Daily Edition · Page 4

THE DAILY INDEX

Technology, AI, software, security, crypto and business

ATTACKS & VULNERABILITIES

TLDR InfoSec

SURVEILLANCE TECH PROVIDER PROTEI WAS HACKED

Protei, a Russian telecom company that develops technology to enable phone and internet companies to conduct web surveillance and censorship, was hacked. The attackers defaced its website and stole 182GB of data, including confidential emails. The threat actor defaced the website with the message “another DPI/SORM provider bites the dust,” referring to the company's sales of deep packet inspection and other internet filtering technologies developed for the Russian lawful intercept system.

HOW I OVERLOOKED THE PROBLEM AND SHOT MYSELF IN THE FOOT

This author disabled and deleted Identity & Access Management (IAM) users before updating associated Terraform state and key policies while migrating from legacy IAM users to SSO in an AWS environment, inadvertently locking access to an AWS KMS key. Terraform applied changes but masked the fact that the EKS cluster continued to use the orphaned key, causing permission failures and locking out key management until AWS Support intervened. Security teams should ensure IAM and key-policy transitions are sequenced and validated, maintain Terraform state accuracy, and treat KMS keys as high-risk break-glass resources during cloud IAM migrations.

THE REALITIES OF CISO BURNOUT AND EXHAUSTION

CISOs are facing a surge in burnout driven by accelerating threats, shrinking budgets, and increasing executive accountability for breaches. The evolving role now spans governance, risk, crisis management, and business strategy, creating sustained cognitive load and operational fatigue that raises organizational and even national-security risk. Security leaders should prioritize realistic resourcing, delegation, mental-health sustainability, and board-level alignment to ensure that essential defensive capabilities do not degrade under chronic pressure.

IRANIAN HACKERS TARGET DEFENSE AND GOVERNMENT OFFICIALS IN ONGOING CAMPAIGN

APT42 (aka SpearSpecter) targets senior defense/government officials through social engineering, extending attacks to victims' family members to increase pressure. The campaign deploys TameCat malware, a PowerShell backdoor using Telegram/Discord for C&C that performs reconnaissance, credential theft, and data exfiltration while evading detection through in-memory execution and obfuscation.

CISA, EYEING CHINA, PLANS HIRING SPREE TO REBUILD ITS DEPLETED RANKS

Given a 40% vacancy rate in pivotal areas, CISA has announced plans to increase hiring in 2026 to replace its depleted workforce and remain competitive. CISA will prioritize hiring liaisons between CISA and critical infrastructure, as well as utilize the DHS's Cyber Talent Management system. CISA will also offer exemptions to its return-to-office policy and strengthen partnerships with colleges and universities to attract top talent.

TLDR IndexPage 4