CyberWire Daily

The lights stay on, but dimmer.

Feb 17, 2026
Steve Elovitz, leader of Unit 42's North America incident response practice, shares hard-won lessons from analyzing 750+ major breaches. He discusses why identity abuse now fuels most intrusions. Short takes cover ransomware hitting industrial targets, AI misconfigurations threatening infrastructure, and OAuth/password-manager weaknesses that widen breach impact.
Ask episode
AI Snips
Chapters
Transcript
Episode notes
ANECDOTE

Operation Doppelbrand Targets Big Firms

  • SOC Radar observed Operation Doppelbrand targeting Fortune 500 financial and tech firms with lookalike domains and cloned portals.
  • The actor automated infrastructure, used short-lived certificates, and sometimes deployed legitimate remote tools like LogMeIn Resolve.
INSIGHT

Infostealers Target AI Agent Secrets

  • Infostealers have shifted to targeting AI agent environments like OpenClaw, exfiltrating tokens, signing keys, and memory files.
  • Stolen AI artifacts enable device impersonation and broader identity compromise in workflows.
INSIGHT

Identity Failures Drive Most Breaches

  • Unit 42 found identity elements contributed to nearly 90% of incidents and caused almost two-thirds of initial intrusions.
  • Poor controls, misconfigurations, and overprivileged accounts let attackers pivot across environments rapidly.
Get the Snipd Podcast app to discover more snips from this episode
Get the app