Storm Watch by GreyNoise Intelligence

Storm⚡️Watch is a weekly podcast and livestream that digs deep into various cybersecurity topics and internet exploitation trends. Our goal is simple: to deliver insightful analyses, thought-provoking perspectives, timely updates and the occasional hot-take on the ever-evolving cybersecurity landscape.

Cyber Threat Showdown: TikTok Malware, Exploit Scoring Wars & Real-World Attacks 06/03/2025

Cyber Threat Showdown: TikTok Malware, Exploit Scoring Wars & Real-World Attacks Forecast = Stormy with a chance of TikTok malware showers—exploit scoring systems hot, but patch management outlook remains partly cloudy. Welcome to Storm⚡️Watch! In this episode, we’re diving into the current state of cyber weather with a mix of news, analysis, and practical insights. This week, we tackle a fundamental question: are all exploit scoring systems bad, or are some actually useful? We break down the major frameworks: **CVSS (Common Vulnerability Scoring System):** The industry standard for assessing vulnerability severity, CVSS uses base, temporal, and environmental metrics to give a comprehensive score. It’s widely used but has limitations—especially since it doesn’t always reflect real-world exploitability. **Coalition Exploit Scoring System (ESS):** This system uses AI and large language models to predict the likelihood that a CVE will be exploited in the wild. ESS goes beyond technical severity, focusing on exploit availability and usage probabilities, helping organizations prioritize patching with better accuracy than CVSS alone. **EPSS (Exploit Prediction Scoring System):** EPSS is a data-driven approach that estimates the probability of a vulnerability being exploited, using real-world data from honeypots, IDS/IPS, and more. It updates daily and helps teams focus on the most urgent risks. **VEDAS (Vulnerability & Exploit Data Aggregation System):** VEDAS aggregates data from over 50 sources and clusters vulnerabilities, providing a score based on exploit prevalence and maturity. It’s designed to help teams understand which vulnerabilities are most likely to be actively exploited. **LEV/LEV2 (Likely Exploited Vulnerabilities):** Proposed by NIST, this metric uses historical EPSS data to probabilistically assess exploitation, helping organizations identify high-risk vulnerabilities that might otherwise be missed. **CVSS BT:** This project enriches CVSS scores with real-world threat intelligence, including data from CISA KEV, ExploitDB, and more. It’s designed to help organizations make better patching decisions by adding context about exploitability. Next, we turn our attention to a troubling trend: malware distribution via . Attackers are using AI-generated videos, disguised as helpful software activation tutorials, to trick users into running malicious PowerShell commands. This “ClickFix” technique has already reached nearly half a million views. The malware, including Vidar and StealC, runs entirely in memory, bypassing traditional security tools and targeting credentials, wallets, and financial data. State-sponsored groups from Iran, North Korea, and Russia have adopted these tactics, making it a global concern. For employees, the takeaway is clear: never run PowerShell commands from video tutorials, and always report suspicious requests to IT. For IT teams, consider disabling the Windows+R shortcut for standard users, restrict PowerShell execution, and update security awareness training to include social media threats. We also highlight the latest from Censys, VulnCheck, runZero, and GreyNoise—industry leaders providing cutting-edge research and tools for vulnerability management and threat intelligence. Don’t miss GreyNoise’s upcoming webinar on resurgent vulnerabilities and their impact on organizational security. And that’s a wrap for this episode! We will be taking a short break from Storm Watch for the summer. We look forward to bringing more episodes to you in the fall! /episode/index/show/dba89b63-ae17-42b2-a104-6ef9f0463061/id/36835190

ASUS Router Botnet Attack: AI Uncovers Hidden Backdoor 05/27/2025

ASUS Router Botnet Attack: AI Uncovers Hidden Backdoor Forecast = Mostly cloudy with a chance of rogue SSH access—keep your patches up to avoid a phishy forecast! Welcome to Storm⚡️Watch, where we unpack the latest in cybersecurity threats, research, and the tools that keep the digital world safe. In this episode, we invite GreyNoise Security Architect and researcher Matthew Remacle (a.k.a., Remy) to kick things off with a deep dive into a fascinating and highly sophisticated botnet campaign targeting ASUS routers—a story that starts with a little help from machine learning and ends with some hard lessons for defenders everywhere. GreyNoise researchers spotted this campaign using SIFT, their AI-powered network traffic analyzer, which sifted through more than 23 billion network entries and managed to flag just 30 suspicious payloads targeting ASUS routers. What made this botnet stand out was its surgical precision and stealth—far from the usual noisy, attention-grabbing attacks. The attackers knew exactly what they were doing, focusing on disabling TrendMicro security features embedded in the routers, essentially breaking in by first turning off the alarm. The attack chain reads like a masterclass in persistence: brute force and clever authentication bypasses got them in the door, a null byte injection tricked the router’s authentication system, and a command injection vulnerability allowed them to manipulate logging features in a way that opened up even more attack paths. The real kicker? The final backdoor was installed using legitimate ASUS features, meaning it could survive firmware updates and stay hidden from traditional detection methods. This campaign affected thousands of routers globally, with over 4,800 compromised devices detected and counting. Even after ASUS released a patch—adding character validation rather than fixing the underlying flaw—researchers found that the fundamental vulnerability remained, and attackers could potentially work around the patch. This story highlights the ongoing challenges in IoT security: complexity breeds vulnerability, persistence is a nightmare to detect and remove when attackers use legitimate features, and patches often address symptoms rather than root causes. It’s a reminder that traditional signature-based detection is no longer enough—behavioral analysis and AI-driven anomaly detection are now essential for spotting these advanced threats. We also touch on the bigger picture: the evolving cat-and-mouse game between attackers and defenders, the importance of defense in depth, and why understanding normal network behavior is more critical than ever. Plus, we look at the human element—attackers who are patient, technically sophisticated, and deeply aware of how to evade detection. For organizations, the takeaways are clear: defense in depth, behavioral monitoring, asset management, and patch management are all non-negotiable. And for everyone else, it’s a reminder that the devices we trust to protect us are themselves complex and potentially vulnerable computers. Later in the episode, we take a closer look at vulnerability scoring systems—CVSS, EPSS, and SSVC—and why reading between the scores is so important for risk management. We also highlight the value of fresh, actionable data from sources like Censys and VulnCheck, and round things out with a nod to the ongoing conversation happening on the GreyNoise blog. Thanks for tuning in to Storm⚡️Watch. Stay vigilant, keep learning, and remember: in cybersecurity, the difference between safe and compromised can be as subtle as a single null byte. /episode/index/show/dba89b63-ae17-42b2-a104-6ef9f0463061/id/36732020

