Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

AI Takes Over RSAC Conference (Now What?) with Dave Bittner

In this RSAC 2026 Conference recap, Dave Bittner, Host of the CyberWire Daily podcast, joins Data Security Decoded host Caleb Tolin from the guest seat to discuss the biggest theme dominating the conference: artificial intelligence, and, more specifically, agentic AI. From wall-to-wall AI messaging across San Francisco to in-depth conversations with security leaders and analysts, one thing became clear: the industry has moved past debating whether AI will take hold. It already has. Now, the focus has shifted to making it safe.

Why Incident Response Fails (And It's Not the Technology)

Incident response plans rarely fail because of technology. It’s usually because of coordination, or the lack of. Nelson Carreira explains why organizations that build isolated recovery environments should use them not only for recovery testing but also to strengthen incident response planning. Simulation exercises reveal a critical need: clear roles, leadership authority, and secure communication channels during a crisis.

Cyber Resilience in Healthcare: Why Recovery Starts at the Endpoint

On this episode of Building Cyber Resilience: A Healthcare Leader’s Guide, Nelson Carreira explains why recovery planning in healthcare has to consider the entire environment, from user devices to network architecture. In large incidents, the blast radius can extend far beyond servers, sometimes forcing organizations to rebuild tens of thousands of endpoints before operations can safely resume. As he puts it.

How to protect yourself from ransomware

• Ransomware complaints filed with the FBI rose 9% in 2024; the FBI describes ransomware as the most pervasive threat to critical infrastructure (FBI IC3 2024 Annual Report). • The average ransom payment reached $2 million in 2024 — a fivefold increase from 2023 — while recovery costs averaged $2.73 million excluding any ransom paid (Sophos State of Ransomware 2024).

What Happens When Healthcare Systems Go Dark

• What happens inside a healthcare system when ransomware takes down Active Directory and authentication fails? In this episode, Josh Howell sits down with Nelson, Executive Healthcare Strategist at CDW, to explore real-world cyber incidents and the architectural shifts required to recover safely. You’ll learn: YouTube Chapters Final Lessons for Healthcare Leaders If you enjoyed this episode, be sure to subscribe to our YouTube channel.

The AI Malware Surge: Behavior, Attribution, and Defensive Readiness

Over the last year, AI-assisted malware development has evolved from an experimental practice into a common part of the attacker toolkit. In a rolling window from February 2025 to February 2026, Arctic Wolf Labs observed over 22,000 distinct files triggering AI-focused YARA rules across multiple malware repositories. These files included AI-generated code, large language model (LLM)-style scaffolding, runtime AI API integration, and DeepSeek-derived artifacts.

Analyzing FAUX#ELEVATE: Threat Actors Target France with CV Lures to Deploy Crypto miners and Infostealers Targeting Enterprise Environments

Securonix threat researchers have been tracking an ongoing campaign targeting French-speaking corporate environments through fake resumes. The campaign uses highly obfuscated VBScript file disguised as resume/CV documents, delivered through phishing emails. Once executed, the malware deploys a mutli-purpose toolkit that combines credential theft, data exfiltration, and Monero cryptocurrency mining for maximum monetization.

TeamPCP Supply Chain Attack Part 2: LiteLLM PyPI Credential Stealer

Part 1 covered CanisterWorm, the self-spreading npm worm. This post covers the next wave: a malicious LiteLLM PyPI package carrying the most capable credential stealer TeamPCP has deployed yet. On March 24, 2026, two versions of litellm, one of the most widely used Python libraries for working with AI language model APIs, were published to PyPI carrying a hidden credential stealer. Versions 1.82.7 and 1.82.8 never appeared on the official LiteLLM GitHub repository.

BewAIre: Detecting Malicious Pull Requests at Scale with LLMs

As AI coding assistants accelerate software development, the volume of pull requests at Datadog has grown to nearly 10,000 per week, increasing the risk that malicious changes slip through due to review fatigue. To address this, Datadog built BewAIre, an LLM-powered code review system designed to identify malicious source code changes introduced by threat actors. By reducing approval fatigue for developers while increasing friction for attackers, BewAIre guides human reviewers to the areas where judgment matters most, without slowing developer velocity.

CanisterWorm: The Self-Spreading npm Attack That Uses a Decentralized Server to Stay Alive

On March 20, 2026 at 20:45 UTC, Aikido Security detected an unusual pattern across the npm registry: dozens of packages from multiple organizations were receiving unauthorized patch updates, all containing the same hidden malicious code. What they had caught was CanisterWorm, a self-spreading npm worm deployed by the threat actor group TeamPCP. We track this incident as MSC-2026-3271.