You're listening to the Cyber Wire Network, powered by N2K. Your IT team wasn't hired to manually manage endpoints. So why do they spend so much time doing just that? As AI-driven threats move faster, Avanti helps IT teams scale their efforts while minimizing risk with autonomous IT solutions. Avanti proactively identifies and resolves endpoint issues to reduce disruption and boost security. Meet endpoint autonomy that doesn't go rogue because it's grounded in verified data. Scale fearlessly at Avanti.com slash future. That's I-V-A-N-T-I dot com slash future.
Nightmare Eclipse drops another Windows zero day. The gentlemen take the ransomware crown. CISA orders emergency Fortinet patching. Canada's surveillance bill faces U.S. scrutiny. VETA's oversight board flags AI censorship bias. Commerce tops the cyber target list. An active espionage campaign hits Bangladesh's military. The Hewlett Foundation commits $100 million to emerging tech security. U.S. prosecutors dismantle an alleged cyber-enabled money laundering network. Our guest is Nick Stolman, vice president of CIGIS Strategy at Imprivata, talking about CIGIS readiness and the identity security challenges facing public safety agencies.
And leaked source code reveals an AI mixtape. It's Friday, July 17th, 2026. I'm Dave Fittner, and this is your CyberWire Intel Briefing. Thanks for joining us here today. It's great as always to have you with us. Happy Friday.
A security researcher using the handle Nightmare Eclipse has released Legacy Hive, a proof-of-concept zero-day exploit that targets the Windows user profile service and enables privilege escalation on fully patched Windows systems. The vulnerability has not yet been assigned a CVE. Unlike the researcher's earlier releases, this proof-of-concept has been deliberately limited, requiring additional user credentials to reduce the risk of widespread abuse. Testing by security researchers Will Dorman and Kevin Beaumont confirmed the exploit works. Dorman said it could let a standard user modify an administrator's registry Hive, potentially enabling code execution when the administrator logs in, while Beaumont published Microsoft Defender for endpoint detection queries. Legacy Hive is the latest in a series of Windows zero-day disclosures from Nightmare Clips, whose previous releases have prompted Microsoft patches and public legal warnings.
The ransomware landscape is shifting, with The Gentleman emerging as the most active cyber extortion group between March and May of this year, according to ReliaQuest. Researchers tracked 300 claimed victims linked to the group, surpassing Keelan, which recorded 289 incidents after leading ransomware activity throughout the previous year. Across 11 major ransomware operations, ReliaQuest identified 1,368 victim claims spanning 99 countries. The report attributes the gentleman's rapid rise to aggressive affiliate recruitment, AI-assisted malware development, and a well-packaged ransomware-as-a-service toolkit that lowers the barrier for new operators. The toolkit includes detailed attack playbooks and pre-configured intrusion tools that help affiliates launch attacks more efficiently. ReliaQuest expects the group's momentum to continue and recommends organizations strengthen remote access controls, harden identity protections, enforce Microsoft's vulnerable driver block list, and monitor suspicious network activity.
CISA has ordered federal agencies to urgently patch two actively exploited critical vulnerabilities in Fortinet Fortisandbox. The flaws, patched by Fortinet in April and June, allow unauthenticated remote code execution through command injection attacks that require no user interaction. Although Fortinet has not confirmed exploitation, threat intelligence firm Diffused reported attacks in June, and CISA has now added both vulnerabilities to its known exploited vulnerabilities catalog. Federal agencies must apply patches by July 19th. Senator Ron Wyden is urging Secretary of State Marco Rubio and Acting Attorney General Todd Blanche to oppose Canada's proposed Lawful Access Act, warning it could threaten U.S. national security and the privacy of American citizens. In a letter, Wyden argued the legislation could compel U.S. technology companies to secretly assist Canadian surveillance by retaining user metadata, creating backdoors, and modifying systems to facilitate lawful access requests. The bill has passed Canada's House of Commons and is awaiting Senate approval.
Wyden called for a review of whether the proposal could force companies like Apple and Google to disclose Americans' data and recommended using ongoing U.S.-Canada Cloud Act negotiations to prohibit such requirements. Canada's Citizen Lab has also raised constitutional concerns about elements of the legislation. A study by Meta's Independent Oversight Board found that leading AI models, including those from OpenAI and Anthropic, are significantly less likely to generate politically critical content about governments with restrictive speech laws than about more permissive countries. Across 10 models, researchers found refusals occurred 34% of the time for restrictive jurisdictions, compared with 14% for permissive ones. The board warned this could introduce bias into widely used AI systems and called for greater transparency in AI training, evaluation, and human rights assessments.
