A leak in the chain of command.

Host Dave Bittner opens with a report that an archive called IcePick has exposed information on more than 41,000 Department of Homeland Security employees and contractors—roughly one-seventh of the department’s workforce. Distributed Denial of Secrets published the material, which reportedly came from DHS’s Okta identity-management system. The exposed records include employee contact details, reporting relationships, and permissions for sensitive systems, giving adversaries a possible map of how the department operates. Wired’s analysis found references to undercover operations, surveillance programs, facial-recognition tools, and investigative platforms. Thousands of Immigration and Customs Enforcement and Customs and Border Protection personnel are reportedly included. Security experts warned that the information could enable targeted phishing, impersonation, and intelligence gathering, particularly when combined with other breached datasets. DHS said it was investigating, while Okta maintained that its systems had not been compromised. The hackers, who call themselves the Department of Peace, presented the release as government accountability. The episode’s title, “A leak in the chain of command,” reflects the practical risk: the records may reveal not just individual identities, but who reports to whom and which people can reach sensitive systems.

The briefing then turns to China-linked Volt Typhoon, whose methods are examined in reporting by Kim Zetter’s Zero Day newsletter. Lumen Technologies’ Black Lotus Labs identified what it calls Silent Train: a covert network of compromised routers, servers, and internet-connected devices used to reach sensitive American networks. Volt Typhoon can assemble a chain of compromised devices in less than two minutes, route activity through several countries, use the chain for one intrusion, and then dismantle it. The attackers erase logs and remove evidence, sometimes spending only minutes inside a network. Researchers identified more than 27 classes of compromised devices and at least four exploited zero-day vulnerabilities. Targets include government agencies, defense contractors, telecommunications companies, military research institutions, and operators of energy, water, and transportation infrastructure, with many victims in Hawaii, California, and Texas—locations important to U.S. military operations in the Indo-Pacific. Researchers believe the campaign combines espionage with preparation for possible disruption during a Taiwan-related conflict. Volt Typhoon has stolen military documents, mapped networks, and collected credentials, then returned weeks later using those credentials and new routes. The result is a maintained set of hidden access points that could remain dormant until needed.

Cisco patched a high-severity, actively exploited zero-day in its Adaptive Security Appliance and Firepower Threat Defense firewall software. The flaw affects devices with SSL VPN enabled and allows an unauthenticated attacker to crash them remotely, causing unexpected reboots and service disruption. Cisco confirmed exploitation earlier in the month but had not identified the attackers or their targets. The company urged customers to install the updates; organizations unable to patch were told they could mitigate the issue by disabling secondary authentication on affected VPN tunnel groups. Separately, Radware researchers described a suspected coordinated supply-chain attack against 61 public GitHub repositories, including projects associated with Google, Brave, and Trivi. They found 83 malicious submissions, most posted within a 43-minute period, and linked them to 74 GitHub accounts, many of which may have been compromised. The attacker hid commands in HTML comments inside issues and pull requests. Vulnerable CI/CD workflows could process that content automatically and attempt to steal environment variables, credentials, and access tokens. Researchers confirmed command execution in two cases but found no definitive evidence that repository permissions or downstream software had been compromised. They assessed that the likely goal was to gain access to trusted repositories and potentially distribute malicious code. Their recommendation was to restrict workflow permissions and treat all externally submitted content as untrusted.

Akamai’s latest State of the Internet report says online-scam detections doubled in a year and surpassed phishing for the first time. Researchers recorded 6.4 million scams in the second quarter of 2026, including fraudulent online stores, investment schemes, and payment scams. Phishing also rose 61%, with AI helping criminals produce more convincing lures and run shorter, more agile campaigns. A separate Identity Theft Resource Center report focused on victims: more than 80% of surveyed U.S. scam victims reported suicidal thoughts, and nearly nine in ten people who sought institutional help received no response. Some victims then paid supposed recovery services and were exposed to additional fraud. The briefing also covers NIST guidance for federal agencies moving to post-quantum cryptography. Under a June executive order, agencies must adopt quantum-resistant key establishment by the end of 2030 and digital signatures by the end of 2031. NIST recommends prioritizing sensitive, long-lived data that could be collected now and decrypted later, allowing hybrid encryption for especially critical systems, and assessing cryptographic supply chains. CISA meanwhile warned that attackers are exploiting a VMware ESXi flaw that permits certain administrator operations without audit logs. CrowdStrike attributed earlier exploitation to China-linked Warp Panda, including intrusions against U.S. organizations such as law firms. Although the flaw has a low severity rating, it can obstruct forensic investigations; federal agencies have two weeks to patch.

