Cipherceval: So you ran your Windows Update this week, right?
Cipherceval: You click the little Restart Now button and let it do its thing
Cipherceval: well, because if you haven't, you may want to pause this
Cipherceval: episode and go do that.
Cipherceval: Seriously, Microsoft just dropped patches for six six,
Cipherceval: zero day vulnerabilities that attackers were already
Cipherceval: exploiting in the wild.
Cipherceval: And that's just the appetizer.
Cipherceval: Now, by the time that you're getting this, I'm hoping you
Cipherceval: would have restarted it, but you should check out if you haven't.
Cipherceval: Now, this week, we've also got
Cipherceval: North Korean hackers posing as
Cipherceval: job recruiters to poison your
Cipherceval: npm packages.
Cipherceval: Nation state actors using
Cipherceval: Google's own AI against us, a
Cipherceval: massive telecom breach affecting
Cipherceval: over six million people in the
Cipherceval: Netherlands, and a government
Cipherceval: contract breach that just went
Cipherceval: from bad to, oh no, potentially
Cipherceval: affecting tens of millions of
Cipherceval: Americans.
Cipherceval: It's been a busy week.
Cipherceval: Let's get into it.
Speaker: Forge OS is online and operational.
Speaker: Welcome.
Speaker: Operator.
Cipherceval: Hey, guys, I'm your host,
Cipherceval: Cipherceval, And welcome to
Cipherceval: Exploit Brokers by Forgebound
Cipherceval: Research.
Cipherceval: If you're watching on YouTube,
Cipherceval: go ahead and drop a like on this
Cipherceval: video.
Cipherceval: Hit that subscribe button and ring the bell notification icon
Cipherceval: so you don't miss an episode.
Cipherceval: If you're listening on Spotify,
Cipherceval: Apple Podcasts, or wherever you
Cipherceval: get your podcasts, I'd really
Cipherceval: appreciate a follow and a five
Cipherceval: star rating.
Cipherceval: It helps other people find the
Cipherceval: show, and honestly, it means a
Cipherceval: lot.
Cipherceval: All right, let's jump into it.
Cipherceval: Our lead story this week.
Cipherceval: And it's a big one.
Cipherceval: Microsoft's February 2026 Patch
Cipherceval: Tuesday dropped on February
Cipherceval: 10th.
Cipherceval: And it is one of the months where you look at the numbers
Cipherceval: and immediately start thinking about your patching timeline.
Cipherceval: They addressed fifty eight
Cipherceval: vulnerabilities across windows,
Cipherceval: Office, Azure and Developer
Cipherceval: tools, but the headline here is
Cipherceval: six actively exploited zero day
Cipherceval: vulnerabilities.
Cipherceval: Now, for those who may not be familiar, a zero day means the
Cipherceval: attackers were exploiting these flaws before Microsoft even had
Cipherceval: a fix available.
Cipherceval: The bad guys had the keys before the locksmith could change the
Cipherceval: locks, and having six of them in a single patch Tuesday.
Cipherceval: That's significant.
Cipherceval: That's not normal.
Cipherceval: Let's break down the big ones.
Cipherceval: So first up, CVE-2026-21510 a
Cipherceval: Windows Shell security feature
Cipherceval: bypass.
Cipherceval: This one has a Cvss score of eight point eight.
Cipherceval: And it's nasty.
Cipherceval: And the attacker can craft a malicious link or shortcut file.
Cipherceval: and when the victim clicks it,
Cipherceval: it completely bypasses windows
Cipherceval: Smartscreen.
Cipherceval: Those are the.
Cipherceval: Are you sure?
Cipherceval: Prompts that are supposed to
Cipherceval: warn you about untrusted
Cipherceval: content.
Cipherceval: So you click a link and instead
Cipherceval: of windows saying, hey, this
Cipherceval: looks suspicious, it just lets
Cipherceval: the malware through just right
Cipherceval: on in.
Cipherceval: Google's threat intelligence
Cipherceval: group actually confirmed that
Cipherceval: this one was under, and I quote
Cipherceval: them on this wide spread active
Cipherceval: exploitation.
Cipherceval: That's Google telling you how bad it is.
Cipherceval: Then we've got CVE-2026-21513 this targets MSHTML.
