The Cybersecurity and Infrastructure Security Agency finally got a new nominee for director, with President Donald Trump on Monday nominating Michael LoSapio, chief information security officer at Palantir.

CISA has been without a Senate-confirmed director for the entirety of Trump’s second term, after his first pick, Sean Plankey, languished in the Senate before withdrawing in April.

LoSapio could face some obstacles of his own, with Palantir far from a popular company with the Democrats set to take over Congress. Democrats have scrutinized the company over its work with the Department of Homeland Security, even as Palantir has denied aiding mass surveillance of immigrants.

As of late last month, Sen. Ron Wyden, D-Ore., was also still waiting for CISA to release a public version of a report on telecommunications cybersecurity, and he had placed one of several Senate holds on Plankey pending the receipt of that report.

Republicans will still control the Senate until January, however, and a lame-duck session began Monday.

Some CISA watchers were convinced that the agency’s acting director, Nick Andersen, was likely to continue holding the role. He was running out of days to hold the “acting” position under the law, but putting forward a nominee could pause the clock on that deadline.

The administration was thought to be looking for someone from a high-profile tech company to fill the CISA director position, a bill LoSapio fits.

The post Trump picks Palantir’s LoSapio to head CISA appeared first on CyberScoop.

The government needs to invest in digital forensics to keep pace with incidents and threats in cyberspace, the principal cyber adviser for the Department of the Air Force said Thursday.

“In order to detect, help us hunt and find where the incident started… the digital forensics, I believe we need to do, and focus, and invest in that world,” said Wanda Jones-Heath, speaking at the Datadog Threat Response Forum, produced by FedScoop.

The forensics role is vital even though “they’re after the fact,” she said.

“They go and look what happened weeks and months after the incident has occurred, and so I think we need to figure out: ‘How do we keep pace with incidents as they are occurring?’” Jones-Heath said. “Once we identify it, then you start looking at the forensics of what happened, who did it, where they are, where it originated from and then how you partition the areas that are still under fire while you continue to operate in that environment.” 

Jeffrey Hunt, global operations branch chief for the Department of Defense Cyber Crime Center, which provides digital forensic investigations, said at the same event that the divide between operations and security on getting visibility into networks about threats is an issue that needs to be addressed early.

But Hunt said combining the teams into one big unit is a “disaster” that doesn’t work.

“It means that you at least want to have sort of a liaison relationship where somebody from security is in the room as part of the planning team from the beginning of where your operational plan starts,” he said.

Another recommendation Jones-Heath made is changing how cyber exercises are conducted. The goal is not to be in “reactive mode” when an incident happens and knowing what to do with the “data is poisoned.” 

“They’re not designed typically of how we would operate if we have engagement,” she said. “So we have to change the lens to be more outside of the box — let the cyber team actually be engaged on the offensive and defensive side.”

“We have to get over the fact that it could never happen,” she continued. “So sharing that intel about what the adversary is doing, real world, may convince those who are not in our community to let us be a part of the exercise, show them and demonstrate what the adversary is actually doing, so that if we are in formation and you get disconnected. You know exactly what to do.

The post Air Force cyber official: need to invest in digital forensics appeared first on CyberScoop.

Democrats’ big win on Election Day, which saw them take control of both the House and Senate, has ramifications for the Cybersecurity and Infrastructure Security Agency, artificial intelligence, surveillance policy and much more.

Here’s what lawmakers and cybersecurity experts have to say about the short-term and long-term prospects on Capitol Hill.

Leadership plans ahead

Maggie Hassan, D-N.H. is in line to take the gavel on the Senate Homeland Security and Governmental Affairs Committee, with Sen. Gary Peters, Mich., retiring.

“Our government’s number one job is to keep people safe, and the Senate Homeland Security and Governmental Affairs Committee must work to ensure that our country remains safe, secure and free from all kinds of threats,” Hassan said in a statement to CyberScoop. “That work involves protecting against terrorism and fentanyl trafficking, but it also includes guarding against emerging threats like artificial intelligence security risks and strengthening our cybersecurity.”

“The Trump-Vance administration has undermined our security on these fronts, including by diverting resources away from combatting fentanyl trafficking and gutting CISA,” she continued. “We need to reverse these cuts, confront these challenges and put public safety first.”

Rep. Bennie Thompson, D-Miss., is poised to return once again as chair of the House Homeland Security Committee, said Democrats are taking over at a “pivotal time for CISA,” with it looking to add staff after cutting back by nearly one-third.

“First and foremost, we will aim to work with CISA to expedite its critical re-staffing effort and to ensure it has the expertise necessary to support stakeholders as they defend against the scale and velocity of AI-enabled cyber-attacks,” he said in a statement to CyberScoop. “Advances in AI can help defenders, but it will also accelerate the consequences of deferred investments in security and CISA must be well-positioned to help critical infrastructure owners and operators rapidly improve their cybersecurity posture.”

“We will prioritize getting resources straight into the hands for defenders — by extending the State and Local Cybersecurity Grant Program and improving support of under-resourced sectors, especially water,” he continued. “We will work to ensure CISA re-establishes its cross-sector coordination capacity, which was diminished when the Trump administration- terminated CIPAC, by making sure the Anchor-CI is eventually up and running and meets the needs of stakeholders. Finally, we will make sure CISA is well-positioned to support the secure development and deployment of AI.”

What happens in the lame-duck session

Before the GOP relinquishes control of the House and Senate to Democrats, though, there’s a lame-duck session ahead. 

Long-term renewal of the Cybersecurity Information Sharing Act of 2015 (CISA 2015) is a bipartisan and industry priority, with it set to expire Dec. 11. Current Senate Homeland Security and Governmental Affairs Chairman Rand Paul, R-Ky., has been the biggest obstacle to reauthorization, but he could get “rolled” by GOP leadership on an extension, said Michael Garcia, a former government cyber official and vice president of the cybersecurity practice at Monument Advocacy. Possible vehicles for CISA 2015 to hitch a ride include an omnibus funding bill or the annual defense policy bill.

The Department of Homeland Security, and its subagency CISA, are currently operating on a continuing resolution that’s also set to expire Dec. 11, where lawmakers could temporarily extend CISA 2015 if a long-term solution can’t be reached in the lame duck. Another continuing resolution before Dec. 11 in lieu of an omnibus spending bill is an option for the lame duck. Both a CR and omnibus spending bill would theoretically include DHS funding, although the agency’s funding has been made more difficult in the past by the presence of Immigration and Customs Enforcement within the department.