AI Layoffs, Bug Bounty Fails & Cyber Workforce Crisis 05/13/2025

AI Layoffs, Bug Bounty Fails & Cyber Workforce Crisis Forecast = Expect scattered AI layoffs, a flurry of bogus bug bounties, and a persistent workforce drought-so keep your firewalls up and your résumés handy! ‍ On this episode of GreyNoise Storm⚡️Watch, we kick things off with our usual round of introductions before diving into the latest cyber weather and threat landscape. If you’re new here, Storm⚡️Watch is where we break down what’s moving the needle in cybersecurity, spotlighting the people, tools, and trends shaping the field. For , we’re feeling nostalgic and asking: What do you miss most from the Slow Internet days? Whether it’s the wild west of Myspace, the quirky chaos of Fark, the creative playground of Wattpad, or the endless flash animations on Albino Blacksheep, we want to know what old-school internet experience you’d revive if you could. We’re also talking about the pitfalls of . The open-source project curl has had enough of users flooding them with AI-generated “slop” vulnerabilities that waste maintainers’ time and don’t actually move security forward. It’s a reminder that, despite the hype, AI isn’t a silver bullet for finding real bugs and can actually create more noise than signal. Speaking of AI, the conversation shifts to how major companies are reshaping their workforce in the name of artificial intelligence. just announced it’s cutting 5% of its jobs, citing AI-driven restructuring and the need for efficiency. It’s not just CrowdStrike- is pushing AI into every corner of its product and workflow, with leadership urging engineers to “start with AI for every task,” even as they admit the tech is still error-prone and often less effective than human effort. The end result? Workers are being asked to manage and troubleshoot clumsy AI tools instead of using their expertise, and users are left with content that’s sometimes flat-out wrong or just less engaging than before. But while AI is shaking up tech jobs, the cybersecurity workforce shortage isn’t going away. The has been revived in Congress to address the growing gap, offering full scholarships for two-year degrees in cyber fields in exchange for government service. It’s aimed at making it easier for people to pivot into cyber careers, especially as professionals in other sectors worry about AI-driven job cuts. The Act is being administered by CISA and is designed to streamline the path into government cyber roles, including those requiring security clearances. As always, we spotlight some of the latest developments from , , , and ; then wrap up with some quick goodbyes and reminders to check out the latest from all our partners and contributors. Thanks for tuning in to Storm⚡️Watch-where the only thing moving faster than the threats is the conversation. /episode/index/show/dba89b63-ae17-42b2-a104-6ef9f0463061/id/36550030

Biggest Cybersecurity Threats EXPOSED: Zero-Day Attacks, Chinese Hackers & Enterprise Breaches 05/06/2025

Biggest Cybersecurity Threats EXPOSED: Zero-Day Attacks, Chinese Hackers & Enterprise Breaches Forecast = Cloudy with a chance of zero-days-watch for Spellbinder storms and scattered Git leaks! ‍ On this episode of Storm⚡️Watch, the crew dives into the fast-moving world of vulnerability tracking and threat intelligence, spotlighting how defenders are moving beyond the traditional CVE system to keep pace with real-world attacks. The show kicks off with a look at the latest listener poll, always a source of lively debate, before jumping into some of the most pressing cybersecurity stories of the week. A major focus of this episode is the recent revelation that a China-aligned APT group, dubbed TheWizards, is using a tool called for adversary-in-the-middle attacks. This technique lets attackers move laterally through networks by hijacking software update mechanisms-specifically targeting popular Chinese applications like Sogou Pinyin and Tencent QQ-to deliver malicious payloads such as the modular WizardNet backdoor. The crew unpacks how this approach leverages IPv6’s stateless address autoconfiguration to intercept and redirect legitimate traffic, underscoring the evolving sophistication of lateral movement techniques in targeted campaigns. The episode then turns to , which reports a drop in the total number of zero-days exploited compared to last year but highlights a worrying shift: attackers are increasingly targeting enterprise products and infrastructure. Microsoft, Ivanti, Palo Alto Networks, and Cisco are among the most targeted vendors, with nearly half of all zero-day exploits now aimed at enterprise systems and network appliances. The discussion covers how attackers are chaining vulnerabilities for more impactful breaches and why defenders need to be vigilant as threat actors pivot to harder-to-monitor enterprise environments. is in the spotlight for its recent research and tooling, including a new Ports & Protocols Dashboard that gives organizations granular visibility into their attack surface across all ports and protocols. This helps teams quickly spot risky exposures and misconfigurations, making it easier to prioritize remediation efforts and automate alerting for high-risk assets. The crew also highlights Censys’s collaborative work on botnet hunting and their ongoing push to retire stale threat indicators, all of which are reshaping proactive defense strategies. latest insights emphasize the importance of prioritizing risks at the asset stack level, not just by CVE. The crew explains how misconfigurations, outdated software, and weak network segmentation can create stacked risks that traditional scanners might miss, urging listeners to adopt a more holistic approach to asset management and vulnerability prioritization. Rounding out the episode, shares new research on a dramatic spike in scanning for Ivanti Connect Secure VPNs and a surge in crawling activity targeting Git configuration files. These trends highlight the persistent risk of codebase exposure and the critical need to secure developer infrastructure, as exposed Git configs can lead to the leak of sensitive credentials and even entire codebases. As always, the show wraps up with some final thoughts and goodbyes, leaving listeners with actionable insights and a reminder to stay vigilant in the face of rapidly evolving cyber threats. If you have questions or want to hear more about any of these topics, let us know-what’s on your mind this week? /episode/index/show/dba89b63-ae17-42b2-a104-6ef9f0463061/id/36455630

