Alex: Good morning. It's Tuesday, September 1st, 2026. This is Cleartext. I'm Alex Chen.

Jordan: And I'm Jordan Reeves. Let's get into it.

Jordan: So here's the thing that should ruin your Tuesday morning coffee. Chinese state-sponsored hackers—a group researchers are calling Fire Ant—have figured out how to implant covert GRE tunnels on Cisco IOS XR routers that are completely invisible to the running configuration and the commit history. You read that right. You could stare at your router config all day and never see it. Your network backbone is potentially a long-term espionage platform and you wouldn't know.

Alex: That is exactly the kind of finding that should trigger an emergency conversation between every CISO running Cisco IOS XR and their network engineering teams today. Not tomorrow. Today. Let me set up what we're covering this morning because it's a dense news day. We've got the Fire Ant Cisco implant, North Korea's worker fraud scheme expanding way beyond IT roles, a genuinely novel AI evasion technique from a Russian-aligned group, a major FSB warning to global finance, a potential 284-million-record healthcare breach, a Teams vishing campaign you need to know about, Berlin refusing to pay ransomware, NIS2 deadlines bearing down, AI agent governance gaps, and a BGP hijack weaponized against software updates. Let's move.

Jordan: Back to Fire Ant. What makes this different from prior router compromises—and there have been many—is the persistence mechanism. Previous campaigns against network infrastructure, like the Volt Typhoon activity, relied on techniques that were at least theoretically discoverable through config review or forensic analysis. This is a step function. The GRE tunnel interface exists on the device but leaves no trace in the running configuration or the commit history. That's not just clever tradecraft, that's purpose-built capability against the way network teams actually operate.

Alex: And that's the business problem. Network teams validate state through config. If the config lies to you—or more precisely, omits the truth—your entire assurance model for network integrity breaks down. The action item here is clear: you need to go beyond config review. Talk to Cisco TAC, get guidance on out-of-band verification methods for IOS XR, and frankly, start thinking about whether your network monitoring would even detect anomalous GRE traffic flows. Because if Fire Ant is tunneling data out through your own routers, your perimeter controls are irrelevant.

Jordan: And the targeting logic is obvious. IOS XR sits in service provider and large enterprise backbone environments. These are the routers that move serious traffic. You compromise one of these, you're not just getting access to a single network, you're potentially positioning yourself to intercept traffic across entire regions or sectors. This is signals intelligence infrastructure being built inside commercial networks.

Alex: Let's stay in the nation-state threat space because the North Korea story connects thematically, even though the vector is completely different. The DPRK IT worker scheme—we've been tracking this for years now—has officially expanded beyond IT roles. Researchers have confirmed fraudulent North Korean operatives placed in sales, marketing, and medical positions.

Jordan: This is the maturation phase everyone predicted but few prepared for. The original scheme was elegant in its simplicity: place IT workers remotely, generate revenue, occasionally exfiltrate data. But it was containable because the hiring pipeline for IT roles could be hardened with technical verification, code tests, identity checks. Now they're in healthcare and sales. How do you technically verify a sales candidate's identity in the same way? The control framework is completely different.

Alex: This is a board-level conversation about insider threat program scope. Most insider threat programs are implicitly designed around IT and privileged access users. If your threat model doesn't account for a fraudulently placed sales representative with access to your CRM, your customer data, your pricing strategy—you have a gap. CISOs need to be partnering with HR and legal to extend identity verification across all remote hiring, not just technical roles.

Jordan: And let's be honest about the scale. This isn't a handful of operatives. The U.S. government has been saying for over a year that thousands of DPRK workers are embedded in companies globally. The expansion into non-technical roles means that number is growing, and the detection difficulty is increasing.

Alex: Let's pivot to something genuinely new. Jordan, the GuardBreaker technique.

Jordan: This one is fascinating and frankly a little unsettling if you've invested heavily in AI-augmented security operations. UAC-0099, a Russia-aligned group targeting Ukrainian organizations, deliberately embedded nuclear weapon-related content strings inside their malware. Not because the malware has anything to do with nuclear weapons—but because those strings trigger the safety guardrails in large language models. If your SOC is using an LLM to assist with malware analysis, the model refuses to analyze the sample because it thinks it's being asked about weapons of mass destruction.

Alex: So the adversary is weaponizing your AI tool's safety features against you. That's adversarial AI in a way most people weren't thinking about. Everyone's been worried about prompt injection and data poisoning. This is simpler and arguably more effective: just make the AI refuse to do its job.

Jordan: ESET is calling it the first documented instance of a nation-state actor doing this deliberately. But I guarantee it won't be the last. Every threat actor watching this will realize they can blind AI analysis pipelines with a few well-placed strings. CISOs who have deployed LLM-assisted analysis—and that's a growing number—need to stress-test those pipelines against this exact technique. Can your AI tooling handle adversarial content designed to trip safety filters? If you don't know, find out this week.

