You're listening to the Cyber Wire Network, powered by N2K. Welcome aboard via rail. Please sit and enjoy. Please sit and stretch. Steep. Flip.
Or that and enjoy. Via Rail. Love the way. If you paid for the venue before revenue came in, built a marketing plan at midnight, or chased the perfect headliner, you know what it takes to grow an event. That's why ShowPass created Event Incubator to give selected independent event organizers access to $10 million in growth capital, plus technology expertise and community. Applications are open through November 30th, 2026. $10 million is on the table. What will you do with it? Search ShowPass Event Incubator, Incubator with a K, or tap the link to apply.
Microsoft confirms active exploitation of two defender flaws. Europol dismantles a VPN service tied to ransomware gangs. A nine-year-old Linux kernel bug exposes SSH keys and password hashes. Cisco patches a critical secure workload vulnerability, while Drupal fixes a highly critical SQL injection flaw. Android malware quietly signs victims up for premium SMS scams. Webworm upgrades its espionage toolkit with Discord and Microsoft Graph backdoors. China and Russia deepen cooperation on AI, cybersecurity, and satellite systems.
Our guest is Jake Moore, Global Cybersecurity Advisor for ESET, sharing a glimpse into his InfoSecurity Europe keynote, The Deepfake Interview. And Greg? Greg doesn't even work here anymore. It's Thursday, May 21st, 2026. I'm Dave Bittner, and this is your CyberWire Intel Briefing. Thanks for joining us here today. It's great as always to have you with us. Microsoft says attackers are actively exploiting two Microsoft defender vulnerabilities, prompting action from both Microsoft and CISA.
The first is a local privilege escalation flaw in the Microsoft malware protection engine. Successful exploitation could grant attackers system-level privileges. The second vulnerability can force Microsoft Defender into a denial of service state, potentially disrupting endpoint protection. Microsoft says both flaws are publicly disclosed and exploited in the wild. Patches are available in updated Defender engine and platform releases. Microsoft Defender is widely deployed across enterprise and government environments. CISA has added both vulnerabilities to its known exploited vulnerabilities catalog and ordered federal civilian agencies to patch or discontinue affected products by June 3rd.
European law enforcement agencies have seized FirstVPN, a private service investigators say was widely used by ransomware gangs and other cybercriminal groups to conceal operations online. The operation, called Operation Saffron, involved authorities from 16 countries with support from Europol and Eurojust. Investigators seized 33 servers, shut down multiple domains, and interviewed the alleged administrator in Ukraine. According to Europol, the VPN advertised heavily on Russian-speaking cybercrime forums and offered anonymous payments and concealed infrastructure designed to evade law enforcement. Authorities also gained access to the server's user database, which investigators say contains information tied to thousands of suspected criminal users. The takedown highlights a growing law enforcement focus on disrupting the infrastructure that enabled cybercrime, not just the operators behind the attacks. Seized customer data could support future ransomware, fraud, and data theft investigations across multiple countries.
Researchers at Qualys have discovered a Linux kernel vulnerability that could allow unprivileged local users to access sensitive files, including SSH private keys and password hashes, on default Debian, Fedora, and Ubuntu systems. The flaw has existed in the Linux kernel since 2016. Qualys says the bug affects the kernel's ptrace mechanism, which manages process tracing and debugging. By exploiting a race condition tied to credential changes, attackers can inherit access to protected file descriptors from privileged processes. Qualys demonstrated proof-of-concept exploits exposing SSH host keys and shadow password hashes. Researchers warn the issue is especially dangerous in shared hosting and multi-tenant environments where untrusted users can obtain local shell access. Kernel patches are available, and Ubuntu and Qualys recommend tightening p-trace restrictions as a temporary mitigation.
Cisco has patched a critical vulnerability in secure workload with a maximum CVSS score of 10. The flaw affects internal REST API endpoints and could allow attackers to access sensitive information and modify configurations across tenant boundaries with site admin privileges. Cisco says the issue impacts both SaaS and on-prem deployments but does not affect the web management interface. Patches are available. Cisco has also addressed three medium severity flaws affecting Thousand Eyes products and Nexus switches. The company says it has not observed active exploitation.
