May 6's Top Cyber News NOW! - Ep 1126
At a glance
Eight stories spanning supply chain attacks on gaming platforms, heap overflow vulnerabilities in local LLMs, AI government access deals, romance scams hitting the UK hard, phishing campaigns impersonating compliance, post-quantum encryption rollouts, AI adoption anxiety among workers, and an operational technology attack on Taiwan's high-speed rail. The common thread: authentication, verification, and threat modeling matter more than ever.
Stories covered
Why is North Korea targeting gaming platforms popular with ethnic Koreans?
What happened: ESET researchers documented a campaign by the North Korean-aligned threat group Scarcraft that installed the Bird Call backdoor on Windows and Android devices through the sqgame.net gaming platform, which is popular with ethnic Koreans in China's Yanbian region. Trojanized game components have been distributed since late 2024, with malicious Android apps still being pushed.
Why it matters: This is a targeted supply chain attack on a niche audience. Scarcraft historically targets North Korean defectors, human rights activists, and investigative journalists—people the regime wants to identify and neutralize. The attack enables espionage to map networks of people helping defectors escape or exposing regime abuses.
What to do: If your organization serves marginalized or politically sensitive populations, conduct threat modeling specific to your audience, not generic baselines. Map realistic threats to your users, then allocate controls accordingly. Don't assume a niche platform means low risk—the attacker's intent determines the actual threat level.
What's the heap overflow vulnerability in Ollama local LLM deployments?
What happened: Sierra researchers disclosed a heap out-of-bounds read in Ollama (a popular open-source project for running local LLMs). A maliciously crafted GGUF model file can leak memory, exposing API keys, tokens, and prompts. The attack requires three unauthenticated API calls and works because Ollama launches without authentication by default and listens on all network interfaces. Patched in version 0.17.1.
Why it matters: If you're running local LLMs with embedded API credentials or sensitive prompts, a compromise means those secrets are exfiltrated. This affects organizations rolling out private LLM instances to avoid SaaS costs or data residency issues.
What to do: Patch to 0.17.1 immediately. More critically: restrict network access. Do not expose Ollama or any LLM to the internet directly. Put it behind a VPN, proxy, or firewall rule that limits inbound connections to your IP only. Network segmentation solved this problem 25 years ago—use it.
Will the US government get early access to new AI models before public release?
What happened: The US Commerce Department's Center for AI Standards and Innovation announced deals with Google, Microsoft, and XAI (joining prior deals with Anthropic and OpenAI) to give the government early access to test new AI models for security on critical systems. Reports suggest the Trump administration is considering an executive order requiring government review of new AI tools before release.
Why it matters: Historically, militaries maintain access to bleeding-edge technology to stay dominant. AI is a weapon. Early government access to private sector models before release is asymmetric advantage. This consolidates power in tech companies and government—entities that already wield disproportionate influence over society.
What to do: Monitor for now. If you're shipping AI products, expect regulatory headwinds and longer pre-release review cycles.
Why did Australia launch a cyber incident review board?
What happened: The Australian government announced a Cyber Incident Review Board that will independently review major cyberattacks with no-fault reviews focused on systemic lessons, not culpability. It's modeled after the US Cyber Safety Review Board (established 2022, disbanded by the Trump administration). Telstra's ISO Narel Deine will chair.
Why it matters: Australia has suffered major breaches at telcos, financial institutions, and healthcare providers. A blameless review board can surface systemic gaps and improve industry-wide defenses. It's the equivalent of NTSB accident investigations for cyber.
What to do: If you operate in Australia and suffer a major incident, expect transparency and post-mortems. If you operate elsewhere, monitor the board's findings—lessons will be applicable to your environment.
How are attackers impersonating compliance communications to harvest credentials?
What happened: Microsoft Defender research found a phishing campaign using fake compliance-related emails as lures. Launched mid-April, it targeted 35,000 users across thousands of organizations, primarily in the US. Emails mimicked enterprise compliance communications with HTML templates, time-sensitive subject lines ("conduct policy review"), and fake security banners (encrypted, Pawbox verified, CloudFlare CAPTCHA). They led to credential harvesting pages for Microsoft and Google accounts.
