You're listening to the Cyber Wire Network, powered by N2K. Spotify Advertising connects you with an audience that's engaged and ready to discover your brand. Launch a campaign with Spotify Ads Manager. Locked Shields wraps another year. Open Models challenge Mythos. CISA tracks Firestarter inside a federal agency. The White House targets foreign AI model extraction. Microsoft lets admins remove Copilot. Treasury sanctions a Cambodian scam compound senator. Breeze Cash rushes a patch. Researchers downplay OT malware hype, while NIST pushes for better OT visibility. Our guest is Eric Russo, Director of Sock Defensive Security at Barracuda, discussing the risks posed by employees downloading pirated software. And con artists charge crypto for counterfeit clearance.
It's Friday, April 24th, 2026. I'm Dave Bittner, and this is your CyberWire Intel Briefing. Thanks for joining us here today. Happy Friday. It is great as always to have you with us.
Locked Shields 2026, the world's largest live-fire cyber defense exercise, concluded Friday in Tallinn, Estonia, after convening more than 4,000 participants from 41 nations. Organized by NATO's Cooperative Cyber Defense Center of Excellence, the exercise simulated sustained cyber attacks against critical infrastructure and military systems, including air defense networks and e-voting platforms, while also testing responses to disinformation and political pressure. Officials said participants demonstrated strong detection and response capabilities. but emphasize the importance of turning lessons learned into real-world readiness as artificial intelligence reshapes cyber operations. Sixteen multinational teams competed, with top performers including France and Sweden, Latvia and Singapore, and Germany, Austria, Luxembourg, and Switzerland. The exercise has grown significantly since its 2010 debut, which involved only four nations and 60 participants.
At Black Hat Asia in Singapore, Run Seibel CEO Ari Herbert Voss said, open-source AI models can identify software vulnerabilities as effectively as Anthropik's restricted Mythos system when used together in coordinated workflows. He attributed Mythos' strength to superlinear scaling, where doubling training resources can produce disproportionately greater capability. However, he argued organizations can approximate similar performance by combining multiple open-source models, which also improves coverage because different systems detect different flaws. cost, and limited access further strengthen the case for open alternatives. Herbert Voss emphasized that human expertise remains essential to coordinate models and evaluate findings, noting AI bug hunting tools generate large volumes of alerts, similar to traditional fuzzing. He expects economic pressure to adopt AI-driven security tools will continue to push organizations toward broader use of automated vulnerability discovery.
The Cybersecurity and Infrastructure Security Agency said a U.S. federal civilian executive branch agency was breached in September of last year through vulnerabilities in Cisco adaptive security appliance software with attackers deploying Firestarter malware to maintain long-term access. The backdoor allowed threat actors to regain entry in March of this year without re-exploiting the original flaws. Investigators also identified LineViper malware, which enabled unauthorized virtual private network sections that bypassed authentication and exposed credentials and keys. CISA warned that patching alone does not remove the threat if persistence is already established. The agency issued updated directives requiring federal agencies to check for compromise and inventory-affected devices. Officials have not attributed the campaign, though earlier reporting linked activity to actors aligned with China's state interests.
The Trump administration is moving to counter what it describes as foreign extraction of U.S. artificial intelligence capabilities, focusing primarily on China. In a memo, White House science advisor Michael Kratos accused China-based entities of conducting large-scale distillation efforts to replicate features of leading American AI systems. The administration said it will work with U.S. companies to detect such activity, strengthen defenses, and pursue penalties. The move comes as analysts report the performance gap between U.S. and Chinese AI models has narrowed significantly.
Lawmakers are advancing bipartisan legislation to identify and sanction actors involved in model extraction. U.S. firms including OpenAI and Anthropic have also raised concerns about Chinese labs using distillation techniques, though experts note distinguishing unauthorized activity from legitimate use remains technically difficult. Microsoft has introduced a new policy setting that allows enterprise IT administrators to uninstall the Copilot AI Assistant from managed Windows devices following the April 2026 Patch Tuesday updates. The Remove Microsoft Copilot App policy applies to Windows 11 systems under specific conditions and is available through Microsoft Intune and System Center Configuration Manager. The change affects enterprise, professional, and education additions, and users can reinstall Copilot if desired.
Microsoft also recently paused automatic co-pilot deployments and previously addressed a bug that exposed confidential email summaries despite data loss prevention controls. The U.S. Treasury Department sanctioned Cambodian Senator Kok An and 28 associates for operating scam compounds linked to millions of dollars in losses to American victims. Officials said the network used casinos and office complexes to conduct cryptocurrency investment fraud, launder proceeds, and support human trafficking operations in which victims were forced to run scams under threat of abuse. Investigators tied at least $73.6 million in victim funds to accounts controlled by laundering networks connected to the operation.
