Klue me in on the breach.

Key takeaways

Active Directory migrations require careful planning, especially around legacy encryption protocols like RC4, to avoid operational failures.
Organizations should proactively document their Active Directory environments, verify key configurations, and communicate with application owners to ensure smooth migrations.
The deprecation of RC4 is imminent, with a phased enforcement approach by Microsoft leading up to July 2026, making early remediation essential.
Security incidents continue to occur across the cyber landscape, emphasizing the importance of timely patching, vulnerability management, and monitoring.
Internal mishaps such as Meta's data exposure incidents demonstrate the critical need for rigorous access controls, especially when handling sensitive or extensive data for AI projects.
Cybercriminals are evolving, with new leak sites and marketplaces facilitating larger-scale extortion and fraud activities, underscoring the need for vigilant cybersecurity defenses.

Summary

Black Hat USA and Specterops Activities

The episode opens with promotional content for Black Hat USA, highlighting the Specterops Kennel Club activities, which include talks on AI attack strategies, identity trade craft, and open graph collector development. Attendees are encouraged to pre-register via Spectrops.io and visit the N2K CyberWire Podcast Studio for live recordings and expert conversations during the event.

Cybersecurity News Highlights and Threat Landscape

The episode covers recent security incidents and vulnerabilities, including a LastPass data breach affecting customer support data but not vaults, active exploitation of Cisco Unified CM vulnerabilities, and newly identified flaws like DiffieTap that could expose AI conversations. It also discusses the launch of a leak site by exploiters, a ransomware attack on Bajaj Auto in India, and U.S. efforts to scrutinize AI models for national security. Additional topics include sanctions against cybercriminal groups linked to Cambodia, and the rise of full-service cyber extortion marketplaces.

Expert Interview on Active Directory and RC4 Migration Challenges

The core of the episode features an in-depth interview with Mike Masciulli from Semperis, focusing on the upcoming deprecation of the RC4 encryption algorithm in Active Directory migrations. Key points include the technical challenges of migrating encrypted accounts, the hidden architectural issues that cause failures, and best practices for organizations to prepare. He emphasizes the importance of understanding password management, proactive documentation, and collaboration among stakeholders to ensure successful migrations before the July 2026 enforcement deadline.

Meta Employee Monitoring Program Mishap

The episode reports on Meta pausing a controversial employee monitoring program after an internal security breach exposed collected data, including keystrokes, mouse clicks, and screen content, due to misconfigured access controls. This incident underscores how data collection initiatives, especially those intended for AI training, can inadvertently create security vulnerabilities. The situation highlights the necessity of proper data governance and security in projects involving extensive internal data.

Show notes

LastPass says Klue breach affected customer information, but passwords remain secure. Attackers begin exploiting Cisco Unified CM vulnerability. CISA flags actively exploited Ubiquiti and Lantronix flaws, urges rapid patching. DifyTap flaws could expose private AI conversations across tenants. Researchers find AI plugin registry let unofficial tools masquerade as trusted software. xpl0itrs launches leak site, signaling shift toward full-service cyber extortion. Ransomware attack hits Indian auto giant Bajaj Auto. U.S. presses Meta to submit AI models for national security reviews. Alleged criminal marketplace administrator extradited to the US. U.S. expands sanctions against Cambodian scam network tied to cyber fraud operations. On today’s Industry Voices segment, we are joined by Mike Masciulli, Managing Director, Migration Products and Services at Semperis, discussing RC4 and AD Migration: The Break Scenarios Hiding in Your Source Domain. And a lesson in access control.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

On today’s Industry Voices segment, we are joined by Mike Masciulli, Managing Director, Migration Products and Services at Semperis, discussing RC4 and AD Migration: The Break Scenarios Hiding in Your Source Domain. If you enjoyed this conversation, check out the full interview here.

Selected Reading

Password manager maker LastPass says hackers stole customer support case data during Klue breach (TechCrunch)

Klue says hackers stole credential from 2022 that led to customer data breaches (TechCrunch)

Cisco Unified CM flaw CVE-2026-20230 now exploited in attacks (BleepingComputer)

U.S. CISA adds Ubiquiti UniFi OS and Lantronix EDS5000 plugin flaws to its Known Exploited Vulnerabilities catalog (SecurityAffairs)

DifyTap: Zafran discovers how attackers can silently wiretap AI data across tenants on a platform powering 1M+ apps (Zafran)

23 ClawHub Plugins Squat Official Org Scopes (Manifold Security)

Cyber Intel Brief: xpl0itrs Leak Site Launch (Dataminr)

Indian auto giant Bajaj Auto hit by ransomware incident (The Record)

U.S. Presses Meta to Agree to A.I. Reviews as Security Concerns Rise (NY Times)

Algerian Man Extradited to US for Running Cybercrime Marketplaces (SecurityWeek)

US adds sanctions against accused Cambodian scammers Prince Group (Reuters)

Ushering in the Next Frontier of Quantum Innovation (The White House)

Meta Exposed Data Internally From Its Controversial Employee-Tracking Program (WIRED)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.
Learn more about your ad choices. Visit megaphone.fm/adchoices