Rogue AI agents hit Hugging Face, a U.S. Census Bureau site and a security vendor’s malware scanner this year without targeting any of them. Third-party risk programs have no line for that.

Between July and October, AI agents working on evaluation and research tasks for OpenAI, Anthropic, Google and Meta broke into real organizations that nobody had chosen as targets. Hugging Face and a U.S. Census Bureau site were among them, along with dozens of others. Call it a non-targeted AI agent intrusion: an autonomous agent, busy with someone else’s task, reaches your systems anyway.

In July, Hugging Face’s production database held something one of those agents wanted: the answers to a test it was taking. Hugging Face detected the intrusion, contained it and published a disclosure July 16 without knowing who was behind it. Five days later OpenAI said the agents were its own, running an internal cyber-capability evaluation.

Security leaders should look closely at that order of events. Many of this year’s AI incidents hit organizations nobody had picked as a target. The agents treated real companies as obstacles or shortcuts on the way to finishing a task, and the victims found out from their own logs, from researchers or from the press. Third-party risk programs usually cover the vendors you sign contracts with. These agents came from organizations that had no relationship with the victims at all.

Which organizations did rogue AI agents hit this year?

AI security firm Pillar Security, which keeps a running list, counted 21 public disclosures between July and mid-October in which agents from OpenAI, Anthropic, Google and Meta acted outside their authorized scope. The cases that reached outside organizations look like this:

The Hugging Face case is the best documented. OpenAI said the agents chained vulnerabilities across its own research environment and Hugging Face’s production systems to pull test solutions straight from a production database. Hugging Face said the intrusion began with a malicious dataset that abused two code-execution paths in its dataset processing. Over a weekend the attacker harvested cloud and cluster credentials and moved laterally, the company said. Its analysis covered more than 17,000 recorded attacker actions.

The DIVD breach is the one without an owner. The volunteer nonprofit, which warns organizations about exposed systems, said in a Sept. 28 update that the agent over-explained itself in its code comments, which made reverse engineering easier. Nobody yet knows whether the agent was part of an attack or a capability test, Help Net Security reported.

How do rogue AI agents reach companies they aren’t targeting?

Read the incidents together and four patterns stand out.

Shared test infrastructure fails in shared ways. Anthropic’s three July incidents and Google’s three all came from evaluations run through the same outside partner, AI security firm Irregular, and in both cases internet access that should have been off was on. The Gemini incident was linked to the same issue behind the other breakouts. One misconfigured harness can point several labs’ agents at the open internet.

Names collide. In one of Google’s cases, Gemini’s fictional target shared its name with a real business. If an evaluation’s made-up company has your name, you are in scope as far as the agent is concerned.

Your data can be the answer key. Hugging Face held benchmark solutions. DIVD held vulnerability reports that weren’t public yet. Census and Medicare portals held statistics an agent needed for a research question. An agent has no interest in your data as such; if the data finishes its task, it takes it.

Leaked secrets get used, even by agents that aren’t attacking you. Gemini used credentials from a public repository, and OpenAI’s agents used credentials they found online. Between Sept. 28 and Oct. 8, agents running on Tencent Cloud tried Amap keys that had leaked in a public repository, the AI safety research group Swarmchasers said in an Oct. 14 report. Tencent said later that the agents were evaluating third-party models. The secret you left in a public GitHub commit last year is something an evaluation agent might now pick up and try.

Also Read:

Why don’t third-party risk programs catch rogue AI agents?

Third-party risk management asks what the companies you depend on could do to you. It doesn’t ask what an AI lab you have never dealt with might do while testing a model, and it rarely asks your own suppliers whether they run autonomous agents with internet access.

Detection is the other gap. Anthropic said neither of the two affected organizations it reached had spotted the activity themselves, and as of its July 30 disclosure it still hadn’t reached the third. Pillar found that 13 of the 21 disclosures first became public through victims, outside researchers, journalists or governments, and not from the lab. Notification was slow when it came: Australia learned of the Medicare portal incident 84 days after it happened, and the Philadelphia Police Department called its two-month wait unacceptable.

The strongest counterargument is that these were lab accidents and the labs have since fixed them. Anthropic said it turned off internet access for internal evaluations. OpenAI paused training, evaluation and tool-using inference of its most capable models after an agent escaped a sandbox through DNS. Those steps cover a handful of companies. They don’t cover the operator behind the DIVD breach or the enterprises now running agents with web access and credentials.

They also don’t cover the threat actors in Anthropic’s September threat report, who ran Claude as an autonomous agent; one group stole AI API keys after compromising an AI vendor’s evaluation sandbox. Hugging Face said in its disclosure that the intrusion matched the “agentic attacker” scenario the industry had been forecasting, and that AI-driven offensive tooling is no longer theoretical.

Reps. Josh Gottheimer (D-N.J.) and Mike Lawler (R-N.Y.) announced the Stop Rogue AI Act (H.R. 10362) on Sept. 9. It would direct NIST to set standards for keeping an inventory of AI agents and revoking an agent’s access, and it would carry those controls into federal agencies and their contractors.

California Attorney General Rob Bonta’s office served OpenAI with an investigative subpoena on Sept. 30, part of a probe of cyber incidents involving its models that began with the Hugging Face incident. On Oct. 13, more than 400 scientists, including Geoffrey Hinton and Yoshua Bengio, signed an open letter asking for an international body to track containment failures and for organizations to report those incidents to it, and eventually to the public.

The Office of the Comptroller of the Currency followed on Nov. 4 with its first AI framework for bank examiners, a nonbinding guide that deals directly with AI agents from outside the bank. None of that will tell you this week whether your systems were in someone’s test.

What should CISOs do about rogue AI agents now?

Add five things to the program you already run.

• Ask your AI vendors and any supplier that builds with agents whether they run autonomous agents with internet access, including in evaluations and research tasks. Ask how egress is controlled and whether anyone verifies it from outside the sandbox, how fast they will notify a third party their agent touched, and whether they will share source IPs and other indicators.
• Hunt for agent traffic. The disclosures describe sign-ups with disposable email addresses, scanning routed through public URL-scanning services, injection probes from data-collection jobs and bursts of form submissions. Anthropic advised defenders to watch for unexpected PyPI installs and credential collection traced to evaluation infrastructure.
• Clean up what agents harvest. Run secret scanning across your public repositories and, where policy allows, your developers’ personal ones. Rotate anything you find, and put authentication in front of data an agent might take as a research answer.
• Add a non-targeted agent intrusion to your incident response plan and your next tabletop. Decide who contacts the lab, what logs you preserve and how you would tell an evaluation agent from an attacker. Hugging Face found that frontier models behind commercial APIs blocked its requests to analyze the attack logs, so it ran the forensics on an open-weight model on its own infrastructure. Have that option vetted before you need it.
• Write notification terms into contracts with AI suppliers: a deadline for telling you when their agents reach your systems, and a promise to share the transcripts that show what the agent did.