Republicans have talked about wanting to get the fiscal 2027 National Defense Authorization Act done in the lame duck. Besides the possibilities of CISA 2015 being included in the bill, Nicholas Leiserson, senior vice president for policy at the Institute for Security and Technology, said the Senate version of the legislation has a pair of very noteworthy cyber provisions: a “very broad” authorization for contractor-owned, contractor-operated offensive cyber operations, and a requirement that every artificial intelligence product sold to the Defense Department have an AI bill of materials.   

Additional leadership shuffle

While Paul is losing his gavel, he’s shown he can be a disruptive force on passing cybersecurity legislation through the Senate in the minority. That makes what he does next possibly determinative for cyber bills, Leiserson and Garcia said. “If he leaves HSGAC, let a thousand cyber bills flourish!” Garia quipped on social media. Paul could opt to become the top Republican on the Senate Health, Education, Labor and Pensions Committee instead of HSGAC.

Nebraska Sen. James Lankford would take over for Paul as top HSGAC Republican in that scenario, and an industry source said he’s viewed as a supporter of CISA 2015.

On Senate Intelligence, the panel’s leadership goes to a lawmaker who has placed a big emphasis on cybersecurity in his congressional career: Mark Warner, D-Va. 

On the House side, while Rep. Andrew Garbarino, R-N.Y., moves to the minority on the Homeland Security panel, he has proven willing to collaborate with Democrats on cybersecurity issues. Rep. Delia Ramirez, D-Ill., is poised to take the gavel of the panel’s cybersecurity subcommittee, and Rep. Vince Fong, R-of California looks set to become the subcommittee’s top Republican and has his own history of bipartisanship. Fong would replace current subcommittee chair Andy Ogles, the far-right Tennessee Republican who lost in the primaries.

One thing to watch in the House, Leiserson said, is how the House looks to tackle AI — through existing committees, a select committee or some other structure. Democrats haven’t put forward a unified front on AI guardrails yet.

With AI models uncovering as many vulnerabilities as they are, “highly capable frontier models are going to drive a lot of discussion” about AI and cybersecurity, said Craig Albright, the Business Software Alliance’s senior vice president for U.S. government relations.

Appropriations, oversight, legislation

If the NDAA or a CISA 2015 extension don’t pass in the lame duck, they’d be priorities in 2027, too.

“CISA 2015 has to happen, and if we can’t get it done, then we can’t move to the next thing,”  said Henry Young, BSA’s policy director. “Once we get it done, there’s an open question about which of these priorities that we’ve talked about gets to be number one. Is it post-quantum cryptography? Is it government IT modernization? Is it frontier AI cybersecurity systems? We don’t know that yet, and we can’t know until we pass this law.”

How damaged the agency CISA is by Trump administration’s budget cuts is something Democrats are expected to scrutinize closely. Another top budget issue is what to do with the expired State and Local Cybersecurity Grants Program housed at DHS, since even if it’s reauthorized, it will require appropriators taking steps to invest in it.

Democrats could take a look at a variety of other Trump administration changes at DHS and CISA, on topics like election security, the Cyber Safety Review Board, the Joint Cyber Defense Collaborative and more. 

More broadly, Leiserson said an area of Democratic cyber oversight is likely to be the Department of Government Efficiency that cut cyber personnel at agencies at and beyond CISA, and “particularly the integrity of systems that DOGE touched when they were given very high privileged access to federal systems.”

If the White House puts forward a permanent nominee for director of CISA, Democrats would be poised to vet that person. They also would have a say in who leads the Office of the National Cyber Director, should the incumbent, Sean Cairncross, depart.

So far, Democrats haven’t put forward a unified posture on expired surveillance authorities known as Section 702, although both Warner and incoming House Intelligence Chairman Jim Himes, D-Conn., have fought in the past for its renewal. The surveillance program is operating similarly still due to a court order, but that order only lasts through next spring.

The post What Democratic control of Congress means for cybersecurity appeared first on CyberScoop.

A Delaware-based defense and aerospace company has settled a case with U.S. agencies over government allegations that the firm neglected its cybersecurity obligations in its contracts.

ILC — the name the government uses to collectively refer to ILC Dover and ILC Astrospace — agreed to pay $13 million to resolve the False Claims Act allegations involving its contracts with the Department of the Army, Missile Defense Agency and National Aeronautics and Space Administration.

ILC, according to the government, submitted false or fraudulent claims for payment on contracts with the agencies because it knew it hadn’t complied with the contracts’ cybersecurity requirements over a period between 2018 and 2024.

For instance, ILC allegedly used a third-party company to store sensitive data in the cloud without proper safeguards, and didn’t develop and update mandated security plans for each of its covered information systems.

“The best response to cyberattacks is to prevent them from happening in the first place,” Benjamin Wallace, U.S. Attorney for the District of Delaware, said in a news release Tuesday. “The obligations that ILC violated exist to prevent bad actors from taking advantage of the United States’ technical innovation.” 

American industrial manufacturing giant Ingersoll Rand, the parent company of ILC Dover, said it inherited the issue when it purchased the firm.

“We became aware of this matter following our acquisition of ILC Dover in June 2024, took prompt action to address the identified issues, and were in compliance with applicable requirements by October 2024,” said Sara Hasell, a spokesperson for Ingersoll Rand. “We have agreed to resolve this matter with the U.S. Department of Justice without an admission of liability and remain committed to maintaining strong cybersecurity practices.”

The $13 million settlement is one of the bigger settlements since the Justice Department began using the False Claims Act in 2022 to penalize contractors over cybersecurity shortcomings. The False Claims Act is a Civil War-era law passed to deal with fraudulent contractors.

“To protect sensitive information from cyber threats, defense and aerospace contractors must comply with the cybersecurity requirements in their federal contracts and subcontracts,” said Assistant Attorney General Brett Shumate of the Justice Department’s Civil Division. 

Under the law, a private citizen can raise allegations that the contractor defrauded the government and is entitled to receive a portion of any settlement. The whistleblower in the ILC case, Philip Root, the company’s former director of cybersecurity, will receive $2.35 million.

Government contract attorneys say that a forthcoming regulatory overhaul could expose more companies to False Claims Act punishments.

The post Defense and aerospace firm settles with government over allegedly failing to meet cybersecurity contract requirements appeared first on CyberScoop.

Major industry groups are clamoring for Congress to include a 10-year extension of a law that they say is essential to cyber threat information sharing in the annual defense policy bill.

Congress has mixed a series of short-term renewals and lapses of the Cybersecurity Information Sharing Act of 2015 (CISA 2015) — which provides legal protections for threat data exchanges between the government and private sector as well as between companies — since its previous 10-year sunset came and went last year. It’s now set to expire again on Dec. 11.

