication of ransomware attacks. Fortinet's EDR product is mentioned as a solution for securing legacy devices such as old versions of Windows. The need for legacy asset support is further emphasized through a story about a critical asset running on an outdated system. Fortinet's ability to run on unsupported assets and provide peace of mind is highlighted. The conversation then moves on to Fortinet's FortiLink feature, which enables traffic routing through the firewall, offering advantages in terms of defense in depth strategy and flexibility. The evolution of FortiGate firewall from separate boxes for different functions to a single integrated solution is discussed, along with the variety of hardware sizes, feature sets, and licensing options available. The speakers then delve into the cycle of expansion and contraction in IT, from mainframes and terminals to the current cloud services and multiple clouds. They touch on the increasing need for processing power and how the cloud addresses this demand. The conversation takes a nostalgic turn as they reminisce about gaming, specifically playing Unreal Tournament and attending a LAN party at the Rochester Institute of Technology. Fortinet's free training and certification program, offered during the pandemic, is mentioned, with praise for its high quality and polished production. The importance of using correct terminology in the IT industry is emphasized, along with a personal anecdote about using the correct terms with a doctor. The discussion briefly touches on Chromebooks and the speaker's experience with an original CR-48 Chromebook from Google. The speakers stress the significance of understanding and using the correct terminology in IT and networking, highlighting its impact on communication and professionalism. They also mention the benefits of having knowledge in electrical systems within the IT industry. The conversation veers towards programming and its integration into networking, mentioning the use of Postman and sharing their experiences with programming tasks. They conclude by briefly mentioning upcoming merchandise related to their podcast and recommending checking out Fortinet's training and certification at training.fortinet.com. The features of FortiGates, including the use of custom ASICs for better performance and lower power requirements, are discussed. The issues with the supply chain and its impact on product availability are touched upon, with an overall optimistic outlook for improvement. The cloud management capabilities of Fortinet's products are then explored, with a focus on FortiManager. The speaker explains how FortiManager allows centralized management and logging of devices, making changes and ensuring synchronization across multiple devices easier. The ability to templatize network configurations for scalability and automation is mentioned, along with the advantages of using FortiManager compared to manual device configuration. The availability of an Ansible playbook for automation is highlighted, and the importance of training to fully utilize Fortinet's offerings is emphasized. The diverse portfolio of Fortinet beyond the well-known FortiGate firewall is mentioned, and listeners are encouraged to explore their products. The episode concludes with an invitation to join the CT Network Users Group's Discord channel and to review and share the show.   Links Discord: https://discord.conft.show Fortinet Training: https://training.fortinet.com

Wireless pros sit at the intersection of networking and security. On today's Heavy Wireless, sponsored by Fortinet, Keith Parsons and guest Ben Wilson discuss this convergence, why visibility into the WLAN and device identity are essential, how Fortinet integrates its Fortigate firewalls with wired and wireless neteworks for unified management and policy enforcement, and more.

Wireless pros sit at the intersection of networking and security. On today's Heavy Wireless, sponsored by Fortinet, Keith Parsons and guest Ben Wilson discuss this convergence, why visibility into the WLAN and device identity are essential, how Fortinet integrates its Fortigate firewalls with wired and wireless neteworks for unified management and policy enforcement, and more. The post Heavy Wireless 007: Why Networking And Security Convergence Is Important For Wireless Pros (Sponsored) appeared first on Packet Pushers.

Wireless pros sit at the intersection of networking and security. On today's Heavy Wireless, sponsored by Fortinet, Keith Parsons and guest Ben Wilson discuss this convergence, why visibility into the WLAN and device identity are essential, how Fortinet integrates its Fortigate firewalls with wired and wireless neteworks for unified management and policy enforcement, and more.

Wireless pros sit at the intersection of networking and security. On today's Heavy Wireless, sponsored by Fortinet, Keith Parsons and guest Ben Wilson discuss this convergence, why visibility into the WLAN and device identity are essential, how Fortinet integrates its Fortigate firewalls with wired and wireless neteworks for unified management and policy enforcement, and more. The post Heavy Wireless 007: Why Networking And Security Convergence Is Important For Wireless Pros (Sponsored) appeared first on Packet Pushers.

