President Trump and his team spent their first week back in office wiping nearly all of the government's cybersecurity and surveillance advisers from its roster.

Why it matters: The pool of experts left to help new Trump officials and remaining agency staffers respond to major cyber incidents is shrinking.

Driving the news: The Department of Homeland Security terminated all members of its advisory boards, including the Cyber Safety Review Board (CSRB) and the AI Safety and Security Board.

• The White House also asked all three Democratic members of the Privacy and Civil Liberties Board to hand in their resignations yesterday or face termination.

Between the lines: Trump has yet to make key cyber hires, and his team hasn't said much about what the administration's cybersecurity agenda is this time around — aside from vague promises for increased cyber offense.

• The dearth of information, paired with this week's committee firings, has left companies and policy experts grasping at straws.

The intrigue: Trump's penchant for loyalism is further diminishing the number of available people to backfill these advisory boards or take key roles.

• The administration has been especially wary of not only anyone who has voted Democratic, but also of conservatives who have ever been "never Trump"-ers or supported his political opponents.
• The administration will likely lean heavily on people "who have never really commented publicly about their politics and never made a donation to ActBlue," Katie Moussouris, CEO and founder of Luta Security, told Axios.

Yes, but: Most staff at the Cybersecurity and Infrastructure Security Agency and the Office of the National Cyber Director are still on payroll — and each of those offices has an acting leader.

• Cyber leaders in the intelligence community are also still at their posts.

Zoom in: Any new DHS advisory board members won't be able to just pick up where they left off — that's a problem especially for the CSRB, which was investigating the Salt Typhoon telco intrusions.

• A CSRB member who was terminated this week told Axios it took the relatively new entity a few years to nail down its investigation process.
• While that member said the board was in the early stages of the review, Moussouris — a former CSRB member who stepped down last spring — said that new members will likely have to start from scratch.
• "There will be notes from the interviews, but in my experience, you had to actually be present in the interviews to get the full context of what was being said in order to turn it into a report," Moussouris said.

What we're watching: Once the Senate (most likely) confirms Kristi Noem's DHS secretary nomination, expect to see the dominos fall into place for key CISA picks.

The U.S. Justice Department released indictments against five people yesterday in connection with a years-long North Korean IT worker scheme.

Why it matters: The indictments are against a mix of people from North Korea, Mexico and the U.S. — highlighting just how global North Korea's operations have become.

Zoom in: The Justice Department accused the five people of running an operation from April 2018 to August 2024 to trick companies into hiring North Korean IT workers.

• In this one scheme, the organizers secured jobs at at least 64 U.S. companies, prosecutors said.
• Payments from 10 of those companies generated at least $866,255 in revenue. The FBI and its partners at the State and Treasury departments have said that these workers have been known to earn up to $300,000 each year from just one job.
• North Korean workers participate in the scam as a way of circumventing sanctions that prohibit U.S. companies from hiring them. The salaries are then used to help fund the country's missile program.

How it worked: The defendants are accused of stealing legitimate American identities and creating fake ID documents, like a passport tied to an actual U.S. citizen, when applying to these remote jobs at U.S. companies.

• Once the North Korean workers secured a job at the U.S. company, prosecutors said, they would ship their company-issued laptops to the two U.S.-based defendants' residences in New York and North Carolina to avoid raising suspicion.
• Those two defendants, Erick Ntekereze Prince and Emanuel Ashtor, would download unauthorized remote access software onto those laptops so the North Korean worker could do their job.
• Prince and Ashtor also are charged with helping to launder salary payments from the remote jobs back to North Korea.

The intrigue: Per the indictment, one of the charged North Korean operators got permission from another defendant, Pedro Ernesto Alonso De Los Reyes, to use his identity to score a job at a U.S. IT company working on its mobile platform.

• That operator also got permission to list Prince's address in New York as his primary residence with the company.

Catch up quick: Last year, prosecutors also charged an Arizona woman and four other people who helped North Korean workers get jobs at more than 300 U.S. companies.

• Security training firm KnowBe4 also said last summer it was the victim of one of these schemes.

What we're watching: Three of the five people indicted yesterday have already been arrested.

If your company has fallen victim to these IT worker rings, find me on Signal: @SamSabin.01.

It didn't take long for scammers to start taking advantage of Trump's pardon of Silk Road creator Ross Ulbricht.

Why it matters: Critics have worried that setting Ulbricht free would further incentivize cybercriminals and online drug traffickers — showing there are few consequences for their actions.

Zoom in: Within hours of Trump signing the pardon Tuesday, researchers at online community vx-underground shared screenshots of scammers flooding the official "Free Ross" account on X with links to an "official" Telegram channel.

• However, once people clicked on that link, they were directed to a page that claimed to need to verify their identity.
• That ID verification was fake and asked them to run a set of commands on their computer that, once completed, would infect their device with malware, according to BleepingComputer.
• Yesterday, X suspended the verified account vx-underground had found originally — but plenty of new verified dupes were up and spreading the fake Telegram link at the time (screenshot above).

The big picture: Scammers used the so-called ClickFix tactic, which is a fancy way of describing a method where attackers lure people into visiting a malicious website posing as a legitimate, widely known one.

Yes, but: Scammers are always going to find ways to scam — pardon or no pardon.

@ D.C.

☑️ The Senate confirmed John Ratcliffe as CIA director in a 74-25 vote. (Axios)

💰 Potential GOP-backed budget cuts at CISA weighed heavy at a House hearing on responding to global cyber threats. (Roll Call)

⚠️ Former CISA Director Jen Easterly said in her exit interview that moves to reverse the agency's progress "will be to the detriment of the safety and security of the American people." (Wired)

@ Industry

🤖 OpenAI released a "research preview" of a new AI agent called Operator that can do web-based tasks, like filling out forms or ordering products, for people. (Axios)

👔 Abnormal Security, a startup looking to challenge traditional email security vendors, has hired former ServiceNow executive Lisa Banks as its chief financial officer. (CNBC)

@ Hackers and hacks

📚 The PowerSchool hackers now claim they have stolen the data of as many as 62 million students in a breach of the ed tech giant. (BleepingComputer)

📍 Researchers uncovered now-patched weaknesses in Subaru's Starlink system that allowed them to access a disturbingly detailed map of the exact locations of where millions of vehicles have been over the last year. (Wired)

💥 Several cybersecurity firms have published reports this month detailing massive distributed denial-of-service attacks against Internet of Things devices. (Ars Technica)

👀 💰 OK, so what I'm hearing is that I could get some major eBay bucks for my TikTok burner phone? (This is a joke!)