Cipherceval: That's Microsoft HTML.
Cipherceval: That's the old Internet Explorer rendering engine.
Cipherceval: Now I know you're thinking Internet Explorer.
Cipherceval: I haven't used that in years.
Cipherceval: At least I hope you haven't.
Cipherceval: Well, neither have I. But here's the thing.
Cipherceval: MSHTML is still baked into
Cipherceval: windows for backwards
Cipherceval: compatibility.
Cipherceval: It's like that old plumbing in your house that you forgot about
Cipherceval: until it starts leaking.
Cipherceval: Attackers can trick you into
Cipherceval: opening a malicious HTML or lnk
Cipherceval: a link file to bypass security
Cipherceval: controls.
Cipherceval: And then there's CVE-2026-21514 targeting Microsoft Word.
Cipherceval: Where opening a malicious
Cipherceval: document lets attackers bypass
Cipherceval: OLE mitigations.
Cipherceval: In Microsoft 365 and Office.
Cipherceval: All three of these security
Cipherceval: bypass zero days were found by
Cipherceval: both Google's threat
Cipherceval: intelligence group and
Cipherceval: Microsoft's own security team
Cipherceval: working together, and all three
Cipherceval: were publicly disclosed before
Cipherceval: the patch.
Cipherceval: Now, the last part is really
Cipherceval: important because it means
Cipherceval: details about how to exploit
Cipherceval: these were already circulating
Cipherceval: on the privilege escalation
Cipherceval: side.
Cipherceval: We have CVE-2026-21533 in Remote Desktop Services that lets a
Cipherceval: local attacker escalate to a system that's right system.
Cipherceval: And that's the equivalent of root for windows.
Cipherceval: That's the highest privilege level in windows.
Cipherceval: Now CrowdStrike found this one.
Cipherceval: And they noted that the exploited binary was
Cipherceval: sophisticated enough that threat actors will likely be racing to
Cipherceval: use it or sell it.
Cipherceval: And CVE-2026-21519 in Desktop
Cipherceval: Window Manager also gives system
Cipherceval: access through a type confusion
Cipherceval: bug.
Cipherceval: Both of these are the kind of vulnerabilities where once an
Cipherceval: attacker has any foothold on your machine, they can become
Cipherceval: the machine's superadmin.
Cipherceval: The ultimate control, if you will.
Cipherceval: Now, the last zero day we'll be
Cipherceval: talking about for this one,
Cipherceval: CVE-2026-21525 is a denial of
Cipherceval: service flaw in the Remote
Cipherceval: Access Connection Manager
Cipherceval: RasMan, which handles your VPN
Cipherceval: connections.
Cipherceval: An unprivileged user, can crash the service.
Cipherceval: If your organization uses always on VPN with fail close policies,
Cipherceval: that crash means endpoints lose network access entirely and IT
Cipherceval: can't even reach those machines to fix them.
Cipherceval: It's a cascading failure scenario.
Cipherceval: Acros security actually found
Cipherceval: this exploit in a public malware
Cipherceval: repository back in December,
Cipherceval: meaning someone had weaponized
Cipherceval: it before the patch was even
Cipherceval: available.
Cipherceval: What really stands out here is
Cipherceval: the collaboration Google,
Cipherceval: CrowdStrike, Acros Security and
Cipherceval: Microsoft's own teams all
Cipherceval: independently finding and
Cipherceval: flagging these bugs suggests
Cipherceval: they were active campaigns,
Cipherceval: possibly by the same threat
Cipherceval: actor chaining some of these
Cipherceval: together.
Cipherceval: When you see security bypass
Cipherceval: flaws combined with privilege
Cipherceval: escalation, that's a full attack
Cipherceval: chain.
Cipherceval: Get in, get root.
Cipherceval: Do whatever you want.
Cipherceval: It does you no good.
Cipherceval: If you get in, you can't access anything.
Cipherceval: And if you can get root but you
Cipherceval: can't get in, well, then there's
Cipherceval: already the chicken and the egg
Cipherceval: problem.
Cipherceval: To get a full attack chain means
Cipherceval: that you can do multiple steps
Cipherceval: in stages.
Cipherceval: So here's where I give you the
Cipherceval: advice you already know is
Cipherceval: coming.
Cipherceval: Update your stuff.