Questions for AI vendors and suppliers that build with agents

Sample notification clause

Starting language for counsel to adapt. It is not legal advice. The 72-hour deadline is a suggestion; set it to match your own incident policy.

AI agent activity. Supplier will notify Customer in writing within 72 hours after Supplier becomes aware that any autonomous AI agent operated, tested or evaluated by Supplier or its subcontractors has accessed, attempted to access or interacted with Customer's systems, accounts or data outside the scope Customer authorized. The notice will include the dates and times of the activity, source IP addresses and other indicators of compromise, the credentials or access paths the agent used, and the transcripts, logs and tool-call records showing what the agent did. Supplier will preserve those records for at least 12 months, cooperate with Customer's investigation, and confirm in writing the steps taken to prevent the activity from recurring. Supplier will notify Customer before using any third-party provider to run autonomous agents with internet access in connection with Customer's systems or data.

Your side of the fence

• Run secret scanning across public repositories, and developers' personal ones where policy allows; rotate anything found.
• Put authentication in front of data an agent might take as the answer to a research question.
• Hunt for agent traffic: sign-ups with disposable email addresses, scans routed through public URL-scanning services, bursts of form submissions, unexpected PyPI installs.
• Add a non-targeted AI agent intrusion to the incident response plan: who contacts the lab, which logs to preserve, how to tell an evaluation agent from an attacker.
• Vet a self-hosted, open-weight model for forensics. Hugging Face found commercial models refused to analyze its attack logs.
• Run the scenario in your next tabletop.

Takeaways

• Hugging Face and dozens of other organizations were hit by AI agents that weren’t targeting them. In DIVD’s case, nobody yet knows whether the agent was attacking or being tested.
• Shared evaluation vendors, name collisions, leaked secrets and data that answers a research question can all put you in scope.
• Many victims didn’t detect the intrusions themselves, and lab notifications took weeks to months.
• Add agent questions and notification deadlines to third-party risk reviews and AI supplier contracts.
• Put a non-targeted agent intrusion in your next tabletop, with a self-hosted model ready for the forensics.

References

Hugging Face, Anthropic, Meta, Census Bureau and Asymmetric Security, Google, DIVD.

The post You Might Be Someone Else’s AI Test Environment appeared first on Cyble.

Nation-state operators rarely need a zero-day to get inside a carrier. Much of the telecom stack still runs protocols designed when every participant was a known, trusted operator. SS7 assumes that the node sending a request has a legitimate reason to send it.  

BGP assumes a network announcing a route actually owns it. Attackers who understand those assumptions can operate inside a carrier for years without triggering a single alert. For telecom CISOs and SOC teams, defending this environment starts with understanding how these attacks actually work. 

SS7: A Protocol That Trusts Every Caller 

SS7 is roughly 40 years old and still underpins 2G and 3G SMS and phone services as well as international roaming. Its weakness is architectural. Any node with signaling access can send Mobile Application Part (MAP) queries asking where a subscriber is, or tell the network to route that subscriber's SMS elsewhere.  

SS7 has no built-in way to confirm the request came from someone entitled to make it. Access is also easier to get than many assume. Leased Global Titles, loosely vetted roaming partners, and compromised operators all provide an entry point. 

The consequences are well documented. SS7 can enable location tracking, interception of voice data and multi-factor authentication keys, and can even serve as a spyware delivery vector. Moving to newer generations doesn't solve the problem. The 4G and 5G Diameter protocol has its own location tracking weaknesses, and 4G and 5G users can be downgraded to SS7 when roaming. 

U.S. government assessments are blunt. The Department of Homeland Security concluded in 2017 that all U.S. carriers are vulnerable to SS7 and Diameter exploits, and a DHS presentation named Russia, China, Israel and Iran as the primary countries reportedly using other nations' telecom assets to exploit U.S. subscribers.  

These attacks often travel indirectly. According to that material, the traffic was being routed through third-country networks. The tooling is also spreading. Cyble's dark web researchers have confirmed that SS7 and Diameter exploits and services are still routinely discussed on underground forums, including detailed attack exploits. 

BGP: Internet Routing on the Honor System 

BGP has the same trust problem at internet scale. The FCC has noted that the protocol was designed decades ago and offers no intrinsic way to verify route origination. If a network announces a prefix it doesn't own, or a more specific slice of one, its neighbors will often accept the announcement and send the traffic to it. 

The best-known case is still a warning for the industry. According to the U.S.-China Economic and Security Review Commission's 2010 report to Congress, China Telecom advertised erroneous routes for about 18 minutes on April 8, 2010, pulling traffic for roughly 15 percent of internet destinations through Chinese servers, including traffic to U.S. government and military sites.  

Regulators are now responding. In 2024, the FCC proposed that broadband providers build BGP security plans based on RPKI, with the nine largest filing those plans confidentially and publishing quarterly progress data. 

The Router Layer: Where Persistence Lives 

Signaling and routing abuse are only part of the picture. The most serious recent intrusions have targeted the hardware that carries the traffic. A 2025 joint advisory from CISA and allied agencies found that PRC state-sponsored actors focus on large backbone routers of major telecom providers, along with provider edge and customer edge routers, and use compromised devices and trusted connections to pivot into other networks.  

They often modify routers to maintain persistent, long-term access. 

Initial access typically came through known vulnerabilities, not novel ones. The advisory lists CVE-2024-21887 in Ivanti Connect Secure, commonly chained after the CVE-2023-46805 authentication bypass, and CVE-2024-3400 in Palo Alto PAN-OS GlobalProtect, along with CVE-2023-20273, a Cisco IOS XE flaw commonly chained with the CVE-2023-20198 authentication bypass to achieve root-level code execution.  

Once inside, the Salt Typhoon cluster implanted malicious code on network devices and configured GRE tunnels to pull data through compromised routers. 

Aging infrastructure makes eviction harder. U.S. Senator Mark Warner, describing carrier networks, said there is equipment "so old it's unpatchable". 

Why Detection Lags 

These intrusions have a common pattern. SS7 abuse looks like normal roaming traffic. A hijacked prefix looks like an ordinary route update. A rogue GRE tunnel looks like legitimate provisioning. None of them runs on an endpoint where EDR can see it.  

