The Real Talk:
- Why Iran’s first significant cyberattack on a U.S. company since the war started is a signal every security team should be reading carefully
- How a supply chain attack cascaded through a trusted open-source tool and compromised AI development environments in a matter of days
- The FCC just banned routers made outside the U.S. over national security risks, and there are already millions of vulnerable ones running in homes and small businesses right now
A Closer Look:
From Espionage to Disruption Iranian-linked threat group Charming Kitten claimed responsibility for a cyberattack on medical tech company Stryker, disrupting a Microsoft Intune environment in what appears to be a deliberate escalation from the surveillance and defacement operations that characterized the early days of the conflict. Eric Brown, CISSP and Nick Mellem noted that the pre-conflict period saw a quiet ramp-up in DDoS activity that didn’t raise alarms until the kinetic attacks followed. The lesson: threat actor behavior shifts before the headline does. Samuel Santiago Aponte Cala added that the attack vector remains stubbornly human. Phishing still only needs one person to click.
The Supply Chain You Trusted Got Compromised Samuel walked the crew through a technical unraveling that started with GitHub Actions, moved through security scanning tool Trivy, and ended with a backdoor quietly inserted into LiteLLM, a widely used open-source AI library. The thread actor pushed a malicious commit that executed a script on pip install, meaning developers pulling down a dependency they had every reason to trust were unknowingly spreading the compromise. Eric framed it plainly: it’s a supply chain attack, and the fix came four hours later, but the exposure window was real. The harder truth he raised: certifications from a company called Delve, used by Trivy among others, appear to have been generated using fabricated audit evidence. When the attestation itself can be faked, the compliance paper trail stops meaning what it’s supposed to mean.
OpenAI Kills Sora to Focus on What’s Next Nick connected OpenAI’s decision to wind down Sora to a pattern he’s seen before: Tesla deprioritizing the Model S and X to pour resources into Optimus. The conversation turned philosophical, with Eric asking the question that actually matters: what are you holding onto that’s keeping you from moving forward? For security teams, the parallel is real. Spreading attention thin across every tool and initiative leaves you mediocre at most of them.
Your Router Is a Risk You’ve Probably Stopped Thinking About The FCC’s ban on new routers manufactured outside the U.S. drew on a story Eric shared from a 2016 hospital audit in New York, where roughly 40% of devices that appeared to be Cisco equipment returned no match when run against Cisco’s own product verification tool. Someone had been buying gray market hardware off eBay and dropping it into a healthcare environment. Nick’s practical note on the router ban: it addresses future risk, but millions of legacy devices are already running in homes and small businesses, unpatched and poorly configured, and there is no fast answer to that.
Bottom Line:
Nation-state attacks are escalating. Supply chain compromises are moving faster than audit cycles can catch them. And the hardware sitting between your network and the internet may have never been what it claimed to be. Eric put it best: you’re probably never going to prevent 100% of attacks. The organizations that hold up under pressure are the ones that have invested as much in detection and recovery as they have in prevention. The question is not whether something gets through. It’s how fast you find it and what you do next.
Tune into the full episode to hear Samuel break down the GitHub Actions exploit chain in real time, Eric’s story about his mom’s first pickleball game, and why hiring for experience sometimes means you’re buying someone’s most valuable mistakes.
🔗 Ep 85 – Iran, Supply Chains, and the FCC Router Ban: Live Cybersecurity News
Listen wherever you get your podcasts – Subscribe to our YouTube channel to stay up to date on breaking cybersecurity news.
Learn more at www.itauditlabs.com