The Federal Election Commission took several systems offline after reports of an attempted cyberattack only days before the U.S. midterm elections. Electronic filing, campaign-finance searches, and reporting tools were unavailable, preventing organizations from submitting required disclosures about political spending. The FEC said it had identified an issue and was implementing a fix, although multiple services remained down. Because record sums were flowing into congressional campaigns, experts warned that interruptions could damage financial transparency and public confidence. The briefing emphasizes that the FEC regulates campaign finance but does not administer elections: the incident did not directly affect voting systems or ballot casting. The episode also reports the sentencing of 36-year-old Ukrainian national Artem Stryzak to nearly six years in U.S. prison for participating in the Nephilim and Hive ransomware operations. Stryzak pleaded guilty to attacks that encrypted systems and demanded payment, including attacks against healthcare organizations during the COVID-19 pandemic. He joined Nephilim in 2021 and agreed to give the operation 20% of his ransom proceeds in exchange for malware access. He later became an early Hive affiliate and participated in attacks against seven organizations, including healthcare providers and law firms. The FBI helped one victim recover files without paying. Authorities continue to seek alleged Nephilim administrator Volodymyr Timoshuk; the State Department is offering up to $11 million for information leading to his arrest, conviction, or location.

In the Industry Voices interview, Bittner speaks with Yonald Chery, CTO of the Technology Advancement Center, or TAC, a 501(c)(4) nonprofit based in Columbia, Maryland. TAC focuses on emerging technology’s national-security opportunities and threats through three lines of effort: training, acceleration, and connection. It trains audiences from young people to experienced military and government professionals; accelerates government access to commercial capabilities through technology scouting; and connects stakeholders through events. Chery cites Defend the Rail and Defend the Airport events, including an OT cyber range replicating a dual-use airport whose critical operations were then red-teamed. Chery says the main gap between new technology and government users is often acquisition speed rather than engineering. Cyber capabilities can become stale within weeks or months, especially with AI accelerating change, while traditional government purchasing processes move too slowly. He also says government customers need help sorting through a rapidly changing market. TAC distinguishes IT, which moves, processes, or stores digital information, from OT, which monitors or controls physical equipment and processes such as factories, power grids, water treatment, and building HVAC. IT practices such as scanning, updating, or taking systems offline can be dangerous in OT environments that must run continuously. TAC’s five-day, vendor-neutral OT boot camp—funded for eligible Maryland workers through a Department of Labor Lighthouse grant—reskills IT professionals and helps OT operators develop cyber knowledge.

Chery explains that TAC’s training is deliberately hands-on rather than limited to virtual simulations. Students wire circuits, connect programmable logic controllers, program them, and learn OT protocols. People accustomed to Python, JavaScript, or HTML discover that PLC programming uses a substantially different approach, including ladder logic and structured tasks. Students also interpret and alter messages on the wire so they can understand how the systems communicate and how changes affect operations. The course rotates students through a sequence Chery calls “hack, operate, defend.” They first operate the plant, then defend it, and finally attack it from a cyber perspective. That rotation is intended to make participants understand both the physical consequences of a cyber event and the constraints faced by defenders. Chery says the course welcomes several types of students: IT professionals moving into critical-infrastructure defense, OT operators who have little cybersecurity experience, and novices with neither background. IT professionals learn which familiar security practices must be adapted; OT operators learn why networks and devices are configured in particular ways and how to communicate with cyber professionals and incident responders; beginners receive a foundation for further training. TAC also connects commercial vendors with government mission partners through Small Business Wednesday. Since Chery joined in mid-2024, hundreds of companies have visited. TAC offers product validation, business-planning advice, and introductions when a vendor appears to match a government problem, while its facility lets government and vendors meet and demonstrate products without immediately dealing with the overhead of secured spaces.

Asked about AI, Chery describes two effects on TAC and its mission customers. The first runs from “data to decision”: AI compresses the time needed to process raw information into substantiated, pre-decisional insights. The second runs from “decision to action”: AI can evaluate more possible outcomes and scenarios, improving analysis of alternatives and supporting faster, better-informed human decisions. Chery warns that the same machine-scale advantages are available to adversaries. He identifies deception, saturation, and acceleration as recurring concerns. AI can create false signals that traditional processes interpret as genuine, producing deception at scale. It can overwhelm sensors and analysts with machine-generated noise, creating saturation. And everything happens at mission speed, increasing the consequences of both problems. Chery says these concerns resemble data-science challenges discussed roughly 15 years earlier: deception concerns the veracity of data, saturation its volume, and acceleration its velocity. In his view, AI is an accelerant of problems data scientists have already begun addressing rather than an entirely new category of problem. For listeners seeking to enter OT cybersecurity, Chery recommends starting with TAC’s OT boot camp if they qualify for the grant, building an IT-cyber foundation through training and certifications, and exploring online open-source OT packages. He invites interested people to contact TAC for advice on developing further OT skills.

The final item describes HeatBit’s BitWater, an $899 replacement heating element that places 20 Bitcoin-mining chips in a household water heater. HeatBit’s premise is that Bitcoin mining produces heat, so the mining hardware can heat domestic water while sending mining proceeds to the homeowner. The unit is intended to fit many conventional electric water heaters, operate without noisy fans, and begin shipping in early 2027. The financial comparison is less attractive than the engineering idea. A conventional heating element costs less than $30. HeatBit’s estimates suggest the mining component might generate about $1 per day, which could recover the premium in roughly three years. The episode notes that this calculation depends on volatile cryptocurrency economics, the longevity of the hardware, and how much hot water a household uses. The program’s “Return on Investment Desk” offers a sharply different conclusion: it says it would take more than 300 years of Bitcoin mining to break even. Bittner closes with the joke that, whether or not BitWater saves money, a morning shower might at least contribute to a retirement portfolio.