The sanctions align with broader U.S. enforcement efforts targeting Southeast Asia's scam center economy, which authorities estimate has generated tens of billions of dollars. Additional actions include domain seizures, arrests tied to Myanmar-based scam compounds, and expanded federal coordination through the Justice Department's scam center strike force. Cloudways has released an emergency update for the BreezeCache WordPress plugin to fix a critical vulnerability under active exploitation that allows unauthenticated attackers to upload malicious files to servers. The flaw affects multiple versions and can lead to full website compromise through persistent web shell access. Exploitation requires the Host Files Locally Gravitars setting to be enabled, which is not the default. Administrators are urged to update to the latest version immediately or disable the affected setting as a temporary mitigation.
Researchers initially flagged a malware sample called Zion Siphon as a potential threat to Israeli water infrastructure, but analysts at Dragos say the tool is largely non-functional and poses no real risk to operational technology environments. First identified by Darktrace, the malware appeared designed to manipulate chlorine levels at water facilities. However, investigators found the code riddled with logic errors, fictional system references, and likely AI-generated content that demonstrated little understanding of industrial control systems. Dragos warned that overstating such immature threats can distract defenders from more credible risks, including activity by groups like Volt Typhoon. The episode highlights ongoing debate over how seriously security teams should treat early-stage AI-assisted malware targeting critical infrastructure.
NIST is launching a new project through its National Cybersecurity Center of Excellence to help critical infrastructure organizations improve visibility into operational technology assets. Officials said asset management and inventory remain the most common challenge across sectors, especially in legacy industrial control environments. The initiative will demonstrate practical approaches for improving OT visibility using existing standards, frameworks, and commercially available tools, with possible support from AI depending on stakeholder interests. The effort follows warnings from U.S. and international agencies urging infrastructure operators to inventory OT systems amid growing nation-state threats. In parallel, NIST is advancing AI security work, including guidance for securing AI systems, managing AI-enabled risks, and developing identity and authorization standards for emerging enterprise AI agents.
Coming up after the break, my conversation with Eric Russo, Director of Sock Defensive Security at Barracuda. We're discussing the risks posed by employees downloading pirated software. And con artists charge crypto for counterfeit clearance. Stay with us. Eric Russo is Director of Sock Defensive Security at Barracuda. I recently caught up with him to discuss the risks posed by employees downloading pirated software.
I must admit, Eric, when I was a young lad back in the 80s, in the days of TRS 80s and Apple IIs, there was a lot of horse trading that went on with software. We were teenagers. We had no money. And so we would trade things that perhaps we should not have. But that was a long time ago. I have to say it's a little surprising for me to hear how prevalent pirated software still is today.
Yeah, so we've actually come across a handful of cases recently of this exact issue of cracked software. And the reason that I believe is behind that is you have users in a lot of very distributed workforces who are trying to do their jobs as quickly and efficiently as possible. And oftentimes they'll run into a task that requires some sort of application and maybe they're not aware or their organization doesn't have that sort of application available for them to use. So what's the first thing that they do? They head over to Google and they do a search for PDF editor, let's say for example, and they'll find free PDF editor and they'll go ahead and without thinking, download it.
And unfortunately, in certain cases, things like PDF editors and other Office applications and creative and design tools are cracked versions that present some security risks with the installer that's being downloaded. And what are the specific risks here? Yeah, I think a couple of concepts. One is the idea of shadow IT. So say, for instance, a user goes ahead and they do install an application that actually is legitimate. Let's say their organization uses Firefox for the browser for all their employees' machines. But then this user wants to go ahead and use Chrome. So they go ahead and install Chrome, and that's what they're using. Unfortunately, the IT team most likely isn't aware of that. So what happens when Chrome has a vulnerability? Well, whose responsibility does it become and who's managing that vulnerability and making sure that it's addressed?
the user in this case, which we know can't always be relied on to be security first. So that's one issue is the idea of shadow IT. Also, specifically the issue with cracked software is oftentimes threat actors that are designing these cracked softwares will embed malicious code within these applications that could do a slew of harmful behaviors on the user's endpoint. Yeah, I was looking through the research that you all recently published about this, and it was really surprising to me what a high percentage of cracked software contains all kinds of malware. Yeah, there were a lot of threats. I can give you an example of one really interesting one we saw not too long ago. There was an organization that we work with. They're located in the United Kingdom. And they had a user who went ahead and downloaded a free version of a common creative and design tool off of the internet. And what was embedded within that application was malicious code to do a number of things. First was info-stealing tactics, trying to scrape passwords from the browsers on the machine, credentials, I should say, from those browsers, and send them back. Other actions that were embedded were shellcode and...