Researchers at Zimperium Z Labs have uncovered a large-scale Android malware campaign that secretly subscribed victims to premium SMS services without their consent. The operation involved roughly 250 malicious apps impersonating popular brands including TikTok, Instagram Threads, Minecraft, and Facebook Messenger. The malware targeted mobile carriers in Thailand, Croatia, Romania, and Malaysia by checking SIM card details before activating fraud routines. Researchers say the app's disabled Wi-Fi intercepted one-time passwords using Google's SMS Retriever API and automated hidden subscription workflows through background web views. One malware variant also exfiltrated victim data and subscription confirmations through Telegram. The campaign highlights how attackers continue to weaponize legitimate mobile platform features and weak SMS-based authentication systems to support long-running fraud operations. Researchers say the infrastructure operated for nearly 10 months and was optimized to evade detection while maximizing carrier billing abuse.
Drupal has released patches for the highly critical SQL injection vulnerability affecting sites that use PostgreSQL databases. The flaw exists in an API responsible for sanitizing database queries and could allow unauthenticated attackers to obtain sensitive information, escalate privileges, or potentially achieve remote code execution. Drupal warned users before disclosure that exploit code could emerge quickly after patches became public. Updates are available for multiple versions. The release also addresses additional vulnerabilities in Symfony and Twig dependencies.
Researchers at ESET say the China-aligned WebWorm Threat Group has significantly evolved its operations in 2025, shifting focus from Asia toward European government organizations and deploying new stealth-focused malware and proxy infrastructure. The group introduced two new backdoors, EchoCreep and GraphWorm, which use Discord and Microsoft Graph API for command and control communications. Researchers decrypted more than 400 Discord messages tied to EchoCreep and uncovered evidence of targeting in Belgium, Italy, Poland, Serbia, and South Africa. Webworm also expanded its use of custom proxy tools designed to create layered encrypted traffic chains across compromised systems. ESET says the group stages malware through GitHub repositories and used a compromised Amazon S3 bucket for configuration retrieval and data exfiltration. The findings reflect a broader trend among advanced persistent threat groups toward blending malicious activity with legitimate cloud services and collaboration platforms to evade detection. Researchers also identified reconnaissance activity using open-source vulnerability scanners and web directory brute-forcing tools against dozens of targets across Europe and Africa.
Chinese President Xi Jinping and Russian President Vladimir Putin pledged deeper cooperation on artificial intelligence, cybersecurity, satellite systems, and internet governance during a summit in Beijing. In a joint statement, the two countries outlined plans to expand collaboration on satellite internet technologies, open-source software, and joint development initiatives aimed at reducing dependencies on Western technology. Moscow and Beijing also agreed to improve interoperability between Russia's GLONASS and China's Beidao satellite navigation systems and coordinate more closely on cyber policy and information security. Both governments reaffirmed support for Internet sovereignty, which gives states broader control over domestic digital environments. The agreement reflects a growing strategic alignment between China and Russia in cyberspace and emerging technologies, particularly as both countries seek alternatives to Western-controlled infrastructure and standards. The announcement also comes amid increasing concerns over the military and cyber applications of artificial intelligence.
Coming up after the break, Maria Vermazis speaks with Jake Moore, Global Cybersecurity Advisor for ESET, sharing a glimpse into his InfoSecurity Europe keynote, The Deepfake Interview. And Greg, Greg doesn't even work here anymore. Stay with us. Welcome aboard Via Rail. Please sit and enjoy. Please sit and stretch. Steep. Flip. Or that. And enjoy. Via Rail. Love the way.
Jake Moore is Global Cybersecurity Advisor for ESET. Our own Maria Vermazis caught up with him to get a glimpse into his recent InfoSecurity Europe keynote, the Deepfake Interview. All right, Jake, thank you so much for joining me today. It's a lovely, I'm so glad to meet you. I do. I heard so much about you, so I appreciate it. Well, Jake, you are, to me, a very well-known person, so I feel a little silly asking you to introduce yourself. But you've done a lot of public speaking, so I know this is de rigueur. So if you wouldn't mind starting us off with an intro, brag a little bit. Tell us about how awesome you are. Well, I'm not going to do that, but thank you ever so much. It's always great to be chatting to you, and it's amazing to be at InfoSec this year. Yeah, I can always start with the fact I love crime, because I genuinely do, but I like to...
test what cyber criminals are up to. I always like to look into the future a little bit as well and see what's coming around the corner that's maybe going to affect businesses in the future. And I'm lucky enough to test a lot of it out. So really, I've got this huge background and just enjoying watching how criminals work. But now I can ethically play around with those tools and really see how businesses can be protected. So it's a great win-win for everyone. I get to have fun. And all in the good spirit of learning about good old cyber education.