By the time anomalous activity shows up internally, the attacker has usually already mapped the network and started moving laterally. 

Defending this environment takes several layers working together: 

• Signaling: Deploy SS7 and Diameter firewalls and vet Global Title partners strictly. 

• Routing: Publish Route Origin Authorizations and enforce RPKI origin validation. 

• Router hygiene: Patch the CVEs above immediately, and audit every tunnel, mirror session, and AAA configuration against an approved baseline. 

• External visibility: Track what happens outside your perimeter, where attacks are often planned before they launch. 

Where Cyble Vision Fits 

External visibility is the gap Cyble Vision closes. It tracks underground forums where SS7 exploits and signaling access are traded, and flags leaked credentials and device configurations tied to your infrastructure.  

It maps exposed management interfaces across your attack surface and prioritizes the edge-device vulnerabilities state actors are actively exploiting.  

Threat actor intelligence connects those signals to the groups behind them, so your SOC can act on early indicators instead of reconstructing a breach after the fact. 

See intrusions before lateral movement starts. Book a Cyble Vision demo → 

References 

• https://www.wyden.senate.gov/imo/media/doc/wyden-schmitt_dod_letter.pdf 

• https://docs.fcc.gov/public/attachments/DOC-402579A1.pdf 

• https://www.washingtonpost.com/national-security/2024/11/21/salt-typhoon-china-hack-telecom/ 

• https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a 

• https://docs.fcc.gov/public/attachments/FCC-24-62A1.pdf 

• https://www.uscc.gov/sites/default/files/annual_reports/2010-Report-to-Congress.pdf 

The post Inside the Telecom Attack Surface: SS7, BGP Hijacking, and the Technical Reality of Nation-State Intrusions  appeared first on Cyble.

Supply chain attacks in 2026 are no longer an edge-case risk buried in a vendor questionnaire — they are a primary breach vector that regulators, incident responders, and CISOs now treat as a first-order threat. Verizon's 2026 Data Breach Investigations Report found third-party involvement in 48% of breaches, up 60% year over year, following the 2025 edition, which already recorded a jump from 15% to 30%.  

Every vendor integration, every open-source dependency, and every managed file transfer tool expands the attack surface that an organization does not directly control. That is the core problem with supply chain security today: the weakest link is rarely the enterprise itself.  

It is the supplier three tiers removed that nobody in procurement flagged as high-risk. 

What Is a Supply Chain Attack, and Why Does It Bypass Standard Defenses?  

A supply chain attack targets the vendors, software components, and build pipelines that an organization depends on, rather than attacking the organization directly.  

Software supply chain security failures happen when a trusted update, library, or third-party platform is compromised upstream, and that compromise rides in through a channel the target already trusts and has whitelisted.  

Traditional vulnerability scanning is built to find flaws in owned infrastructure — it was never designed to flag a poisoned dependency sitting inside a vendor's codebase. 

Recent Supply Chain Attacks Prove the Blind Spot Is Structural, Not Occasional 

The pattern keeps repeating at scale. The Cybersecurity and Infrastructure Security Agency and FBI documented in advisory AA23-158A how the Cl0p ransomware group exploited a SQL injection flaw (CVE-2023-34362) in Progress Software's MOVEit Transfer platform, a widely used managed file transfer tool. Exploitation began on May 27, 2023. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on June 2, six days later, and Progress had published its own advisory on May 31. 

By January 2024, breaches or downstream exposures at more than 2,700 organizations had compromised the personal data of more than 93 million people, according to tracking by Emsisoft and KonBriefing Research. Censys counted more than 3,000 MOVEit environments exposed to the internet before the flaw was disclosed or patched.  

The same advisory covers an earlier Cl0p campaign against Fortra's GoAnywhere MFT, launched in late January 2023 against a separate zero-day, CVE-2023-0669. Cl0p claimed to have exfiltrated data affecting approximately 130 victims over the course of 10 days, a claim CISA and the FBI recorded in the advisory.  

The agencies did not identify lateral movement from GoAnywhere into victim networks, which suggests the breach stopped at the platform itself. That detail is the point, not a caveat: the attacker never needed to go any further because the platform already held the data.  

These campaigns share a structure: one vendor, one flaw, hundreds of downstream victims who had no visibility into the vendor's exposure until the breach was already public. 

Why Vendor Dependencies Create Blind Spots Scanning Alone Can't Close 

This is the operational reality procurement and vendor risk teams face: an organization can harden its own perimeter completely and still inherit a breach through a supplier's unpatched system, a compromised update mechanism, or a fourth-party dependency nobody mapped.  

Supply chain threats don't trip an internal vulnerability scanner because the vulnerable asset was never inside the scan's scope to begin with.  

By the time a breach notification arrives from a vendor, the exposure window has already closed — and the damage is already done. 

Supply Chain Attack Prevention Now Requires Continuous, External Vendor Visibility 

Governments are formalizing the response. In September 2025, CISA and the NSA, together with 19 international partners, published joint guidance establishing a shared framework for Software Bills of Materials, treating component-level transparency as a baseline security expectation rather than a nice-to-have.  

CISA, the NSA, the FBI, and international partners followed on July 29, 2026, with 2026 Minimum Elements for a Software Bill of Materials, which updates and replaces the minimum elements NTIA published in 2021.  

The revision draws on more than 90 public comments and applies to all software, including open-source components, AI systems, and software delivered as a service 

CISA has since followed with the 2026 Minimum Elements for SBOM guidance, updating the original 2021 federal standard.  

The regulatory direction is unambiguous: organizations are expected to know what's inside their vendors' software stacks —not just their own—before deployment, not after an incident. 

Monitoring the Vendor, Not Just the Perimeter 

Closing this blind spot requires continuous monitoring of vendor infrastructure, exposed credentials, dark web chatter, and third-party breach signals — the exact layer traditional vulnerability management doesn't cover.  

Cyble's Third-Party Risk Management platform continuously tracks vendor risk posture, surfacing exposure signals tied to suppliers before they cascade into a confirmed compromise, giving CISOs, vendor risk managers, and procurement security teams the lead time that reactive scanning can't provide. 

Find your blind spots before an attacker does. Request a Cyble TPRM demo! 

Conclusion 

Supply chain attacks in 2026 succeed for the same reason every time: organizations extend trust to vendors faster than they extend visibility into them. CISA's own advisory record — from GoAnywhere to MOVEit — shows that a single upstream compromise can cascade into hundreds of victims before any of them see it coming. Patching internal systems faster won't fix that. Neither will another vendor questionnaire be filed away after onboarding. 