Cipherceval: Seriously, a patch does you no good if it's not installed.
Cipherceval: If you're running windows in any
Cipherceval: capacity, personal enterprise
Cipherceval: server, get the patches
Cipherceval: deployed.
Cipherceval: Get them out there.
Cipherceval: Six actively exploited zero days in one month is not something
Cipherceval: you sit on.
Cipherceval: Microsoft also started rolling
Cipherceval: out new secure boot certificates
Cipherceval: this month to replace the twenty
Cipherceval: eleven ones expiring in June, so
Cipherceval: that's another thing to keep on
Cipherceval: your radar.
Cipherceval: Now let's talk about something that hits closer to home.
Cipherceval: For a lot of us, especially if you're a software developer.
Cipherceval: The Lazarus Group, that's North
Cipherceval: Korea's most prolific state
Cipherceval: sponsored hacking operation, or
Cipherceval: hacking entity, which has been
Cipherceval: running a sophisticated fake
Cipherceval: recruiter campaign targeting
Cipherceval: JavaScript and Python
Cipherceval: developers.
Cipherceval: For my developers out there, please be mindful.
Cipherceval: And they're doing it through npm and PyPI, the package
Cipherceval: repositories that most of us use every single day.
Cipherceval: To give context, for those who
Cipherceval: aren't developers, NPM and PyPI
Cipherceval: are like app stores for code
Cipherceval: libraries.
Cipherceval: When developers build software, they pull in packages from these
Cipherceval: repositories to avoid reinventing the wheel.
Cipherceval: You trust that the code you're downloading is legitimate, and
Cipherceval: that trust is exactly what the Lazarus Group is exploiting.
Cipherceval: ReversingLabs published research
Cipherceval: on this campaign, which they've
Cipherceval: codenamed GraphAlgo after the
Cipherceval: first malicious package they
Cipherceval: found.
Cipherceval: It's been active since at least May 2025.
Cipherceval: And here's how it works.
Cipherceval: The attacker creates fake
Cipherceval: companies in the blockchain and
Cipherceval: cryptocurrency space.
Cipherceval: One was called "Veltrix Capital",
Cipherceval: complete with professional
Cipherceval: looking domains like
Cipherceval: veltrixcap[.]org and GitHub organizations
Cipherceval: with legitimate looking
Cipherceval: projects. Then
Cipherceval: they approach developers on LinkedIn, Facebook, and Reddit with
Cipherceval: job offers. You're
Cipherceval: a developer. You
Cipherceval: get a message from what appears to be a recruiter at a crypto
Cipherceval: trading firm. They
Cipherceval: want you to complete a coding assessment. Makes
Cipherceval: sense right? Every
Cipherceval: developer doing anything, anywhere
Cipherceval: usually does a coding assessment.
Cipherceval: Now
Cipherceval: that is how the industry works. But
Cipherceval: the project they send you to clone and run contains a malicious
Cipherceval: dependency hosted on NPM or PyPI. The
Cipherceval: moment you run npm install, which every developer does without
Cipherceval: thinking twice, it's just something you do to make sure
Cipherceval: everything is installed and runs the way you need it to be. You've
Cipherceval: just installed a downloader
Cipherceval: for a remote access trojan.
Cipherceval: You've
Cipherceval: backdoored your own machine using the same exact steps
Cipherceval: you would for legit stuff. And
Cipherceval: the patience here is remarkable. One
Cipherceval: package called "bigmathutils" racked up over ten
Cipherceval: thousand downloads as a completely benign util library. It
Cipherceval: wasn't until version 1.1.0 that
Cipherceval: the malicious payload was introduced.