Akamai's latest State of the Internet report says commerce has become the world's most targeted industry for cyberattacks as AI-powered shopping agents and autonomous tools reshape online retail. By the end of 2025, AI bots accounted for nearly 48% of all commerce traffic on Akamai's network, with AI training crawlers making up the majority. The report warns that attackers are increasingly exploiting AI through agent hijacking, synthetic identity fraud, and API attacks, while Layer 7 distributed denial-of-service attacks continue to surge, particularly against retailers. Akamai also found widespread gaps in API visibility, with most organizations unable to identify sensitive data exposure. Meanwhile, phishing and malware activity have risen sharply, fueling account takeovers and loyalty fraud as attackers industrialize cybercrime against digital commerce platforms.
Researchers at Sideris Howler Cell uncovered an active cyber espionage campaign targeting Bangladesh's military and defense sector and attributed it with high confidence to Do Not, also known as APTC35. The operation begins with a spearfishing RTF document disguised as the biography of a Bangladesh Air Force officer. The document uses remote template injection to retrieve a malicious macro, with server-side geofencing limiting delivery to intended regional targets. The malware executes through multiple encrypted stages before installing a DLL that establishes persistence. profiles the infected system, and communicates with command and control servers over encrypted HTTPS. By interacting directly with the C2 infrastructure, researchers retrieved a live second-stage payload, confirming the campaign remains active. Matching encryption keys, infrastructure, and communication patterns further strengthen the attribution to DoNot and indicate an ongoing intelligence-gathering operation targeting South Asian government and military organizations.
The William and Flora Hewlett Foundation has launched a $100 million emerging technology and security initiative to fund research and policy efforts through 2031 focused on the safe development of artificial intelligence, biotechnology, and quantum computing. Announced at the Aspen Security Forum, the initiative will support universities, think tanks, and civil society organizations working to protect critical infrastructure, address emerging technology risks, and strengthen global governance. Building on earlier exploratory grants, The program aims to promote practical, evidence-based solutions that balance innovation with security through collaboration across government, industry, and independent organizations. On a personal note, our own Research Saturday program was initially made possible by a Hewlett Foundation grant.
U.S. prosecutors have charged Zhuoying Shen and Huaje Zhang, two New York residents, with operating a large-scale money laundering network that allegedly moved at least $43 million in proceeds from cyber-enabled investment fraud scams between 2020 and 2022. According to the indictment, the pair managed a network of more than a dozen associates who used approximately 140 bank accounts tied to 45 shell companies to transfer stolen funds to China. The underlying scams involved criminals building trust with victims through social media and messaging platforms before convincing them to invest in fake opportunities. If convicted of conspiracy to commit money laundering, the defendants face up to 20 years in prison. The case highlights the continued growth of investment fraud, which the FBI says caused $8.6 billion in reported losses in 2025.
Coming up after the break, my conversation with Nick Stolman from Imprivata. We're talking about CGIS readiness and the identity security challenges facing public safety agencies. And leaked source code reveals an AI mixtape. Stay with us. The cybersecurity challenges shaping our future demand more than conversation. They demand action. On November 18th, the Aspen Cyber Summit brings together leading voices from government, industry, and civil society in Washington, D.C. to tackle today's most pressing cyber and technology policy issues and advance real cross-sector solutions. Join the leaders shaping what comes next in cybersecurity. Learn more and register at aspencybersummit.org.
Cyber risks continue to evolve, and Travelers Cyber Threat Report helps organizations stay informed on what's changing across today's risk landscape. This quarter's report uses data from leaked sites and Travelers' claims to examine the ransomware ecosystem and trends in account takeover attacks. It's a practical, data-driven resource built to help security and insurance professionals better understand emerging cyber trends and what they could mean moving forward. Download the latest Travelers Cyber Threat Report today. Visit travelers.com slash cyberwire.
Nick Stolman is vice president of CIGIS Strategy at Imprivata. We recently sat down to talk about CIGIS readiness and the identity security challenges facing public safety agencies. We really wanted to get a temperature of the water where agencies were with their CETA's compliancy journey. In October of 2024, the FBI released a document of 400 pages or more of requirements to meet compliancy. And we wanted to find out how many people had started that process and started on their journey to find out what's the real lay of the land out there. And so we decided let's do a survey and ask agencies for multiple sizes, multiple types, and see where they're at when it comes to CETA's compliancy.
