You're listening to the Cyber Wire Network, powered by N2K. A major takedown disrupts the glassworm botnet. The White House rewrites federal cyber logging rules as CISA faces cuts amid rising AI threats. Federal agencies ramp up scrutiny of so-called anti-tech extremism. GCHQ warns Russia is targeting UK infrastructure. Researchers uncover stealthy new malware. We got AI coding agent supply chain risks and in-person extortion tactics targeting US law firms. Europe grabs satellite spectrum. Ben Yellen joins us to discuss the bipartisan push for more support of CISA and hacking your way to the main stage.
It's Wednesday, May 27th, 2026. I'm Dave Bittner, and this is your CyberWire Intel Briefing. Thanks for joining us here today. It's great as always to have you with us. Cybersecurity firm CrowdStrike says the Glassworm botnet, active for more than six months, has been disrupted through a coordinated takedown with Google and the Shadow Server Foundation.
Glassworm used a resilient command and control structure built on the Solana blockchain, BitTorrent, Google Calendar, and commercial VPS servers. The malware spread through trojanized Visual Studio extensions, GitHub repositories, and compromised Python packages. It stole developer credentials, targeted cryptocurrency wallets, and enabled remote access on infected systems. CrowdStrike says the operators continuously evolve their tooling and infrastructure to resist disruption efforts. Attackers increasingly target developers and software supply chains rather than end users directly.
CrowdStrike warns that weak developer environments and build pipelines can expose every organization consuming affected software. The Trump administration has rescinded a 2021 federal cybersecurity logging directive introduced after the SolarWinds breach, replacing it with a more targeted risk-based framework focused on detection and incident response. The updated guidance from the Office of Management and Budget emphasizes continuous monitoring, threat hunting, forensic investigations, and rapid response capabilities. OMB Director Russell Voigt said the previous requirements generated large volumes of costly data with limited defensive value. The new framework also expands logging guidance to Internet of Things and operational technology systems.
while directing CISA and federal partners to develop a government-wide logging architecture aligned with zero-trust modernization efforts. The policy reflects growing concern that adversaries are using automation and AI to accelerate attacks beyond the pace of traditional monitoring systems. Agencies will now retain logs in searchable form for six months and retrievable form for one year. Newly obtained intelligence documents reviewed by Wired show federal agencies and fusion centers increasingly monitoring activists, protesters, and online communities under a developing category described as anti-technology extremism. The reports, circulated by the Department of Homeland Security, the FBI, and regional fusion centers, cite concerns about protests tied to artificial intelligence, data center construction, and anti-corporate sentiment. Some assessments warn that unrest linked to AI adoption could evolve into violence targeting critical infrastructure or technology executives.
The documents also reference monitoring of public demonstrations, online forums, and constitutionally protected gatherings opposing data centers and AI expansion. Civil Liberties advocates warn the category is broadly defined and could sweep in peaceful protesters, AI skeptics, and environmental activists alongside individuals advocating violence. Federal officials maintain the focus remains on threats involving criminal activity or national security concerns. In her first public speech as director of GCHQ, Anne Keast Butler warns that the UK faces a moment of consequence as Russia intensifies cyber and hybrid threats against critical infrastructure, supply chains, and democratic institutions. Keast Butler says GCHQ is working with intelligence and defense partners to counter cyberattacks, sabotage, and espionage linked to Moscow, while also warning about China's growing technological and cyber capabilities. She stresses that advances in artificial intelligence are rapidly reshaping the threat landscape and narrowing the UK's strategic advantage.
Her speech also calls for stronger cybersecurity practices across government, industry, and households. The Cybersecurity and Infrastructure Security Agency is entering the AI era with reduced staffing, budget cuts, and a diminished role in the federal government's response to emerging AI-enabled cyber threats, according to reporting from Axios. Since early 2025, CISA has reportedly lost roughly one-third of its workforce through buyouts and funding reductions. Industry and former government officials warn the cuts have weakened the agency's ability to coordinate with critical infrastructure operators and respond to increasingly sophisticated threats from advanced AI models.
