Risky Business #807 -- Shai-Hulud npm worm wreaks old-school havoc

On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:

• Shai-Hulud worm propagates via npm and steals credentials

• Jaguar Land Rover attack may put smaller suppliers out of business

• Leaked data emerges from the vendor behind the Great Firewall of China

• Vastaamo hacker walks free while appeal is underway

• Why is a senator so mad about Kerberos?

This week’s episode is sponsored by Knocknoc. Chief exec Adam Pointon joins to talk through the surprising number of customers that are using Knocknoc’s identity-to-firewall glue to protect internal services and networks.

This week’s episode is also available on Youtube (youtu.be/LzCRbNX_Z0s).

Show notes

• Self-Replicating Worm Hits 180+ Software Packages – Krebs on Security (krebsonsecurity.com/2025/09/self-replicating-w…)

• Jaguar Land Rover: Some suppliers 'face bankruptcy' due to hack crisis (bbc.com/news/articles/czdjn0lv64ro)

• Jaguar Land Rover production shutdown could last until November (telegraph.co.uk/business/2025/09/15/jaguar-lan…)

• U.S. Investors, Trump Close In on TikTok Deal With China - WSJ (wsj.com/tech/details-emerge-on-u-s-china-tikto…)

• U.S. Investors, Trump Close In on TikTok Deal With China - WSJ (wsj.com/tech/details-emerge-on-u-s-china-tikto…)

• How China’s Propaganda and Surveillance Systems Really Operate | WIRED (wired.com/story/made-in-china-how-chinas-surve…)

• Mythical Beasts: Diving into the depths of the global spyware market - Atlantic Council (atlanticcouncil.org/in-depth-research-reports/…)

• Hacker convicted of extorting 20,000 psychotherapy victims walks free during appeal | The Record from Recorded Future News (therecord.media/finland-vastaamo-hacker-free-d…)

• US national charged in Finnish psychotherapy center extortion | The Record from Recorded Future News (therecord.media/finland-vastaamo-hack-us-natio…)

• BreachForums administrator given three-year prison stint after resentencing | The Record from Recorded Future News (therecord.media/conor-fitzpatrick-pompompurin-…)

• Microsoft, Cloudflare disrupt RaccoonO365 credential stealing tool run by Nigerian national | The Record from Recorded Future News (therecord.media/microsoft-cloudflare-disrupt-r…)

• Senator blasts Microsoft for making default Windows vulnerable to “Kerberoasting” - Ars Technica (arstechnica.com/security/2025/09/senator-blast…)

• Exclusive: US warns hidden radios may be embedded in solar-powered highway infrastructure | Reuters (reuters.com/legal/government/us-warns-hidden-r…)

• Israel announces seizure of $1.5M from crypto wallets tied to Iran | TechCrunch (techcrunch.com/2025 09/15/israel-announces-seizure-of-1-5-million-from-crypto-wallets-tied-to-iran/)