Risky Business
Risky Business #825 -- Palo Alto Networks Blames It on the Boogie
Risky Business
•February 18, 2026•1h 3m
0
Risky Business•Feb 18, 2026
Why It Matters
Understanding how threat actors adapt—whether by moving to data extortion or leveraging AI—helps organizations anticipate emerging risks and adjust defenses. The episode also underscores the geopolitical tightrope companies walk when attributing attacks, a factor that can shape public policy and incident response strategies.
Key Takeaways
- •Data‑only extortion outpaces traditional ransomware profits.
- •Palo Alto omitted China attribution to avoid retaliation.
- •Cambodian scams generate over 30% of national GDP.
- •BeyondTrust PAM bug actively exploited by Silk Typhoon group.
- •Kim Wolfe botnet’s I2P rollout caused network collapse.
Pulse Analysis
The weekly security roundup highlighted a clear market shift: ransomware operators are increasingly favoring data‑only extortion over classic encryption attacks. Arctic Wolf’s report shows extortion revenue climbing while overall ransomware remains the top cybercrime case load. This model prolongs victim impact, turning stolen data into a long‑tail liability rather than an immediate service outage. For enterprises, the change means that breach response plans must expand beyond downtime recovery to include data‑leak mitigation, regulatory notification, and reputation management. The trend also pressures insurers and policymakers to rethink risk models that have traditionally centered on ransomware downtime.
Geopolitical pressure surfaced when Palo Alto Networks removed explicit Chinese attribution from a threat report, citing staff safety and market exposure. The decision sparked debate over the role of private security firms in naming nation‑state actors, especially when corporate interests in China clash with transparency expectations. A parallel discussion examined Cambodia’s cyber‑scam industry, which now accounts for more than 30 % of the country’s GDP. Analysts warn that dismantling such an entrenched illicit economy will be politically and economically disruptive, suggesting that any effective response will require coordinated international aid and long‑term socioeconomic reforms.
Technical vulnerabilities also dominated the conversation. BeyondTrust’s privileged‑access manager received a CVSS 9+ flaw that Silk Typhoon quickly weaponized, underscoring the high value attackers place on PAM weaknesses. Meanwhile, the Kim Wolfe botnet attempted a massive I2P integration, overloading the niche anonymity network and causing a cascade failure. Both incidents illustrate how operational missteps—whether in patch management or botnet architecture—can amplify attack impact. Organizations should prioritize rapid patch deployment for privileged‑access tools and maintain vigilant monitoring of emerging botnet tactics, especially those that exploit lesser‑known privacy networks.
Episode Description
On this week’s show, Patrick Gray, Adam Boileau and James WIlson discuss the week’s cybersecurity news. They cover:
Palo Alto threat researchers want to attribute to China, but management says shush
An increasing proportion of ransomware is data extortion. Is this good?
Cambodia says it’s going to dismantle scam compounds
CISA sufferers through yet another shutdown
Google Gemini’s training secrets are being systematically harvested to improve other LLMs
Academics assess SaaS password managers’ resilience against a malicious server
This episode is sponsored by SSO-firewall integration vendor Knocknoc. Chief exec Adam Pointon joins to talk about the latest in defences… which is to say Knocknoc for Solaris/Sparc and HPUX on PA-RISC?! Okay also that other little known OS… Windows.
This episode is also available on Youtube.
Show notes
Data-only extortion grows as ransomware gangs seek better profits | Cybersecurity Dive
Arctic Wolf Threat Report 2026
Exclusive: Palo Alto chose not to tie China to hacking campaign for fear of retaliation from Beijing, sources say
Risky Bulletin: Cambodia promises to dismantle scam networks by April - Risky Business Media
Age of the ‘scam state’: how an illicit, multibillion-dollar industry has taken root in south-east Asia | Cybercrime | The Guardian
Critical flaw in BeyondTrust Remote Support sees early signs of exploitation | Cybersecurity Dive
CISA Navigates DHS Shutdown With Reduced Staff - SecurityWeek
Kimwolf Botnet Swamps Anonymity Network I2P – Krebs on Security
BADIIS to the Bone: New Insights to a Global SEO Poisoning Campaign — Elastic Security Labs
Over 500,000 VKontakte accounts hijacked through malicious Chrome extensions | The Record from Recorded Future News
Password managers' promise that they can't see your vaults isn't always true - Ars Technica
Zero Knowledge (About) Encryption: A Comparative Security Analysis of Three Cloud-based Password Managers
Google finds state-sponsored hackers use AI at 'all stages' of attack cycle | CyberScoop
Google: Gemini hit with 100,000+ prompts in cloning attempt
Proofpoint acquires Acuvity to tackle the security risks of agentic AI | CyberScoop
Cisco Redefines Security for the Agentic Era with AI Defense Expansion and AI-Aware SASE
Sophos Acquires Arco Cyber to Bring CISO-Level, Agentic AI-Powered Expertise to Every Organization
Dave Kennedy on X: "Regarding this, there was a couple questions on does the pacemaker continue to advertise - most BLE implantable devices go into a sleep type mode. In this case, we are lucky - it does not. We know based on law enforcement answers that she is using a more modern pacemaker with" / X
Clash Report on X: "BIG: Dutch Defence Minister Gijs Tuinman hints that software independence is possible for F-35 jets. He literally said you can “jailbreak” an F-35. When asked if Europe can modify it without US approval: “That’s not the point… we’ll see whether the Americans will show https://t.co/f11cGvtYsO" / X
Dutch police arrest man who refused to delete confidential files shared by mistake | The Record from Recorded Future News
Show Notes
0
Comments
Want to join the conversation?
Loading comments...