Why it matters: This works because compliance emails trigger fear of job loss and perceived legitimacy from corporate branding. The green security banners are convincing. Attackers are reusing a proven social engineering angle.
What to do: Send a sample of this email to your workforce with a warning. Educate staff: if your manager hasn't discussed performance reviews or conduct issues in advance, treat the email as suspicious. Do not click. Implement and enforce multi-factor authentication on all accounts to limit damage if credentials are compromised. Do not reuse passwords across services.
Why is Proton Mail rolling out post-quantum encryption?
What happened: Proton Mail announced support for post-quantum cryptography (PQC) across its platform, including free plans. It complements existing RSA and ECC encryption. Users must opt in with new encryption keys and use the latest Proton apps. OpenPGPv6 compatibility is also coming. Proton is collaborating with the open email ecosystem to ensure quantum-safe mail works across providers.
Why it matters: Nation-states with quantum computers could theoretically decrypt today's RSA-encrypted emails in the future (harvest now, decrypt later attacks). PQC is a hedge against that risk—relevant for high-value targets (diplomats, researchers, activists). For most organizations, this is not an urgent threat.
What to do: Monitor for now. If you use Proton Mail and PQC is transparent and free, enable it. If your mail provider offers PQC at no cost, roll it out. Do not pay extra per user for PQC unless your threat model explicitly requires protection against quantum decryption. Prioritize MFA and credential hygiene instead.
Why do most workers fear falling behind on AI but resist adopting it?
What happened: Microsoft's 2026 Work Trend Index found that 65% of workers fear falling behind without AI adoption, but 45% prefer current workflows over redesigning for AI. Only 26% say leadership is aligned on AI strategy. Sixteen percent are "frontier professionals" using multi-agent systems to rethink workflows. Top AI use cases are analysis/reasoning (49%), interactions (19%), work production (17%), and information gathering (15%).
Why it matters: AI is a force multiplier. Workers using AI are substantially more productive than those avoiding it. Organizations without clear AI strategy will lose talent and competitive advantage. Shadow AI adoption will proliferate if leadership doesn't align.
What to do: Invest in AI literacy and adoption now. If you're not learning AI tools, you will fall behind in the job market. Encourage teams to experiment with AI for reasoning, summarization, and workflow automation. Establish guardrails (data handling, output review) but don't block adoption.
How did a student halt Taiwan's high-speed rail using software-defined radio?
What happened: A 23-year-old Taiwanese student used a software-defined radio to send a general alarm signal to the Tetra communication system used by the country's high-speed rail network, triggering emergency braking on four trains for 48 minutes on April 5th. The student was arrested and faces up to 10 years in prison. The Tetra radio system has not rotated encryption parameters in 19 years and likely uses no encryption or the broken TEA1 algorithm (with a known backdoor since 2023).
Why it matters: This is an operational technology (OT) attack. Unverified radio commands to critical infrastructure are catastrophic. The attacker could have accelerated trains instead of braking them, causing derailments and mass casualties. This is not a curiosity—it's infrastructure sabotage.
What to do: If you manage OT systems (pipelines, rail, power, water), audit your command-and-control communication: Are transmissions encrypted? Are they authenticated? Can anyone send a valid command, or only authorized operators? Implement mutual authentication between controllers and devices. Rotate encryption keys regularly. Tetra deployments need immediate review.
Key takeaways
- Threat modeling is not optional: map your actual adversaries and assets before implementing controls. Generic frameworks miss the mark.
- Network segmentation and access controls (firewalls, VPNs, proxies) are foundational; don't expose internet-facing services without them, especially LLMs and OT systems.
- Authentication and verification of commands—whether radio signals, API calls, or emails—prevent both external attacks and insider abuse.
- AI adoption is accelerating; workers not learning AI tools will fall behind competitively and in the job market.
- Romance scams and phishing campaigns exploit emotion and urgency; educate staff and elders proactively; shame and psychological entanglement are barriers to disclosure.
Topics covered
Want the live experience? The Daily Cyber Threat Brief airs live every weekday at 5am PT / 8am ET on YouTube. 400+ practitioners join the chat in real time.