On Sunday, 35 business groups sent a letter to leaders of the House and Senate Armed Services panels, asking them to renew the law for 10 years as part of their final negotiations for the fiscal year 2027 National Defense Authorization Act.

“The case for a long-term reauthorization has only grown more urgent,” they wrote. “Recent incidents have demonstrated that advanced AI systems can identify and exploit software vulnerabilities at machine speed, collapsing the window between the discovery of a weakness and its use in an attack.”

“AI tools are also making sophisticated cyber capabilities cheaper, faster and easier to use, allowing threats to spread and adapt in real time,” they continued. “In this environment, the speed and breadth with which defenders share information determines whether they keep pace with adversaries. That speed depends on the legal certainty CISA 2015 provides.”

The letter’s signatories include overarching business groups like the Chamber of Commerce and Business Roundtable, the latter of which led the letter, as well as groups representing critical infrastructure sectors such as aviation, telecommunications and technology.

The House version of the fiscal 2027 defense bill includes a 10-year extension. The Senate version notably does not, and past efforts to include a long-term extension in the defense bill, which has been signed into law every year for decades, have encountered objections from Senate Homeland Security and Governmental Affairs Chairman Rand Paul, R-Ky.

Paul has hinged his support for any long-term extension of CISA 2015 on adoption of provisions designed to curtail past practices at the other CISA — the Cybersecurity and Infrastructure Security Agency — that he maintains threaten free speech.

Top Trump administration cyber officials have pressed Congress for a straightforward extension of the CISA 2015 laws. The Trump administration has also touted its efforts to crack down on what they said was the free-speech-limiting disinformation work of the agency CISA, which the Biden administration denied impinged on free speech and that it had ended anyway.

The annual defense policy bill often passes at the end of each calendar year or beginning of the next. A potential congressional committee leadership shuffle could change the equation for CISA 2015 in 2027, but the Dec. 11 expiration looms in 2026.

The post Business groups mount fresh campaign for long-term renewal of information sharing law appeared first on CyberScoop.

The clock is running out on Nick Andersen’s time to serve as acting director of the Cybersecurity and Infrastructure Security Agency, but there appear to be efforts afoot to keep him in the role for longer, with no permanent nominee in sight.

There’s broad support for the idea of Andersen retaining the position one way or another, which he’s held since February of this year. Since then, Sean Plankey withdrew his nomination for the Senate-confirmed position in April, and in June, Department of Homeland Security Secretary Markwayne Mullin said a likely replacement nominee had met with the president and was coming soon. Four months later, no nominee has materialized.

“We proudly support the work Acting CISA Director Nick Andersen has done in his role,” a DHS spokesperson said in response to questions about keeping Andersen on board and what became of that potential nominee. DHS referred CyberScoop to the White House for any further comment, but the White House didn’t respond to inquiries.

The easiest way to keep Andersen in the acting role would be to select a nominee, thus pausing his 210-day limit on serving as acting director, said Mark Montgomery, senior director of the Foundation for Defense of Democracies think tank’s Center on Cyber and Technology Innovation.

But “my gut reaction is that there’s just no appetite at the White House to say the four-letter ‘CISA’ to the president,” given his past animosity toward the agency, Montgomery said. “The way to keep Andersen in play is to nominate somebody. I think that stops the clock. But I don’t even think they can get the president to nominate Bugs Bunny. To me, that’s troubling.”  

Other top agency positions have received Senate confirmation under Mullin, Montgomery observed.

Multiple sources told CyberScoop they’ve been told that the administration has been working to keep Andersen in the job, possibly by shifting his title to “senior official performing the duties of” CISA director.

Some would like to see Andersen receive the job full-time, but sources say that when the search to replace Plankey began, the administration was looking for someone with a high pre-existing profile, such as a role at a big-name tech company.

On Capitol Hill, the leaders of the House Homeland Security Committee offered at least some  degree of support for Andersen.

“Acting Director Andersen is doing an excellent job preparing CISA to meet today’s threats, and we have a great working relationship. He has shown exceptional leadership at the agency, which is especially important in an increasingly complex threat environment as adversaries and criminals use AI to expand their capabilities and make attacks on our networks and critical infrastructure harder to defend against,” said Chairman Andrew Garbarino, R-N.Y. “I appreciate our partnership and would gladly support his nomination.”

“Acting Director Andersen has provided some much-needed stability to CISA following a year of chaos and incompetent leadership,” said the panel’s top Democrat, Bennie Thompson of Mississippi. “While we may have our differences, I appreciate his dedication to the mission: securing government networks and the critical infrastructure ordinary Americans rely on every day. I am also concerned that any unnecessary changes to CISA’s leadership could once again destabilize CISA, which would make America less safe. It is in the best interest of CISA’s mission to have an empowered leader who has earned the trust of the agency’s workforce and its stakeholders.”

One industry source also said Andersen was a popular leader.

“Frankly, from everything [I’ve heard], people broadly support Nick, and he’s doing well at CISA,” the source said. “I don’t get the sense that anyone in the White House wants to make the effort to nominate a CISA director, which is a missed opportunity. With limited time remaining in this Congress, the administration would be wise to push his nomination through the Senate and put Nick on firmer footing.”

Andersen has made a tangible difference at an agency that has seen dramatic budget and personnel cuts, said John Zangardi, a former chief information officer at DHS.

“The organization is actually getting much better under Nick,” said Zangardi, chair of the Northern Virginia Technology Council Cyber Summit and Cyber50 Awards. “Like if you were there a year ago, it was pretty stark. … So morale has kind of gone back up, and I think Nick has been very instrumental in that. And I think he’s important in keeping that continuity going.”

One of the notions of having a Senate-confirmed nominee is for the prospective leader to be well-vetted by an outside body. On the other hand, it can also lead to nominees being stalled as senators press other agendas, something that Plankey ran into on multiple occasions.

But having a Senate-confirmed nominee at the agency also helps CISA compete for its priorities within the interagency process and at the White House, Montgomery said. Absent that, keeping Andersen in the position in some capacity is the next-best option, he said.

Montgomery also said Andersen has been making longer-term plans at the agency. Most recently, it released a strategy meant to carry CISA through 2030.

Andersen “strikes me as someone who knows he’s got more than a month left in his job,” Montgomery said. “He’s thinking hard about it, and he’s starting to think three to six months out, which is a lot for this administration.”

The post Could Nick Andersen’s leadership outlast the clock on his acting role? appeared first on CyberScoop.

Apple has sent new notifications of mercenary spyware infections to almost 100 countries, with recipients including journalists and documentary filmmakers.

