From cybersecurity and big data to cloud computing, IT Brew covers the latest trends shaping business tech in our 4x weekly newsletter, virtual events with industry experts, and digital guides.

IT Brew

Eoin Higgins

itbrew.com

A person uses a computer in a darkened office.

FBI investigation into Hive hacking group breaks gang; State offers $10 million for more information

The operation was a ‘21st century cyber stakeout,’ the DOJ says.

an image of the US capitol building from the east

Federal officials are increasingly being targeted by commercial spyware

Rep. Jim Himes is leading a drive to take action against firms selling the spyware. 

Federal officials are increasingly being targeted by commercial spyware, raising alarm for lawmakers

‘This is the most intimidating thing that can happen on a mobile device,’ says one digital forensics expert.

Pegasus spyware targets journalist’s mobile devices, raising questions about state surveillance

The US capital on two computer screens in front of binary code on a purple background

Government

Caroline Nihill

The White House released long-awaited AI guidance in July, and it’s a mixed bag. While the Trump administration’s “anti-woke” executive order takes aim at perceived diversity, equity, and inclusion (DEI) initiatives in the development of large language models, IT pros who spoke with IT Brew were pleasantly surprised to find a focus on open source in its separate AI action plan.

According to the EO signed by President Trump, DEI in regard to AI is considered the “suppression or distortion” of factual information about race or sex. It continues: “DEI displaces the commitment to truth in favor of preferred outcomes and, as recent history illustrates, poses an existential threat to reliable AI.” The Associated Press 

 the order as an attempt at censorship, and noted that it “still faces a study period before it gets into official procurement rules.”

Asad Ramzanali, the current director of AI and tech policy at the Vanderbilt Policy Accelerator and former official at the White House Office of Science and Technology Policy under President Biden, told IT Brew that he imagines the implementation of the “anti-woke” order may look like a government-established test for systems.

“I worry that in the hope of creating neutrality, you just mandated an ideological purity test,” Ramzanali said. “I’m allowed to have a political view, you’re allowed to have a political view, your company can have a political view. That’s really tricky to push companies ostensibly through procurement to meet some kind of neutrality.”

While experts maintain that the anti-woke EO that follows the action plan’s release is concerning, they also agree that the administration’s positioning toward open-source models is a benefit to the private sector.

Seemingly more substantive guidance on AI is outlined in the administration’s action plan, titled “Winning the Race,” which points to the government’s ability to “accelerate the maturation of a healthy financial market for compute” through collaborating with industry and using other vehicles in the federal space, like the National AI Research Resource Pilot and the National Institute of Standards and Technology, for open-source models.

The administration recommends ensuring access to “large-scale computing power for startups and academics by improving the financial market for compute. Currently, a company seeking to use large-scale compute often must sign long-term contracts with hyperscalers—far beyond the budgetary reach of most academics and many startups.”

The action plan further states that the US has “solved this problem before” through spot markets (when assets are purchased or sold immediately without a long-term commitment) and forward markets (where contracts are made to purchase or sell assets at a determined price in the future). This is in concert with the industry and government approach the administration believes can hasten the maturation of a healthy market for compute.

the action plan focuses on infrastructure and diplomacy—pointing directly toward encouraging both open-source and open-weight models.

 webpage points to releasing open-source software as a benefit from the standpoint of having more perspectives. It states that open-source work has “benevolent results” but it is not “an act of charity.” It goes on to say that having an open-source approach can yield higher returns than the initial investment.

, however, pointed to open-source software as having limited support and functionality, compatibility issues, and more. It looks to open-source security risks, as well, if the software is maintained incorrectly—specifically, vulnerabilities can allow attackers to access sensitive information or take control of a system.

Policy and industry experts, like Travis Hall, the director for state engagement at the nonprofit and nonpartisan Center for Democracy and Technology and Dhruv Patel, CEO of Syncurrent—a company that provides digital services to match local governments to grants—point to the action plan’s stance on open source as a positive for the market.

Hall highlighted the open-source and open-weight systems of the action plan as a potential positive.