Cipherceval: Build
Cipherceval: up trust, build up download counts and then inject the
Cipherceval: poison right after the malicious version was published. They
Cipherceval: deprecated the package to cover their tracks. In
Cipherceval: total, researchers found 192 malicious
Cipherceval: packages connected to this
Cipherceval: campaign. The
Cipherceval: RAT they deployed is no joke either. It
Cipherceval: can download and upload files, listen to running processes,
Cipherceval: execute commands, create and delete folders. Basically
Cipherceval: full remote control of your system. The
Cipherceval: command and control communication
Cipherceval: is protected by a token
Cipherceval: based mechanism, meaning only
Cipherceval: requests with a valid token are
Cipherceval: accepted. That's
Cipherceval: a level of sophistication that tells you this is not some script
Cipherceval: kiddie operation. It's
Cipherceval: not just something randomly listening for an commands. They
Cipherceval: have a full auth mechanism built in. Now
Cipherceval: the attribution to the Lazarus group is assessed at medium
Cipherceval: to high confidence based on consistent patterns. Fake
Cipherceval: job interviews. As
Cipherceval: the initial vector, cryptocurrency
Cipherceval: focused lures, multi-stage
Cipherceval: encrypted malware, delayed
Cipherceval: activation of malicious package
Cipherceval: versions, and this is a nice
Cipherceval: detail, Git commit timestamps
Cipherceval: aligned with GMT+9, or
Cipherceval: also known as North Korea's time
Cipherceval: zone. The
Cipherceval: reason this matters to you is
Cipherceval: that North Korea is not a profitable
Cipherceval: country. They
Cipherceval: need money to fund their state operations and cybercrime, especially
Cipherceval: cryptocurrency theft. It's
Cipherceval: one of their major revenue sources. This
Cipherceval: is a nation state, treating your
Cipherceval: npm install as an attack surface.
Cipherceval: If
Cipherceval: you're a developer and you've installed any unfamiliar packages
Cipherceval: as part of a coding challenge or job assessment in the
Cipherceval: last year, ReversingLabs recommends rotating all tokens and
Cipherceval: passwords and honestly consider full OS reinstall. The
Cipherceval: IOCs are in the report and for
Cipherceval: everyone, just be extremely cautious
Cipherceval: about running code from strangers.
Cipherceval: Even
Cipherceval: if it looks like a legitimate
Cipherceval: job assessment, you should
Cipherceval: be cautious of anything and
Cipherceval: everything.
Cipherceval: Staying on the nation state theme for a moment, because this
Cipherceval: next story ties in perfectly.
Cipherceval: Google's threat intelligence group, GTIG, published a report
Cipherceval: on February twelfth confirming what a lot of us in the security
Cipherceval: space have been worried about.
Cipherceval: State backed hackers from North
Cipherceval: Korea, Iran, China and Russia
Cipherceval: are actively using Google's
Cipherceval: Gemini AI to accelerate their
Cipherceval: cyber operations.
Cipherceval: It's something we're seeing.
Cipherceval: Okay, so before we jump in, let
Cipherceval: me give some context on why this
Cipherceval: is significant.
Cipherceval: Generative AI models like
Cipherceval: Gemini, ChatGPT, Claude, and
Cipherceval: others are incredibly powerful
Cipherceval: tools for research, coding, and
Cipherceval: analysis.
Cipherceval: But those same capabilities make
Cipherceval: them force multipliers for
Cipherceval: threat actors.
Cipherceval: You don't need to spend weeks manually profiling a target when
Cipherceval: you can have AI synthesized, open source Intel in minutes.
Cipherceval: The headliner here is North
Cipherceval: Korea's UNC2970, which overlaps
Cipherceval: with, you guessed it, Lazarus
Cipherceval: Group.
Cipherceval: The same crew we just talked about.
Cipherceval: So Google observed them using
Cipherceval: Gemini to synthesize Osint or
Cipherceval: open source intelligence and
Cipherceval: profile high value targets in
Cipherceval: the defence and cybersecurity
Cipherceval: sectors.
Cipherceval: They were searching for information on major
Cipherceval: cybersecurity and defence companies, mapping specific
Cipherceval: technical job roles and gathering salary information.
Cipherceval: Why salary information?
Cipherceval: Because if you're going to
Cipherceval: impersonate a recruiter offering
Cipherceval: a software engineer at a defence
Cipherceval: contractor a new position, you
Cipherceval: need to know what a realistic
Cipherceval: offer looks like to make the
Cipherceval: lure convincing.
Cipherceval: That's Operation Dream Job, the same campaign now supercharged
Cipherceval: with AI near you.
Cipherceval: I know it's just.
Cipherceval: What the heck?
Cipherceval: So Iran's APT42 is using Gemini
Cipherceval: for social engineering, creating
Cipherceval: official looking email
Cipherceval: addresses, researching targets,
Cipherceval: and crafting personas with
Cipherceval: natural native sounding
Cipherceval: language.