On this week's show Patrick Gray and Adam Boileau discuss the week's security news. They cover: The SEC is targeting SolarWinds executives UK to make banks liable for fraud NSA issues advice on UEFI trojan Microsoft blocks 100+ dodgy drivers The US IC knew what Prihozhin was up to. But what FSB doing? Much, much more This week's show is brought to you by Netwrix. Martin Cannard, Netwrix's VP of Product Strategy, is this week's sponsor guest. He talks about why zero standing privilege is a worthy goal. Links to everything that we discussed are below and you can follow Patrick or Adam on Mastodon if that's your thing. Show notes SEC notifies SolarWinds CISO and CFO of possible action in cyber investigation | Cybersecurity Dive While Australian banks refuse most scam victims refunds, the UK is making them mandatory - ABC News New law could allow GCHQ to monitor UK internet logs in real-time to tackle fraud Federal incentives could help utilities overcome major cybersecurity hurdle: money | CyberScoop Major Japanese port suspends operation following ransomware attack Petro-Canada reports service restoration after suspected Suncor breach | Cybersecurity Dive Chinese state-backed hackers accidentally infected a European hospital with malware Hackers exploit gaping Windows loophole to give their malware kernel access | Ars Technica 336,000 servers remain unpatched against critical Fortigate vulnerability | Ars Technica CISA says latest VMware analytics bug being exploited MOVEit vulnerability snags almost 200 victims, more expected | Cybersecurity Dive Actively exploited vulnerability threatens hundreds of solar power stations | Ars Technica U.S. intelligence learned in mid-June Prigozhin was plotting uprising - The Washington Post Russian election-meddling ‘troll factory' reportedly shut down after Wagner revolt Russian telecom confirms hack after group backing Wagner boasted about an attack | CyberScoop Hackers claim to take down Russian satellite communications provider Russian railway site allegedly taken down by Ukrainian hackers Several US states investigating ‘SiegedSec' hacking campaign Hacking crew targeting states over transition bans claims cyberattack hitting global satellite systems | CyberScoop Hacktivists steal government files from Texas city Fort Worth | TechCrunch Belarusian hacktivists сlaim to breach country's leading state university British prosecutors say teen Lapsus$ member was behind hacks on Uber, Rockstar Silk Road's Second-in-Command, Variety Jones, Gets 20 Years in Prison | WIRED Russian cyber expert arrested in Kazakhstan, triggering a showdown between US and Moscow More than 6,500 arrested since French and Dutch police's EncroChat hack BreachForums seized by FBI three months after arrest of alleged admin BreachForums replacement emerges as robust forum for criminal hackers to trade their spoils | CyberScoop Genesis Market gang tries to sell platform after FBI disruption Hackers using TrueBot malware for phishing attacks in US, Canada, officials warn | Cybersecurity Dive CSI_BlackLotus_Mitigation_Guide.PDF Hacks targeting British exam boards raise fears of students cheating More than $125 million taken from crypto platform Multichain Twitter's chaotic weekend of outages and rate limits leaves more questions than answers Mastodon fixes critical “TootRoot” vulnerability allowing node hijacking | Ars Technica