2025 Cybersecurity Report Breakdown: FBI, Mandiant, GreyNoise, VulnCheck 04/29/2025

2025 Cybersecurity Report Breakdown: FBI, Mandiant, GreyNoise, VulnCheck Forecast = Scattered phishing attempts with a 90% chance of encrypted clouds. ‍ In this episode of Storm⚡️Watch, the crew dissects the evolving vulnerability tracking landscape and the challenges facing defenders as they move beyond the aging CVE system. The show also highlights the rise of sophisticated bot traffic, the expansion of GreyNoise’s Global Observation Grid, and fresh tools from VulnCheck and Censys that are helping security teams stay ahead of real-time threats. In our listener poll this week, we ask: what would you do if you found a USB stick? It’s a classic scenario that always sparks debate about curiosity versus caution in cybersecurity. It’s officially cyber report season, and we’re breaking down the latest findings from some of the industry’s most influential threat intelligence teams. spotlights the growing risk from resurgent vulnerabilities-those old flaws that go quiet for years before suddenly making a comeback, often targeting edge devices like routers and VPNs. The revealing a record $16.6 billion in reported losses last year, with phishing, extortion, and business email compromise topping the charts. , , and other reports all point to a relentless pace of vulnerability weaponization, with nearly a third of new CVEs being exploited within 24 hours of disclosure. We also dig into a series of ace blog posts and research from , including their push to end stale indicators and their deep dives into the sharp rise in attacks targeting edge security devices. Their recent work with GreyNoise and CursorAI on botnet hunting, as well as their new threat hunting module, are changing the game for proactive defense. VulnCheck’s quarterly report is raising eyebrows with the revelation that 159 vulnerabilities were exploited in Q1 2025 alone, and 28% of those were weaponized within a single day of disclosure. This underscores how quickly attackers are operationalizing new exploits and why defenders need to move faster than ever. We round out the show with the latest from runZero and a look at GreyNoise’s recent findings, including a ninefold surge in Ivanti Connect Secure scanning and a spike in Git configuration crawling-both of which highlight the ongoing risk of codebase exposure and the need for continuous vigilance. /episode/index/show/dba89b63-ae17-42b2-a104-6ef9f0463061/id/36358310

CVE Chaos: The Fragmented Future of Vulnerability Tracking, Bad Bots & Real-Time Threat Intel 04/22/2025

CVE Chaos: The Fragmented Future of Vulnerability Tracking, Bad Bots & Real-Time Threat Intel Forecast = Prepare for scattered CVEs, rising bot storms, and real-time threat lightning. Keep your digital umbrellas handy! ‍ On this episode of Storm⚡️Watch, we’re breaking down the latest shifts in the vulnerability tracking landscape, starting with the ongoing turbulence in the As the MITRE-run CVE system faces funding uncertainty and a potential transition to nonprofit status, the global security community is rapidly adapting. New standards and databases are emerging to fill the gaps—Europe’s ENISA is rolling out the to ensure regional control, while China continues to operate its own state-mandated systems. Meanwhile, the CVE ecosystem’s chronic delays and the NVD’s new “Deferred” status for tens of thousands of older vulnerabilities are pushing teams to look elsewhere for timely, enriched vulnerability data. Open-source projects like OSV.dev and commercial players such as VulnCheck and Snyk are stepping up, offering real-time enrichment, exploit intelligence, and predictive scoring to help organizations prioritize what matters most. The result is a fragmented but innovative patchwork of regional, decentralized, open-source, and commercial solutions, with hybrid approaches quickly becoming the norm for defenders worldwide. We’re also diving into which reveals that nearly a third of all internet traffic last year came from malicious bots. These bots are getting more sophisticated—using residential proxies, mimicking human behavior, and bypassing traditional defenses. The report highlights a surge in account takeover attacks and shows that industries like entertainment and retail are especially hard hit, with bot traffic now outpacing human visitors in some sectors. The rise of simple bots, fueled by easy-to-use AI tools, is reshaping the threat landscape, while advanced and evasive bots continue to challenge even the best detection systems. On the threat intelligence front, GreyNoise has just launched its —now the largest deception sensor network in the world, with thousands of sensors in over 80 countries. This expansion enables real-time, verifiable intelligence on internet scanning and exploitation, helping defenders cut through the noise and focus on the threats that matter. GreyNoise’s latest research shows attackers are exploiting vulnerabilities within hours of disclosure, with a significant portion of attacks targeting legacy flaws from years past. Their data-driven insights are empowering security teams to prioritize patching and response based on what’s actually being exploited in the wild, not just theoretical risk. We’re also spotlighting Censys and its tools for tracking botnets and advanced threats, including collaborative projects with . Their automated infrastructure mapping and pivoting capabilities are helping researchers quickly identify related malicious hosts and uncover the infrastructure behind large-scale attacks. Finally, continues to bridge the gap during the CVE program’s uncertainty, offering autonomous enrichment, real-time exploit tracking, and comprehensive coverage—including for CVEs that NVD has deprioritized. Their Known Exploited Vulnerabilities catalog and enhanced NVD++ service are giving defenders a broader, faster view of the threat landscape, often surfacing critical exploitation activity weeks before it’s reflected in official government feeds. As the vulnerability management ecosystem splinters and evolves, organizations are being forced to rethink their strategies—embracing a mix of regional, open-source, and commercial intelligence to maintain visibility and stay ahead of attackers. The days of relying on a single source of truth for vulnerability data are over, and the future is all about agility, automation, and real-time insight. /episode/index/show/dba89b63-ae17-42b2-a104-6ef9f0463061/id/36264145

Cyber Threat Horizon: InfosecSherpa Interview, Ukraine Drone Malware, & VulnCon Recap 04/15/2025

Cyber Threat Horizon: InfosecSherpa Interview, Ukraine Drone Malware, & VulnCon Recap Forecast = Scattered exploits, Mirai storms brewing, and rogue drones dropping malware over Russia. Keep your firewalls up—a vulnerability front is rolling in fast! ‍ On this episode of Storm⚡️Watch, we’re bringing you a packed episode that covers the latest in cyber threat intelligence, industry news, and a few stories you won’t want to miss. We kick things off with our usual round of introductions and a quick look at the cyber weather, setting the stage for what’s happening across the threat landscape. In our first segment, Tod shares his wrap-up from , highlighting the key takeaways and emerging trends from this year’s conference. From new vulnerability research to the latest in exploit techniques, Tod breaks down what security professionals need to know and what’s likely to shape the industry in the coming months. Next up, we sit down with , better known as InfosecSherpa, for an interview that traces her journey from librarian to cybersecurity professional. Tracy shares insights on career pivots, the importance of information literacy in security, and her ongoing work to make the field more accessible. Her story is a must-listen for anyone considering a move into cyber or looking for inspiration from someone who’s successfully navigated the transition. We then turn our attention to a headline-grabbing story out of , where reports indicate that drones sent into Russian territory are not just for surveillance or kinetic impact—they’re also carrying malware designed to infect military systems if captured. This blend of physical and cyber warfare is a stark reminder of how modern conflicts are increasingly fought on multiple fronts, with digital payloads now as critical as traditional munitions. If we need to fill a little extra time, we’ll explore some of the more bizarre aspects of hybrid warfare, including reports of weaponized consumer goods—think exploding sex toys and cosmetics—being used as part of psychological and disruption campaigns targeting the West. It’s a strange new world where almost anything can be turned into a tool of conflict. We also spotlight recent research from Censys on the attacks, which underscore the need for advanced defenses as attackers continue to exploit edge devices and cloud infrastructure. Their findings highlight the importance of proactive monitoring and rapid response to emerging threats. On the GreyNoise front, we’ve observed a threefold surge in exploitation attempts targeting , likely linked to Mirai botnet activity. This uptick is a clear signal that attackers are constantly scanning for vulnerable devices to conscript into their botnets, and it’s a reminder for defenders to stay vigilant and patch exposed systems. As always, we wrap up with a round of goodbyes and a reminder to subscribe for more insights, interviews, and real-time threat intelligence. Thanks for tuning in to Storm⚡️Watch—where we keep you ahead of the cyber storms. /episode/index/show/dba89b63-ae17-42b2-a104-6ef9f0463061/id/36153705

