A leak in the chain of command.
DHS suffers a massive data leak. Researchers reveal Volt Typhoon’s sophisticated methods. Cisco patches a firewall zero-day. A suspected coordinated supply chain attack targets public GitHub repositories. Online scams overtake phishing. NIST shares post-quantum cryptography guidance. CISA warns a VMware ESXi vulnerability is under active exploitation. The Federal Election Commission takes systems offline. A Ukrainian national gets prison time for ransomware operations. Our guest is Yonald Chery, CTO from Technology Advancement Center (TAC), discussing securing operational technology in our critical infrastructure. Bitcoin mining gets you in hot water.
Today is Thursday October 29th 2026. I’m Dave Bittner. And this is your CyberWire Intel Briefing.
DHS suffers a massive data leak.
A massive leak of Department of Homeland Security records has exposed information on more than 41,000 employees and contractors, potentially providing adversaries with a detailed roadmap of the department’s operations.
The archive, dubbed “Icepick,” was published by transparency nonprofit Distributed Denial of Secrets. It reportedly contains data from DHS’s Okta identity management system, including employee contact information, reporting relationships, and access permissions for sensitive systems.
WIRED’s analysis identified references to undercover operations, surveillance programs, facial recognition tools, and investigative platforms. The records cover roughly one-seventh of DHS’s workforce, including thousands of ICE and Customs and Border Protection personnel.
Security experts warn the information could facilitate targeted phishing, impersonation, and intelligence gathering, particularly when combined with other leaked datasets.
DHS says it’s investigating a potential breach. Okta maintains its systems were not compromised.
The hackers, calling themselves the Department of Peace, framed the release as an act of government accountability.
Researchers reveal Volt Typhoon’s sophisticated methods.
For years, U.S. officials have warned that China’s Volt Typhoon hacking group poses an extraordinary threat to American critical infrastructure. Now, researchers are revealing the sophisticated methods behind those warnings.
As Kim Zetter writes in her Zero Day newsletter, Lumen Technologies’ Black Lotus Labs has uncovered what it calls Silent Train, a covert network of compromised routers, servers, and internet-connected devices that Volt Typhoon uses to infiltrate sensitive American networks.
The attackers construct elaborate chains of compromised devices, sometimes in less than two minutes, routing their activity through multiple countries before reaching their targets. Each chain is typically used for a single intrusion, then dismantled. The hackers erase logs, remove evidence, and disappear, sometimes after spending just minutes inside a network.
Researchers tracked more than 27 classes of compromised devices and identified at least four exploited zero-day vulnerabilities.
The targets include government agencies, defense contractors, telecommunications providers, military research institutions, and operators of energy, water, and transportation infrastructure.
Many victims are concentrated in Hawaii, California, and Texas, locations strategically important to U.S. military operations in the Indo-Pacific.
Researchers believe the campaign combines espionage with preparations for potential disruption during a conflict involving Taiwan. They’ve observed attackers stealing military-related documents, mapping networks, and collecting credentials that could provide future access.
And that access can persist long after the initial intrusion. Volt Typhoon sometimes returns weeks later using stolen credentials and entirely new routes.
The result is a carefully maintained network of potential access points into critical American systems, built to remain largely invisible until the attackers decide they need it.
Cisco patches a firewall zero-day.
Cisco has patched an actively exploited zero-day vulnerability affecting its ASA and Firepower Threat Defense firewall software. The high-severity flaw, tracked as CVE-2026-76418, allows unauthenticated attackers to remotely crash vulnerable devices with SSL VPN enabled, causing unexpected reboots and service disruptions. Cisco confirmed exploitation earlier this month but hasn’t identified the attackers or their targets. The company urges customers to install security updates immediately. Administrators unable to patch can mitigate the vulnerability by disabling secondary authentication on affected VPN tunnel groups.
A suspected coordinated supply chain attack targets public GitHub repositories.
Radware researchers have uncovered a suspected coordinated supply chain attack targeting 61 public GitHub repositories, including projects from Google, Brave, and Trivy. They identified 83 malicious submissions, most posted within just 43 minutes, using 74 GitHub accounts, many potentially compromised.
The attacker concealed malicious commands inside HTML comments in issues and pull requests. When vulnerable CI/CD workflows processed that content, the commands could execute automatically, attempting to steal environment variables, credentials, and access tokens.
Researchers confirmed malicious command execution in two cases but found no definitive evidence of stolen repository permissions or compromised downstream software.
The suspected objective was to gain access to repositories and potentially distribute malicious code through trusted open source projects.
Researchers recommend restricting workflow permissions and treating externally submitted content as untrusted.
Online scams overtake phishing.
Online scam detections doubled over the past year, overtaking phishing for the first time, according to Akamai’s latest State of the Internet report. Researchers recorded 6.4 million scams during the second quarter of 2026, including fraudulent stores, investment schemes, and payment scams.
Phishing also increased 61%, with AI helping criminals create convincing lures and launch shorter, more agile campaigns.
Meanwhile, a separate report from the Identity Theft Resource Center highlights the devastating human consequences. More than 80% of surveyed U.S. scam victims reported suicidal thoughts, while nearly nine in ten who sought institutional assistance received no response.
