The feds flip the script.

Key takeaways

Comprehensive asset inventory and proactive vulnerability management are essential for securing modern infrastructure.
Critical vulnerabilities in widely used platforms like Git-T and supply chain elements such as npm mirrors pose significant risks and require urgent remediation.
Emerging standards like the Linux Foundation’s Trace aim to improve transparency and accountability in AI operations, addressing growing concerns over autonomous agent activities.
Exposed building automation systems in data centers and other facilities can be exploited remotely, emphasizing the need for better security controls and communication between IT and facilities teams.
Cybersecurity incidents highlight the importance of verification, as synthetic or manipulated breach data can mislead investigations and reporting.
Law enforcement continues to disrupt major nation-state hacking operations and mitigate risks to sensitive government and infrastructure sectors.

Summary

Global Cyber Threat Landscape and Government Disruptions

The episode opens with a focus on significant cyber operations disrupting or targeting U.S. and international agencies. The U.S. Justice Department reports the disruption of a Chinese hacking operation linked to intrusions at key government sectors like NASA, DOJ, the Federal Reserve, and the U.S. Senate, involving seized domains associated with hacking platforms QScan and QT router. Additionally, CISA reports over 100 water systems attacked in July, with Iranian threat actors exploiting vulnerabilities in operational technology connected via cellular modems. The episode highlights ongoing threats to critical infrastructure and the importance of reducing internet-facing attack surfaces.

Vulnerabilities and Exploits in Critical Infrastructure and Software

The podcast discusses recent vulnerabilities such as a critical flaw in Git-T, which allows for arbitrary command execution, and the abuse of npm mirrors hosting malicious pages disguised as Cloudflare verification screens. These exploits target both industrial control systems in water facilities and development platforms, showing the diverse attack vectors hackers utilize. Federal agencies are ordered to remediate the Git-T flaw by August 28th, emphasizing the need for rapid vulnerability management. The episode also emphasizes the risks of exposed building automation systems in data centers, potentially allowing remote control and manipulation that could impact operational stability.

Emerging Technologies and Standards in Cybersecurity

A significant portion of the episode covers innovations like the Linux Foundation’s Trace standard, which aims to create cryptographically verifiable records of AI agents' activities using hardware-backed technology. This aims to provide transparency and accountability for autonomous AI actions. Additionally, the episode highlights the increasing sophistication of AI-driven attacks, such as voice AI used to impersonate Apple support and phishing services like AnonyMousKIT that help criminals unlock stolen iPhones, illustrating the evolving landscape of cybercrime.

Cyber Risks in Business and Data Center Security

Industry experts discuss current security challenges faced by data centers, including the potential for exposed building automation systems to be exploited remotely. A detailed interview with Stephen Hilt from Trend AI emphasizes that most assets can be identified and mitigated through comprehensive inventory practices, but traditional security measures must evolve to address new attack surfaces. The conversation underscores the importance of protecting physical infrastructure, especially as AI and automation become integral to operational technology.

Notable Cyber Incidents and Legal Cases

The episode reviews recent cybersecurity incidents, including Boston Scientific experiencing a global operational disruption due to a cyberattack, and Troy Hunt’s analysis of the Carhartt data breach. Hunt uncovered synthetic data mixed with genuine customer data, illustrating the importance of verifying breach claims and preventing misinformation. Additionally, a case is discussed involving the arrest of a 21-year-old man accused of helping overseas scammers siphon over $7.5 million from elderly victims, highlighting ongoing scams and the role of money mules in cybercrime.

Show notes

The U.S. disrupts a Chinese hacking operation blamed for intrusions at several sensitive government agencies. CISA says more than 100 water systems were targeted in July. Attackers exploit a critical Gitea flaw, while malicious pages masquerade as Cloudflare verification screens. Cyber insurance claims get costlier, and AI agents break out of their sandboxes. Boston Scientific battles a cyber incident. Plus, a new standard tracks AI agent activity, criminals target stolen iPhones, and an alleged money mule is charged in a $7.5 million scam. Our guest is Stephen Hilt, Sr. Threat Researcher at TrendAI, on the risks facing data centers. Some breach data doesn’t quite measure up.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

On today’s Industry Voices, we are joined by Stephen Hilt, Sr. Threat Researcher at TrendAI discussing the cybersecurity risks facing data centers and the thousands of internet-exposed industrial control systems that could leave them vulnerable to attack. And if you enjoyed this conversation, be sure to check out the full interview here.

If you’d like to hear more on this topic from TrendAI, you can check out this recent episode of the AI Security Brief podcast that focuses on data center security. Guest Mark Houpt, CISO at DataBank, joined hosts Johnny Hand and Dustin Childs to explain why securing the AI era starts with protecting the physical data centers that power it—and why proven security fundamentals still matter against rapidly evolving threats. AI Security Brief podcast publishes every other Thursday on the N2K CyberWire network. Subscribe today!

Selected Reading

China-sponsored hacking platforms seized by US, Justice Department says (Reuters)

CISA: Over 100 Internet-Exposed Water Systems Targeted in July Cyberattacks (SecurityWeek)

Hackers now exploit critical Gitea flaw in code injection attacks (Bleeping Computer)

Hackers abuse npm mirrors to host phishing redirect pages (Bleeping Computer)

Average Cyber Insurance Losses Increase Despite Fewer Claims (Infosecurity Magazine)

VMs won't contain cyber-capable agents (Trail of Bits)

Boston Scientific hit by cyberattack, global operations affected (Reuters)

Linux Foundation Introduces TRACE Standard for AI Runtime Evidence (Infosecurity Magazine)

AnonyMousKIT PhaaS uses voice AI agents to phish iPhone passcodes (Bleeping Computer)

Indian man who fled US arrested on charges he helped scammers siphon $7.5 million from the elderly (The Record)

Trump signs memo to help drastically boost US commercial space launches (Reuters)

A Cautionary Tale About Data Breach Claims, Verification and Carhartt (Troy Hunt)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.
Learn more about your ad choices. Visit megaphone.fm/adchoices