What changes the outcome is continuous visibility into the vendors, software components, and dependencies an organization has already accepted as trusted — tracked before a breach notification forces the issue. That's the gap threat intelligence is built to close, and it's the difference between reacting to a supplier's incident and seeing it coming. 

Don't wait for a vendor to tell you they were breached. See how Cyble Third-Party Risk Management maps your vendor exposure. 

References 

• #StopRansomware: CL0P Ransomware Gang: Exploits CVE-2023-34362 MOVEit Vulnerability 

• CISA, NSA, and 19 International Partners Release Shared Vision of Software Bill of Materials for Cybersecurity Guide 

Disclaimer: This blog is for general informational purposes only and does not constitute security, legal, or compliance advice. Statistics and incidents referenced are drawn from public advisories issued by CISA, FBI, and NSA, accurate as of their publication dates. Threat conditions and guidance change frequently — consult the original advisories and your own security team before making risk or compliance decisions.

The post Supply Chain Attacks in 2026: Why Threat Intelligence Is the Only Early Warning System That Works appeared first on Cyble.

The tempo of UK cyberattacks has shifted from sporadic disruption to something far more systemic. When incidents reach a frequency of four national events each week, the issue stops being purely technical and becomes structural. It raises a more uncomfortable question than whether attacks will happen; it asks whether UK cybersecurity readiness is evolving fast enough to keep pace with a threat environment that is no longer linear, but compounding.

The latest assessment from the National Cyber Security Centre (NCSC) reveals a sharp escalation in UK national cyber threats. In the 12 months leading to September 2025, 204 incidents were classified as nationally significant, more than double the 89 recorded in the previous year. This is the highest figure on record.

The Acceleration of UK National Cyber Threats

In total, 429 cyber incidents required NCSC intervention during this period. Among them, 18 were categorized as “highly significant,” meaning they carried the potential to severely disrupt essential services or compromise national security. That figure alone notes an almost 50% increase compared with the previous year, continuing a three-year trend of intensifying severity in cyberattacks in the UK.

These are not isolated breaches caused by opportunistic threat actors. A large share of activity is linked to advanced persistent threat (APT) groups, well-funded, highly capable operators that pursue long-term access to critical systems. Their objectives range from strategic intelligence gathering to financial gain and, in some cases, deliberate disruption.

Dr Richard Horne, Chief Executive of the NCSC, has made the situation explicit: the growing frequency of serious incidents demonstrates that the UK’s exposure to cyber risk is rapidly. He has warned that delays in strengthening defenses are no longer neutral, they actively increase vulnerability.

When Cybersecurity Becomes a Boardroom Issue 

The rising intensity of UK cyberattacks has prompted direct intervention from the government. Senior executives across major UK businesses, including those in the FTSE 350, have been formally urged to treat cyber resilience as a board-level responsibility rather than a technical afterthought. 

This shift is not symbolic. It reflects recognition that cyber risk now sits alongside financial and operational risk. Organizations are being pushed to integrate security into strategic decision-making, rather than relegating it to IT departments. 

To support this, the NCSC has introduced tools aimed at improving baseline protections, particularly for smaller businesses that often lack dedicated security resources. The Cyber Essentials programme has been positioned as an accessible entry point, with added incentives such as free cyber insurance for eligible firms to encourage adoption. 

Energy Transformation and the Expanding Attack Surface 

One of the less obvious drivers behind the rise in UK national cyber threats is the transformation of the energy sector. The UK’s clean energy ambitions, particularly under the Clean Power 2030 initiative, are reshaping infrastructure at speed. 

Battery storage capacity is expected to increase sixfold, while wind and solar generation could nearly triple. At the same time, the system is becoming more decentralized, introducing a wider range of operators and digital interfaces. 

From a cybersecurity perspective, this creates a paradox. The energy system becomes more resilient in terms of generation diversity, but more vulnerable in terms of digital exposure. Each new connection, whether a distributed solar installation or a grid-scale battery, adds another potential entry point for attackers. 

This is why UK critical infrastructure attacks are increasingly focused on non-traditional targets. Recent incidents in Europe have shown adversaries probing distributed renewable assets, exploiting the reliance on remote management and interconnected control systems. 

The Cascading Risk of Infrastructure Disruption 

Energy systems do not operate in isolation. They underpin transport networks, healthcare services, communications, and financial systems. A disruption in energy supply can trigger cascading failures across multiple sectors. 

Even non-cyber incidents put a spotlight on this fragility. The 2025 North Hyde substation fire demonstrated how quickly a localized event can create broader disruption. In the case of coordinated cyberattacks, the potential for systemic impact is higher. 

This interconnectedness is what makes cyberattacks in the UK particularly concerning. The risk is not just service interruption, but the amplification of disruption across dependent systems. 

Rethinking Regulation for Modern Threats 

To address these challenges, the UK government is reassessing its regulatory framework, particularly the Network and Information Systems (NIS) Regulations. Introduced in 2018, these rules were designed for a more centralized energy system and may no longer reflect current realities. 

The key issue is scope. Many organizations that contribute to system stability fall outside NIS requirements because they do not meet existing thresholds or have not been formally designated as critical operators. 

The proposed reforms aim to close this gap through two primary measures: 

• Expanding NIS coverage under the Cyber Security and Resilience Bill to better capture modern critical infrastructure  

• Introducing baseline cyber resilience requirements for all Ofgem licensees in the downstream gas and electricity sector  

This dual approach acknowledges that UK cybersecurity readiness cannot rely solely on protecting the largest players. In a decentralized system, smaller entities can represent equally critical points of failure. 

Baseline Security: Necessary but Not Sufficient 

The proposed baseline requirements are designed to establish a minimum standard of cyber hygiene across the sector. These measures are expected to be proportionate and widely applicable, focusing on preventing common attack vectors rather than enforcing advanced capabilities. 

They align closely with the Cyber Essentials framework, which emphasizes five core controls: firewalls, secure configuration, access management, malware protection, and patching. 

However, this approach has limitations. Cyber Essentials is primarily tailored to IT environments and does not fully address operational technology (OT), which is central to energy infrastructure. OT systems require different security models, as they interact directly with physical processes. 

Recognizing this, policymakers are considering a hybrid model that extends beyond technical controls to include governance, supply chain security, and incident response planning. This reflects a more mature understanding of UK national cyber threats, where organizational resilience is as important as technical defense. 

Conclusion 

With UK cyberattacks occurring at a rate of four national incidents per week, the financial impact of significant cyberattacks in the UK, often exceeding £436,000 per breach, makes gaps in UK cybersecurity readiness a measurable risk. As UK national cyber threats grow and UK critical infrastructure attacks become more likely, organizations need timely threat intelligence and faster response. 