2025 Cyber Breakdown: CrushFTP Chaos, NVD Crisis & North Korean Threats 04/08/2025

2025 Cyber Breakdown: CrushFTP Chaos, NVD Crisis & North Korean Threats Forecast: Patchy with a 32% backlog surge, CVE squalls causing auth bypass showers, and Lazarus fronts looming—keep your threat umbrellas handy!" 🌩️☔ We’re kicking things off with a deep dive into the chaotic world of CVEs. The vulnerability saga is a case study in how bureaucracy can collide with real-world threats. When a critical auth bypass flaw emerged in March 2025, patches rolled out quickly, but the CVE process stumbled—two different identifiers (CVE-2025-2825 and CVE-2025-31161) were assigned by competing firms, VulnCheck and Outpost24. The resulting confusion left organizations scrambling as exploit activity spiked, with Shadowserver tracking over 1,800 vulnerable instances initially. CrushFTP blamed security researchers for accelerating attacks, while defenders faced the nightmare of reconciling conflicting vulnerability tracking. The (NVD) isn’t making life easier either. Despite processing CVEs at pre-2024 rates, a 32% surge in submissions has created a growing backlog. NIST’s March 2025 update reveals they’re exploring machine learning to automate tasks, but with older CVEs now being marked “deferred,” many legacy systems might fly under the radar. It’s a stark reminder that even foundational security infrastructure is buckling under scale. Shifting gears to nation-state threats, IT workers are running a global shadow IT empire. Google’s threat team uncovered operatives managing 12+ fake personas across Europe and the US, targeting defense contractors and governments. Their projects range from blockchain job marketplaces to AI-driven web apps, funded through crypto and freelance platforms like Upwork. The plot thickens with BYOD policies becoming an unwitting accomplice—these workers exploit virtualized environments to avoid detection, while extortion schemes spike amid increased law enforcement pressure. Rounding out the episode, we’ll touch on critical advisories from Censys, VulnCheck, runZero, and GreyNoise—including the CrushFTP auth bypass and a new Ivanti Connect Secure RCE flaw. /episode/index/show/dba89b63-ae17-42b2-a104-6ef9f0463061/id/36053590

Cybercrime Evolution: Robot Dog Backdoors & Mob's Digital Takeover 04/01/2025

Cybercrime Evolution: Robot Dog Backdoors & Mob's Digital Takeover Forecast = Cloudy with a chance of cyber meatballs. ‍ We're not fooling around in this episode of Storm⚡️Watch! The show kicks off with some positive news about the returning to full operations following a cyberattack. This is followed by important information for VMware users regarding Broadcom's significant licensing changes effective April 10, including an increase in minimum core requirements from 16 to 72 cores per command line and a new 20% penalty for late subscription renewals that will be applied retroactively. The crew then reviews results from their recent poll asking listeners which feature of encrypted messaging apps concerns them most, with options including data storage, unencrypted backups, metadata, and accidental adds. In our first segment, we discuss security concerns with the Unitree Go1 consumer-grade , specifically focusing on the recently disclosed Zhexi Oray Tunnel backdoor that has raised alarm in the security community. Next up, the team explores and their SparrowDoor malware, examining the techniques and implications of this threat actor's operations. In light of recent event, the hosts provide comprehensive guidance on secure messaging practices, drawing from recent and articles. They emphasize that secure communication depends not just on the app but also on how you use it. Key recommendations include choosing contacts wisely, securing your devices by using personal rather than work equipment, setting messages to automatically delete, and selecting the right messaging apps with Signal being the top recommendation for its verifiable end-to-end encryption. They also warn about potential vulnerabilities in cross-platform messaging and advise caution with apps like Telegram. We quickly review on the evolving landscape of organized crime, which now heavily intersects with cybercrime. Traditional criminal networks have transformed into technology-driven enterprises using AI, blockchain, and cryptocurrency to enhance their operations. The internet has become the primary theater for organized crime with data as the new currency of power. The report identifies seven key threat areas and calls for improved global financial security measures, noting that criminal asset confiscation remains stagnant at around 2%. Finally, we conclude with updates from our benevolent overlords, including Censys' reports on vulnerabilities and Kubernetes issues, VulnCheck's partnership with , runZero's approach to , and GreyNoise's observations on router activity and scanner activity that may indicate upcoming threats. /episode/index/show/dba89b63-ae17-42b2-a104-6ef9f0463061/id/35960680

OpenAI 'Attack' Debunked: The Real Threat Lurking in Third-Party Wrappers 03/25/2025