“Today’s notification is being sent to targeted users in 99 countries, and to date we have notified users in over 150 countries in total,” the company said. “The extreme cost, sophistication, and worldwide nature of mercenary spyware attacks make them some of the most advanced digital threats in existence today. As a result, Apple does not attribute the attacks or the notice you’re receiving to any specific attackers or geographical regions.”

Apple didn’t immediately respond to a request for comment Friday about the countries targeted. Researchers and groups that work on spyware said the notifications were significant, however.

“This again promises to be an important set of notifications with a bunch of cases, based purely on what we see publicly,” said John Scott-Railton, senior researcher at The Citizen Lab at the University of Toronto. He also posted on social media about how potential victims could defend themselves, warning people to be cautious about companies that offer paid solutions to spyware infections.

He cautioned that the lack of notification doesn’t rule out an infection. The steps Apple recommends, which Scott-Railton seconded, were to enable Lockdown Mode and to get in touch with the digital rights group Access Now.

“The number of Apple threat notifications we are seeing from countries around the world indicates that the fight against the scourge of spyware abuse is far from over,” said Natalia Krapiva, senior tech-legal counsel with Access Now. “While we have increased our capacity to investigate spyware abuse, and companies like Apple have done a lot to notify and protect people from it, repressive states continue to use these powerful surveillance technologies, including against civil society actors and opposition figures.”

Apple sent its last major batch of notifications in August. The notifications frequently lead to victims approaching Access Now, The Citizen Lab and other groups seeking further assistance and prompting deeper investigations.

The notifications come shortly before the final rounds of negotiations over industry standards for commercial hacking tools being developed under the voluntary Pall Mall Process. The industry guidelines follow an earlier set of guidelines catered to governments.

“The states that will ultimately adopt these guidelines must come to terms that the current system is not working, and that the spyware industry must face some real consequences for the uncontrolled sale of these tools and refusal to curb the abuses,” Krapiva said.

The post Apple notifications alert victims in 99 countries about mercenary spyware infections appeared first on CyberScoop.

A company working on behalf of the Department of Homeland Security sought to cut off online access to information on more than 41,000 employees that hacktivists said they obtained from a database breached at DHS.

A search tool for the database, named Icepick, went offline for a spell before coming online again Thursday under a different registrar.

Icelandic hosting company FlokiNET said Thursday that it received a request from DHS contractor ZeroFox to remove the data, which it refused.

“By mid-morning, icepi.cx no longer resolved. Its registrar, CentralNic, had placed the domain on serverHold,” FlokiNET said in a blog post. “Our refusal kept nothing online. The request that decided the outcome to take the site down was not the one sent to us. A registrar reached the opposite conclusion the same morning, published nothing, and a global audience lost access to the site. In the meantime the site is online again under a domain from a different registrar.”

CentralNic and ZeroFox did not immediately respond to requests for comment Thursday.

DHS said late Wednesday that it was working to protect its employees against any breach.

“DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively,” a spokesperson said. “We take all security threats against our employees and officers seriously and will work to ensure all are properly protected. We will update the public when more information is available.”

The social media site Bluesky was also blocking links to the archive because it shared people’s contact information without their permission, although a company official said changes were coming because the wording had identified it as a malicious link.

FlokiNET said it refused the ZeroFox request that mislabeled the archive as part of a doxxing campaign.

“Doxxing publishes private details about private people so that others can find them at home. Icepick publishes work identities of government employees,” it wrote. “Who they work for. What their role is. How they can be reached in that role. The information describes people in the exercise of public authority, not in their private lives. Federal officers carrying out an enforcement programme are not private individuals while they are carrying it out.”

“The public has a legitimate interest in knowing who is doing that work, under whose authority, and in which office,” it continued. “Journalists cannot report on an agency whose personnel are structurally unknowable.”

ZeroFox said that regardless of that, the data made it possible to locate people whose information was in the database.

“The request does not depend on who the listed individuals are or what their duties are,” ZeroFox wrote to FlokiNET. “It rests on two facts: the data was stolen, and it is personal data that identifies and locates real people.”

The post Leaked DHS employee archive, Icepick, faces challenges to stay online appeared first on CyberScoop.

A leak website was published Wednesday, showcasing internal data on more than 41,000 Department of Homeland Security employees and contractors after it was obtained by hackers who claimed to have breached an identity service used by the agency.  

The transparency nonprofit Distributed Denial of Secrets and the hacker maia arson crimew got the data from a hacktivist outfit known as the Department of Peace.

”The leak is extraordinary but deceptive in [its] simplicity as it identifies the officials responsible for overseeing covert and undercover operations, the government’s hunt for leakers and the failed BlueLeaks investigation — along with key personnel in DHS’s ever-escalating rendition and deportation programs,” said Emma Best, founder of DDoSecrets.

CyberScoop was able to verify numerous current Cybersecurity and Infrastructure Agency employees are listed in the data, along with some former leadership members who left the agency years ago.

The data goes back years, with various group names listed in the database making reference to COVID-19 planning and internal summits in 2023.

As of Thursday morning, the website hosting a searchable form of the data has been taken offline.

The hacktivists said the breach was a response to the promise of stepped-up operations from Immigrations and Customs Enforcement by DHS Secretary Markwayne Mullin.

”On July 17th, Markwayne Mullin said he was ’turning up the heat.’ This is what happens to ICE when you do that,” said a spokesperson for the Department of Peace.

The spokesperson said they obtained the database from an Okta single sign-on service used at DHS. Okta said it was aware of the report.

“Okta is secure, and we have no evidence our data or systems were compromised,” an Okta spokesperson said.

DHS did not immediately respond to a request for comment.

”This dataset is massive in terms of both size and impact,” said crimew, a Swiss hacker and journalist who has been indicted in the United States over past leaks and who created a search tool for the DHS data. “It provides an unprecedented look into the Department of Homeland Security’s organizational structure, highlighting which people do what work across multiple DHS agencies, including ICE.”

One researcher said the leak could prove valuable for Freedom of Information Act requests.

“Email addresses and phone numbers are indispensable tools for FOIA researchers, often making the difference between a vague records request that gets stonewalled and one that gets results,” Ryan Shapiro, executive director of Property of the People, said. “Given the Trump administration’s contempt for even basic transparency, the need for such tools is urgent.”

DHS has suffered notable breaches before, dating back to a 2014 breach that may have exposed the data of 390,000 then-current and former Homeland Security Department employees, job applicants and contractors. In 2018, DHS notified nearly 250,000 people of a breach at the department.

Earlier this year, Security firm GitGuardian said it discovered a public GitHub repository that exposed credentials for privileged AWS GovCloud accounts and internal CISA systems dating back to November 2025.