Cipherceval: This is a big deal because one
Cipherceval: of the classic tales for
Cipherceval: phishing has always been
Cipherceval: awkward.
Cipherceval: Grammar and syntax.
Cipherceval: AI eliminates that red flag and pretty well most of the time.
Cipherceval: Now, China's Mustang Panda used
Cipherceval: it to compile dossiers on
Cipherceval: individuals in Pakistan and
Cipherceval: gather data on separatist
Cipherceval: organizations.
Cipherceval: Russia's UNC795 used it for
Cipherceval: technical troubleshooting and
Cipherceval: building web based attack
Cipherceval: infrastructure.
Cipherceval: I mean, that's pretty much what
Cipherceval: private individual developers
Cipherceval: would do.
Cipherceval: You're using AI as a way to amplify your output.
Cipherceval: Yeah, some people Vibe coding and they don't know what they're
Cipherceval: doing, but you also have legitimate developers and
Cipherceval: software engineers who can read and debug where it's like, cool.
Cipherceval: You use it as a way to just 10x your output.
Cipherceval: So here's where it gets really interesting.
Cipherceval: Google also identified a new malware called HONESTCUE that
Cipherceval: actually uses Gemini's API as part of its attack chain.
Cipherceval: It's a downloader that sends prompts to Gemini and receives
Cipherceval: C#(CSharp) source code as responses, then compiles and
Cipherceval: executes that directly in memory, leaving no file on disk.
Cipherceval: I want you to think about that for a second.
Cipherceval: The malware is using the AI to
Cipherceval: write its own payload on the
Cipherceval: fly.
Cipherceval: That's fileless polymorphic and AI generated all in one package.
Cipherceval: This is just like some next level stuff.
Cipherceval: This is where there's a bunch of red alerts going off in my head.
Cipherceval: And they also found something else a phisphing kit called
Cipherceval: COINBAIT that impersonates a major cryptocurrency exchange.
Cipherceval: And the kit itself was built using an AI coding platform
Cipherceval: called lovable AI.
Cipherceval: So we've got AI being used for recon, social engineering, code
Cipherceval: generation, and now the actual construction of attack tools.
Cipherceval: The last one doesn't surprise me
Cipherceval: as much as you would think,
Cipherceval: because we're already seeing
Cipherceval: developers using AI to build
Cipherceval: stuff.
Cipherceval: So malicious developers using it
Cipherceval: to build malicious stuff kind of
Cipherceval: makes sense.
Cipherceval: Now, Google also detected and
Cipherceval: blocked model extraction attacks
Cipherceval: that attempt to clone Gemini's
Cipherceval: reasoning abilities from private
Cipherceval: sector entities and researchers
Cipherceval: globally.
Cipherceval: And model extraction is where you're doing kind of what the
Cipherceval: attack sounds like.
Cipherceval: You're using the AI and the
Cipherceval: model to train another AI model,
Cipherceval: so you can pull all the
Cipherceval: information it has without
Cipherceval: having to do every, like, all
Cipherceval: the legwork that you would have
Cipherceval: needed to create the AI from the
Cipherceval: bottom up.
Cipherceval: Now, the takeaway here is that AI is becoming an integral part
Cipherceval: of the threat landscape.
Cipherceval: It's not hypothetical anymore.
Cipherceval: The defenders are using AI and the attackers are using AI.
Cipherceval: And the question is who adapts faster?
Cipherceval: We're cat and mouse amplified with AI, Essentially.
Cipherceval: For organizations, this means
Cipherceval: you're phishing awareness
Cipherceval: training needs to account for
Cipherceval: the fact that phishing emails
Cipherceval: are going to look a lot more
Cipherceval: polished going forward, and have
Cipherceval: a lot more realistic aspects to
Cipherceval: them.
Cipherceval: Now that bad grammar red flag, it's disappearing.
Cipherceval: Focus on verifying requests
Cipherceval: through out-of-band channels and
Cipherceval: maintaining healthy skepticism
Cipherceval: even when comms look perfectly
Cipherceval: legitimate.
Cipherceval: You should always do essentially
Cipherceval: two factor authentication of
Cipherceval: sorts.