Sources also told Axios that CISA has taken a secondary role in White House discussions surrounding cybersecurity risks tied to frontier AI systems. Former officials argue the agency would traditionally play a central role in shaping national cyber policy and coordinating vulnerability management across government and industry. Later in the show, I'm joined by Ben Yellen to discuss the bipartisan push for more CISA funding. Europe is moving to reserve most of a valuable satellite spectrum band for European operators, setting up a potential clash with Washington over the future of space-based connectivity and tech sovereignty. The proposal could limit access for U.S. companies like SpaceX and Amazon while boosting Europe's own satellite ambitions. Our contributing host Maria Vermazis joins us with more on the growing geopolitical battle over who controls the skies.
Thanks, Dave. As much as data sovereignty is a critical topic in the European Union right now, so too is its companion concern, space sovereignty. That concept encompasses access to radio frequency spectrum bands, and there is only so much RF spectrum to go around, that's physics for you. So it is a major development in European space sovereignty, with news reported by Politico and Reuters this week that the European Commission is moving to reserve most of a valuable satellite spectrum band for primarily European operators when current licenses held by US-based operators via Saturn EchoStar expire in 2027. The proposal would divide the frequencies into three 10 megahertz blocks over the next 20 years.
one block for secure EU government communications and the EU's Iris squared satellite internet constellation, another block for European startups, and the last block would be open to either European or foreign companies. There is also discussion of making the EU exclusive spectrum open to EU adjacent countries like Norway and the UK. Should this plan come to fruition, it would sharply limit spectrum access for US operators like SpaceX and Amazon, both of which are fast increasing their global presence with Starlink and Amazon Leo, and acquiring access to spectrum bands to make that happen. EU officials say that their plan of reallocating the band to prioritize EU access is necessary for European technical sovereignty and secure internet connectivity. But squeezing out U.S. competition could provoke retaliation from the United States, just as the EU and U.S. seem to be nearing finalization of a new trade deal. For the Cyber Wire Daily, I'm Maria Varmazes from T-Space Cyber Briefing. Back to you, Dave. Be sure to subscribe to the T-Space Cyber Podcast wherever you get your favorite shows.
Researchers at Fortinet FortiGuard Labs have identified a phishing campaign distributing a pure logs malware variant designed to steal credentials, cryptocurrency wallet data, browser sessions, and other sensitive information. The campaign used purchase order themed phishing emails containing malicious RAR archives with obfuscated JavaScript files. Once executed, the malware launched PowerShell scripts using process hollowing to inject code into Microsoft's MSBuild process and downloaded additional modules directly into memory. FortiGuard says the malware relied on layered encryption. fileless execution, and dynamic plug-in delivery to evade traditional detection methods. The malware targeted browser credentials, Discord tokens, VPN accounts, email clients, and dozens of cryptocurrency wallets. Researchers warn the attack highlights the continued effectiveness of phishing combined with increasingly stealthy post-compromise techniques.
The FBI is warning the silent ransomware group, also known as Luna Moth and Chatty Spider, is escalating its extortion operations against U.S. law firms by using in-person social engineering attacks. According to the FBI, attackers pose as internal IT staff through phishing emails and phone calls, convincing employees to grant remote desktop access. If remote access attempts fail, the group may dispatch an individual directly to the victim's office to connect malicious USB drives or external storage devices to company systems. The stolen data is then used for extortion campaigns targeting both organizations and their clients. The group has reportedly targeted legal and financial firms since 2023 and was previously linked to bizarre call campaigns associated with Conti and Ryuk ransomware operations.