OpenAI 'Attack' Debunked: The Real Threat Lurking in Third-Party Wrappers Forecast: Cloudy with a chance of SSRF attacks. OpenAI's skies clear, but third-party wrappers bring storms. ‍ This week’s episode kicks off with a asking listeners which virtual assistant they use—Alexa, Siri, Google Assistant, or none at all due to privacy concerns. The results give us a snapshot of how people feel about these ubiquitous technologies and their trust levels in them. We then tackle the headlines surrounding and the alleged "attack" on its systems. While media outlets are buzzing with claims of vulnerabilities in ChatGPT, the reality is less dramatic. A third-party wrapper using OpenAI’s API introduced an SSRF vulnerability that’s being actively exploited. This issue highlights the risks of insecure third-party implementations rather than flaws in OpenAI's core infrastructure. It’s a reminder that integrations can be a weak link in the cybersecurity chain, and we explore how this misunderstanding has fueled sensationalized reporting. Next up is a discussion on cybersecurity labeling for consumer that have reached their End-of-Life (EOL) or End-of-Service (EOS). The idea is to inform users when their devices will no longer receive updates, but the execution is fraught with challenges. From complex software stacks to secondary markets breaking communication chains between vendors and consumers, we unpack why this labeling initiative is easier said than done. With home networks increasingly tied to employer networks, outdated IoT devices could become major security risks, especially in remote work setups. Privacy concerns take center stage as we examine controversial decision to eliminate the "Do Not Send Voice Recordings" feature on Echo devices starting March 28, 2025. This change means all voice data will be processed in Amazon’s cloud as part of its Alexa+ upgrade, which promises advanced generative AI capabilities. Critics argue this move erodes user privacy by removing local processing options entirely, raising questions about data retention and misuse. For privacy-conscious users, this might signal the end of their relationship with Echo devices. We also cover two critical vulnerabilities making waves in the cybersecurity world. First is , a post-authentication Remote Code Execution flaw in Veeam Backup & Replication software. Exploitable by any domain user due to weak authentication measures and unsafe deserialization practices, this vulnerability underscores why blacklist-based approaches are insufficient for robust security. Then there’s , a remote code execution vulnerability affecting Apache Tomcat servers that can be exploited with just one PUT request. This attack leverages session persistence mechanisms and deserialization processes to gain full remote access without authentication—a stark reminder of how seemingly benign requests can lead to catastrophic breaches. Finally, we touch on updates from our benevolent overlords, including insights into and upcoming events like . These resources continue to provide valuable intelligence for staying ahead of emerging threats in the cybersecurity landscape. /episode/index/show/dba89b63-ae17-42b2-a104-6ef9f0463061/id/35854975

Unforgivable Vulnerabilities & The Ballista Botnet Nightmare: Why Your Router Might Be Part of a Global Attack 03/18/2025

Unforgivable Vulnerabilities & The Ballista Botnet Nightmare: Why Your Router Might Be Part of a Global Attack Forecast = Router-geddon: Ballista storms brewing with a chance of unforgivable vulnerabilities. Patch umbrella required. ‍ In this episode of Storm ⚡ ️Watch, the crew laments the sorry state of modern edge computing through the lens of Steve Coley's 2007 paper on "". The discussion examines security flaws that should never appear in properly developed software yet continue to plague systems today. These vulnerabilities demonstrate a systematic disregard for secure development practices and would be immediately obvious to anyone with basic security awareness. The team breaks down "The Lucky 13" vulnerabilities, including buffer overflows, cross-site scripting, SQL injection, and hard-coded credentials, while also exploring how modern AI tools might inadvertently introduce these same issues into today's codebase, and how one might go about properly and safely use them in coding and security engineering. The episode also features an in-depth analysis of the newly discovered that's actively targeting TP-Link Archer routers through a vulnerability discovered two years ago. First detected on January 10, 2025, this botnet has already infected over 6,000 devices worldwide, with the most recent activity observed in mid-February. The threat actors behind Ballista, believed to be based in Italy, have targeted organizations across multiple sectors including manufacturing, healthcare, services, and technology in the US, Australia, China, and Mexico. The botnet exploits CVE-2023-1389 to spread malware that establishes encrypted command and control channels, enabling attackers to launch DDoS attacks and further compromise vulnerable systems.\ The team rounds out the episode with updates from their partner organizations. Censys shares insights on threat actor, along with an investigation into server misidentification issues. RunZero discusses the importance of for end-of-life and end-of-support consumer IoT devices. GreyNoise alerts listeners to a new surge in attempts reminiscent of the 2019 Capital One breach and promotes their on March 24th. As always, the Storm⚡️Watch crew delivers actionable intelligence and expert analysis to help security professionals stay ahead of emerging threats in the ever-evolving cybersecurity landscape. /episode/index/show/dba89b63-ae17-42b2-a104-6ef9f0463061/id/35747600

Cybersecurity Chaos: CISA Controversy, Telecom Hacks, and Exploited Vulnerabilities 03/11/2025

Cybersecurity Chaos: CISA Controversy, Telecom Hacks, and Exploited Vulnerabilities Forecast: Cloudy with a chance of compromised credentials and scattered vulnerabilities—stay alert out there! ‍ In this episode of Storm⚡️Watch, we’re unpacking some of the most pressing developments in cybersecurity and what they mean for the industry. First, we tackle the and its mounting challenges. From allegations that the Trump administration ordered U.S. Cyber Command and CISA to stand down on addressing Russian cyber threats, to financial groups pushing back against CISA’s proposed incident reporting rule, there’s no shortage of turbulence. Adding fuel to the fire, Homeland Security Secretary Kristi Noem has disbanded eight federal advisory committees, including key cybersecurity groups, citing compliance with a Trump-era executive order. Critics argue these cuts could weaken public-private collaboration and hinder CISA’s ability to protect critical infrastructure. We’ll break down what all this means for the future of cybersecurity leadership in the U.S. Next, we revisit a shocking case involving a U.S. soldier who plans to plead guilty to hacking 15 telecom carriers. This story highlights the ongoing risks posed by insider threats and the vulnerabilities within telecom networks, which are often targeted for their treasure troves of sensitive data. We’ll explore how this case unfolded, what it reveals about vetting processes for individuals with access to critical systems, and the broader implications for cybersecurity in government-affiliated organizations. We also spotlight some fascinating research from Censys on a phishing scam exploiting toll systems across multiple states. Attackers are leveraging cheap foreign SIM cards and Chinese-hosted infrastructure in a campaign that keeps evolving. Plus, RunZero sheds light on a critical vulnerability affecting Edimax IP cameras (), while GreyNoise reports on mass exploitation of a PHP-CGI vulnerability () and active threats linked to Silk Typhoon-associated CVEs. /episode/index/show/dba89b63-ae17-42b2-a104-6ef9f0463061/id/35638170

Cyber Apocalypse 2025: Ransomware Rampage, ICS Mayhem, & Vulnerability Avalanche Exposed 03/04/2025

Cybersecurity Under Fire: MiC Leadership, Edge Device Threats, and Black Basta Secrets 02/25/2025