“I think that this is a big deal, particularly for industry and IT professionals, because there have been debates…on whether or not open systems should be allowed, whether they can be exported, whether there should be expert controls on model weights or open-source systems,” Hall said. “It means that the tendency towards large model, proprietary systems being the only thing that is available is not going to be the case.”

Hall believes this aspect of the plan is a “pro-competitive move that will help IT professionals in particular” through having a broader set of choices than what is currently available—like those provided by Linux, WordPress, and Android. He also said that IT pros can benefit from having the ability to use open-source systems and “innovate on their own.”

“Everybody knows that open-source software is available, it is a thing,” Hall said. “It hasn’t made commercial proprietary software go away, but it does help to diversify the ecosystem and also help support a more competitive ecosystem.”

Patel told IT Brew that those who adopt open-source models will be impacted, but said he doesn’t know if it’s “for the better or for the worse.”

“Right now, I lean more good than bad, particularly because of the emphasis on supporting open source and supporting open models, as opposed to not,” Patel said.

He continued: “For tech businesses, for tech startups, it’s incredibly important that we have robust open-source models. But even more so for nutritional IT tech-enabled businesses, businesses that don’t directly have a fingerprint in tech but they’re tech-enabled.”

Trump administration’s AI plan takes aim at ‘anti-woke’ large language models

The action plan, released at the end of July, also contains language in support of ensuring access to open models for startups and academics.

Ask Huntress CEO and co-founder Kyle Hanslovan about the future of the cybersecurity industry’s public-private partnership and you’ll get a long answer.

Hanslovan, who spent 16 years in US intelligence before launching Huntress a decade ago, is no stranger to the back and forth between agencies and the corner office. Add to that the reality of the federal government and its interplay with the states and you have a recipe for, if not disaster, certainly confusion.

IT Brew had a chance to catch up with Hanslovan in early August, and we asked him where the public-private partnership goes next in an era of budget cuts and an uncertain federal commitment.

This interview has been edited for length and clarity.

As we’ve reported, budget cuts have impacted cybersecurity programs at the federal level. The public-private cybersecurity partnership in the US has long been a point of pride for the industry—where are things at now?

At the end of the day, there is stuff that the government will not be funded to do. Today, it might be more on the states to handle things. Tomorrow, it could be more on federal, but I think we have to acknowledge that hope is not a very good strategy.

Private business is in many ways stepping up for some of that predictability… I’m not promoting vigilante hacking, but I think there should be a lot more collaboration when vendors and folks like us see mistakes. 

Whether it’s a cybercriminal doing something and they leave a door open, or they leave a password available, I’m not so sure there shouldn’t be a rapid response capability in the government that says, “I found this mistake.” The government should be able to leverage it.

So it’s safe to say that you’re in favor of the public-private relationship?

Public and private relationships are critical, but we are still very immature on how we collaborate to support offensive operations against cybercrime and nation-state threat actors.

Sometimes it seems the government moves a little slowly on these threats. In the US we have federal and state governments, for example, with differing regulations and policies. How does that play into reaction time and defender decisions?

We just bombed a country without congressional approval. If we really, as a federal government, wanted to take a quick reaction to a threat actor in cyber, we’d do it. We're not. Let’s call that spade a spade first.

Second, I don’t think we should have the ability to fire from the hip and not ask for permission, right? I do think asking for permission is important. Oversight is very important.

There is a hell of a lot of bureaucracy, and the people paying for it are not the largest companies with unlimited budgets and unlimited staff. The people paying for it are the businesses that are the backbone of our economy that don’t have access to unlimited talent, or have limited budgets, or people overworked and underresourced.

This starts with decisive leadership that’s willing to take a more firm stance—and that might mean some imperfection. I think it starts with our new secretary of defense. We’ve talked about returning to the warrior ethos of the military. I would like to see that warrior ethos extend to how public and private collaborations in cyberspace help arm and protect, whether it’s any democratic Western government, let alone the citizens behind it. I think this is something that we really need to consider if we want to keep our edge over cybercrime.

When you look at the state of the last decade in public-private efforts to push back on cyber threats, where do you see us headed? How does the danger of attackers manifest itself?

The next 10 years are going to require better collaboration, better automation, and, to be honest, more reactivity with urgency, even better proactivity or getting ahead of these threats before they happen.