Yeah, and the work that you've done has been so fascinating to follow over the years. So I'm thrilled to hear that you're doing a keynote at InfoSec Europe this year where you're going to be sharing some of your findings that I feel almost obligatory AI mentioned. They are AI related. Of course, it has to be these days, isn't it? Of course, they have to be. Yes, indeed. Yeah. So maybe we start with the elevator pitch for your keynote. I know we don't want to give too much away, but so what are you going to be sharing with the audience this year? Well, it's pretty much what it says in the talk. It's a deep fake interview. I thought this year, why not just say exactly what it is?
I've been fascinated with these deepfake interviews for a couple of years, knowing that it's been possible that people have been actually getting jobs as other people. I've been trying it for a couple of years and I did try it two years ago and failed miserably. It was so bad. I just couldn't get it right using the deepfake technology that was available. Then moving on, I've been able to actually do it. And then I came up with this idea that I'd actually try it on someone, see if I could actually manipulate someone. So with permission from the CEO of the business, they let me try for a job and I got.
through a first interview, which I was so nervous about. So not just because I was using technology that could have failed at any moment, but I realized I hadn't been for many interviews in my life. I worked in the police force for 14 years. I only really had one interview. And then I've been working at ESET for eight years and only had one interview at the start then. So it all came back to me, all those nerves. That terrible feeling. Yeah. But do you know what? I thought that might help that I was nervous. Of course, if you're in an interview, you might be nervous. So I went with it and I had some fun. And within a few minutes, I realized that the deep fake technology that I was using had...
ultimately fooled them into thinking that I was a real person. They weren't asking me to do any tests or anything. Ironically, we even start talking about AI in the interview. It was brilliant. I was trying not to laugh. We had lots of fun. But yeah, I got around to another interview. I started doing a presentation. I got AI to write this PowerPoint. We had loads of fun. And ultimately, I did get offered the job. But it actually doesn't stop there. That isn't actually the ending of the whole talk. There's more to it, but I don't want to give away too much more. It gets funnier. That is wild. And yeah, definitely. So folks who are going to be attending at InfoSec Europe, you have to tell me what happens next.
No, I have been so fascinated to be following these stories about deepfake interviews. Seeing the viral videos from often the other end when someone goes, I caught someone trying to apply for this job rec that I had open. And it's been like so many things in InfoSec, that cat and mouse game. But the pace at which the technology has developed has been really astounding, especially when I think of the techniques that people have been told to sort of try and spot a deepfake interviewer. But very quickly, those techniques don't work anymore. What are your thoughts on all those kinds of things that you've been seeing there? I'm just curious because you've been in that world so much. Yeah. You've hit the nail on the head right there. There are loads of techniques like you can ask people to.
wave their hand in front of their face or talk about North Korea, funnily enough, what their thoughts are about the government there. I mean, it's kind of funny, but these don't always work, you know, because there are workarounds and the technology improves. I mean, I've seen that myself with the software that I've been using, how it improves over time. And I just think, gosh, in two years time, it's going to be even better. So it's difficult to say, hey, do this one thing and it's foolproof because as it's technology, it improves all the time. And criminals know exactly how to get around things because we as...
people in the industry are saying, oh, this is what you might need to look out for. And they go, right, okay, that's what we're going to do with version two. And they're very good at doing that. And so really, it comes down to verifying who people are in much better ways. But what I found is speaking to, in fact, I've been doing a lot of work with HR departments in different industries, which has been a brilliant insight for me, because it's not just cybersecurity professionals that I've been dealing with here. There's HR people who are brilliant people people. They know how to talk. They know how to get people to talk themselves. But they're not always aware of the technology that's available. And they are inundated.
with people going for their jobs that they have on offer. And so they've got to speed up the process. And lots of them, ironically, are also using AI. In fact, one of the interviews I went to, I actually spoke to an AI avatar in my very first interview. And I was using an AI avatar as a female. So it was AI talking to AI. It felt so strange. It was like an episode of Black Mirror, but it was fun. Yeah, I was going to say, I think from the InfoSec point of view, that is fun. And then zooming out, I go, what on earth does this mean for not just companies, but job seekers and for...
all of us and humanity? I mean, are we just going to go, no more remote interviews, everybody come back in person because we can't trust anything on the screen anymore? I really wonder. Well, I think we need a bit of both. So remote interviews, of course, they do so much to help the industry because some jobs, they have a thousand applicants go for this one role. So they're using lots of technology and remote interviews to whittle it down to the right numbers. But there has to be an element of human interaction at some point. I've spoken to huge companies, global companies that say this is impossible, but then they're starting to see...
the help that is on offer with third parties that get involved in other countries that might have contractors before they go and send out a laptop, because that's ultimately what they're wanting here. It's not just to get a job to get maybe your first month's paycheck. They want that laptop so they can break in from within. And that's what's powerful here. And that has been done. And so this really was a way to prove that anyone could fall for this. It's not to point fingers at those people that are on the other end of the interview, because...
