International operation disrupts Amadey and StealC malware infrastructure.

Summary

By the N2K CyberWire staff

At a glance.

International operation disrupts Amadey and StealC malware infrastructure.
Cal Water says Handala's hacking claims were overstated.
Stealthy new backdoor may be tied to initial access broker.
DraftKings hacker is sentenced to eighteen months.

International operation disrupts Amadey and StealC malware infrastructure.

A major law enforcement and industry operation disrupted infrastructure used by two leading strains of malware, Amadey and StealC, Europol announced yesterday. The operation focused on the cybercriminal supply chain, as Amadey and StealC are frequently used to stage additional attacks. Microsoft used AI-assisted analysis to determine that the two strains of malware relied on the same infrastructure, then used the RICO Act to obtain legal basis to disrupt more than 200 command-and-control servers.

The effort was also assisted by ESET, BitSight, Lumen, IBM X-Force, Proofpoint, and Mitsui Bussan Secure Directions (MBSD), as well as law enforcement agencies from Canada, Denmark, Germany, the Netherlands, the United Kingdom, and the United States. The operation follows last week's disruption of the SocGolish malware operation by Dutch police.

The research breaks at Black Hat first. Be there this August.

If you follow the research, you already know a lot of it breaks at Black Hat first. Hundreds of peer-reviewed Briefings, more than a hundred hands-on Trainings, and the largest Business Hall in Black Hat's history, across AI, cyber conflict, resilience, and identity. Six days in Las Vegas, August 1–6. Prices increase July 17. Register now with code CYBERWIRE for $200 off your Briefings pass.

Cal Water says Handala's hacking claims were overstated.

California Water Service (Cal Water) has completed its investigation into claims made by the Iranian hacktivist group Handala, concluding that the hackers overstated their access and did not have the ability to disrupt OT systems, SecurityWeek reports. Handala, which is likely backed by the Iranian government, said it could have physically disrupted the water supply after gaining access to industrial control systems, but decided not to do so. Cal Water retained Mandiant to investigate the incident, and the cybersecurity firm found that the hackers had only compromised two IT user accounts belonging to third-party service providers.

Cal Water stated, "The investigation determined that the threat actor accessed one active customer’s online Cal Water account using stolen user credentials. The customer account did not provide access to the billing system, and no payment information was compromised. The threat actor also accessed an external, third-party web site related to a GPS location correction tool; however, the website does not contain any confidential or sensitive information."

Your crisis plan exists. But will it work under pressure?

Most organizations have a plan. Fewer have prepared for the decisions, tradeoffs, and uncertainty that come with a real crisis.

In a recent conversation with Dave Bittner, Courtney Guss of Semperis explains why compliance alone doesn't create resilience and how organizations can better prepare for the moments that matter most.

Listen now for practical guidance on strengthening your incident response program.

Stealthy new backdoor may be tied to initial access broker.

Symantec and Carbon Black have published a report on a new backdoor that surfaced in April 2026. The malware, tracked as "Backdoor.Mistic," may be tied to Woodgnat, an initial access broker that peddles to ransomware gangs.

The researchers note, "The stealth of the backdoor is also notable, as is the fact that Woodgnat is also possibly behind the development of ModeloRAT, indicating a group that is quite highly skilled at the development of stealthy remote access tools. This indicates it is a group that should be actively tracked as it could continue to develop custom tools, as well as widen the pool of ransomware actors it works with."

Behind the Headlines with Media Insiders

Inside the Media Minds pulls back the curtain on today’s media landscape, helping communicators understand what journalists, editors, and audiences actually care about. Hosts Christine Blake and Madison Farabaugh of W2 Communications sit down with influential media professionals for candid conversations about news, storytelling, and media trends. Listen now to sharpen your messaging, strengthen your media strategy, and tell stories that resonate.

DraftKings hacker is sentenced to eighteen months.

21-year-old Nathan Austad of Minnesota has been sentenced to 18 months in prison after pleading guilty to his role in a November 2022 hack of the DraftKings betting platform, BleepingComputer reports. Austad and two accomplices were accused of compromising 60,000 DraftKings user accounts and selling access to the accounts for hundreds of thousands of dollars. The two co-conspirators are already serving prison sentences. Austad was also ordered to pay $463,000 in forfeiture and over a million dollars in restitution.