Alex: That connects directly to the broader AI governance conversation. The Financial Stability Board—chaired by Andrew Bailey—just issued a warning to G20 banking leaders that cyber risk from frontier AI is the most immediate concern to global financial system stability. That's not a think tank saying this. That's the FSB chair speaking to the people who regulate the world's largest banks.

Jordan: The specific language around concentration risk is what matters here. Bailey called out shared technology dependencies across multiple firms and told institutions to prepare for severe simultaneous disruption scenarios. Read between the lines: they're worried about what happens when a widely shared AI platform or cloud dependency fails or is compromised across the financial sector simultaneously.

Alex: For financial sector CISOs, this is a signal flare. Regulatory pressure is coming. You will be asked to document your AI risk scenarios, your concentration dependencies, your third-party AI provider risk assessments. If you don't have that work underway, you're behind. And this connects to the AI agent governance piece from VentureBeat—the Box CISO made the point that traditional IAM controls govern what an AI agent can access, but not how it behaves once it's active. Autonomous agents can convert legitimate data access into unintended actions in seconds. Access control is necessary but insufficient. You need execution governance layered on top.

Jordan: Which is a hard architectural problem that most enterprises haven't even started scoping.

Alex: Let's move to the McKesson breach. ShinyHunters claims 284 million records stolen from one of the largest healthcare distributors in the United States. McKesson has acknowledged the attack and warned of intermittent service degradation.

Jordan: ShinyHunters has a track record of legitimate claims. They're not typically bluffers. If this number holds up, we're talking about one of the largest healthcare data compromises in history. McKesson distributes medicines and devices to hospitals and practices across the country—the downstream exposure is enormous.

Alex: If McKesson is anywhere in your supply chain—and if you're in healthcare, there's a good chance it is—you need to be running your downstream risk assessment right now. HIPAA notification obligations, state breach notification laws, potential exposure of patient data, operational data, supply chain data. This is a multi-month regulatory and legal process that starts today.

Jordan: The Spring Ring vishing campaign is worth sixty seconds of everyone's attention. Unit 42 documented a campaign running January through April this year where attackers registered external Microsoft Teams tenants designed to look like internal IT support, then used those to vish employees into installing malware or granting remote access. Over 150 employees targeted across more than ten companies in multiple industries.

Alex: The fix is straightforward but often overlooked: review your external tenant access policies in Teams. The default configuration allows external tenants to communicate with your internal users. If you haven't restricted that, do it. And reinforce your helpdesk impersonation training because this attack vector preys on the trust employees place in internal communications platforms.

Jordan: Quick hit on Berlin. The city's state government got hit by Rhysida, confirmed data theft from administrative networks, and Governing Mayor Wegner went public saying Berlin will not pay. Full stop. Emergency Senate session, state criminal police engaged.

Alex: Good case study in crisis communication and institutional resolve. Berlin is doing what we advise boards to prepare for: have the ransom payment policy decided before the incident, not during it. The public refusal to pay is a posture decision that should be made in peacetime.

Jordan: The Virtualizor BGP hijack is the last technical item and it's important. Attackers hijacked BGP routing for Virtualizor's update infrastructure, redirecting update requests to malicious servers that delivered compromised updates directly to users. This is a supply chain attack that bypasses everything you'd normally rely on at the endpoint level.

Alex: BGP-level manipulation for supply chain compromise is not new conceptually, but seeing it weaponized against a specific vendor's update infrastructure is a reminder that software update integrity cannot rely solely on TLS and code signing. You need to be monitoring for BGP anomalies affecting your critical vendors and validating that your update verification mechanisms would actually catch a redirected, malicious payload.

Jordan: And finally, NIS2. October enforcement deadlines are arriving across EU member states. Austria, Poland, and others are moving from transposition to active enforcement. Essential entities face fines up to ten million euros for non-compliance across IAM, supply chain risk management, incident reporting, and board-level accountability.

Alex: If you're an essential entity under NIS2 and your IAM remediation isn't complete, this is now a board-level financial risk conversation. Ten million euros in potential fines focuses the mind.

Jordan: So stepping back, the theme this week is the expansion of attack surfaces into domains that security teams historically haven't owned. Network backbone infrastructure with invisible implants. HR and hiring pipelines infiltrated by nation-state operatives. AI analysis tools blinded by adversarial content. BGP routing exploited for supply chain compromise. The perimeter of what a CISO is responsible for keeps expanding.

Alex: And the governance frameworks haven't kept pace. NIS2 is trying. The FSB warning is trying. But the gap between where adversaries are operating and where our controls are deployed is widening, not narrowing. The CISOs who will navigate this well are the ones building cross-functional partnerships—with network engineering, with HR, with legal, with the board—because none of these problems are solvable within the security team alone.

Jordan: Agreed. Watch for more GuardBreaker-style techniques. Once adversaries realize they can weaponize AI safety features, that playbook will proliferate fast. Test your AI tooling now.

Alex: That's our show for today. Show notes, links to every story we covered, and our analysis are at cleartext.fm. We'll be back tomorrow. Stay sharp.

Jordan: See you then.