So many people would fall for it and don't question it. But it's not known, especially in HR. Yeah. Yeah. I wonder what I imagine the advice would be changing almost day to day at this point. Or is it actually? Maybe I should not assume. What is the advice that we give organizations at this point? Yeah. To have at some point in that process to meet people in real life. The best thing would be to say, you know, just come to our head office and we can give you that laptop and we can check all the credentials. But at some point that can be manipulated. It's just social engineering at the highest level. There's always a reason. And by that time they've.
created a friendship. I mean, in one of my interviews, one of the HR people would say, oh my goodness, you'd so fit in here because I pretended that I had a teaching background. She was saying, oh, Janet used to be a teacher. You'd really get on with her. And by then I'm feeling like I know extra people in the organisation. And so if I then come up with a wonderful story about even just the trains are out today and I'm not going to get down and my family member has a problem, just like all those scams we hear in, say, romance scams, for example. By the time you've got that...
emotional investment in there, then it can be abused. And that's what I'm really trying to hit on. And it comes out, I use loads of the footage from the interviews because it really shows how these people get attached in these interviews. Oh gosh, yeah, because people want to trust. People want to create that connection. That's it. It's the beautiful part of humanity, but unfortunately it is so often exploited. And AI is such a fascinating accelerant of good and bad.
I feel like sometimes the best advice is for everyone to slow down, but that is tough advice to follow in today's business world. So I don't really know how that would work. So yeah. I love AI. I think everyone is playing with it and that's great. And if it can be used for efficiency, then fantastic. But yeah, we do need to have some of that time back because I think a lot of people are saying, oh, it can make me more productive. Well, then don't do more and that extra time has been given back. Take some time away if it's doing, say, a certain proportion of your job. That should be therefore something that we should take hold of and go and play with the kids, play with the dog, go and see some friends or family. That is when AI really helps out.
Yeah, that's what I'm waiting for is that part. So that's what I want to see as well. Yeah. Well, Jake, it's been a joy speaking with you. I want to make sure that you get the last word. And again, you're going to be doing the keynote at InfoSec Europe. So folks who are going to be attending that, you're in for a treat for sure. Anything else you want to mention to our audience today, Jake? Well, I think you mentioned the big word there. It's all about trust. Can we trust anyone these days? Is seeing, believing, or I can promise you this, on stage, it will be the real me. No deep fakes there. It won't be my avatars. It will be the real Jake Moore. And I'm hoping we get lots of people there. It'd be great to see you all there.
Wonderful. Thanks so much for speaking with me today, Jake. Appreciate it. Thank you. And of course, Maria Vermazis is host of the T-Space Cyber Podcast. You can find that right here on our network or wherever you get your favorite shows. Welcome aboard Via Rail. Please sit and enjoy. Please sit and stretch. Steep. Flip. Or that. And enjoy. Via Rail. Love the way. Spotify Ads Manager makes it easy to create your first audio ad in minutes for free. Sign up today, launch a campaign, and start reaching your audience.
And finally, according to The Register, Nicole Beckwith of Cribble recalls investigating a breach at a U.S. city where attackers first treated the network like tourists on a casual sightseeing trip. They played with conference room projectors, wandered through city systems, and eventually discovered controls tied to the municipal water utility. That is where the story stopped being funny. The attackers gained access through an account belonging to Greg from Auditing, a former employee who had not worked for the city in years.
Somehow, Greg's account still held domain admin privileges, SCADA operator access, and help desk permissions, which is an impressive resume for someone no longer on the payroll. Beckwith suspects attackers found Greg's credentials in a previous data leak and simply tried reused passwords until something worked. The incident highlights an old but persistent security problem, dormant accounts, excessive privileges, and the dangerous assumption that someone else surely handled off-boarding. As Beckwith put it, every forgotten account is just one bad day away from the evening news. And that's The Cyber Wire. For links to all of today's stories, check out our daily briefing at thecyberwire.com. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to cyberwire at n2k.com. N2K's lead producer is Liz Stokes. We're mixed by Trey Hester with original music and sound design by Elliot Keltzman. Our contributing host is Maria Vermazis. Our executive producer is Jennifer Iben. Peter Kilpie is our publisher. And I'm Dave Bittner.
Thanks for listening. We'll see you back here tomorrow.