In today’s cybersecurity news…

CISA reauthorization 

One of the impacts of the prolonged US government shutdown was the expiration of the 2015 Cybersecurity Information Sharing Act, or CISA, at the end of September. One provision in a deal to reopen the government, advancing through the Senate as of this recording, would reauthorize the law. However, this is only a temporary stay of execution, as that reauthorization would only go through January 30, 2026. The House Homeland Security Committee approved legislation in September that would extend CISA for the next decade. Two members of the Senate Homeland Security Committee introduced a similar bill, but a vote on it was blocked by the Committee’s chair, Senator Rand Paul, during the shutdown. 

(The Record)

Denmark and Norway investigating electric bus “kill switches”

Earlier this month, the Norwegian bus operator Ruter investigated the connected capabilities of two bus models, one from the Dutch manufacturer VDL and the other by the Chinese firm Yutong. It found that, because of how Yutong buses receive over-the-air updates, the company “has direct digital access to each individual bus.” The company said it put in stricter controls for new vehicle purchases and will collaborate with local authorities on “clear cybersecurity requirements.” Danish public transport provider Movia also said it is investigating its Yutong buses for any issues. However, COO Jeppe Gaard clarified that this isn’t a “Chinese bus concern,” but rather something to account for with any connected vehicle. Yutong said all vehicle data in the region is stored in an EU-based AWS data center “protected by storage encryption and access control measures.” 

(NBC News, FT)

European Commission looking to simplify privacy laws for AI

Draft documents obtained by Politico show that as part of a “digital omnibus” package meant to simplify tech laws, the European Commission will make considerable changes to the General Data Protection Regulation, GDPR. The draft creates exemptions to allow AI companies to process protected categories of data for training and operating models. The changes would also redefine what constitutes personal data, allowing anonymized data to be excluded from the GDPR. The draft also adds a provision to enable site and app owners to have more legal grounds to justify user tracking. The EC will officially unveil this draft proposal on November 19th.  

(Politico)

UK cyber insurance claims triple

According to a new report from the Association of British Insurers, or ABI, UK insurers paid out over £197M for cyber insurance claims in 2024, up from £60 in 2023. Ransomware-related claims accounted for 51% of that total, up from 32% in 2023. ABI also reported that the number of cyber insurance policies in the UK increased by 17% on the year in 2024.

(FT, ABI)

Huge thanks to our sponsor, Vanta

Dozens of victims named in Oracle EBS campaign

The Cl0p ransomware group named 29 organizations impacted by its recent campaign. This targeted Oracle’s E-Business Suite, likely with a zero-day affecting its Publisher Integration component, which was exploited for 2 months before being patched. Some of the named entities, like the Washington Post, Envoy Air, Harvard, and Wits University, have already confirmed a breach. But most of the named victims haven’t confirmed the attack, including Logitech, Cox Enterprises, and Schneider Electric. Cl0p also released data from 18 of these organizatios allegedly attained in the attacks. An initial investigation by SecurityWeek found they likely originated from an Oracle environment. 

(Security Week)

We need to worry about “rapport-building phishing” now 

Researchers at Volexity studied a campaign linked to the China-aligned APT UTA0388, operating from June through August 2025. This used tailed messages to each victim, impersonating senior researchers, and tried to get them to download GOVERSHELL malware archive files. Volexity noted this campaign marked a change in tactics for the group, using extended conversations to build rapport with victims before delivering a payload. The researchers found signs that the threat group used large language models to both draft these highly tailored messages and develop malware, saying,` “This campaign consistently lacked coherence in a way that is more suggestive of context-unaware automation.”

(Infosecurity Magazine)

Russian national pleads guilty to helping Yanluowang (yan-low-wong) attacks

Aleksei Volkov pleaded guilty to charges related to working as an initial access broker for the ransomware crew. These stem from Yanluowang attacks planned from July 2021 through November 2022. I looked it up, and we covered them on the show. This indictment offers insight into the economics of this type of work. Volkov charged $1,000 for access to business networks with pilfered credentials and received shares of ransom payments, from 16-20%. Volkov was ordered to pay $9.1 million in restitution to six of seven named victims (one victim was restored successfully from backups), and he awaits further sentencing. 

(The Register)

EU radio stations getting hacked

Last week, two European radio stations had operations disrupted due to seemingly unrelated cyberattacks. The Dutch broadcaster RTC Noord discovered its computer systems were inaccessible on November 6th, with a morning show resorting to playing music on CDs and LPs to the delight of hipsters everywhere. While some operations were resumed, days after the attack, the RTV newsroom could only be “reached via WhatsApp,” indicating comms systems were still down. 

This attack came on the same day that the Rhysida ransomware gang claimed responsibility for an attack on KISS-FM, a Spanish radio station, and demanded a $300,000 ransom. 

(Bitdefender)