Cipherceval: If you get a text claiming to be
Cipherceval: your boss, shoot them a teams
Cipherceval: message, shoot them a slack
Cipherceval: message.
Cipherceval: Hit them up directly via email somewhere that you are
Cipherceval: contacting at a known thing.
Cipherceval: Now that's just what we're seeing right now.
Cipherceval: And granted, there might be some other mitigations that come out
Cipherceval: later, but that's what's going on right now and the
Cipherceval: recommendations that I can give.
Cipherceval: Okay. So moving on to our next story.
Cipherceval: And this is a big data breach coming out of the Netherlands,
Cipherceval: Odido which is the largest mobile network operator in the
Cipherceval: Netherlands, formerly known as T-Mobile Netherlands confirmed
Cipherceval: on February twelfth that hackers breached their customer contact
Cipherceval: system and stole personal data affecting approximately six
Cipherceval: point two million people.
Cipherceval: To put that into perspective,
Cipherceval: the Netherlands has a population
Cipherceval: of about seventeen and a half
Cipherceval: million, so the breach impacted
Cipherceval: about a third of the entire
Cipherceval: country.
Cipherceval: It's pretty big.
Cipherceval: Now, to give context, Odido was formed in 2023 when T-Mobile
Cipherceval: Netherlands rebranded after merging with Tele2 Netherlands.
Cipherceval: They offer mobile broadband and TV services and the breach also
Cipherceval: affected customers of their subsidiary Ben Just Ben.
Cipherceval: The company first detected signs of the breach over the weekend
Cipherceval: of February seventh and eighth.
Cipherceval: Now here's what was stolen and where it gets concerning.
Cipherceval: The attackers got names, home
Cipherceval: addresses, email addresses,
Cipherceval: phone numbers, dates of birth,
Cipherceval: customer account numbers, bank
Cipherceval: account numbers, IBANs and this
Cipherceval: is one that really jumps out,
Cipherceval: Passport or driver's license
Cipherceval: numbers, including the validity
Cipherceval: dates.
Cipherceval: That combination is, as one Dutch ethical hacker put it,
Cipherceval: worth gold to criminals.
Cipherceval: It's everything you need for
Cipherceval: highly convincing identity
Cipherceval: fraud, spear phishing or social
Cipherceval: engineering attacks.
Cipherceval: You got everything you need to build profiles on whoever you
Cipherceval: want to attack.
Cipherceval: It's insane.
Cipherceval: Now, Odido emphasized that no passwords, call records, billing
Cipherceval: data, or scans of the actual ID documents were compromised.
Cipherceval: But you have enough of the information.
Cipherceval: You don't necessarily need the image of it.
Cipherceval: Now they're operational services.
Cipherceval: Calling internet and TV were unaffected.
Cipherceval: But that's cold comfort when your IBAN and passport number
Cipherceval: are in someone else's hands.
Cipherceval: The attackers apparently
Cipherceval: contacted Odido directly to say
Cipherceval: they had stolen millions of
Cipherceval: records, though no group has
Cipherceval: publicly claimed the attack and
Cipherceval: no data has surfaced on dark web
Cipherceval: forums yet.
Cipherceval: As of the latest reports, the
Cipherceval: company shut down the
Cipherceval: unauthorized access, brought in
Cipherceval: external cybersecurity experts
Cipherceval: and reported to the Dutch Data
Cipherceval: Protection Authority.
Cipherceval: Now, this story is part of a larger pattern we are seeing.
Cipherceval: Telecom companies are prime targets because they aggregate
Cipherceval: massive amounts of personal data in centralized systems.
Cipherceval: We saw salt typhoon compromise
Cipherceval: hundreds of telecoms globally
Cipherceval: for espionage.
Cipherceval: SK Telecom in South Korea saw a
Cipherceval: ninety percent drop in operating
Cipherceval: profit from breach related
Cipherceval: costs.
Cipherceval: French regulators fined free SaaS forty two million euros.
Cipherceval: The message here is that if
Cipherceval: you're an Odido or Ben customer,
Cipherceval: be prepared for targeted
Cipherceval: phishing attempts that use your
Cipherceval: real personal details to look
Cipherceval: legit.