Greg Otto contributed to this story.

UPDATE: 10/29/2026, 9:30 a.m.: This story has been updated with details about the web-based database being taken offline.

The post Leak site publishes data on more than 41,000 DHS employees obtained by hacktivists appeared first on CyberScoop.

Prosecutors announced charges against six alleged scammers based out of Africa who targeted Americans with fake non-fungible token (NFT) investment scams by posing as women on dating websites, netting hundreds of victims.

According to an affidavit for the arrest of of the six people — Chui Kok Wa, Gislen Neukeu, Shamusa Ninsiima, Clement Mugiraneza, Merveille Mudacumura and Nicodemus Hingima Monyancha — the criminal group with connections to China and Malaysia opened a scam compound in Madagascar early last year.

“In the scheme, scammers posed as beautiful women who met victims on dating websites, eventually enlisting them to connect their cryptocurrency wallets to fraudulent websites associated with the NFT investments,” the Justice Department said in a news release Tuesday. “Once connected, the scammers willed the victims to continue to fund their cryptocurrency wallets, and then surreptitiously pulled money from the victims’ wallets without their knowledge.”

The FBI identified approximately 74 cryptocurrency wallets associated with approximately 800 victims in the scheme, for an estimated loss of at least approximately $516,695, according to the affidavit and news release.

The U.S. District of Columbia’s Scam Center Task Force, the FBI’s field office in Honolulu and the U.S. Attorney’s Office for the District of Alaska made a trip to Madagascar in August to review electronic devices seized from scam compounds. Interviews with scam compound workers there revealed that Cambodian police activity and armed conflict between Thailand and Cambodia led to operations at a Cambodian scam compound being moved to Madagascar.

Phones for the alleged scheme leader, Wa, contained employment contracts and scripts for what scammers should say to victims, which said they would be committing “an emotional scam.” The devices that officials reviewed and the interviews also established further connections between the scammers and Southeast Asia and China.

After the initial interviews, though, Madagascar repatriated some suspects to China before the investigation was complete, according to the Justice Department.

“Today, [D.C.] U.S. Attorney Pirro called on the Madagascar government to cooperate with the United States, extradite the six charged defendants, and further noted that the government had obtained a material witness warrant to interview 15 employees of the scheme, who claimed they were human trafficked and abused by Wa, but are believed to be held in jail in Madagascar,” the release stated.

In the same release, DOJ said that the Scam Center Strike Force had crossed the $1 billion threshold in cryptocurrency recovered in its first year. 

The post Prosecutors charge Madagascar scammers in NFT-stealing scheme based on fake online dating profiles appeared first on CyberScoop.

The Office of the National Cyber Director has rolled out its second regional cyber pilot program, this one focused on rural hospitals.

National Cyber Director Sean Cairncross visited South Carolina on Monday to debut the six-month program, Project Lifeline 250, which connects industry with rural hospitals. The concept is similar to the first pilot program in Texas that connected industry with the water sector.

“Project Lifeline 250 connects the world-leading American industry with rural hospitals and uses the greatest American tools and capabilities to defend hospital networks; deploy physical back up devices after an initial incident to ensure an impacted hospital can still provide critical care; and identify high-risk and legacy devices and replace them,” Cairncross said in a statement.

The health care sector had a record year for breaches last year, with 804 large breaches reported to the Health and Human Services Department’s Office for Civil Rights that affected more than 140 million people. The FBI identified the sector as the top target for ransomware and other hackers in 2025.

Rural hospitals, like the water sector, lack resources compared to other kinds of critical infrastructure.

Besides industry and the ONCD, the effort is a project that draws in the South Carolina Critical Infrastructure Cybersecurity program, the South Carolina Law Enforcement Division and local governments in the state.

“Cyber threats are a rising challenge to our nation’s security, and we must remain vigilant to protect the systems our communities depend on,” said South Carolina Gov. Henry McMaster. “Project Lifeline 250 is another important step toward ensuring South Carolina’s rural hospitals have the resources they need to defend against cyberattacks and continue providing critical care.”

Some of the same companies involved in providing free services in the Texas pilot are involved in the South Carolina pilot, too, along with some new participants. Among the participating firms: Abnormal AI, Cisco, Cyera, Microsoft, Rilian Partners, Trellix and Zscaler.

“The stakes for critical infrastructure are getting higher and higher,” said Yotam Segev, cofounder and CEO of Cyera. “There’s real urgency in bringing cyber expertise from some of the world’s largest and most complex enterprises to rural hospitals through Project Lifeline 250. When a hospital knows where its patient data lives and who can reach it, it can reduce the leverage behind ransomware. Every community should have that clarity, no matter the size of the hospital or its IT team.”

Members of Congress also have introduced legislation designed to aid rural hospital cybersecurity.

The ONCD hasn’t said what will happen at the end of the six-month pilots. And so far it has only partnered, or publicly discussed partnering with, GOP-led states.

The post National cyber director rolls out latest pilot in South Carolina, this time for rural hospitals appeared first on CyberScoop.

The Trump administration is breaking the law after being more than a month overdue on declassifying a court opinion on the surveillance of U.S. citizens, according to two senators and a coalition of civil liberties groups.

Release of the Foreign Intelligence Surveillance Court (FISC) opinion has been closely tied to reauthorizing Section 702 of the Foreign Intelligence Surveillance Act (FISA), which lapsed this summer, although collection authority has continued under another court ruling that runs through March of next year.

Under Section 702, the government can warrantlessly search foreign targets’ electronic and phone communications using the personal information of Americans who have been in contact with them.

In the FISC opinion that the administration has not declassified, a judge objected to tools the government has created to let analysts process messages. The objection reportedly was over a filtering system that allowed analysts to get information in a way that should be counted as a query of Americans’ information, which is subject to extra protections.

Sen. Ron Wyden, D-Ore., who co-authored a letter to administration officials Monday with Sen. Adam Schiff, D-Calif., had previously said the opinion shows “major compliance problems” and had  objected to a short-term reauthorization of Section 702 until officials agreed to release it.

“As Congress continues to debate the fate of this authority, lawmakers must be able to discuss these abuses openly,” Wyden and Schiff wrote to Director of National Intelligence Jay Clayton and Attorney General Todd Blanche. “Otherwise, the American people will rightly question whether a government that so flagrantly violates basic legal requirements, like the statute requiring declassification, can ever be trusted to not abuse a powerful surveillance tool like Section 702.”

