Play ransomware's new tools. Fancy Bear is out and about. Updates on Sandworm. Ransomware in Russia's war against Ukraine. The US Air Force opens an investigation into the alleged leaker's Air National Guard wing. The Washington Post\u2019s Tim Starks joins us with insights on the Biden administration's attempts to better secure the water supply. Carole Theriault chats with Cisco Talos' Vanja Svacjer about the threat landscape, now and tomorrow. And KillNet\u2019s in the education business with a new hacker course: \u201cDark School.\u201d\xa0\n\nFor links to all of today's stories check out our CyberWire daily news briefing:\nhttps://thecyberwire.com/newsletters/daily-briefing/12/75\n\nSelected reading.\nPlay Ransomware Group Using New Custom Data-Gathering Tools (Symantec)\nNCSC-UK, NSA, and Partners Advise about APT28 Exploitation of Cisco Routers (National Security Agency/Central Security Service)\nAPT28 exploits known vulnerability to carry out reconnaissance and deploy malware on Cisco routers (NCSC)\nState-sponsored campaigns target global network infrastructure (Cisco Talos Blog)\xa0\nUkraine remains Russia\u2019s biggest cyber focus in 2023 (Google)\nFog of War: How the Ukraine Conflict Transformed the Cyber Threat Landscape (Google Threat Analysis Group)\nM-Trends 2023: Cybersecurity Insights From the Frontlines (Mandiant)\nFaltering against Ukraine, Russian hackers resort to ransomware: Researchers (Breaking Defense)\xa0\nAir Force unit in document leaks case loses intel mission (AP NEWS)\nPentagon Details Review of Policies for Handling Classified Information (New York Times)\xa0\nUkraine at D+419: GRU cyber ops scrutinized. (CyberWire)\nLearn more about your ad choices. Visit megaphone.fm/adchoices