Researchers at Adversa AI have demonstrated a new supply chain attack technique called SimJack that targets developers using AI coding agents. The attack abuses trusted repositories and symbolic links, or symlinks, to silently register a malicious MCP server inside an AI coding environment. Developers may unknowingly approve what appears to be a harmless file copy request, while hidden commands modify agent configurations and execute attacker-controlled code. Adversa says the technique could steal credentials, cloud tokens, browser sessions, or compromise CI pipelines without further user interaction. The firm tested the method against several major AI coding agents, including CloudCode, GitHub Copilot CLI, Gemini CLI, Cursor Agent CLI, and GrokBuild CLI. Researchers say the issue reflects growing security risks tied to developer trust in automation rather than a traditional software vulnerability.
Coming up after the break, my conversation with Ben Yellen about the bipartisan push for more support of CISA and hacking your way to the main stage. Stay with us. And it is always my pleasure to be joined by Ben Yellen. He is my co-host over on the Caveat podcast. And also he is from the University of Maryland Center for Cyber Health and Hazard Strategies. Ben, welcome back. Good to be with you again, Dave. Interesting story from our friends over at CyberScoop. And this is about bipartisan support to take a closer look at some of these budget cuts that CISA has been experiencing here. What are we looking at here, Ben?
So two members of Congress, Representative Don Bacon, a Republican from Nebraska, and Representative James Walkinshaw, a Democrat from Virginia, spoke during a panel at the National Cyber Innovation Forum and harped on the importance of the Cybersecurity and Infrastructure Security Agency, known as CISA. This agency has suffered significant budget cuts over the past year and a half. A lot of that was due to the Department of Government Deficiency and the fork in the road thing where employees were incentivized potentially. to leave unless they face the threat of layoffs. And then even through the fiscal year 2026 budgeting cycle, it's faced significant cuts. Some estimates say about a third of the January 20th, 2025 workforce has since left the agency.
And this is during a time when the threat landscape is extremely significant. We've seen the high profile attacks. We've heard about advanced potential offensive cyber tools, the threats around something like Mythos or similar technology, not to mention concerns about attacks on our critical infrastructure. So these two members of Congress are coming together. They are encouraging their colleagues as we move into the fiscal year 2027 appropriations process to prioritize funding this agency, to prioritize.
information sharing of cyber threats. And I think this could be a really powerful call for their colleagues. The one thing I will say is that the Republican member here, Representative Bacon, is retiring at the end of this year. So in the next Congress, I think somebody else on the Republican side of the aisle will have to take this over as a cause, given that we will be losing Representative Bacon's voice on this. Are these representatives in a position of influence when it comes to this particular topic? Yeah. So Representative Bacon is the chairman of the House Armed Services Subcommittee on Cyber Information Technology and Innovation.
And, you know, he spoke passionately in the past about how important this is to protecting our networks and our critical infrastructure. I mentioned previous campaigns that we've all known about, like Salt Typhoon. And just that our adversaries are... more sophisticated than they've ever been. And when surveying the threat landscape, we're all terrified of attacks on energy grids or water systems or other things that we rely on as a society for our subsistence. And there's a limited capability for state and local governments to do this on their own just because this is a problem that's national and international in scope. So yeah, I think both of these guys have significant influence. I think because of Representative Bacon's chairmanship and the fact that he's a member of the president's party, I think his voice is critically important on this. Yeah. As we look at this, I mean, to what degree...
Do we suppose that CISA is seeing these cuts as part of the broader government-wide cuts that have been a big part of this administration? You mentioned Doge, and CISA got cut there. The proposed budget for 2027 is reducing CISA's funding by between $361 million or even up to over $700 million, depending on which budget document you're looking at. But we've also got this sort of this longtime specter of the president himself having a grudge against the organization for way back when in 2020, saying that... the election was fair and the president doesn't seem to have gotten over that. No, certainly if you read the Truth Social feed, he has not gotten over that. Yeah, I think that's a huge element of this. The president fired the chair of CISA post-election 2020 during his first term after Mr. Krebs said publicly that he thought the election was fair and that there weren't any irregularities and he was fired by tweet. And I think there's certainly a perception out there that some of the president's reluctance or grievances at CISA are still based on
what he saw as that improper statement in the aftermath of the 2020 election. I think that's had a huge impact on it. Now, there are a lot of programs, including ones that weren't directly in the president's line of fire, that have faced significant cuts that I think members of both parties would say are cost-effective spending programs that shouldn't have been on the chopping block. Right. Especially for things like public health. I mean, we're looking at what's happening with Ebola. I think at one point, Elon Musk said in the Oval Office that he accidentally cut off the funding stream to fight Ebola in Africa.