The Senate duo and the coalition of civil liberties groups in a separate letter to congressional leaders said that under the law, the letter was due Sept. 13. Blanche had previously committed to declassify the letter to lawmakers by the statutory deadline. The letter was also overdue by another measurement, with the leaders of the Senate Intelligence Committee saying that they expected the declassification and release by May 15.

A spokesperson for Senate Intelligence Chairman Tom Cotton, R-Ark., didn’t respond to a request for comment, but the office of the leader of the Democratic side of the panel, Sen. Mark Warner of Virginia, did.

“The Vice Chairman has been clear that he supports transparency with regard to Section 702 of FISA,” a spokesperson, Rachel Cohen, said in a statement to CyberScoop. “This is precisely why he and Chairman Cotton urged then-DNI [Tulsi] Gabbard in March to declassify the March 17 FISC opinion. Unfortunately, neither Director Gabbard nor Acting Director [Bill] Pulte were responsive, but Senator Warner expects that DNI Clayton will declassify the opinion, consistent with the bipartisan SSCI letter and as required by law.”

Failure to declassify the opinion should be fatal to reauthorizing the expired surveillance law, the civil liberties groups wrote.

“Congress should refuse to support any reauthorization of Section 702 while the administration actively withholds legally mandated information about how the surveillance program operates,” they wrote. “Further, it must stop relying on executive branch self-policing to protect Americans’ rights and reauthorize Section 702 only with a warrant requirement to access Americans’ private communications.”

The Office of the Director of National Intelligence and the Justice Department didn’t immediately respond to requests for comment.

The post Senators, rights groups say Trump administration breaking law by withholding surveillance court opinion appeared first on CyberScoop.

The Cybersecurity and Infrastructure Security Agency published a strategy Monday that focuses on taking a leading role in cyber defense, prioritizing protection of critical infrastructure and building the ability to withstand attacks.

The 10-page strategy — “CISA 2030: Defend, Harden, Prevail” —  largely reaffirms existing roles for the agency, but CISA will begin reviewing its core services and capabilities within 60 days to make sure they meet key objectives, followed by implementation over the next 180 days and an update on its progress after one year.

Acting CISA Director Nick Andersen said in a foreword that the agency needs to act with “renewed purpose” in the face of threats.

“The threat landscape we face today is not static,” he said. “Nation-state actors and other malicious adversaries continue to grow more sophisticated in their efforts to compromise our networks, and there is no guarantee that a strong defense will eliminate intrusions. As President Trump has reminded us, resilience must be the foundation of our approach. We must ensure that when adversaries gain a foothold, we are prepared to detect them quickly, evict them decisively, and keep critical operations running without interruption.”

The strategy is also meant to align with the administration’s broader cyber strategy, published in March, and last year’s executive order on state and local preparedness.

“I call on every company and organization in the critical infrastructure community — from owners and operators to vendors and technology manufacturers — to act now,” Andersen said in a comment released with the strategy. “CISA 2030 provides a focused roadmap to strengthen defenses, eliminate adversarial footholds, and deny them any advantage that could endanger the nation’s security, economy, or public health.”

Within each section of the strategy, there are other goals listed.

Under “defend: lead national cyber defense,” the key objectives are to integrate state, local and industry cyber defense; protect operational technology; developing guidance and best practices on software security; and assess and develop emerging technologies.

Under “harden: prioritize national infrastructure security,” the key objectives are to coordinate intelligence for critical infrastructure; analyze infrastructure data; work with international partners; and emphasize strengthening the nation’s most important infrastructure.

Under “prevail: mobilize national resilience,” the key objectives are to invest in critical infrastructure resilience; strengthen national communications interoperability; modernize planning and exercises; and build next-generation interoperable infrastructure.

Critics say much of CISA has been badly diminished by budget cuts at the agency by the Trump administration, including many of them specifically a focus of the new strategy, that have left it understaffed.

The last strategic plan at the agency, published in 2023, also had three pillars: address immediate threats, harden the terrain and drive security at scale.

The post CISA publishes strategy with eye on the next four years appeared first on CyberScoop.

Two senators say that revelations about online targeted advertising being used as a vector for spyware infections underscore the need for better security practices in the industry.

Some members of the advertising industry that were subjects of the report, meanwhile, think their practices are up to the task.

The Citizen Lab at the University of Toronto, in partnership with the cybersecurity and ad-tech firm Confiant, last week published a report on AdFection, a technique whereby targeted ads were delivering zero-click mercenary spyware.

“Ad vendors must significantly level up their cybersecurity and threat detection capacity to effectively cut off malicious advertisers across the supply chain,” The Citizen Lab report states. “They must rigorously and regularly vet, screen, and audit their business partners and hold them accountable for their own supply chains.”

In 2023, Democratic Sens. Ron Wyden of Oregon and Cory Booker of New Jersey introduced legislation to ban advertising networks and facilitators from using personal data to target, but the legislation never advanced past introduction. Both said The Citizen Lab report illustrated the need for industry reform.

“The report underscores the growing risk of spyware and the increasingly sophisticated methods used to track and target people online,” Booker said in a statement to CyberScoop. “Americans need vastly stronger privacy protections that stay ahead of these evolving surveillance threats.”

The security threat of targeted online advertising to government devices is of particular concern to Wyden, with his letters to government agencies cited in the report. Wyden has called adtech a national security threat. Ads from Discover-Tech, the company most linked to AdFection, got impressions on government networks.

“Allowing targeted ads on government devices is an open invitation to spies and criminals. It’s the digital equivalent of leaving all the doors and windows unlocked at a sensitive government facility,” he said in a statement to CyberScoop.

“It’s clear that advertising exchanges are not meaningfully protecting users against malware and location tracking, which is why I’ve been urging the government to disable ads on government browsers and turn off mobile ad IDs, and have pushed my bill to ban all targeted advertising,” he continued. “The latest Citizen Lab report is an impressive reminder that this sector simply cannot be trusted to put users’ security ahead of profits.”

A number of U.S. agencies have taken steps to block ads due to the threats they pose, or recommended blocking them for feds.

Discover-Tech appeared on lists of “certified” and “approved” vendors that Google and the advertising industry association IAB Europe maintained. Google participated in the report, but IAB Europe didn’t respond to it until after publication. Both provided additional comments to CyberScoop.

Google and IAB Europe, and the ad networks Beeswax, Vungle and Eskimi all took steps to remove Discover-Tech’s access to the digital advertising ecosystem, according to the report. A mix of other ad systems replied to The Citizen Lab, but some did not, including Microsoft, which owns the ad system Xandr. Microsoft also didn’t respond to requests for comment from CyberScoop.

The Citizen Lab report concluded that the advertising industry displayed “a dangerous lack of due diligence” and criticized “broken digital infrastructure,” while also saying that the sector needed to “get serious” about security.