Cybersecurity Under Fire: MiC Leadership, Edge Device Threats, and Black Basta Secrets Forecast = Expect a storm of insights as we tackle cybersecurity's cloudy diversity gaps, edge device downpours, and ransomware winds blowing from Black Basta! ‍ In this episode of Storm⚡️Watch, we kick things off with an insightful interview with , the CEO of (MiC). MiC is a groundbreaking organization dedicated to addressing the lack of support and representation for women and minority leaders in cybersecurity. Mary shares how MiC is building a community that fosters leadership development and equips members with essential skills for career advancement. We also discuss the alarming statistics that highlight the underrepresentation of minorities in cybersecurity leadership roles and explore how MiC’s programs, like The MiC Inclusive Community™ and The MiC Leadership Series™, are making a tangible difference. Next, the crew descends into a critical discussion about edge security products, drawing on insights from . These devices, while vital for network protection, are increasingly becoming prime targets for attackers. We examine recent vulnerabilities added to CISA's Known Exploited Vulnerabilities catalog, including flaws in products from Palo Alto Networks and SonicWall, and explore how state-sponsored actors like Salt Typhoon are exploiting these weaknesses. The conversation underscores the importance of proactive patch management and tools like attack surface monitoring to mitigate risks. In the next segment, we analyze leaked chat logs from the ransomware group with insights from VulnCheck. These logs reveal how Black Basta prioritizes vulnerabilities in widely used enterprise technologies, their rapid response to new advisories, and even their pre-publication knowledge of certain CVEs. We break down their strategy for selecting targets based on financial viability, industry focus, and vulnerability presence, offering actionable advice for defenders to stay ahead. Finally, we turn our attention to GreyNoise’s recent observations of active exploitation campaigns targeting , a Chinese state-sponsored group. Using data from GreyNoise’s global observation grid, we discuss how legacy vulnerabilities like CVE-2018-0171 remain valuable tools for advanced threat actors. This segment highlights the importance of patching unaddressed issues and leveraging real-time threat intelligence to protect critical infrastructure. /episode/index/show/dba89b63-ae17-42b2-a104-6ef9f0463061/id/35424415

The Untold Stories: North Korean Hacks, Exploited Vulnerabilities & Cybersecurity Legends 02/18/2025

The Untold Stories: North Korean Hacks, Exploited Vulnerabilities & Cybersecurity Legends Forecast: Expect increased malicious activity targeting enterprise network infrastructure and remote work platforms. ‍ In this episode of Storm⚡️Watch, the crew tackles some of the most pressing stories in cybersecurity and tech. First, we explore the case of , an Arizona woman who faces federal prison time for orchestrating a scheme that allowed North Korean IT workers to pose as U.S.-based employees. This operation, which generated over $17 million for North Korea, involved Chapman running a "laptop farm" that enabled remote access to U.S. company networks. The scheme not only compromised sensitive company data but also funneled money to North Korea’s weapons programs. This story underscores the critical need for robust identity verification and background checks in hiring processes, especially in remote IT roles, to avoid inadvertently aiding malicious actors. Next, we discuss GreyNoise's findings on the active exploitation of a high-severity vulnerability in Palo Alto Networks PAN-OS (). This authentication bypass flaw allows attackers to execute unauthorized PHP scripts, posing significant risks to unpatched systems. Organizations are urged to apply security patches immediately and restrict access to firewall management interfaces to mitigate potential breaches. GreyNoise’s real-time intelligence highlights the importance of staying vigilant against evolving threats. In our featured segment, we sit down with , a celebrated journalist with over two decades of experience in cybersecurity reporting. Fisher shares insights from his career, including his work as co-founder of *Threatpost* and Editor-in-Chief at *Decipher*. Known for his analytical approach, Fisher has covered major cybersecurity events and delved into the motivations behind both attackers and defenders. His expertise offers a unique perspective on the complexities of information security. Finally, we touch on broader issues in vulnerability management and encryption policies. From GreyNoise’s observations of exploitation surges in vulnerabilities like to Censys’ argument against , these discussions emphasize the need for proactive measures and smarter prioritization in cybersecurity strategies. Whether it's patching overlooked vulnerabilities or resisting calls to weaken encryption under the guise of security, staying informed is key to navigating today’s threat landscape. /episode/index/show/dba89b63-ae17-42b2-a104-6ef9f0463061/id/35335625

When AI Attacks: Taxpayer Data, Beijing's Chatbots & LLM Hallucinations 02/11/2025

When AI Attacks: Taxpayer Data, Beijing's Chatbots & LLM Hallucinations Forecast = Punxsutawney Phil saw his shadow, so we can expect continued Musk-y days ahead in these remaining DOGE days of Winter. ‍ In this week's episode of GreyNoise Storm⚡️Watch, we have a bit of an AI-theme. First, the Department of Government Efficiency (), led by Elon Musk, has sparked significant privacy and security concerns by accessing sensitive federal systems like Treasury databases and Education Department records through AI-driven analysis. Critics highlight undisclosed partnerships with vendors like Inventry.ai, which allegedly introduced algorithmic bias by disproportionately targeting diversity programs and climate initiatives while retaining fossil fuel subsidies. Cybersecurity experts warn about unvetted API integrations and data security risks, as Inventry.ai processed taxpayer information without proper FedRAMP authorization. These issues have led to bipartisan calls for stricter AI procurement rules and transparency mandates to rebuild public trust. Meanwhile, Chinese AI startup faces scrutiny over its claims of rivaling GPT-4 at lower costs, with analysts questioning its $5.6M training budget and geopolitical alignment. The models show systematic pro-China biases, refusing to answer 88% of sensitive questions about Tiananmen Square or Taiwan while promoting CCP narratives in responses. Security researchers flag its opaque training data—potentially using OpenAI outputs—and anti-debugging features that hinder independent audits. These concerns have triggered bans in Australia, South Korea, and U.S. agencies like NASA, with EU officials noting non-compliance with cybersecurity standards. On the defense front, AI honeypot introduces innovative deception tech by letting users simulate systems via text prompts, democratizing access to advanced threat detection. While it offers dynamic behavioral analysis and safe sandboxing, security professionals caution about LLM hallucination risks that could tip off attackers and ethical questions around logging fabricated credentials. The open-source tool shows promise but remains untested against sophisticated adversaries. Rounding out the cybersecurity landscape, Censys research exposes the botnet's infrastructure and BeyondTrust vulnerabilities, while VulnCheck highlights and Zyxel's unpatched telnet flaws; and GreyNoise's latest showcases new platform features + upcoming events. /episode/index/show/dba89b63-ae17-42b2-a104-6ef9f0463061/id/35239875

Mastercard's 4-Year DNS Nightmare, DHS Axes Cyber Board & New Botnet Wreaks Havoc 01/28/2025