Cipherceval: Now, verify any comms that you
Cipherceval: get through official channels,
Cipherceval: and be especially wary of anyone
Cipherceval: claiming to be from your bank or
Cipherceval: telecom asking you to take on
Cipherceval: urgent action.
Cipherceval: If they say it's urgent, if they
Cipherceval: say you gotta do this, like
Cipherceval: right now, there's still a lot
Cipherceval: of flags that you can use as
Cipherceval: like your little radar or your
Cipherceval: threat detector.
Cipherceval: If they want you to do something right now or everything's going
Cipherceval: to go horrible.
Cipherceval: If there's ever like a if you don't verify this, you're going
Cipherceval: to go to jail.
Cipherceval: Those are just examples of red flags.
Cipherceval: You ultimately have to be skeptical and always try to
Cipherceval: verify things outside of wherever you were contacted.
Cipherceval: Look for official channels.
Cipherceval: Look for an official way to get Ahold of it.
Cipherceval: If you have anywhere that you
Cipherceval: can go in store to just get some
Cipherceval: kind of second authentication or
Cipherceval: some kind of second verification
Cipherceval: on whatever you're doing before
Cipherceval: you just give away anything
Cipherceval: else.
Cipheceval: Okay, so our last story this week.
Cipheceval: And it's one of those situations where a breach that was already
Cipheceval: bad just got a lot worse.
Cipheceval: Government technology giant Conduent, a company that
Cipheceval: provides IT services to government agencies across the
Cipheceval: US, just suffered a ransomware attack back in January 2025, and
Cipheceval: it knocked out their operations for several days.
Cipheceval: At the time, they disclosed it that it affected about four
Cipheceval: million people in Texas.
Cipheceval: Well, TechCrunch reported on
Cipheceval: February 5th that the actual
Cipheceval: numbers in Texas alone is now at
Cipheceval: 15.4 million.
Cipheceval: That's half of the state's population.
Cipheceval: And another 10.5 million people are affected in Oregon.
Cipheceval: And notifications have been going out to hundreds of
Cipheceval: thousands more in Delaware and Massachusetts and New Hampshire
Cipheceval: and other states.
Cipheceval: The total number could stretch into the tens of millions across
Cipheceval: the entire country.
Cipheceval: For those who may not be
Cipheceval: familiar with Conduent, they're
Cipheceval: one of those companies most
Cipheceval: people have never heard of, but
Cipheceval: that touches their lives
Cipheceval: significantly.
Cipheceval: They process government
Cipheceval: payments, handle benefits
Cipheceval: administration, manage toll
Cipheceval: collection systems, provide
Cipheceval: child support payment services,
Cipheceval: critical infrastructure,
Cipheceval: government stuff.
Cipheceval: Now the data stolen includes
Cipheceval: names, social security numbers,
Cipheceval: medical data and health
Cipheceval: insurance information that is
Cipheceval: deeply that is a deeply
Cipheceval: sensitive combination.
Cipheceval: The Safeway ransomware gang, not to be confused with the grocery
Cipheceval: store, claimed responsibility, saying they stole over 8
Cipheceval: Terabytes of data.
Cipheceval: In an SEC filing, Conduent
Cipheceval: acknowledged that the stolen
Cipheceval: datasets contained a
Cipheceval: "significant number of
Cipheceval: individuals' personal
Cipheceval: information associated with our
Cipheceval: clients' end-users."
Cipheceval: Clients being the government
Cipheceval: agencies, end-users being
Cipheceval: everyday citizens who use
Cipheceval: government services.
Cipheceval: What makes this story particularly frustrating?
Cipheceval: As a timeline, the attack happened in January 2025. The company
Cipheceval: originally said four million affected and then over a year later
Cipheceval: in February 2026. We're learning
Cipheceval: it's potentially ten times that number. This is
Cipheceval: exactly the kind of slow drip disclosure
Cipheceval: that erodes public trust.
Cipheceval: If your
Cipheceval: data was stolen in this breach. You may
Cipheceval: not know about it for months after the fact. The lesson
Cipheceval: here is twofold. First, if
Cipheceval: you interact with government services
Cipheceval: and most of us do
Cipheceval: monitor your credit, freeze it
Cipheceval: if you can, and be vigilant for
Cipheceval: any unusual activity. Second,
Cipheceval: for
Cipheceval: organizations, nothing's hack proof, but your incident response
Cipheceval: plan needs to be honest, timely, and disclose everything that
Cipheceval: you know. The cover
Cipheceval: up is always worse than the crime. You are
Cipheceval: just eroding trust. Now, the
Cipheceval: other thing to also keep in
Cipheceval: mind, with enough information, as
Cipheceval: one of the previous stories
Cipheceval: that we just covered said,
Cipheceval: they can start building profiles.