There’s a lot of infrastructure, bureaucratic overhead, a lot of really hard things. Who do you get a hold of if you find a hacker doing this? Do you call the FBI? Do you call the internet cybercrime center? Do you call DHS? Do you call CISA? Do you call the NSA, the CIA? We have to figure it out because the one thing that threat actors have is they’re very small. They’re very agile, and they don’t have the same overhead of the system.

Public-private cybersecurity partnership is strong, but there are still improvements to make

“Hope is not a very good strategy,” Huntress CEO Kyle Hanslovan tells IT Brew.

ITB VE-Governing AI-video embed

Speakers

Questions?

AI regulation is evolving fast and unevenly, leaving IT leaders to navigate a maze of fragmented rules and rising compliance risks. Join IT Brew and YeshID to learn how to build adaptable frameworks, align teams, and apply proven risk strategies to today’s AI landscape.

Ready or Not: Governing AI in a Fragmented Regulatory Landscape

Billy Hurley

On July 4, just five hours after Joey Chestnut 

, President Trump signed legislation taking a big bite out of Medicaid.

To pay for Big Beautiful’s tax cuts, the bill reduces federal Medicaid spending by approximately $1 trillion from 2025 to 2034, according to estimates from nonprofit Kaiser Family Foundation (KFF). The bill limits state-provider tax arrangements (cutting $191 billion, according to the KFF analysis) and state-directed Medicaid payments (cutting 

A June 24 examination from the Congressional Budget Office calculated that the bill’s Medicaid provisions would lead to 7.8 million uninsured individuals by 2034, and lower funds would result in states “reducing provider payment rates, reducing the scope or amount of optional services, and reducing Medicaid enrollment.”

With less money, Michael Hamilton, field CISO of Lumifi Cyber, sees rural hospitals (which rely heavily on Medicaid for revenue) sacrificing in an area they can ill afford to cut: cybersecurity.

“They’re not going to be investing in, ‘Hey, let’s get better at patching.’ They’re just going to try and keep their IT networks alive,” Hamilton told us.

“We are going to start seeing some ransomware or other kinds of extortion events that ultimately end up putting these hospitals out of business or forcing them into a fire sale.”

Tim Powers faced ransomware when he was an executive at a Nevada hospital in 2021; the incident led to downed systems and encrypted files (and a monthlong move to pen and paper, Powers told us).

Now as CFO at nonprofit Idaho Hospitals Association, Powers acts as a “Medicaid guru,” assisting orgs with financial issues and helping facilities as new legislation impacts resources.

While Powers hopes orgs don’t compromise on cybersecurity services, it wouldn’t surprise him to see cyber cuts.

“It’s all about patient care, and ‘Where can I put my best resources and efforts to take care of the patients in my community?’” Powers said. When hospitals consider costs associated with implementing a cybersecurity initiative, “they might think twice about it.”

, examined over 250 US rural hospitals and determined many struggle with basic cybersecurity practices like email security (65% of respondents admitted), multifactor authentication (69%), and network segmentation (62%).

In 2024, Microsoft launched its Cybersecurity Program for Rural Hospitals—a project offering US facilities free security assessments, training resources, and security-product discounts. More than 375 of the roughly 2,000 US rural hospitals are participating in Microsoft-funded cybersecurity assessments, the white paper revealed.

A Georgetown University study released in January found that in 15 states, at least 20% of working-age adults living in small towns and rural areas are covered by Medicaid.

“Large reductions in federal Medicaid funding would put the residents of small towns and rural communities and their healthcare systems at serious risk,” the report concluded.

Almost half (48%) of rural hospitals operated at a loss in 2023, according to the 

 (AHA). Total hospital expenses grew 5.1% in 2024, 

 revealed: labor spend accounted for 56% of hospital costs, drugs took up 9%, and “supplies” reached 13%.

In 2026, according to the July 4 bill, $50 billion over the next five years will be available through a Rural Health Transformation Program, following application proposals from states.

“We will be competing for those dollars with other entities. So, we have to put our best foot forward to make certain our members have front-and-center access to that cash available to them and cyber is a big piece of that,” Powers told us.