So CJIS stands for Criminal Justice Information Services. For folks who may not be familiar with that, what does it mean and why does compliance here matter? So CJIS is actually part of the FBI out of West Virginia. They employ about 3,000 different people within that section of the FBI. And their main focus is to provide and to secure access to criminal justice information databases that public safety agencies use on a daily basis. NCIC, Inlets, and so forth, running your criminal history, running a driver's license through DMV, through NCIC, finding out if there's any warrants on an individual or a piece of property. So all the databases that public safety access, we need to protect. And the FBI's focus is to make sure those...
those databases being accessed properly by the right personnel, those that have rights, and that the compliance is handled in a professional manner and that we're meeting those requirements that the FBI has put out. So what are some of the challenges that public safety agencies face here to meet that compliance? Yeah, you know, it comes down to cost and bandwidth a lot of the time. I was a former undersheriff at a sheriff's office, and I started my career as a drug enforcement agent, and I always had to deal with cegus compliancy as well as an end user. But from a department standpoint, there's cost to be compliant. You have to buy the right tools, multi-factor authentication tools, software, you know, and then you have to put those into practice. You have to implement them, and then you have to train, and you have to have those end users, which is everybody in the department, making sure they're, you know, obviously accessing the systems properly and that they're conducting themselves in a compliant manner.
One of the things it really does come down to, it's not necessarily that agencies don't understand the priority of this and the necessity and need. It's finding the funding to buy the right software, the right technology, and then the training and so forth. And it's compliancy. See, this compliancy is not a one-fix-all. You buy a product and fix it. It's everyday practice, and it's really an agency's responsibility. It's not an IT problem. It's an agency problem. And you're only as strong and only as compliant as your weakest user.
So it really takes consistent training, consistent upkeep of the system you're using. And so obviously there's a cost of that and it has to be prioritized. And when you've got to look for fuel money for your patrol cars or buy some software, you have to pick the priority there. Right. Now, it's my understanding that the Department of Homeland Security has a proposed framework here. Is it Anchor CL? Is that correct? That's correct. They do have an initiative out there that they're working on, which is going to be able to kind of like, you know, setting the guidelines and making it easier. And obviously, when Homeland Security gets involved, you'll find that they also are a big provider of grant funding, right? So that obviously can solve twofold. It can get compliancy in a more structured manner, but it also can provide a path to financing to be able to afford that.
For the public safety folks in our audience, what are your recommendations? What are the steps that you would suggest for folks to strengthen their identity security without trying to solve everything all at once? Coming from running an agency, I would approach it like I do everything within the agency's jurisdiction and scope, right? That's a mission. And when you have a mission, you get the right personnel involved. I would formulate a team from command staff, end users, power users, and IT staff. And I'd evaluate our workflows and what do we really need to be compliant? Where's our weakest points? Is it password? Is it, you know, you share devices? Where are we weak? What workflows are causing us the opportunity to fall into the non-practice of compliancy and become a victim?
Just because you're a public safety agency doesn't mean you can't become a victim as well, right? So I would put a team together and make it a focus, put a timeline to it, and I would advise them start researching what other agencies are doing, make contact with the FBI. The FBI is their friend and their partner. And see this compliancy, ask for guidance from them, their state agency. You know, here in North Carolina, I would live. I would contact the FBI, State Bureau Investigations, and get their input on compliancy and formulate a plan and look for a good partner. Not a vendor, I look for a partner. You know, again, I mentioned earlier that compliancy is an ongoing everyday practice.
So you need a partner. You're not buying something. It's not a transactional sale. It's a commitment. It's a journey. And you want to find a partner that's staying ahead of the game and is connected with the Bureau, connected with the state agencies, and understands the market, understands the need and the pain points, and understands where the FBI is going with future compliancy concerns. Every time technology changes, for example, when we went from on-premise systems to cloud systems, that caused more compliancy concerns on how you access the cloud system.
And now today we're dealing with AI, right? You hear AI through any type of vertical, any market out there. Well, it's obviously very strong and prevalent in public safety as well. So that creates new compliance concerns. So you need to find a partner that understands that and is not just trying to sell you a piece of product or a piece of software that's going to solve multi-factor authentication. That's where it starts, but it goes much further than that. It sounds to me the way you're describing it, like there is a good amount of collaboration out there among the people who are using these tools. Is there a sense of collegiality out there among those folks?
