Striker Mass Wipes, a Telnet RCE, and Alleged Delve Audit Fabrication
· 24:33 · Watch on YouTube ↗
Summary
The panel discusses a reported destructive attack on Striker affecting more than 200,000 devices across 79 countries, an unauthenticated root-level Telnet RCE in GNU inetutils, and allegations that Delve fabricated audit reports.
Key points
- The episode reports that Iran-linked Handala accessed Striker’s global network and issued destructive commands affecting more than 200,000 servers and mobile devices across 79 countries; manufacturing operations reportedly halted and thousands of employees were sent home.
- Striker reportedly found no evidence of ransomware malware. The discussion cites reports that attackers may have used Microsoft Intune or a similar cloud device-management platform for the mass wipes; the precise mechanism and access route are not established in the transcript.
- Panelists warn that overly broad remote-wipe permissions create operational risk and discuss stronger safeguards, including multiple approvals, monitoring, access governance, and change control.
- The panel describes CVE-2026-32746 in GNU inetutils telnetd as a CVSS 9.8 buffer overflow that could enable unauthenticated remote code execution as root on affected legacy embedded or IoT systems. Maintainers reportedly developed a patch.
- Suggested mitigations include patching or disabling Telnet, checking that port 23 is not listening, scanning networks, segmenting systems, and preventing outside access where Telnet cannot be removed.
- The panel discusses allegations that compliance startup Delve fabricated hundreds of audit reports, including by prewriting auditor conclusions and reusing templates. The allegations are presented as unconfirmed and based on a leak spreadsheet, an investigation, and social-media reporting.
Article Details
MITRE ATT&CK
People
Eric HenryEpisode participant discussing the reported cyber incidents and vulnerability.EvilmogEpisode participant discussing the reported cyber incidents and vulnerability.Kimmy FingtonEpisode participant discussing the reported cyber incidents and vulnerability.Nick BradleyEpisode participant discussing the reported cyber incidents and vulnerability.