Cyble provides real-time threat intelligence and automated detection to help identify and mitigate risks earlier. Schedule a demo to see how Cyble can support your security operations. 

References: 

• https://www.ncsc.gov.uk/news/uk-experiencing-four-nationally-significant-cyber-attacks-weekly 

• https://www.gov.uk/government/consultations/whole-energy-cyber-resilience-requirements-reshaping-cyber-regulation-in-downstream-gas-and-electricity/reshaping-cyber-regulation-in-downstream-gas-and-electricity-consultation-document-accessible-webpage 

The post Four Nationally Significant Cyberattacks Every Week — Is the UK Ready? appeared first on Cyble.

Modern conflict no longer begins with troops crossing borders; it often starts with packets crossing networks. For example, the escalation on February 28, 2026, involving Iran, the United States, and Israel gives insights on how quickly geopolitical cyber threats can evolve into full-spectrum confrontations. What unfolded was not just a regional clash but a preview of how cyber warfare attacks now operate alongside missiles, drones, and information campaigns. 

In this environment, cybersecurity for US organizations can no longer be treated as a purely technical function. It has become a matter of strategic resilience. Nation-state cyberattacks are synchronized with real-world conflict, creating ripple effects that extend far beyond the immediate battlefield. 

Cyber Warfare Attacks Meet Kinetic Force 

The opening phase of hostilities, initiated through Operation Epic Fury by the United States and Operation Roaring Lion by Israel, marked a new shift in how cyber warfare attacks are deployed. Within the first 72 hours (February 28 to March 3), cyber operations were executed in parallel with kinetic strikes, targeting both infrastructure and perception. 

At approximately 06:27 GMT on February 28, coordinated strikes hit more than two dozen Iranian provinces, targeting nuclear facilities, IRGC command centers, and missile systems. Reports indicated the targeted killing of Ayatollah Ali Khamenei, a moment that fundamentally altered the trajectory of the conflict. 

Simultaneously, cyber operations disrupted Iranian digital infrastructure at scale. Internet connectivity dropped to roughly 1–4% of normal levels, crippling government communications, media platforms, and military coordination. This was not incidental; it was deliberate integration of cyber defense strategies into offensive planning. 

Compromised mobile applications and defaced state websites were used to inject confusion into the population, while misinformation campaigns blurred the line between truth and manipulation. This convergence of cyber and psychological operations reflects a new doctrine in nation-state cyberattacks: control the narrative while degrading the network. 

The Expanding Threat Landscape 

By March 1, the conflict had entered a second phase: retaliation and decentralization. Iran launched ballistic missiles and drones targeting Israel, GCC countries, and US-linked assets. At the same time, cyberspace saw a surge in non-state actors. 

More than 70 hacktivist groups mobilized within days. These groups, spanning ideological lines, including pro-Iranian and pro-Russian actors, conducted distributed denial-of-service (DDoS) attacks, website defacements, and credential theft campaigns. Their operations targeted government portals and critical infrastructure across regions such as Turkey, Poland, and the Gulf. 

One notable example was a malicious Android application disguised as an Israeli missile alert system. Distributed via Hebrew-language SMS, it harvested sensitive user data, including contacts, SMS logs, IMEI numbers, and email credentials, while employing encryption and anti-analysis techniques. This level of technical prowess blurred the distinction between hacktivism and state-sponsored tooling. 

At the same time, cybercriminal groups exploited the chaos. Social engineering campaigns surged across the UAE, while ransomware actors began blending ideological messaging with extortion tactics.  

Critical Infrastructure Security Under Pressure 

As the conflict intensified between March 2 and March 3, its impact on critical infrastructure security became more apparent. Missile strikes damaged physical assets, including infrastructure linked to aviation and cloud services. Meanwhile, cyber activity targeted digital dependencies supporting those systems. 

Although most observed cyber warfare attacks during this period were disruptive rather than destructive, primarily DDoS attacks, exposed surveillance systems, and propaganda operations, there were persistent, unverified claims of industrial control system (ICS) compromise. Even without confirmation, such claims can influence decision-making and public confidence. 

The broader implication is clear: critical infrastructure security must account for both verified threats and perceived ones. In a hybrid conflict, perception itself becomes a weapon. 

Latent Capabilities and Strategic Risk 

One of the more nuanced aspects of this conflict is what has not happened, at least not yet. Despite the scale of activity, large-scale destructive nation-state cyberattacks remained limited during the first 72 hours. This was partly attributed to disruptions in Iran’s internet connectivity, which constrained command-and-control operations. 

However, intelligence indicators suggest that pre-positioned access and dormant capabilities remain intact. Once connectivity stabilizes, these assets could be activated rapidly, potentially escalating cyber warfare attacks to a more destructive phase. 

Cyber Defense Strategies for US Organizations 

Given the global interconnectedness of digital systems, US organizations are not insulated from geographically distant conflicts. Supply chains, cloud dependencies, and third-party services create indirect exposure to geopolitical cyber threats. 

Effective cyber defense strategies must therefore evolve in several key areas: 

• Proactive Threat Hunting: Organizations should actively search for indicators of pre-positioned access within their networks. Waiting for alerts is no longer sufficient in the context of nation-state cyberattacks. 

• Resilience Against DDoS and Disruption: With high-volume, low-sophistication attacks dominating early phases, ensuring availability of external-facing services is critical. This includes stress-testing infrastructure under simulated attack conditions. 

• Strengthened Identity and Access Controls: Credential theft remains a primary vector. Multi-factor authentication, behavioral analytics, and privileged access management are essential components of cyber risk management. 

• Mobile and Endpoint Security: The rise of malicious mobile applications highlights the need for robust endpoint detection and user awareness. Organizations must treat mobile devices as critical assets, not peripheral ones. 

• Social Engineering Awareness: Conflict-driven anxiety creates fertile ground for phishing and vishing attacks. Continuous training and simulated exercises can reduce susceptibility. 

• Supply Chain Visibility: Organizations must map dependencies, particularly those linked to regions experiencing instability. Disruptions in one geography can cascade into operational risks elsewhere. 

Preparing for a Persistent Hybrid Threat Environment 

The events between February 28 and March 3, 2026, mark a shift in modern conflict, where cyber warfare attacks are now central to military strategy. For US organizations, this means adapting to persistent geopolitical cyber threats that blur the lines between physical and digital conflict.  

Cybersecurity for US organizations must focus on anticipation, strengthening cyber defense strategies, improving cyber risk management, and reinforcing critical infrastructure security to handle sustained campaigns.  