Notes.

Today's issue includes events affecting Canada, Denmark, Germany, Iran, the Netherlands, the United Kingdom, and the United States.

Attacks, Threats, and Vulnerabilities

Cordyceps: The Silent Parasite Consuming Your Supply Chain (Novee) Novee's research team discovered Cordyceps, a critical supply chain flaw hiding in plain sight, impacting code repositories at thousands of organizations, including Microsoft, Google, Apache, and Cloudflare

Russia used Cellebrite phone-hacking tool to crack down on dissident after firm cut off country (The Record) The continued use of the powerful data extraction product soon after the company in March 2021 said it would stop working with Russia suggests the firm has been unable to pull back its technology from authoritarian government customers, researchers say.

CISA warns of max severity Ubiquiti flaws exploited in attacks (BleepingComputer) The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning of hackers actively exploiting flaws in Ubiquity UniFi OS and Lantronix serial-to-ethernet servers.

Marketplace

China’s 360 says it has developed tools to match Anthropic’s Mythos (Reuters) China's 360 claims to have developed domestic answer to Anthropic's Mythos

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

Interviewing Essentials: Grow Interviewing Muscle with Mock Interviews on The Dev Difference Tool (Virtual, USA, Jul 17, 2026) This session will introduce members to The Dev Difference, a free mock interview tool designed to help candidates practice, build confidence, and prepare for real interviews.

Breaking Barriers: Navigating Your Early Career as Women in STEM (Virtual, USA, Jul 21, 2026) Starting a career in tech can feel exciting, challenging, and uncertain. This session is designed to help women in STEM navigate the early years of their careers with more clarity and confidence. You’ll hear from Hayley Murphy, Senior Campus Recruiter on CBRE’s Campus Digital & Technology team, along with women working in Digital & Technology at CBRE.

Tech for Good: When Moments Matter with Axon (Virtual, USA, Jul 28, 2026) This session will explore career pathways in mission-driven technology and give members a closer look at how technical teams at Axon build products that support public safety, accountability, and real-world impact.

Events

CSA Agentic AI Security Summit 2026 (Virtual, USA, Jun 24 - 25, 2026) Coding agents are rewriting how software gets built. Orchestration harnesses are rewriting how work gets done. And underneath all of it, non-human identity is the trust fabric that determines what these systems are allowed to touch, chain together, and act on autonomously. Most organizations are adopting coding agents and harnesses right now, without a clear picture of the identity and access model being created in the process. Every agent spins up credentials. Every harness chains permissions. And without a coherent NHI strategy, that trust fabric becomes your largest unmanaged attack surface. CSA's free virtual Agentic AI Security Summit is where the security community comes to get ahead of this. Over two days, we'll work through the full agentic stack: how coding agents operate and authenticate, how harnesses like LangChain, CrewAI, and AutoGen chain access across systems, and how to build the NHI trust fabric that governs all of it safely. Sessions are grounded in real enterprise environments and focused on what you can act on now.

Black Hat USA (Las Vegas, Nevada, USA, Aug 1 - 6, 2026) The premier cybersecurity event of the year returns to Mandalay Bay with a re-engineered, six-day program built to ignite innovation, push boundaries, and bring the global security community together like never before. This year’s event features four days of immersive, expert-led Trainings (August 1–4), followed by Summit Day on Tuesday, August 4, and a two-day main conference packed with groundbreaking Briefings, open-source tool demos in Arsenal, a dynamic Business Hall, and unlimited learning & networking opportunities.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry's largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust N2K CyberWire to get the message out. Learn more.

Daily Briefing for 06.25.26

At a glance.

International operation disrupts Amadey and StealC malware infrastructure.

Cal Water says Handala's hacking claims were overstated.

Stealthy new backdoor may be tied to initial access broker.

DraftKings hacker is sentenced to eighteen months.

Notes.

Attacks, Threats, and Vulnerabilities

Marketplace

Newly Noted Events

Events