Many victims subsequently paid supposed recovery services, potentially exposing themselves to further fraud.
The findings illustrate both the growing industrialization of online scams and the troubling lack of support for their victims.
NIST shares post-quantum cryptography guidance.
NIST has released guidance to help federal agencies meet deadlines for transitioning sensitive systems to post-quantum cryptography. Under a June executive order, agencies must adopt quantum-resistant key establishment by the end of 2030 and digital signatures by the end of 2031. The guidance recommends prioritizing sensitive, long-lived data vulnerable to future quantum decryption, while allowing hybrid encryption approaches for particularly critical systems. NIST also urges agencies to assess their cryptographic supply chains, warning that meeting the deadlines will require immediate, coordinated action.
CISA warns a VMware ESXi vulnerability is under active exploitation.
CISA warns that attackers are exploiting a VMware ESXi vulnerability that allows administrators to perform certain operations without generating audit logs. The flaw, tracked as CVE-2026-41709, has been added to CISA’s Known Exploited Vulnerabilities catalog. CrowdStrike attributes earlier exploitation to the China-linked group Warp Panda, which reportedly used the zero-day to conceal activity during intrusions targeting U.S. organizations, including law firms. Despite its low severity rating, the vulnerability can significantly hamper forensic investigations. Federal agencies have two weeks to apply patches.
The Federal Election Commission takes systems offline.
The Federal Election Commission has taken several systems offline following reports of an attempted cyberattack, just days before the U.S. midterm elections.
The disruption affects electronic filing, campaign finance searches, and reporting tools, preventing organizations from submitting required disclosures detailing political spending. The FEC says it has identified an issue and is implementing a fix, but several services remain unavailable.
The timing is particularly sensitive, with record amounts of money flowing into congressional campaigns. Security experts warn that interruptions to financial disclosures could undermine transparency and public confidence.
Importantly, the FEC regulates campaign finance but does not administer elections. The incident has no direct impact on voting systems or how ballots are cast.
The agency says it’s working to restore services.
A Ukrainian national gets prison time for ransomware operations.
A Ukrainian national has been sentenced to nearly six years in a U.S. prison for his role in the Nefilim and Hive ransomware operations. Thirty-six-year-old Artem Stryzhak pleaded guilty to participating in attacks that encrypted victims’ systems and demanded ransom payments, including attacks against healthcare organizations during the COVID-19 pandemic.
Stryzhak joined Nefilim in 2021, agreeing to surrender 20% of his ransom proceeds in exchange for access to its malware. He later became an early Hive affiliate, participating in attacks against seven organizations, including healthcare providers and law firms.
The FBI helped one victim recover its files without paying.
Authorities are still searching for alleged Nefilim administrator Volodymyr Tymoshchuk. The State Department is offering up to $11 million for information leading to his arrest, conviction, or location.
Stay with us, after the break we have Yonald Chery, CTO from Technology Advancement Center (TAC), discussing securing operational technology in our critical infrastructure takes more than traditional I.T. cybersecurity skills.
On our Industry Voices segment, we are joined by Yonald Chery, CTO from Technology Advancement Center (TAC), discussing securing operational technology in our critical infrastructure takes more than traditional I.T. cybersecurity skills. Here’s our conversation.
That was Yonald Chery, CTO from Technology Advancement Center, if you enjoyed this conversation and want to learn more, check out the show notes for the full interview.
Bitcoin mining gets you in hot water.
A company that previously turned space heaters into bitcoin miners now wants to bring cryptocurrency into your shower.
Heatbit has introduced Bitwater, an $899 replacement heating element that uses twenty bitcoin-mining chips to heat household water while generating cryptocurrency.
The idea is straightforward: Bitcoin mining produces heat, so why not put that heat to work? The company says Bitwater fits many conventional electric water heaters, operates without noisy fans, and sends mining proceeds directly to the homeowner.
The economics, however, are a little less refreshing.
A conventional heating element costs less than $30. Heatbit has shared estimates suggesting mining could generate roughly a dollar a day, potentially recovering the premium in about three years. But those returns depend on volatile cryptocurrency economics, hardware longevity, and household hot-water demand.
Shipments are planned for early 2027.
Our return on investment desk reports it would take over three hundred years of bitcoin mining to break even.
Whether Bitwater ultimately saves money remains uncertain. But at least your morning shower might finally contribute to your retirement portfolio.
And that’s the CyberWire.
For links to all of today’s stories, check out our Daily Briefing at the cyberwire dot com.
We’d love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like the show, please share a rating and review in your podcast app. Please also fill out the survey in the show notes or send an email to cyberwire@n2k.com
We’re proud that N2K CyberWire is part of the daily routine of the most influential leaders and operators in the public and private sector, from the Fortune 500 to many of the world’s preeminent intelligence and law enforcement agencies.
N2K helps cybersecurity professionals and organizations grow, learn, and stay ahead. We’re the nexus for discovering the people, tech, and ideas shaping the industry. Learn how at n2k.com.
N2K’s lead producer is Liz Stokes. We’re mixed by Tré Hester, with original music by and sound design Elliott Peltzman. Our contributing host is Maria Varmazis. Our executive producer is Jennifer Eiben. Peter Kilpe is our publisher. And I’m Dave Bittner. Thanks for listening.