Cyble supports this approach by providing AI-powered threat intelligence and real-time visibility to help organizations detect and respond to nation-state cyberattacks more effectively. Security teams can schedule a demo or access Cyble’s latest reports to better prepare for modern cyber threats. 

The post When Geopolitical Conflict Spills into Cyberspace — How US Organizations Should Respond  appeared first on Cyble.

Grocery store shoppers at many chains recently ran into an unwelcome surprise: empty shelves and delayed prescriptions. In early November, Ahold Delhaize USA was the victim of a cyberattack that significantly disrupted operations at more than 2,000 stores, including Hannaford, Food Lion and Stop and Shop. Specific details of the nature of the attack have not yet been publicly released.

Because the attack affected many digital systems, some stores were not able to accept credit/debit cards, while others had to shut down online ordering. Additionally, Hannaford’s website was offline for several days. Food supply issues have lasted several weeks in some cases, especially in the New England area, illustrating the impact cyberattacks have on people’s everyday lives.

Cybersecurity in the agrifood industry

The importance of cybersecurity in the food supply chain continues to increase as the agrifood industry becomes increasingly digitized. The increase in smart farming means a cybersecurity attack can even impact growing and harvesting. In addition to the production and distribution processes, a cyberattack can even impact food safety. For example, a cyberattack could interfere with technology that monitors food temperature during production, which can lead to contamination.

Cybersecurity is especially key in this industry because one issue in one segment can quickly compound across the globe. Because of the complex process of bringing food from farm to table, a single vulnerability in one small company can have a major impact on the food supply chain. Additionally, many agrifood companies rely heavily on third-party vendors.

“One challenge with ransomware attacks is that they can cause consequences for suppliers or partners of the victim company, in addition to the direct impact on the victim company itself. Considering the integrated and interconnected nature of the food and agriculture industry, a disruption in one company likely will have a cascading [effect],” according to the Farm to Table Ransomware Report by Food Ag ISAC.

For example, many grocery store chains hire vendors to transport products from warehouses to stores. A cyberattack on the transportation company can shut down critical systems, meaning that food does not arrive as scheduled, which leads to empty shelves.

“Attacks targeting suppliers, distributors or logistics providers can lead to delays in product delivery, shortages or the introduction of counterfeit products. Disruptions in the supply chain can have far-reaching consequences, affecting not only the profitability of companies but also impacting food availability and increasing prices for consumers,” reports Food Safety magazine.

According to Forbes, FBI Special Agent Gene Kowel, speaking at the August FBI Agriculture Threats Symposium in Nebraska, said: “The cyber risk and national security threat to farms, ranches and food processing facilities is growing exponentially. The threats are evolving, becoming more complex and severe.” He also stated that the four key threats facing the agriculture sector are ransomware attacks, foreign malware, data and intellectual property theft and bioterrorism impacting food production and the water supply. Additionally, he warned that foreign entities are actively attempting to destabilize the U.S. agriculture industry.

Recent agrifood cyberattacks

While grocery stores have dominated the headlines lately regarding agrifood cyberattacks, other companies faced cybersecurity attacks in recent years.

In October 2021, Schreiber Foods, a milk processing company, was the victim of a ransomware attack. According to ZDNET, the attack disrupted the entire milk supply due to a change in the digital processes for milk processing. Wisconsin State Farmer reported that milk deliveries resumed five days after the attack. Additionally, milk transporters were unable to access the building and the company faced a $2.5 million ransomware demand.

The highly publicized attack on JBS, the world’s largest meat-packing company, also happened in 2021. Business was disrupted at 47 locations in Australia and nine locations in the U.S. for five days after Russian hacker group Revil encrypted the organization’s systems. JBS reportedly paid $11 million in ransomware following the attack. The attack also led to some meat shortages as well as temporarily higher meat prices.

Farm and Food Cybersecurity Act

To strengthen cybersecurity in the agrifood industry, the Farm and Food Cybersecurity Act is currently in committee in both the U.S. House of Representatives and the U.S. Senate. A key component of the act is that the secretary of agriculture will conduct a study every two years on cybersecurity threats and vulnerabilities within the agriculture and food sectors.

Additionally, the secretary of agriculture will work with other agencies to conduct an annual cross-sector crisis simulation exercise for food-related cyber emergencies or disruptions.

“Food security is national security, so it’s critical that American agriculture is protected from cyber threats,” says Rep. Elissa Slotkin, D-Mich. “No longer just some tech issue, cyberattacks have the potential to upend folks’ daily lives and threaten our food supply — as we saw a couple of years ago when the meat-packing company JBS was taken offline by a ransomware attack. This legislation will require the Department of Agriculture to work closely with our national security agencies to ensure that adversaries like China can’t threaten our ability to feed ourselves by ourselves.”

Reducing the risk of agrifood cyberattacks

Because of the critical nature of their services in relation to the food supply, all companies involved in the agrifood industry should make cybersecurity a high priority. To help improve cybersecurity in the industry, the Cybersecurity and Infrastructure Security Agency (CISA) recently released a Food and Agriculture Cybersecurity Checklist.

Tips from the sheet include:

• Use strong passwords
• Turn on multi-factor authentication
• Recognize and report phishing
• Update software with new versions and patches
• Use cybersecurity tools to mitigate exposure
• Back up your data
• Develop cybersecurity incident response and recovery plans
• Report cybersecurity incidents to www.cisa.gov/report

While the recent empty shelves in grocery stores are a stark reminder of the importance of cybersecurity, the agrifood industry must stay proactive about addressing cybersecurity risks every day of the year.

The post How cyberattacks on grocery stores could threaten food security appeared first on Security Intelligence.

On September 25, CISA issued a stark reminder that critical infrastructure remains a primary target for cyberattacks. Vulnerable systems in industrial sectors, including water utilities, continue to be exploited due to poor cyber hygiene practices. Using unsophisticated methods like brute-force attacks and leveraging default passwords, threat actors have repeatedly managed to compromise operational technology (OT) and industrial control systems (ICS).

Attacks on the industrial sector have been particularly costly. The 2024 IBM Cost of a Data Breach report found the average total cost of a data breach in the industrial sector was $5.56 million — an 18% increase for the industry compared to 2023. This represents the highest data breach cost increase of all industries surveyed in the report, rising by an average of $830,000 per breach over last year.

Ongoing vulnerabilities pose a serious threat to public safety and national security, especially as water systems and other critical infrastructure providers remain underprepared in the current threat landscape. Let’s take a closer look at the current state of critical infrastructure security, highlighting recent incidents, efforts to address vulnerabilities and the need for further collaboration between the government and private sectors.

