Risky Business #829 -- Sneaky lobsters: Why AI is the new insider threat

On this week’s show, Patrick Gray, Adam Boileau and James WIlson discuss the week’s cybersecurity news. They discuss:

• Iran’s Intune-based wiper attack on medical device maker Stryker

• Qihoo 360’s AI publishes its own wildcard TLS cert private key

• Instagram is canning its end-to-end encrypted messaging

• What’s going on with mobile internet access in Moscow?

• The Xbox One’s bootloader gets voltage glitched into submission

• Oh Qualys! We love you! (At least, whoever is in the basement writing these beautiful .txt files…)

This week’s episode is sponsored by browser-based detection and response company, Push Security. Researcher Dan Green and Field CTO Mark Orlando join Pat to talk through the InstallFix variant of the *Fix attack technique.

This episode is also available on Youtube (youtu.be/09jsoTMdOPw).

Show notes

• Iranian Hacktivists Strike Medical Device Maker Stryker in "Severe" Attack that Wiped Systems (zetter-zeroday.com/iranian-hacktivists-strike-…)

• Stryker says it's restoring systems after pro-Iran hackers wiped thousands of employee devices | TechCrunch (techcrunch.com/2026/03/17/stryker-says-its-res…)

• Stryker attack raises concerns about role of device management tool | Cybersecurity Dive (cybersecuritydive.com/news/stryker-attack-devi…)

• Stryker tells SEC that timeline for recovery from cyberattack unknown | The Record from Recorded Future News (therecord.media/stryker-tells-sec-unknown-time…)

• How ‘Handala’ Became the Face of Iran’s Hacker Counterattacks | WIRED (wired.com/story/handala-hacker-group-iran-us-i…)

• U.S Strikes Killed Iranian Cyber Chiefs, But The Hacks Continued (forbes.com/sites/the-wiretap/2026/03/17/us-str…)

• Risky Business Features: Being a Wartime CISO (risky.biz/RBFEATURES4)

• Supply-chain attack using invisible code hits GitHub and other repositories - Ars Technica (arstechnica.com/security/2026/03/supply-chain-…)

• China's biggest cybersecurity company, Qihoo 360 just leaked their own wildcard SSL private key (x.com/intcyberdigest/status/2033547961976639890)

• Emergent Cyber Behavior: When AI Agents Become Offensive Threat Actors - Irregular (irregular.com/publications/emergent-offensive-…)

• Risky Business Features: MCP is Dead (risky.biz/RBFEATURES7)

• Measuring AI Agents’ Progress on Multi-Step Cyber Attack Scenarios (aisi.gov.uk/research/measuring-ai-agents-progr…)

• Measuring AI Agents' Progress on Multi-Step Cyber Attack Scenarios (arxiv.org/pdf/2603.11214)

• What is end-to-end encryption on Instagram | Instagram Help Center (help.instagram.com/491565145294150)

• US Lawmakers Move to Kill the FBI’s Warrantless Wiretap Access | WIRED (wired.com/story/us-lawmakers-move-to-kill-the-…)

• Website "whitelists" launched in Moscow | Forbes.ru (forbes.ru/tekhnologii/557184-v-moskve-zarabota…)

• Exclusive: Foreign hacker in 2023 compromised Epstein files held by FBI, source and documents show | Reuters (reuters.com/world/us/foreign-hacker-2023-compr…)

• Feds say another DigitalMint negotiator ran ransomware attacks and helped extort $75 million | CyberScoop (cyberscoop.com/digitalmint-ransomware-negotiat…)

• Researchers disclose vulnerabilities in IP KVMs from four manufacturers - Ars Technica (arstechnica.com/security/2026/03/researchers-d…)

• RE//verse 2026: Hacking the Xbox One by Markus 'doom' Gaasedelen - YouTube (youtube.com/watch?v=FTFn4UZsA5U)

• CrackArmor: Multiple vulnerabilities in AppArmor (cdn2.qualys.com/advisory/2026/03/10/crack-armo…)