Illustration of a hospital with a "sorry we're closed" sign in front of it

Hospital pros reflect on Medicaid cuts and the cyber impacts on rural healthcare

At least one security pro sees more ransomware and “fire sales.”

The Department of Education was subject to a phishing campaign that targeted the agency’s G5 portal, which handles its grant management system.

BforeAI, a company that provides predictive intelligence for attacks and digital risk protections, identified the campaign on July 15 according to 

 released by the company. The cybersecurity group found that there were “multiple lookalike domains” that were attempting to spoof the G5 login page to harvest login credentials.

Lead researcher at BforeAI Abu Qureshi told IT Brew that the company was tracking the bad actor that had been targeting insurance and HR agencies in the US, but pivoted to ED as the group started doing work to take the campaign down. Qureshi said that the phishing attempt is “very timely” with the recent layoffs from the agency.

“It’s not uncommon for actors to try and exploit these reductions in force in big companies or layoffs in [the] public sector as well, especially because the view from the attacker perspective is that public sector is not very well staffed internally to begin with for cybersecurity,” Qureshi said.

Qureshi said that currently, the victim tally is unknown and is not something they are tracking, but “the infrastructure is still live and it was live for some time…there’s a chance that there have been victims.”

These could be the same actors that BforeAI found were sending fraudulent texts to users accused of having unpaid toll fees, according to Qureshi. These actors were found to “be almost operated exclusively out of China.”

“We haven’t been able to connect the dots yet, but it’s possible,” Qureshi said. “The amount of time this has been live leads me to believe that it likely is one of those geographies that don’t cooperate with the US or even companies based in the West.”

He continued: “This is a common problem we face on the…internet mitigation, abuse mitigation side, which is dealing with unfriendly nations and dealing with operators within those unfriendly nations. Because sometimes it has to get to the level where the US government gets involved and outreach to that government—and then they kick in the door, quite literally at some point, because they will not take this down.”

The department did not respond to BforeAI’s report that the company sent through its Office of Inspector General, according to Qureshi.

ED now has a message populated on the G5 portal stating the phishing campaign “intended to steal login credentials to access grant award data and change payment instructions.” The agency advised users to type in G5’s URL directly instead of clicking links from any email.

The Cybersecurity and Infrastructure Security Agency did not respond to a request for comment in time for publication.

Phishing hook going through a mouse pointer arrow

Education Department targeted in phishing scheme

 BforeAI, a cybersecurity threat intelligence company, found evidence of a phishing scheme involving ED’s grant management system on July 15. 

In 2022, Lawrence Livermore National Laboratory (LLNL) found Chinese surveillance cameras stealthily built into US critical-infrastructure systems. The discovery was part of a CISA-backed program called “CyberSentry,” which matched LLNL sensors with private-sector partners.

LLNL’s cyber program Leader Nate Gleason told a Department of Homeland Security (DHS) panel on July 22 that the CyberSentry project is currently on hold, while it awaits funding and sign-off from the Department of Energy and DHS.

National laboratories are not legally able to operate without being funded by a government agency, he said. The sensors are in place; just no one’s allowed to read what they’re detecting.

“Our threat-hunters stopped monitoring networks on Sunday,” he told Congress, referring to July 20.

In a hearing featuring visions of runaway trains, blacked-out hospitals, and downed water plants, industry experts spoke about defensive-security challenges facing today’s 

 operators. A solution, they proposed, requires public–private partnerships, including some on hold, or about to be.

, a computer-worm discovered in 2010 that reportedly 

 supporting Iranian nuclear facilities around that time. (The 

 in 2012 that Stuxnet was developed by the United States and Israel.)

The worm targeted industrial control systems at the uranium-enrichment plant at Natanz, Iran—not so much disrupting the computers it infected, according to journalist Kim Zetter, but the operational technology: the equipment and processes that those computers controlled.