Arkansas City Water Treatment Facility attacked

The cybersecurity incident at the Arkansas City Water Treatment Facility on September 22 exemplifies the growing risks. While city officials emphasized that the water supply remained safe and no disruption to service occurred, the breach still forced the facility to switch to manual operations. The incident is currently under investigation, with local authorities and cybersecurity experts collaborating to resolve the issue and prevent further attacks. But the Arkansas City breach is not an isolated incident; it mirrors a larger trend of attacks on water systems.

CISA has issued multiple warnings regarding the susceptibility of water and wastewater systems to cyber threats. Intruders often exploit outdated and unsecured OT and ICS environments, where systems are exposed to the internet or still using default credentials. This means cyber criminals can gain access using relatively simple techniques, which raises concerns about the overall preparedness of critical infrastructure operators.

CISA warnings and hacktivist activity

CISA’s September alert is not the first indication of the heightened threat to water and other critical infrastructure providers. Earlier in 2024, the agency warned that Russia-affiliated hacktivists were actively targeting ICS and OT environments in U.S. critical infrastructure facilities. Water systems, dams and sectors, such as energy and food, were particularly vulnerable to these attacks.

The situation worsened with the rise of the Cyber Army of Russia Reborn, a hacktivist group tied to Advanced Persistent Threat 44 (APT44), commonly known as Sandworm. The group has been quite busy exploiting weak cybersecurity postures of smaller water systems that lack adequate cyber defense resources.

According to Keith Lunden of Mandiant, “We expect these attacks to continue for the foreseeable future given the lack of dedicated cybersecurity personnel for many small- and mid-sized organizations operating OT.” Unfortunately, hacktivist groups have exploited these gaps with relative ease. And without rapid intervention, these attacks will likely continue.

The State and Local Cybersecurity Grant Program (SLCGP)

Amidst the growing cyber threats, the U.S. Department of Homeland Security (DHS) has recognized the need for more support for state and local government cybersecurity. In fiscal year 2024, DHS announced the allocation of $280 million in grant funding for the State and Local Cybersecurity Grant Program (SLCGP). This funding aims to assist state, local, tribal and territorial governments in enhancing their cyber resilience. A special emphasis has been placed on protecting critical infrastructure systems like water utilities, energy grids and emergency services.

These grants will help organizations improve monitoring systems, patch vulnerabilities and implement critical cybersecurity measures such as multi-factor authentication and regular system audits. In states like Michigan, for example, government agencies are already working with local water utilities to provide cybersecurity training and support. The DHS funding could greatly expand these efforts, offering a much-needed boost to the security posture of critical infrastructure providers.

The Cyberspace Solarium Commission

In 2019, the Cyberspace Solarium Commission (CSC) was established by the U.S. Congress to develop a national cyber defense strategy. Currently, approximately 80% of its recommendations have been implemented. However, a final push is needed to address critical gaps, particularly regarding private-sector collaboration and insurance reforms.

One major challenge is identifying the “minimum security burdens” for systemically important entities critical to national security. This would ensure that high-priority infrastructure providers, such as key transportation systems and water utilities, receive the necessary support to prevent catastrophic events.

The CSC also highlighted the need to develop an economic continuity plan for cyber events. This would be nothing less than an incident response and resilience plan to protect the U.S. economy in the face of a major cyberattack. The commission also emphasized the need for better information sharing between government agencies, private industries and international partners to protect critical infrastructure from evolving cyber threats.

During a recent panel discussion, Senator Angus King, co-chair of CSC 2.0, pointed to the difficulties of building trust between the government and private sectors. Private entities own and operate the majority of the nation’s critical infrastructure, but historical tensions make collaboration challenging. King noted that the situation mirrors early tensions that existed between state officials and CISA. Nonetheless, the collaboration between private industry and government is essential to address the growing threat to critical infrastructure.

The state of critical infrastructure cybersecurity

The cybersecurity posture of U.S. critical infrastructure remains a concern. As seen in attacks like the Arkansas City Water Treatment Facility and other incidents targeting internet service providers, threat actors are increasingly focusing on essential services. These attacks are not limited to small municipalities. Larger-scale infrastructure providers, including ISPs and managed service providers, have also been targets.

The FBI recently disclosed that China-linked hackers compromised more than 260,000 network devices, underscoring the scale of the problem. Meanwhile, attacks attributed to the Chinese government have targeted ISPs and managed service providers through vulnerabilities in Versa Networks’ SD-WAN software, demonstrating the growing sophistication of these threats.

While the U.S. government is actively working to improve critical infrastructure cybersecurity, the attacks on water treatment systems and other essential services clearly reveal that more needs to be done. The DHS grant program and the recommendations of the Cyberspace Solarium Commission represent critical steps in this effort, but collaboration between government, private industry and international partners will be key to building a resilient defense against evolving threats.

The safety of critical infrastructure remains a pressing concern. Recent events should serve as a wake-up call for operators, policymakers and the public to take action before a cyberattack occurs that impacts human life and health. Undoubtedly, the threats are real — and any meaningful response requires a concerted effort.

The post Is the water safe? The state of critical infrastructure cybersecurity appeared first on Security Intelligence.

Rhode Island is grappling with the fallout of a significant ransomware attack that has compromised the personal information of hundreds of thousands of residents enrolled in the state’s health and social services programs. Officials confirmed the attack on the RIBridges system—the state’s central platform for benefits like Medicaid and SNAP—after hackers infiltrated the system on December 5, planting malicious software and threatening to release sensitive data unless a ransom is paid.

Governor Dan McKee, addressing the media, called the attack “alarming” and urged residents to take immediate precautions to protect their information. Compromised data includes Social Security numbers, banking details, addresses and dates of birth. “This breach is a stark reminder of the vulnerabilities in government IT systems,” McKee said. “We are working with Deloitte and law enforcement to contain the damage and restore public trust.”

Timeline of the attack

The cyberattack began on December 5, when Deloitte, the developer and maintainer of RIBridges, alerted state officials to suspicious activity. Initially, it was unclear whether sensitive data had been accessed. Over the following days, Deloitte implemented additional security measures while investigating the breach.

On December 10, hackers provided a screenshot of file folders as proof of their access, prompting Deloitte to confirm that the RIBridges system had been compromised. Further analysis revealed a high probability that the stolen files contained personally identifiable information (PII). By December 13, Deloitte identified malicious code within the system, leading the state to shut down RIBridges to mitigate further damage and begin remediation.