It said ad vendors needed to better share threat data, improve vetting of partners, audit vendor registries and ban vendors by default in jurisdictions known to be permissive of abuse.

In response to questions from CyberScoop about those conclusions, a Google spokesperson provided a statement.

“We banned Discover Tech during a joint investigation with Citizen Lab and Confiant,” the spokesperson said. “Throughout that work, we continuously blocked malicious ads to help people stay protected while we dismantled the network.”

Google said that its safety teams and systems continuously blocked individual bad ads from Discover-Tech, but banning them entirely from the platform required proof that their ad infrastructure was linked to spyware.

The company also said it regularly audits participants in its Authorized Buyer program, as well as deploying “multi-layered defenses to stop bad ads,” and that its automated systems detected over 99% of policy-violating ads before reaching users last year.

IAB Europe responded more specifically.

“The findings do not demonstrate that the digital advertising infrastructure is broken, but rather point to the potential misuse of existing technologies and functionalities that are not specific to digital advertising but inherent to web technologies,” said Lauren Wakefield, marketing and communications director for the association. “While the industry continuously invests in improving security and safeguards against fraud and other forms of misuse, the investigation of potentially unlawful activities, such as the deployment of spyware, ultimately falls within the remit of competent authorities.”

The Citizen Lab report also urges regulators to take action, including conducting an investigation of Discover-Tech and the spyware firm Candiru, which infect users through Discover-Tech online ads; “more closely scrutinize the advertising ecosystem to determine whether other companies are leveraging it for espionage and spyware delivery, and determine whether they have violated applicable laws and regulations;” and pursue sanctions against mercenary spyware firms and the companies that enable them.

“Preventing fraud and other forms of misuse is already an ongoing priority across the digital advertising ecosystem, and IAB Europe supports industry efforts to invest in technologies, processes and safeguards to identify and mitigate cybersecurity risks,” Wakefield continued. “We hope this report will be seen as an opportunity to reassess and improve existing approaches to cybersecurity. It is important to recognise that cybersecurity requirements and measures must be proportionate to the risks and circumstances of each individual company, which is why one-size-fits-all recommendations may not always be appropriate.”

The post Senators say targeted ads are a security risk. Ad groups say the critics are off base. appeared first on CyberScoop.

Russian government-connected hackers compromised two defense firms and a law enforcement agency in North Atlantic Treaty Organization countries as part of an espionage campaign, Symantec researchers said in a blog post Tuesday.

The infamous group behind hacks of the Democratic National Committee during the 2016 election cycle was behind the attacks that Symantec identified in recent months: Swallowtail, also known as APT28, Fancy Bear and Forest Blizzard, notorious for its links to the Russian military agency GRU.

The hackers apparently chose the targets of their attacks carefully, including a naval shipbuilder, a manufacturer of military aircraft engines and the law enforcement agency. In the attack on the shipbuilder, Symantec saw “hands-on-keyboard” activity as the hackers repeatedly returned to a compromised host over the course of a week to steal credentialed material.

“Hands-on-keyboard activity means a human operator is choosing what to do next, rather than malware running a fixed routine,” Dick O’Brien, principal intelligence analyst at the Symantec Threat Hunter Team, told CyberScoop. “It’s essentially confirmation that the organization is a genuine target for the operators, not an accidental infection. It also confirms that further exploitation beyond the initial infection was at least attempted.”

O’Brien said the campaign reflected broader intelligence collection aimed at European government and defense targets, but its motive wasn’t certain. He speculated that it could have been part of campaigns to target nations aiding Ukraine in its war against Russia.

The hackers made use of the Hookedge backdoor first identified in August by Recorded Future’s Insikt Group. That firm saw attacks dating back to September of last year by the same group using the same backdoor on defense and diplomatic targets in Romania, Spain and Turkey.

Symantec also observed the hackers deploying a previously undocumented loader.

“What surprised us was that the attackers then moved their most sensitive follow-up activity onto a dedicated server, when Recorded Future had expected them to keep hopping between free services,” O’Brien said. “The loader, ld.exe, hadn’t been publicly documented. It decrypts its payload in memory, and it needs a key supplied only at runtime on the command line. Without both the encrypted file and the key, the payload can’t be recovered. We didn’t recover it, so we don’t know its function.”

This spring, researchers and U.S. government agencies said they quashed a Forest Blizzard espionage campaign. Western governments warned last year about the group targeting companies supporting Ukraine.

The post Russian GRU hackers hit NATO shipbuilder, aircraft engine maker, law enforcement agency in espionage campaign appeared first on CyberScoop.

Hundreds of federal agencies should adopt an encryption tool to protect whistleblowers, veterans suffering from mental health crises and others from hackers who might target them when they reach out via agency websites, Sen. Ron Wyden said Monday.

The Oregon Democrat urged the Cybersecurity and Infrastructure Security Agency and Office of Management and Budget to take steps to adopt Encrypted Client Hello — a cybersecurity technology that protects the name of the website visited by a user — in a letter to the two agencies. His office identified at least 350 sites that don’t use its protections.

While almost all federal agency websites are encrypted, standard web encryption doesn’t secure some website names, Wyden said, using reportfraud.ftc.gov as an example.

“As data travels across the internet, hackers and foreign actors monitoring network connections can easily see these exposed website names,” he wrote. “This visibility could lead to malicious eavesdroppers identifying whistleblowers, profiling cleared federal personnel, tracking Americans seeking crisis support, and mapping interactions between agencies.”

Wyden wrote that Encrypted Client Hello (ECH) is especially effective with Content Delivery Networks (CDNs) that connect hundreds of thousands of websites to the internet. For websites delivered by a CDN, ECH makes it so anyone intercepting user web traffic can view the network delivering the content but not the specific site.

Agencies using CDN infrastructure without Encrypted Client Hello include an FBI tipline that supports ECH but doesn’t enable it and a Department of Veteran Affairs online suicide prevention hotline that isn’t protected by ECH because Amazon doesn’t support it, as well as agencies offering things like national security personnel services and whistleblower channels.

Because of the lack of ECH protection, foreign adversaries might be able to identify someone submitting crime tips to the FBI, Wyden warned.

Wyden made two recommendations to the leaders of CISA and the OMB.

“CISA should require that civilian federal agencies enable the protections of ECH across all public-facing websites and inter-agency web systems,” he said. “OMB, in coordination with the Office of the National Cyber Director and CISA, should establish support for ECH protections as a mandatory condition for commercial cloud and network vendors seeking federal contracts.”

CISA and OMB didn’t immediately respond to a request for comment on the letter, first reported by NextGov/FCW.