“The same techniques Stuxnet used can be used against critical infrastructure in the US to disrupt services the public, government, and military rely on, or to damage equipment that can also cause death, either directly by causing passenger trains to collide, or indirectly by preventing patients from being treated at hospitals because the electricity is out,” Zetter, author of 

Countdown to Zero Day: Stuxnet and the Launch of the World’s First Digital Weapon

The panelists, who included Zetter, Gleason, Dragos CEO Robert M. Lee, and executive director of the Operational Technology Cyber Coalition Tatyana Bolton, discussed partnerships set to expire.

The Cybersecurity and Information Sharing Act of 2015 is set to expire in September. The law grants liability and privacy protections for organizations that share threat indicators and defensive measures through the Cybersecurity and Infrastructure Security Agency’s 

. “If the legal protections established by this act were to lapse, this flow of information would be disrupted up to 80% to 90%, and national security put in jeopardy,” Bolton told attendees.

The DHS’s State and Local Cybersecurity Grant Program (SLCGP), also set to expire in September, allocates $1 billion over four years to support state and local cybersecurity efforts. “Just as we wouldn’t expect an individual county such as Polk County in Texas to defend themselves against missile strikes from a nation-state, we shouldn’t expect them to respond to cyberattacks on their own. This is a national-security priority,” Bolton said. CISA, which has reportedly lost about a 

 under the current administration, and the Federal Emergency Management Agency, administer the program.

Lee wants to see a “focused CISA” that connects with the private sector on threats, but lets companies lead on technology support. “Government tools have consistently underperformed in comparison to private-sector tools and at a higher cost to taxpayers,” he said in his opening statement.

The problem with a narrow focus, according to Zetter, is that small utilities lack the funds, in many cases, to attain security privately.

“They have relied on CISA for that kind of service. And I think that when we have legislation, of course, that has that ability to provide the funds, that’s really significant for those organizations, and that shouldn’t go away,” Zetter said.

The US Capitol building with binary code 

Experts urge action on OT as key partnerships face expiration

A Homeland Security hearing explored the consequences of cyberattacks on trains, hospitals, and the electric grid.

Anthropic co-founder Jack Clark appeared in 

 at the end of June for a hearing about why the nation has to lead in artificial intelligence innovation and deployment. Clark, in his opening remarks, acknowledged that the US can win the race to build powerful AI but, “We have to get safety right.”

Clark continued that, when he says “powerful AI,” he’s pointing to AI systems that would be a major advancement beyond the current capabilities of the technology, but believes that it’s buildable by late 2026 or early 2027.

Clark, during the hearing, pointed to the need to have AI crafted in the US, saying: “I know that AI systems are a reflection of the societies that build them. AI built in democracies will lead to better technology for all of humanity.”

Clark’s statement and responses focused on the need for US control over the proliferation of AI systems as well as a federal-level focus on innovating within the government and investing in capacity for security testing.

“The US government must find ways to accelerate deployment of AI technology across federal agencies, especially within the intelligence community,” Clark said. “This will help our government move faster in handling a rapidly evolving threat landscape, and it will help us gain a better understanding of AI’s impact on national security.”

The Anthropic co-founder said that the US “should control the proliferation of powerful AI systems” through the maintenance and strengthening of export controls of advanced semiconductors to China.

“This all runs through compute,” Clark said.

The hearing followed Anthropic’s success in federal court, where it won a copyright infringement lawsuit from three individual authors—the putative class action was sparked by complaints that Anthropic had allegedly infringed on federal copyrights by “pirating copies for its library and reproducing them to train its [large language models],” 

The judge, William Alsup, granted summary judgement for Anthropic that “the training was a fair use…But it denies summary judgement for Anthropic that the pirated copies must be treated as training copies.”

Alsup wrote that there will be a trial on pirated copies used to create Anthropic’s central library and the resulting damages, actual or statutory.

“That Anthropic later bought a copy of a book it earlier stole off the internet will not absolve it of liability for the theft but it may affect the extent of statutory damages,” Alsup said in the filing. “Nothing is foreclosed as to any other copies flowing from the library copies for uses other than for training LLMs.”

Anthropic co-founder Jack Clark on Capitol Hill.

Anthropic co-founder makes case for proliferation of AI systems following fair use win in court

Anthropic co-founder Jack Clark appeared before Congress to discuss how the US can win the AI race, soon after the company won a landmark fair use case against authors. 