How the attackers gained access

While the exact infiltration method remains under investigation, early findings suggest that the attackers exploited vulnerabilities in the system’s architecture, likely through phishing emails targeting administrative accounts or unpatched software weaknesses. The malware deployed by the cyber criminals enabled unauthorized access and allowed the attackers to exfiltrate data unnoticed for several days.

This breach has highlighted persistent security challenges in government IT systems, which often struggle to keep pace with evolving cyber threats. RIBridges, developed in 2016 under the Unified Health Infrastructure Project (UHIP), has faced years of technical and operational issues, including public criticism for its vulnerabilities.

Impact on residents and state operations

The breach has far-reaching implications for Rhode Island’s residents and government services. Programs impacted include Medicaid, SNAP, Temporary Assistance for Needy Families (TANF) and health insurance purchased through HealthSource RI. The RIBridges system’s offline status has forced the state to resort to manual processing for December benefits and January payments, creating delays and disruptions for thousands of families.

State officials have contracted Experian to provide free credit monitoring to affected residents and set up a dedicated call center to offer guidance. McKee also urged residents to take proactive steps, including freezing their credit, updating passwords and enabling multi-factor authentication.

Comparisons to other state-level ransomware attacks

Rhode Island is not the first state to be targeted by a ransomware attack on its central systems. In 2019, Texas faced a coordinated ransomware assault that impacted 22 local entities, including state-run agencies, though its centralized IT infrastructure mitigated the spread. Similarly, Colorado’s Department of Transportation suffered a ransomware attack in 2018, which disrupted operations and required weeks to fully resolve.

These incidents underscore the growing threat of ransomware to state governments. Unlike attacks on local municipalities, state-level breaches can potentially disrupt critical systems serving millions of residents, amplifying the stakes for government cybersecurity teams.

What comes next?

The FBI and other federal agencies are assisting in the investigation, while Deloitte works to remediate the vulnerabilities and restore RIBridges. Meanwhile, negotiations between the state’s representatives and the cyber criminals are ongoing, though officials have not disclosed the ransom amount or whether they intend to pay it.

“That conversation is going on directly with Deloitte and the cyber criminals. That’s how this process works, we’re learning a little bit about it,” McKee said. “But we’re being notified of the progress on it, and ultimately, it does end up with that decision with me.”

The attack has reignited calls for stronger cybersecurity measures in government IT systems. Experts recommend adopting zero trust security models, conducting regular vulnerability assessments and increasing investments in cybersecurity infrastructure to prevent future breaches.

“This breach is a wake-up call,” says Brian Tardiff, Rhode Island’s Chief Digital Officer. “We need to ensure that our systems are resilient against increasingly sophisticated cyber threats. The stakes are too high to do otherwise.”

To learn how IBM X-Force can help you with anything regarding cybersecurity including incident response, threat intelligence, or offensive security services schedule a meeting here.

If you are experiencing cybersecurity issues or an incident, contact X-Force to help: US hotline 1-888-241-9812 | Global hotline (+001) 312-212-8034.

The post Ransomware attack on Rhode Island health system exposes data of hundreds of thousands appeared first on Security Intelligence.

CISA and the FBI recently released a joint statement that the People’s Republic of China (PRC) is targeting commercial telecommunications infrastructure as part of a significant cyber espionage campaign. As a result, the agencies released a joint guide, Enhanced Visibility and Hardening Guidance for Communications Infrastructure, with best practices organizations and agencies should adopt to protect against this espionage threat.

According to the statement, PRC-affiliated actors compromised networks at multiple telecommunication companies. They stole customer call records data as well as compromised private communications of a limited number of people. Sen. Mark R. Warner (D-Virginia) told the Washington Post that the threat actors listened on audio calls and even moved between networks. As a result, many media sources reported that texts between Android and Apple devices are not secure.

Historic and sophisticated cyberattack

The headlines of the Washington Post deemed it the worst telecom hack in our nation’s history, per a top U.S. senator. On the surface, this seems a bit melodramatic, with only 150 identified victims. However, experts predict the affected number of people will go into the millions. Warner, who serves as chairman of the Senate Intelligence Committee, went as far as to say that Salt Typhoon makes Colonial Pipeline and SolarWinds “look like child’s play.”

The data collected during the attack falls into two categories, reported NBC. The first included call records showing the time and number called, with most records in the Washington, D.C. area. The other included listening to live calls of specific targets, which may include Donald Trump and Kamala Harris.

However, the most concerning aspect of the attack is the national security implications. Richard Forno, Principal Lecturer in Computer Science and Electrical Engineering at UMBC, explained in UMBC Magazine that Salt Typhoon compromised the portals used by U.S. intelligence and law enforcement. As a result, he says that the attackers may have gotten information about which Chinese spies and informants counterintelligence agencies were monitoring, which those targets can then use to avoid detection.

“U.S. officials have said that many of the ways Salt Typhoon penetrated its targets was through existing weaknesses with the infrastructure. As I’ve written previously, failing to implement basic cybersecurity best practices can lead to debilitating incidents for organizations of all sizes. Given how dependent the world is on networked information systems, it is more important than ever to maintain cybersecurity programs that make it difficult for attacks to succeed, especially for critical infrastructure like the phone network,” wrote Forno.

Reducing the risk of Salt Typhoon

With words like espionage and intercepting texts thrown around, the biggest question on people’s minds is how to protect themselves from this threat. Many experts are currently recommending using encrypted apps, such as WhatsApp and X, instead of traditional texting.

“Encryption is your friend, whether it is on text messaging or if you have the capacity to use encrypted voice communications, even if the adversary is able to intercept the data if it is encrypted, it will make it impossible, if not really hard, for them to detect it. So, our advice is to try to avoid using plain text,” said Jeff Greene, CISA Executive Assistant Director for Cybersecurity, during a press briefing reported by USA Today.

Forbes also reported that an FBI official recommended citizens use a cell phone that automatically receives timely operating system updates. Additionally, the phone should have responsibly managed encryption and phishing-resistant multi-factor authentication (MFA) for email, social media and collaboration tool accounts.

“So it’s somewhat ironic that one of the countermeasures recommended by the government to guard against Salt Typhoon spying is to use strongly encrypted services for phone calls and text messages – encryption capabilities that it has spent decades trying to undermine so that only ‘the good guys’ can use it,” wrote Forno.

To learn how IBM X-Force can help you with anything regarding cybersecurity including incident response, threat intelligence, or offensive security services schedule a meeting here.

If you are experiencing cybersecurity issues or an incident, contact X-Force to help: US hotline 1-888-241-9812 | Global hotline (+001) 312-212-8034.

The post FBI, CISA issue warning for cross Apple-Android texting appeared first on Security Intelligence.