and then like try to restore it. You know, so it's these types of things where it's not just one agency, but just given the threat landscape here, I think this is a particularly important one. And one of the things that the Democratic lawmaker James Walkinshaw said here is he's had experience at the local level working for Fairfax County in Virginia, which is a pretty wealthy county that has a sophisticated water system. And in his work there, he saw the critical importance of having these communications channels through this federal agency. And that we need to restore that capability has just not been the same since it lost so many of its staff members. And since as an agency, it's kind of been deprioritized. Yeah, yeah. And I suppose, I mean, it's good to see that the representatives are offering bipartisan support for this. It seems like there's pretty much universal understanding that CIS's mission is an important one. Part of me wonders if it's fair to the president to keep going back to the 2020 thing. But it's hard to, because of the importance of CIS's mission, it's hard to.
And the White House's lack of direct information and comment on the justification for cutting CISA, other than just broad budget cutting, it's hard to come to other conclusions, right? Yeah. Yeah, I mean, I think it leaves a lot of us to just speculate, which you're right, sometimes is not fair. And I think the representatives here are doing a good job of not making this a Donald Trump story. Right, right. No matter what happens, we'll have a new president in 2029, and we need this agency to be up and working because of the threat environment. Yeah. And because of the importance to this coordinating agency to state and local governments in particular. Right.
And I think that's what they're saying, that they have the requisite experience both in terms of what they've done in Congress and in their previous careers in local governments. And they're coming at it from that perspective, not in the, you know, let's have a food fight about the Donald Trump administration where CISA gets caught in a crossfire. I don't think any of these members of Congress are particularly interested in doing that. Yeah, yeah, yeah, fair enough. All right, well, Ben Yellen is from the University of Maryland Center for Cyber Health and Hazard Strategies and also my co-host on the Caveat Podcast. Ben, thanks so much for joining us. Good to be with you, Dave. Thanks.
At precisely 8.23 p.m., Roger Kwan was not waiting for a table outside his favorite restaurant with his girlfriend, so a passing sports coupe did not splash slush all over her, making her question why she was dating him. And a second car did not splash her again, confirming her belief. All because Roger skipped it, stayed in, and with the skip app ordered the best chicken tikka masala she'd ever had, confirming Roger might just be the one. Way to go, Rog. Skip to the good part.
And finally, a security researcher found an unusually effective way to get conference talks accepted. Compromise the submission platform first. Researchers at Novi disclosed a stored cross-site scripting flaw in PreTalks, a popular open-source conference management platform used by security events worldwide. The vulnerability allows malicious JavaScript hidden in speaker submissions to execute inside organizer accounts. Researcher Elad Meged demonstrated the issue by automatically submitting proposals to roughly 40 conferences, all for a deliberately bland talk titled, Securing Modern Web Apps. Apparently, subtlety still works. Novi says the flaw could have enabled attackers to hijack organizer sessions, alter submissions, or launch phishing attacks from trusted conference infrastructure. Pre-talks patched the issue in April. Meged emphasized the testing remained controlled and non-destructive, though he admitted a more outrageous talk title would have been funnier.
And that's The Cyber Wire. For links to all of today's stories, check out our daily briefing at thecyberwire.com. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to cyberwire at n2k.com. N2K's lead producer is Liz Stokes. We're mixed by Trey Hester with original music and sound design by Elliot Keltzman. Our contributing host is Maria Vermazis. Our executive producer is Jennifer Iben. Peter Kilpie is our publisher. And I'm Dave Bittner. Thanks for listening. We'll see you back here tomorrow.