Feed aggregator

WHITEHALL, Ohio (WCMH) -- It was a heated night inside Whitehall City Council chambers Tuesday as officials took up an effort to recall the city's mayor and two council members. "Whitehall is for everybody, not just for some people," Whitehall City Council member Lori Elmore said. "And with that, we're going to continue to fight." [...]

The FCC has banned all new consumer routers made outside the US, leaving networks stuck with aging, insecure hardware while blocking innovation. Find out why this sweeping move is raising eyebrows and lawsuits—and why it makes zero sense for cybersecurity.

• Will California require Linux to verify its user's age.
• Apple's iOS 26.4 requires UK users to prove their age.
• Russia chooses to use home grown 5G mobile encryption.
• Ukraine knew the webcam was installed by Russian spies.
• Google moves quantum computing "Q Day" to 2029.
• At RSA, UK's NCSC CEO warns of vibe-coded SaaS replacements.
• More information about nasty ClickFix campaigns.
• More than one in seven Reddit postings are an AI-bot.
• The story behind the LiteLLM disaster that was averted

Show Notes - https://www.grc.com/sn/SN-1073-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to Security Now at https://twit.tv/shows/security-now.

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Join Club TWiT for Ad-Free Podcasts!
Support what you love and get ad-free audio and video feeds, a members-only Discord, and exclusive content. Join today: https://twit.tv/clubtwit

Sponsors:

• meter.com/securitynow
• zscaler.com/security
• material.security
• bitwarden.com/twit
• hoxhunt.com/securitynow

COLUMBUS, Ohio (WCMH) -- A coalition of more than 1,300 businesses across Ohio is renewing efforts to pass statewide LGBTQ+ protections, arguing such policies are essential not only for civil rights, but also for economic growth. Leaders behind Ohio Business Competes joined NBC4's LGBTQ+ show "Out in Ohio" to discuss the coalition's relaunch and its [...]

COLUMBUS, Ohio (WCMH) -- Local businesses are showing support for the family behind Schmidt's Sausage Haus. Matt Schmidt was killed in a fire early Easter morning. He’s a fifth-generation member of Schmidt's—a business that dates back to 1866. Some local businesses donated a portion of their profits to support Schmidt's family.John Blakely went to high [...]

COLUMBUS, Ohio (WCMH) -- Intoxicating hemp products have been illegal in Ohio since the state’s new cannabis regulations went into effect on March 20, but the hemp industry and its supporters aren’t giving up yet. Hemp retailers won a small victory in court last week when Sandusky County Judge Jeremiah Ray issued a temporary restraining [...]

COLUMBUS, Ohio (WCMH) -- Columbus city leaders are putting a major focus on youth safety. Many students are out of school for spring break and summer is just a few months away. On Tuesday, Columbus Mayor Andrew Ginther visited one youth program, giving his take on how to slow youth violence. This program is called [...]

COLUMBUS, Ohio (WCMH) — The Ohio Department of Transportation (ODOT) has added wrong-way driver detection technology to dozens of exit ramps around central Ohio. It's one of the latest steps ODOT has taken to try and prevent wrong-way crashes. “It’s a rare issue but it's a bigger issue because people are more likely to be [...]

COLUMBUS, Ohio (WCMH) -- Every year, the city of Columbus spends hundreds of thousands of taxpayers’ money to settle lawsuits against the city. NBC4 Investigates dug through those settlements from the last three years and added up all that money to see just how much it’s costing. Council members have approved settlements ranging from $25,000 [...]

COLUMBUS, Ohio (WCMH) — Columbus' beer culture is well-established, annually ranked among the top 10 beer cities in America by USA Today, reaching as high as #3 nationally. Tuesday is National Beer Day in America, an unofficial holiday designed to celebrate the end of prohibition in the 1930s. Nearly 50 breweries are in business in [...]

COLUMBUS, Ohio (WCMH) — Early voting for the May primary election began on Tuesday and the Franklin County Auditor’s Office is encouraging homeowners to be prepared before heading to the polls. There are no countywide levies on the ballot but there are six local levies within Franklin County, including Minerva Park, Prairie Township, Jefferson Township, [...]

COLUMBUS, Ohio (WCMH) -- Despite central Ohio not hosting any games for this summer's FIFA World Cup, the city will be home to a final preparation match for one of the tournament's dark horse teams. The Columbus Crew confirmed that Ecuador will play a friendly against Guatemala at ScottsMiracle-Gro Field on June 7 ahead of [...]

DELAWARE, Ohio (WCMH) -- An assistant prosecutor who accused a Delaware County judge of stalking has resigned due to the judge's "imminent" return to the bench. The resignation was submitted Monday and is effective May 11. Judge James Schuck, 50, took a voluntary leave of absence in November after allegations of stalking were filed in a [...]

Hackers linked to Russia’s military intelligence units are using known flaws in older Internet routers to mass harvest authentication tokens from Microsoft Office users, security experts warned today. The spying campaign allowed state-backed Russian hackers to quietly siphon authentication tokens from users on more than 18,000 networks without deploying any malicious software or code.