Mastercard's 4-Year DNS Nightmare, DHS Axes Cyber Board & New Botnet Wreaks Havoc Forecast: Murdoc botnet storms hit IoT devices, Mastercard's DNS flaw clouds visibility, and DHS shutdowns leave security in the dark. ‍ In this episode of Storm⚡️Watch, we explore a major DNS misconfiguration at that went undetected for over four years. Security researcher Philippe Caturegli uncovered a simple but critical typo in Mastercard's DNS nameserver records where "akam.net" was written as "akam.ne". This error affected one in five DNS requests to Mastercard's infrastructure and could have allowed attackers to intercept emails, capture Windows authentication credentials, and distribute malware through trusted domains. The cybersecurity community was rocked by news that several crucial advisory committees have been terminated. The Cyber Safety Review Board, which was actively investigating the Salt Typhoon hacks targeting U.S. telecommunications companies, was among the disbanded groups. This move has interrupted ongoing investigations into communications targeting high-profile political figures and raised concerns about gaps in information sharing and policy recommendations. A sophisticated new variant of the Mirai malware called the has emerged, targeting IoT devices worldwide. With over 1,300 compromised devices and more than 100 command-and-control servers, this botnet specifically exploits vulnerabilities in AVTECH IP cameras and Huawei HG532 routers. Between December 2024 and January 2025, the botnet has launched significant DDoS campaigns against Japanese corporations, banks, and organizations across multiple sectors in various countries. The 2022 HIPAA Breach Report reveals concerning trends in healthcare security. There were 626 incidents affecting over 41 million people, with hacking and IT incidents accounting for 74% of all large breaches. Surprisingly, paper records remain a significant vulnerability, especially in smaller breaches. The report highlights persistent issues with weak authentication practices, insufficient audit controls, and incomplete risk analyses, resulting in major settlements totaling over $2.4 million. Join us for an in-depth discussion of these critical cybersecurity developments and their implications for the industry. Don't forget to check out the upcoming event for more insights into threat intelligence and network security. /episode/index/show/dba89b63-ae17-42b2-a104-6ef9f0463061/id/35050960

From Bans to Breaches: TikTok, PlugX, FortiGate, and Salt Typhoon 01/21/2025

Ivanti's Blast Radius Expands, CFIUS Hack, & Censeye Automates Threat Hunting 01/14/2025

Chinese Hackers Strike Again: BeyondTrust & Salt Typhoon Breaches Expose Critical U.S. Infrastructure 01/07/2025

Chinese Hackers Strike Again: BeyondTrust & Salt Typhoon Breaches Expose Critical U.S. Infrastructure Forecast: Cyber conditions are turbulent with two major Chinese state-sponsored storms impacting U.S. infrastructure, with aftershocks expected into mid-January. ‍ In today's episode of Storm Watch, we cover two major cybersecurity incidents that have significantly impacted U.S. infrastructure. The breach, initially discovered in early December 2024, involved a compromised Remote Support SaaS API key that allowed attackers to reset passwords and access workstations remotely. The Treasury Department was notably affected, with attackers accessing unclassified documents in the Office of Financial Research and Office of Foreign Assets Control. The incident exposed critical vulnerabilities, including a severe command injection flaw with a CVSS score of 9.8, and over 13,500 BeyondTrust instances remain exposed online. The conversation then shifts to the extensive telecommunications breaches known as the campaign, where Chinese state actors successfully infiltrated nine major U.S. telecom companies. This sophisticated espionage operation gained the capability to geolocate millions of individuals and potentially record phone calls, though actual communication interception was limited to fewer than 100 high-profile targets. The breach revealed shocking security lapses, such as a single administrator account having access to over 100,000 routers and the use of primitive passwords like "1111" for management systems. Major carriers including AT&T, Verizon, and Lumen Technologies were among the affected companies, with varying degrees of impact and response effectiveness. T-Mobile stands out for their quick detection and mitigation of the attack. In response to these incidents, the FCC is preparing to vote on new cybersecurity regulations by mid-January 2025, while the White House has outlined key areas for improvement including configuration management, vulnerability management, network segmentation, and enhanced information sharing across the sector. The episode wraps up with insights from recent posts and the latest GreyNoise blog entry about , along with VulnCheck's analysis of the most dangerous software weaknesses and a discussion of the Four-Faith Industrial Router vulnerability being exploited in the wild. /episode/index/show/dba89b63-ae17-42b2-a104-6ef9f0463061/id/34757605

Hackers Get Glazed: Krispy Kreme's Security Hole & Holiday Cyber Threats 12/17/2024

Cyber Festivus 2024: Airing Security Grievances, Driving Action In Your Org, & OPSEC 101 12/10/2024

Cyber Festivus 2024: Airing Security Grievances, Driving Action In Your Org, & OPSEC 101 Forecast: Visibility is low with a 43% chance of extended response times. Heavy downpours of healthcare vulnerabilities dominate, with brief breaks of exploit intelligence. ‍ In this week's episode of GreyNoise Storm⚡️Watch, we kick things off with our regular roundtable introductions before diving into some intriguing about cybersecurity metrics. The community weighed in heavily on what drives action in their organizations, with Mean Time to Respond leading the pack at 43% of votes, followed by Mean Time to Detect at 28%. Notably, system patching status came in third at 26%, while the tongue-in-cheek option about whiskey levels in the team liquor cabinet garnered a surprising 13% of responses. The crew then gathers round the Festivus pole to channel their inner George Costanza's as they each air their grievances — cyber and possibly otherwise — from the past year. So many things were busted in 2024 that we're shocked we kept the episode under four hours. The episode features a crucial discussion on practical OPSEC fundamentals, particularly focusing on executive protection challenges. We explore how predictable movement patterns and excessive public information exposure can create security vulnerabilities. The conversation covers everything from website vulnerabilities to social media risks, emphasizing the importance of consistent security protocols and information control strategies. Healthcare cybersecurity takes center stage as we discuss recent research presented at the Health-ISAC Fall Americas Summit, courtesy of our friends at Censys. We also dig into VulnCheck's comprehensive analysis of Known Exploited Vulnerabilities for 2024, along with essential insights on exploit intelligence and vulnerability prioritization. The show wraps up with a look at the results of platform improvements since GreyNoise's "Greyt Migreytion". /episode/index/show/dba89b63-ae17-42b2-a104-6ef9f0463061/id/34366365

Kansas City Hacking Indictment, ProjectSend Zero-Day & The Greyt Migreytion 12/03/2024

