Daily Briefing for 11.21.25

Top stories.

• US Cyber Command names new Chief AI Officer.
• Hacker claims to have stolen 2.3 terabytes of data from Italy's railway operator.
• China's APT24 deploys stealthy BADAUDIO downloader.

US Cyber Command names new Chief AI Officer.

Brig. Gen. Reid Novotny has been named Chief AI Officer at US Cyber Command, MeriTalk reports. Novotny previously served as Director of Intelligence & Cyber Effects Operations for the National Guard Bureau.

Novotny said in a LinkedIn post, "In this role, I’m committed to ensuring that AI strengthens our cyber forces, enhances decision advantage, and preserves the security and freedom that our nation relies on. This means driving responsible innovation, integrating advanced capabilities at speed and scale, and forging partnerships across the Department of War, industry, and academia."

Hacker claims to have stolen 2.3 terabytes of data from Italy's railway operator.

A hacker is claiming to have leaked 2.3 terabytes of data belonging to Italy's national railway operator, the FS Italiane Group, BleepingComputer reports. The data were allegedly stolen from the railway operator's IT provider, IT services provider, Almaviva. FS hasn't commented on the claims, but Almaviva confirmed it sustained a cyberattack in recent weeks that resulted in data theft.

Andrea Draghetti, Head of Cyber Threat Intelligence at D3Lab, says the hacker claims to have stolen "internal shares, multi-company repositories, technical documentation, contracts with public entities, HR archives, accounting data, and even complete datasets from several FS Group companies."

China's APT24 deploys stealthy BADAUDIO downloader.

Google's Threat Intelligence Group (GTIG) has published a report on a cyberespionage campaign by the Chinese threat actor APT24. The group has been using a "highly obfuscated first-stage downloader" dubbed "BADAUDIO" for the past three years.

GTIG notes, "While earlier operations relied on broad strategic web compromises to compromise legitimate websites, APT24 has recently pivoted to using more sophisticated vectors targeting organizations in Taiwan. This includes the repeated compromise of a regional digital marketing firm to execute supply chain attacks and the use of targeted phishing campaigns." Some of the group's more recent techniques include "supply chain compromise, multi-layered social engineering, and the abuse of legitimate cloud services."