In today’s cybersecurity news…
NSA and Cyber Command head confirmed
In a rare floor vote, the US Senate voted 71-29 to confirm Army Lt. General Joshua Rudd as the head of US Cyber Command and director of the National Security Agency. The post had been vacant for almost a year, with Lt. General William Hartman serving in an acting capacity. Rudd serves as the deputy chief of U.S. Indo-Pacific Command, and previous in various special forces leadership roles. He has no prior experience in signals intelligence or cyber operations. Rudd will continue the “dual-hat” leadership of Cyber Command and the NSA, with The Record’s sources saying President Trump told aids he settled on a “clean” 18-month extension of the leadership format. Senator Ron Wyden called for the floor vote as part of his opposition to Rudd’s nomination, citing his lack of experience and vague answers about using the NSA’s surveillance tools for warrantless spying on US citizens.
Russians targeting encrypted messaging app users
The Netherlands’ Defence Intelligence and Security Service (MIVD) and the General Intelligence and Security Service (AIVD) published details about a campaign by entities tied to Russian state actors, targeting users of Signal and WhatsApp. This didn’t crack either app’s end-to-end encryption. Instead, Dutch intelligence saw Signal users targeted by people posing as the app’s support team, warning specific users about “data leaks” and trying to get their PIN codes. These codes are used to register a new device and intercept new messages. On WhatsApp, the attackers try to trick people into using the “Linked Device” feature to get access to all messages.
OpenAI rolls out vulnerability scanner
It was big news when Anthropic rolled out vulnerability scanning in Claude Code, and so it’s a big deal that OpenAI did the same now with Codex. Codex Security was previously known as Aardvark, in private beta testing since last year and now available as a research preview to ChatGPT Pro, Enterprise, Business, and Edu customers. In testing, OpenAI said it found over 10,000 high-severity issues with Codex Security, including in widely used projects like Chromium, OpenSSL, PHP, and GnuTLS. Anthropic’s announcement had stock market implications; we’ll see if that becomes part of the story with Codex Security.
Fins warn of persistent cyber espionage
According to a new security assessment from the Finnish Security and Intelligence Service, the country’s tech sector, government, and research institutions face “sustained operations” from Russian and Chinese intelligence services. The assessment painted a bleak picture, stating that the country faces “continual attempts at cyberespionage, with no prospect of such operations subsiding, even in the long term.” These attacks are attempting to steal sensitive research and intellectual property, supplement tradition espionage efforts that were scuttled when Finland expelled Russian diplomats, and spreading misinformation as part of larger influence operations.
Huge thanks to our sponsor, Dropzone AI
The intelligence drops. Dropzone picks it up, turns it into a threat hunt, and runs it across your SIEM, EDR, and cloud data while your team sleeps. By morning, your analysts have answers, not a backlog.
That is the AI Threat Hunter, the newest agent on the team, debuting at RSAC. Booth 455, South Expo Hall. dropzone.ai/rsa-2026-ai-diner
Meta acquires Moltbook
You’ll be forgiven if you’ve already forgotten about the AI flavor of the week that was Moltbook. This was a Reddit-clone designed for use by AI agents created by Matt Schlict and Ben Parr. Well Meta didn’t forget them, acquiring the platform and the team behind it in an undisclosed deal. Schlict and Parr will roll into Meta’s Superintelligence Labs unit on March 16th, with Moltbook itself shutting down around the same time. Moltbook was notable in that it left its production database completely exposed at launch, revealing that a large number of accounts were created by very few users, and that it had no system for verifying users were bots. This comes a month after OpenClaw creator Peter Steinberger was hired by OpenAI.
(Axios)
KadNap botnet targeting ASUS routers
Researchers at Black Lotus Labs detailed the newly discovered KadNap botnet, active since August 2025. This current has about 14,000 enrolled devices, communicating through a customized version of the Kademlia Distributed Hash Table (DHT) protocol to conceal IP addresses. About half the botnet is made up of ASUS routers, with 60% of all infected devices in the US. KapNap spreads through a malicious script that establishes persistence on routers and edge devices as a cron job that runs every 55 minutes. The researchers believe KadNap is tied to the Doppelganger proxy service.
Microsoft rolls out passkey support for Entra
Microsoft says will allow “users to create device‑bound passkeys stored in the Windows Hello container and authenticate using Windows Hello.” Each Entrea account will register a passkey per device, with support for multiple accounts per machine. These keys will be device-bound and not synced. Passkey support will go into an opt-in global public preview in mid-March and run until the end of April. After that, it will roll out to Governement cloud environments starting in mid-April through mid-May.
CISA shortens patch time for critical bugs
Generally, when CISA adds a vulnerability to its Known Exploited Vulnerabilities catalog, federal civilian agencies have three weeks to patch. However the latest round of additions have been given tighter deadlines. On Monday, CISA added a critical vulnerability in SolarWinds Web Help Desk, first discovered by Trend Micro in September, and has since been actively exploited. Agencies have until Thursday, March 12th to patch. CISA also added two vulnerabilities this week with a shorter two-week patch deadline, one of which impacts Ivanti EPM, and reportedly actively exploited since February.