Russian Wi-Fi Hacks, Baltic Cable Sabotage, and Security Skills Poll Results 11/26/2024

JA4+ Creator Reveals All: Water Systems at Risk & Why NIST is Playing Catch-up 11/19/2024

JA4+ Creator Reveals All: Water Systems at Risk & Why NIST is Playing Catch-up Forecast: High pressure systems of infrastructure attacks continues to build over U.S. utilities with scattered exploitation attempts, while the vulnerability forecast shows increasing cloudiness around CPE data availability. ‍ In today's episode, we're diving into network fingerprinting and vulnerability management with some fascinating developments in the cybersecurity landscape. Our featured guest is John Althouse, the , who has developed an innovative suite of network fingerprinting methods that's making waves in threat detection. JA4+ builds on previous fingerprinting techniques but takes things further with human-readable formats and enhanced detection capabilities. John's work comes at a critical time, as we've seen an uptick in zero-day exploits targeting enterprise networks throughout 2023. The latest highlights how threat actors are becoming more sophisticated in their approaches, particularly in exploiting vulnerabilities before patches can be deployed. Speaking of vulnerabilities, we've got some concerning news about critical infrastructure security. Recent findings have exposed potential vulnerabilities in around 300 U.S. , highlighting the ongoing challenges in protecting our essential services. This ties directly into the importance of tools like JA4+ for detecting and preventing unauthorized access to critical systems. We're also discussing an interesting development in vulnerability management - VulnCheck's NVD++ initiative. They're outpacing by providing CPE data for nearly 77% of CVEs published in 2024, compared to NIST's 41%. This is particularly relevant given the recent disruption in CPE data availability from the NVD. Throughout our conversation, we'll explore how these developments intersect and what they mean for the future of cybersecurity, especially in protecting critical infrastructure and managing vulnerabilities effectively. John's insights on JA4+ and its applications in real-world threat detection scenarios are particularly valuable as organizations face increasingly sophisticated cyber threats. /episode/index/show/dba89b63-ae17-42b2-a104-6ef9f0463061/id/33998397

Disney Menus Hacked, Pacific Rim APT Campaign Exposed, and Zero-Days Found Using AI 11/05/2024

TfL's Cyber Nightmare & White House's Hacker Handshake 10/29/2024

TfL's Cyber Nightmare & White House's Hacker Handshake Forecast = Expect severe disruptions in transit security, with a chance of clearer skies as the White House pushes for smoother collaboration with cybersecurity researchers. Transport for London’s Cybersecurity Crisis\ (TfL) has found itself in a cybersecurity “trainwreck,” facing a range of vulnerabilities and management issues that have exposed its infrastructure to significant risk. An investigation reveals a series of failures, from outdated systems to neglected security protocols, painting a chaotic picture of public infrastructure’s readiness against cyber threats. With passengers’ data and critical operations potentially at stake, this story highlights the growing urgency for improved cybersecurity measures in public sector systems. White House Endorsement of Cybersecurity Researcher Collaboration In a significant policy shift, the has endorsed a more collaborative approach with cybersecurity researchers, aiming to bolster national defenses against growing cyber threats. This endorsement includes support for responsible disclosure practices and partnerships that could help expedite vulnerability identification and mitigation across industries. By actively promoting collaboration, the administration signals a move toward a more unified and proactive stance on national cybersecurity, recognizing the essential role of researchers in safeguarding critical infrastructure and public safety. CVE’s 25th Anniversary Report Celebrating 25 years, the Common Vulnerabilities and Exposures (CVE) program reflects on its progress in tracking and cataloging cybersecurity threats, becoming a cornerstone in the fight against vulnerabilities. The not only emphasizes milestones in vulnerability identification and mitigation but also considers how the program must evolve to meet emerging challenges as cyber threats grow more sophisticated. With an eye on improving its database and keeping pace with the expanding threat landscape, CVE aims to continue being an essential resource for the cybersecurity community. CVE-2024-47575 Vulnerability as Flagged by Censys Censys has flagged as a serious vulnerability affecting systems reliant on outdated cryptographic protocols, specifically impacting certain SSL/TLS implementations. This vulnerability poses a risk to data integrity and confidentiality, enabling potential attackers to intercept or alter sensitive information in transit. The case of CVE-2024-47575 underscores the need for organizations to update and secure their cryptographic practices to avoid exposure to similar vulnerabilities. /episode/index/show/dba89b63-ae17-42b2-a104-6ef9f0463061/id/33669362

Security Meltdown: American Water Attacked, Internet Archive Breached, Rackspace Hit by 0-Day 10/22/2024

Security Meltdown: American Water Attacked, Internet Archive Breached, Rackspace Hit by 0-Day Forecast = Turbulent conditions persist as major platforms face relentless attacks, with data breaches and DDoS storms threatening critical infrastructure and digital archives ‍ In this episode of Storm⚡️Watch, we wade into several significant cybersecurity incidents and updates. First, has raised concerns about the vulnerability of critical infrastructure, with potential implications for military services and water supply systems across the United States. We'll explore the details of this cyberattack and its broader impact on national security. , a vital resource for digital preservation, has been facing a series of relentless attacks. We'll discuss the ongoing distributed denial-of-service (DDoS) attacks that have disrupted services, as well as a major data breach affecting 31 million users. Our conversation will cover the challenges of protecting such a vast repository of information and the potential motivations behind these persistent assaults on the "Wayback Machine" and other Archive services. On the tools and intelligence front, we'll highlight Censys' new , which promises to enhance vulnerability management for security professionals. We'll also discuss GreyNoise's latest analysis of , revealing that 9 out of 12 vulnerabilities tracked by GreyNoise from a recent U.S. and UK advisory are currently being actively probed. Additionally, we'll touch on GreyNoise's upcoming Quarterly Roadmap Showcase, offering listeners a glimpse into future developments. Lastly, we'll examine the recently disclosed , which has been added to CISA's Known Exploited Vulnerabilities catalog. This zero-day flaw has been linked to a breach at Rackspace, underscoring the critical nature of prompt patching and the ongoing challenges in securing third-party utilities. Join us as we break down these crucial cybersecurity stories and their implications for the digital world. /episode/index/show/dba89b63-ae17-42b2-a104-6ef9f0463061/id/33568737

Healthcare Data at Risk & Chinese Hackers Exploit 30-Year-Old Law 10/15/2024

Cyber Chaos Unleashed: Kaspersky's Vanishing Act & CUPS Vulnerability Mayhem 10/01/2024

Storm Watch by GreyNoise Intelligence

TOPICS