changing startup processes in order to evade defense evasion tactics like disabling endpoint security and others. We also saw behaviors that were indicative of privilege escalation within some of that code in the application. And lastly, we also saw beaconing to a malicious IP address halfway around the world. So a lot of those types of things that ultimately lead to command and control and give threat actors access are being baked into these cracked softwares. I'm curious, how much do you think this is kind of an organizational culture problem? As you mentioned at the outset, folks are just trying to get their work done. And I suspect in a lot of cases, they go to the powers that be and say, hey, I want to do this thing. I want to do this task. I need this tool. And they're told no, or we can't afford that, or it's going to take a month to fill out a requisition, those sorts of things. Exactly. I definitely think that's a factor, especially what you alluded to at the end there, the time that it can take. It can take weeks, maybe even months, depending on procurement processes and things like that. And users just don't want to deal with it. They want to get their work done and move on. So I definitely think, like you said,
that kind of culture contributes to some of these scenarios. So ideally, what I would suggest to organizations is to make sure that they have the tools that users need available to them and they have a process for users to be able to submit anything else that they might need that the organization might not already have and have a way for users to get a hold of what they need in a timely fashion so that we're not encouraging users to go out and just install things on their own. How do you strike that balance between having an end-user's system properly configured, locked down, but not so much that they feel as though they can't get anything done? People want to feel like they have a certain amount of autonomy, a certain amount of freedom in their day-to-day work.
Yeah, absolutely. I think there are a couple of different degrees of levels of security, I will say, that you could apply to address this type of issue. You could go full-fledged with the concept of zero trust and say users aren't allowed to download or install anything except for what is explicitly authorized by our organization. Obviously, that approach typically provides the highest level of security. But like you said, maybe in certain cases you do want to give users some flexibility, but you could still take other controls as well.
limiting the amount of administrative actions that they could take on their endpoints or requiring approval from IT administrators before they install something. So at least there is some level of verification there. That seems to be a common step that organizations could take. Oftentimes, as I'm sure you know, if you're going to install a new application, you need admin privileges to do so. And if you could restrict local admin privileges on those endpoints and have your users automatically submit something to the IT team if they need to use local admin privileges on their machine, that could be a way of having a verification step in place.
So overall, what are your recommendations to the defenders out there in our audience who are faced with this? To me, the biggest thing, especially coming from a background of security operations, is having visibility. I think that's where it really becomes an issue for organizations is when they're not aware of what's out there and they're not aware of what their users are doing. So making sure that you have visibility into what's going on in their systems and it's being monitored and mitigated appropriately when something bad happens. And I think for something like this, really the most effective approach is having some sort of advanced endpoint protection in place that can identify these sorts of threats in real time and mitigate them appropriately.
That example that I talked about earlier with that organization and the user with the correct version of a creative and design tool, fortunately for them, they had advanced endpoint protection. And the behavioral AI detection engine within that endpoint protection agent detected it almost instantaneously and was able to mitigate the file and quarantine it before it became an issue. So to me, I'm a big believer that advanced endpoint protection will really help solve the issue of users clicking and downloading things that maybe they should. That's Eric Russo from Barracuda. With Export Development Canada, Canadian businesses are competing, leading, and winning in more international markets. Like how agri-food businesses are strengthening global food supply. And critical minerals are powering industries of the future. Their ambition can't be contained. And with EDC behind them, neither can their growth. Export Development Canada is the financial partner for Canadian businesses going global. Visit edc.ca for more.
And finally, crypto scammers are reportedly targeting commercial vessels stranded near the Strait of Hormuz, posing as Iranian authorities and requesting transit fees in Bitcoin or Tether for safe passage through the contested waterway. Greek maritime risk firm Marisks warned ship owners after identifying at least one vessel that may have paid such a demand before being fired upon anyway. Another cargo ship was also shot at after receiving what may have been fraudulent clearance to proceed. Roughly 2,000 ships remain stuck amid escalating regional conflict, with confirmed missile, drone, and small boat attacks complicating navigation. Iranian inspections, U.S. naval enforcement actions, and retaliatory strikes have created a confusing security environment, one apparently chaotic enough that even counterfeit maritime tollbooths, now accepting cryptocurrency,
are finding willing customers. And that's The Cyber Wire. For links to all of today's stories, check out our daily briefing at thecyberwire.com. Be sure to check out this weekend's Research Saturday and my conversation with Juliana Testa, senior security engineer from 7AI. The research is titled Quish Splash, when the QR code is the weapon, a multi-wave phishing campaign that slipped past every filter. That's Research Saturday. Do check it out. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app.
Please also fill out the survey in the show notes or send an email to cyberwire at n2k.com. N2K's lead producer is Liz Stokes. We're mixed by Trey Hester with original music and sound design by Elliot Peltzman. Our contributing host is Maria Vermazis. Our executive producer is Jennifer Iben. Peter Kilpie is our publisher. And I'm Dave Bittner. Thanks for listening. We'll see you back here next week.