Microsoft said in a blog post today it identified more than 200 organizations and 5,000 consumer devices that were caught up in a stealthy but remarkably simple spying network built by a Russia-backed threat actor known as “Forest Blizzard.”

How targeted DNS requests were redirected at the router. Image: Black Lotus Labs.

Also known as APT28 and Fancy Bear, Forest Blizzard is attributed to the military intelligence units within Russia’s General Staff Main Intelligence Directorate (GRU). APT 28 famously compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election.

Researchers at Black Lotus Labs, a security division of the Internet backbone provider Lumen, found that at the peak of its activity in December 2025, Forest Blizzard’s surveillance dragnet ensnared more than 18,000 Internet routers that were mostly unsupported, end-of-life routers, or else far behind on security updates. A new report from Lumen says the hackers primarily targeted government agencies—including ministries of foreign affairs, law enforcement, and third-party email providers.

Black Lotus Security Engineer Ryan English said the GRU hackers did not need to install malware on the targeted routers, which were mainly older Mikrotik and TP-Link devices marketed to the Small Office/Home Office (SOHO) market. Instead, they used known vulnerabilities to modify the Domain Name System (DNS) settings of the routers to include DNS servers controlled by the hackers.

As the U.K.’s National Cyber Security Centre (NCSC) notes in a new advisory detailing how Russian cyber actors have been compromising routers, DNS is what allows individuals to reach websites by typing familiar addresses, instead of associated IP addresses. In a DNS hijacking attack, bad actors interfere with this process to covertly send users to malicious websites designed to steal login details or other sensitive information.

English said the routers attacked by Forest Blizzard were reconfigured to use DNS servers that pointed to a handful of virtual private servers controlled by the attackers. Importantly, the attackers could then propagate their malicious DNS settings to all users on the local network, and from that point forward intercept any OAuth authentication tokens transmitted by those users.

DNS hijacking through router compromise. Image: Microsoft.

Because those tokens are typically transmitted only after the user has successfully logged in and gone through multi-factor authentication, the attackers could gain direct access to victim accounts without ever having to phish each user’s credentials and/or one-time codes.

“Everyone is looking for some sophisticated malware to drop something on your mobile devices or something,” English said. “These guys didn’t use malware. They did this in an old-school, graybeard way that isn’t really sexy but it gets the job done.”

Microsoft refers to the Forest Blizzard activity as using DNS hijacking “to support post-compromise adversary-in-the-middle (AiTM) attacks on Transport Layer Security (TLS) connections against Microsoft Outlook on the web domains.” The software giant said while targeting SOHO devices isn’t a new tactic, this is the first time Microsoft has seen Forest Blizzard using “DNS hijacking at scale to support AiTM of TLS connections after exploiting edge devices.”

Black Lotus Labs engineer Danny Adamitis said it will be interesting to see how Forest Blizzard reacts to today’s flurry of attention to their espionage operation, noting that the group immediately switched up its tactics in response to a similar NCSC report (PDF) in August 2025. At the time, Forest Blizzard was using malware to control a far more targeted and smaller group of compromised routers. But Adamitis said the day after the NCSC report, the group quickly ditched the malware approach in favor of mass-altering the DNS settings on thousands of vulnerable routers.

“Before the last NCSC report came out they used this capability in very limited instances,” Adamitis told KrebsOnSecurity. “After the report was released they implemented the capability in a more systemic fashion and used it to target everything that was vulnerable.”

Multiple Italian American groups are suing the city of Columbus over its removal of a Christopher Columbus statue, claiming the removal of the statue is discriminatory and was done illegally.

COLUMBUS, Ohio (WCMH) – A sports bar just south of Grandview Heights has shuttered after less than a year. Draft Day, located at 1130 Dublin Road, shut down in mid March. The pub opened in May 2025, taking over the space formerly occupied by Smokehouse Brewing Company. View NBC4's previous coverage in the video player [...]

COLUMBUS, Ohio (WCMH) -- A cocktail lounge has opened in the Old North neighborhood, bringing a speakeasy-inspired concept to a space long known for its nightlife. Proof by The Alibi began welcoming patrons last week following its grand opening at 2598 N. High St., taking over the former home of Bossy Grrls Pin-Up Joint. The [...]

Kroger's Columbus Division announced plans to invest $112 million in 2026 to open two new stores and renovate eight existing locations, bringing enhanced shopping experiences to local communities.

COLUMBUS, Ohio (WCMH) — A man has been sentenced to nearly 90 years in prison after raping an elderly woman in east Columbus last year. According to court documents, a Franklin County jury found Miguel Rodriguez Rolon guilty on four felony charges, including the rape of an 87-year-old woman in January of 2025. A Columbus [...]

MANSFIELD, Ohio (WCMH) -- Buc-ee's opened its first Ohio location on Monday, and a second location is already being considered. Buc-ee's opened Monday in Huber Heights off of State Route 235 just north of Interstate 70. The Texas-based travel center was originally slated to open in fall 2025 but ran into delays. Another location could [...]