Cipheceval: So you
Cipheceval: should be cautious of anything that's
Cipheceval: messaging you with urgency
Cipheceval: or any call, text or whatever.
Cipheceval: If it
Cipheceval: sounds urgent, be extremely skeptical. Your data
Cipheceval: is out there. A lot
Cipheceval: of people's data is out there, and the more that is getting built
Cipheceval: up by attackers, the more realistic things are going to
Cipheceval: sound. And AI
Cipheceval: lends to the credibility because AI
Cipheceval: can make them sound more legitimate
Cipheceval: than they actually are.
Cipherceval: Okay. So let's just kind of recap things.
Cipherceval: Number one patch like it's urgent.
Cipherceval: Six actively exploited zero days
Cipherceval: in a single patch Tuesday is an
Cipherceval: emergency.
Cipherceval: If you manage windows systems in any capacity, this can't wait.
Cipherceval: Update your stuff.
Cipherceval: Number two, your package manager is an attack surface.
Cipherceval: Lazarus group is poisoning NPM
Cipherceval: and PyPI through fake job
Cipherceval: assessments.
Cipherceval: If a recruiter asks you to run code as part of a hiring
Cipherceval: process, treat it with the same caution you treat an email
Cipherceval: attachment from a stranger.
Cipherceval: Sandbox it.
Cipherceval: Audit the dependencies.
Cipherceval: Don't just blindly npm install.
Cipherceval: Now number three AI is a force multiplier for good or bad.
Cipherceval: Nation state hackers are using generative AI to craft better
Cipherceval: phisphing lures, profile targets faster, and even generate
Cipherceval: malware on the fly.
Cipherceval: Your security awareness training needs to evolve.
Cipherceval: Bad grammar is no longer reliable phishing indicator.
Cipherceval: Number four Telecom data is a goldmine.
Cipherceval: The Odido breach shows that centralized customer contact
Cipherceval: systems are high value targets.
Cipherceval: If your provider is breached, expect convincing social
Cipherceval: engineering attacks that use your real data.
Cipherceval: Verify everything through
Cipherceval: official channels and always do
Cipherceval: a two factor style approach
Cipherceval: where just because you think
Cipherceval: something's real, you always go
Cipherceval: through your known channels,
Cipherceval: your official channels, through
Cipherceval: official websites that you know
Cipherceval: to actually verify what's going
Cipherceval: on.
Cipherceval: And number five, breach
Cipherceval: disclosures can be Iceberg's
Cipherceval: Conduent went from four million
Cipherceval: to potentially tens of million
Cipherceval: affected over the course of a
Cipherceval: year.
Cipherceval: Monitor your identity proactively.
Cipherceval: Don't wait for notification letter.
Cipherceval: Keep an eye on your credit.
Cipherceval: Keep an eye on your accounts.
Cipherceval: The whole thing.
Cipherceval: And as always, remember security
Cipherceval: is a combination of person and
Cipherceval: tech.
Cipherceval: You can have the best firewall in the world, but if someone
Cipherceval: clicks the wrong link, well, none of that mattered.
Cipherceval: Stay informed, stay skeptical,
Cipherceval: and make it as hard as possible
Cipherceval: for attackers.
Cipherceval: Now that's going to do it for this week's episode of HN, and I
Cipherceval: want to thank you for tuning in.
Cipherceval: Whether you're watching on YouTube, listening on Spotify or
Cipherceval: Apple Podcast, or catching this wherever you get your content.
Cipherceval: If you found value in this
Cipherceval: episode, please share it with
Cipherceval: someone who needs to hear it a
Cipherceval: colleague, a friend, someone who
Cipherceval: still hasn't updated the windows
Cipherceval: machine.
Cipherceval: We're all in this together.
Cipherceval: This has been your host, Cipherceval, and I'll catch you
Cipherceval: in the next one.