On this week's show Patrick Gray and Adam Boileau discuss the week's security news. They cover: The SEC is targeting SolarWinds executives UK to make banks liable for fraud NSA issues advice on UEFI trojan Microsoft blocks 100+ dodgy drivers The US IC knew what Prihozhin was up to. But what FSB doing? Much, much more This week's show is brought to you by Netwrix. Martin Cannard, Netwrix's VP of Product Strategy, is this week's sponsor guest. He talks about why zero standing privilege is a worthy goal. Links to everything that we discussed are below and you can follow Patrick or Adam on Mastodon if that's your thing. Show notes SEC notifies SolarWinds CISO and CFO of possible action in cyber investigation | Cybersecurity Dive While Australian banks refuse most scam victims refunds, the UK is making them mandatory - ABC News New law could allow GCHQ to monitor UK internet logs in real-time to tackle fraud Federal incentives could help utilities overcome major cybersecurity hurdle: money | CyberScoop Major Japanese port suspends operation following ransomware attack Petro-Canada reports service restoration after suspected Suncor breach | Cybersecurity Dive Chinese state-backed hackers accidentally infected a European hospital with malware Hackers exploit gaping Windows loophole to give their malware kernel access | Ars Technica 336,000 servers remain unpatched against critical Fortigate vulnerability | Ars Technica CISA says latest VMware analytics bug being exploited MOVEit vulnerability snags almost 200 victims, more expected | Cybersecurity Dive Actively exploited vulnerability threatens hundreds of solar power stations | Ars Technica U.S. intelligence learned in mid-June Prigozhin was plotting uprising - The Washington Post Russian election-meddling ‘troll factory' reportedly shut down after Wagner revolt Russian telecom confirms hack after group backing Wagner boasted about an attack | CyberScoop Hackers claim to take down Russian satellite communications provider Russian railway site allegedly taken down by Ukrainian hackers Several US states investigating ‘SiegedSec' hacking campaign Hacking crew targeting states over transition bans claims cyberattack hitting global satellite systems | CyberScoop Hacktivists steal government files from Texas city Fort Worth | TechCrunch Belarusian hacktivists сlaim to breach country's leading state university British prosecutors say teen Lapsus$ member was behind hacks on Uber, Rockstar Silk Road's Second-in-Command, Variety Jones, Gets 20 Years in Prison | WIRED Russian cyber expert arrested in Kazakhstan, triggering a showdown between US and Moscow More than 6,500 arrested since French and Dutch police's EncroChat hack BreachForums seized by FBI three months after arrest of alleged admin BreachForums replacement emerges as robust forum for criminal hackers to trade their spoils | CyberScoop Genesis Market gang tries to sell platform after FBI disruption Hackers using TrueBot malware for phishing attacks in US, Canada, officials warn | Cybersecurity Dive CSI_BlackLotus_Mitigation_Guide.PDF Hacks targeting British exam boards raise fears of students cheating More than $125 million taken from crypto platform Multichain Twitter's chaotic weekend of outages and rate limits leaves more questions than answers Mastodon fixes critical “TootRoot” vulnerability allowing node hijacking | Ars Technica

336,000 servers remain unpatched against critical Fortigate vulnerability Patchless Cisco flaw breaks cloud encryption for ACI traffic Google changed its privacy policy to reflect Bard AI's data collecting Top 10 cybersecurity findings from Verizon's 2023 data breach report Ron Reiter, Co-Founder and CTO of Sentra talks data security and improving your Security Posture. Host: Louis Maresca Guest: Ron Reiter Download or subscribe to this show at https://twit.tv/shows/this-week-in-enterprise-tech. Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit Sponsors: discourse.org/twit cs.co/twit bitwarden.com/twit

Fortinet is a security vendor most of you have heard of. But if all you think of when you hear the name “Fortinet” is firewalls, well yeah, but you should think more broadly. On today's sponsored Heavy Networking we're going after the work-from-anywhere challenge with Fortinet's Zero Trust Network Access (ZTNA) and Secure Access Service Edge (SASE) tech, all of which is baked into FortiOS. If you're running a FortiGate, you've got these capabilities already.

Fortinet is a security vendor most of you have heard of. But if all you think of when you hear the name “Fortinet” is firewalls, well yeah, but you should think more broadly. On today's sponsored Heavy Networking we're going after the work-from-anywhere challenge with Fortinet's Zero Trust Network Access (ZTNA) and Secure Access Service Edge (SASE) tech, all of which is baked into FortiOS. If you're running a FortiGate, you've got these capabilities already. The post Heavy Networking 676: Implementing ZTNA And SASE With Fortinet (Sponsored) appeared first on Packet Pushers.

Fortinet is a security vendor most of you have heard of. But if all you think of when you hear the name “Fortinet” is firewalls, well yeah, but you should think more broadly. On today's sponsored Heavy Networking we're going after the work-from-anywhere challenge with Fortinet's Zero Trust Network Access (ZTNA) and Secure Access Service Edge (SASE) tech, all of which is baked into FortiOS. If you're running a FortiGate, you've got these capabilities already.

Fortinet is a security vendor most of you have heard of. But if all you think of when you hear the name “Fortinet” is firewalls, well yeah, but you should think more broadly. On today's sponsored Heavy Networking we're going after the work-from-anywhere challenge with Fortinet's Zero Trust Network Access (ZTNA) and Secure Access Service Edge (SASE) tech, all of which is baked into FortiOS. If you're running a FortiGate, you've got these capabilities already. The post Heavy Networking 676: Implementing ZTNA And SASE With Fortinet (Sponsored) appeared first on Packet Pushers.