CyberWire Daily Iran is muddying the waters.
24 snips
Mar 6, 2026 A rundown of Iran-linked MuddyWater intrusions and their backdoors hitting U.S. and Israeli networks. Coverage of China-associated campaigns targeting South American telecoms. Alerts about critical Cisco firewall fixes and actively exploited Hikvision and Rockwell vulnerabilities. A deep dive into the Anthropic–Pentagon fallout and the Pentagon’s pivot to OpenAI. A bizarre Wikimedia JavaScript worm incident adds unexpected chaos.
AI Snips
Chapters
Transcript
Episode notes
MuddyWater Uses Signed Backdoors To Maintain Footholds
- MuddyWater conducted recent intrusions against U.S. and Israeli targets using backdoors Dindor and Fakeset signed with fake certificates.
- Researchers observed attempted exfiltration from a US airport, bank, and software company and warn attackers retain footholds for further operations.
New Multi‑Platform Malware Targets South American Telecoms
- A China-linked actor targeted South American telcos with three new malware families: TurnDoor (Windows DLL sideload backdoor), PeerTime (BitTorrent C2 Linux backdoor), and BruteEntry (proxy-scanner).
- Cisco Talos links victim profiles to Salt Typhoon tactics but finds no confirmed operational tie.
Patch Cisco Firewalls Now No Workarounds Exist
- Apply Cisco's patches immediately for 48 firewall vulnerabilities including two CVSS 10 flaws in Secure Firewall Management Center.
- There are no workarounds; the critical issues include HTTP auth bypass and insecure deserialization enabling root or remote code execution.