I think so. I think this is always back historically has always been on the shoulders of IT. And I think now because the true weakness is usually through our own end users, it can't be all on IT. So you're starting to see that group of that formation of teamwork and not just within the agency. other agencies and also other partners and vendors and also collaborating with the FBI. The FBI, again, you know, their job, they're trying to do the job and make you successful as well and make sure that you're compliant and that you don't put your agency at risk and your citizens you serve at risk. So it takes teamwork, it takes collaboration, and it takes an understanding that we're all in this for the same mission. We want to protect those CGI databases. We want to protect the citizens and we want to make sure the folks are out there serving them get home at night. And there's a lot of ways that can happen if you're where they could not get home at night if you're not practicing CIS compliancy. That's Nick Stolman from Improvata.
Maybe that's an urgent email from your CEO, or maybe it's a deepfake targeting your business. Doppel is the AI-native social engineering defense platform fighting back against impersonation and manipulation. As attackers use AI to make their tactics more sophisticated, Doppel uses it to fight back, automatically dismantling cross-channel attacks, building team resilience, and providing agentic email protection. Doppel, outpacing what's next in social engineering. Learn more at doppel.com. That's D-O-P-P-E-L dot com.
Quick question. Who or what has access to your critical systems right now? I'll give you a hint. It's not just employees anymore. It's vendors, machines, applications, workloads, and so many AI agents. Zage Security helps organizations control every identity with zero-trust policies that govern what they can access, what they can do, and when. Because when critical systems are at stake, compromised access can mean downtime, disrupted production, and real-world consequences. Protect what matters most with the Zage Identity Fabric platform. Learn more at Zage.com. That's X-A-G-E dot com.
In 2002, Ryan Wedding was an Olympic snowboarder at the top of his game. Ryan's style is really gunned and gold. And in less than a minute, it slipped away. But he continued to chase the high. Ryan James Wedding. He controls one of the most violent drug trafficking organizations in this world. I'm Michelle Shepard, and from CBC Podcasts and the Toronto Star, The Most Wanted Olympian. The Most Wanted Olympian. Available now on Spotify.
And finally, a hacker has pulled back the curtain on how AI music company Suno built its models, revealing source code that allegedly shows the platform scraped millions of songs, lyrics, podcasts, and stock audio from services including YouTube Music, Deezer, Genius, Pond5, and Gemendo. The leaked code appears to detail massive training datasets, automated scraping tools, and techniques for finding vocal tracks, while also suggesting the use of proxy infrastructure to collect content at scale. The breach reportedly exposed customer contact information and limited Stripe payment data, though Suno says the incident-involved outdated code was quickly contained and did not compromise full payment card numbers. The revelations add weight to ongoing copyright lawsuits accusing Suno of training on copyrighted music. It's a reminder that, in AI, today's training playlist can become tomorrow's courtroom exhibit.
And that's The Cyber Wire. For links to all of today's stories, check out our daily briefing at thecyberwire.com. Be sure to check out this weekend's Research Saturday and my conversation with Lauren Fibison, Senior Threat Researcher at Silent Push. The research is titled Meet Drive Surge, a new threat actor using click-fix and fake update drive-by attacks in thousands of compromised sites. That's Research Saturday. Check it out. And hello, Maria Vermas is here. On Sunday's T-minus Space Cyber Briefing, we're diving into Europe's push for space sovereignty, from data laws to independent launch and secure communications.
T-Minus producer Ethan Cook and I have a conversation on why and how Europe is urgently pursuing space sovereignty. That is on Sunday on T-Minus. See you then. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to cyberwire at n2k.com. N2K's lead producer is Liz Stokes. We're mixed by Trey Hester with original music and sound design by Elliot Kultzman. Our contributing host is Maria Vermazis. Our executive producer is Jennifer Ivan. Peter Kilpie is our publisher. And I'm Dave Bittner. Thanks for listening. We'll see you back here next week.
And now a word from our sponsor, SpecterOps. Today, AI is rapidly adding non-human and agentic identities to modern enterprise environments, creating new trust relationships and attack paths. Bloodhound Enterprise helps defenders map attack paths across AWS and hybrid environments as one connected graph, identify the choke points that matter most, and bring trusted attack path intelligence into approved AI workflows with Bloodhound Hunter. See how SpecterOps helps teams secure the AI-driven identity era at specterops.io. Sorry, investing, trading, that isn't a personality. You don't need the voice. You don't need the jargon. You don't need the podcast. You already know how to trade. You've done it your whole life. And TD Easy Trade taps into that instinct. So you can build something real. No minimums, no monthly fees, 24-hour support. No investor personality required. Because you are made to trade. And TD Easy Trade is made to help. Download it now.