Wyden’s Monday missive is his most recent aimed at improving security technology at federal agencies, following on the heels of a letter in July first reported by CyberScoop that urged feds to get rid of older, insecure, public-facing VPNs.

The post Wyden seeks adoption of encryption tech at hundreds of federal agencies to protect visitors’ sensitive traffic appeared first on CyberScoop.

A joint international law enforcement and industry operation against scammers netted 28 arrests, rescued 117 trafficking victims and led to the takedown of more than 3.7 million accounts, the Justice Department announced Tuesday.

The crackdown, billed as “Joint Disruption Week,” focused on West Africa and also identified more than $11 million in freezable funds and led to the seizure of hundreds of electronic devices. The range of scams involved included law enforcement impersonation scams, digital arrest extortion schemes, pig butchering and other online fraud operations targeting victims around the world.

Participants heralded it as the largest joint scam operation to date, and the first focused on West Africa.

“For so long, the problem of international scams seemed impossible to tackle,” Kelly Milliron, acting chief of staff and counselor to the Assistant Attorney General leading the Criminal Division, told reporters. “But now, because of collaborations like Joint Disruption Week, we have a plan, a consolidated approach, bringing together people that can bring solutions and, most of all, safety for our citizens.”

It’s the latest effort in the Trump administration’s ongoing bid to make countering scam operations a theme of his term, and to make disrupting cyber adversaries and criminals a central focus of its cyber strategy. 

Participating agencies in the London-hosted operation beyond the Justice Department were the Scam Center Strike Force under the U.S. Attorney’s Office for the District of Columbia, the FBI, the Secret Service, the Treasury Department, Homeland Security Investigations, the Homeland Security Task Force, the United Kingdom’s National Crime Agency, the Nigerian Joint Case Team on Cybercrimes, the Nigeria Police Force’s National Cybercrime Center and the Ghanaian Cyber Security Authority, INTERPOL and agencies from Australia, Canada, India and New Zealand also were involved. 

Adobe, Binance, Coinbase, Cyjax, Elliptic, Chainalysis, Flashpoint, Google, Meta, Microsoft, OpenAI, Silent Push, Starlink and TRM Labs were companies that participated in the operation. Meta said it removed more than 3.7 million accounts, groups and pages from Facebook and Instagram based in West Africa, a majority of which targeted people in the United States and United Kingdom.

Some on Capitol Hill have raised concerns about whether U.S. operations to counter scams are coordinated enough.

The operation actually began in September, with a series of raids in Ghana before last week’s designated action. Jeanine Pirro, U.S. Attorney for the District of Columbia, said Disruption Week occurred not long after a new partnership with the United Kingdom.

“The aim is to bring cases in parallel and also to combat fraud together through joint targeting,” she said. “This was the perfect time to continue that partnership.”

It’s not clear how many of the potentially freezable funds will actually be frozen as a result of the operation.

“Identifying the assets is the easy part, and tracing them, going after and developing probable cause within our investigations so that we can legally seize them does require a little bit of work,” said Matthew Floyd, deputy assistant director of the FBI’s Criminal Investigative Division. “So at this point, that’s why it’s much easier in these efforts to identify assets initially, and then they’ll fold into our investigations as we move forward.”

Disruption Week was the culmination of agencies meeting to combine forces, something that will happen on a regular basis, Floyd said, but at an interval to be determined going forward. The operation led to the sharing of more than 30 leads on scam centers, participants said.

The post West African scammers targeted in joint international government-industry operation appeared first on CyberScoop.

The Justice Department and FBI announced that they had seized two hacking tools connected to the Chinese government-linked group Flax Typhoon and a China-based company that the U.S. government has repeatedly taken action against, including with a new multi-agency advisory Thursday.

The domain name seizures were meant to deny hackers access to the vulnerability scanning tool Microscan and the spearphishing tool FishHub created by the Chinese firm Integrity Technology Group, which the United States sanctioned last year. The U.S. government in 2024 also made the company the focus of a takedown operation, saying it was behind a massive botnet.

Authorities were granted the court-authorized seizures in the Western District of Pennsylvania, the FBI and DOJ announced Thursday in unsealing documents in the case.

U.S. agencies paired the announcement of the seizures with an advisory from the FBI, Cybersecurity and Infrastructure Security Agency and National Security Agency.

“Chinese government-linked cyber threat actors, enabled by the Integrity Technology Group, are combining automated scanning tools, large-scale botnets, and hands-on exploitation techniques to target and steal sensitive data from organizations worldwide, including U.S. critical infrastructure sectors,” the advisory reads. “These actors exploit vulnerabilities by using scanning tools, cross-site scripting attacks, and password spraying on Microsoft Exchange servers, while establishing persistence through VPN software and exfiltrating emails and credentials using scripts.”

Similar to previous allegations, law enforcement said Integrity Tech leaned on a Mirai-variant botnet of internet-of-things devices, in this case to facilitate Microscan.

Microscan targets have included a South Carolina power company, airports in Japan and Poland, critical infrastructure companies and universities in Taiwan and others, according to the FBI and DOJ. Victims of FishHub, which downloads malware on their networks after gaining access through spearphishing, include Taiwanese universities.

“Chinese government-affiliated actors continue to position themselves within critical infrastructure networks, including operational technology (OT) systems, with the aim of disrupting critical functions at a future time of their choosing,” said Chris Butera, acting executive assistant director for cybersecurity at CISA. 

“Under the FBI Cyber Strategy, we pursue both the actors who threaten critical infrastructure and the enterprises that support them,” said Brett Leatherman, head of the FBI’s Cyber Division. “Integrity Technology Group, a China-based company with ties to the Chinese government, is one of those enterprises, acquiring or developing cyber tools and hosting infrastructure for actors targeting networks worldwide.”

The post DOJ, FBI seize Flax Typhoon-linked hacking tools Microscan, FishHub appeared first on CyberScoop.

Federal government contractors that handle sensitive information could soon face a “sea change” in rules about how they protect that information and report when it has been part of a breach.

Pending federal regulations on the handling of “controlled unclassified information,” or CUI, a category of sensitive data that falls short of classified — including people’s personal information such as Social Security numbers, information that could expose vulnerabilities in critical infrastructure and more — could arrive as soon as the end of this year, but likely no later than the end of President Donald Trump’s term, attorneys who specialize in federal procurement rules said. The changes are part of a larger overhaul of federal contracting rules.

As currently written, the proposed CUI rules mandate that unauthorized access of such data, including as a result of a cyberattack, would have to be reported to the federal government within 72 hours of discovery. The rules are a companion for most federal agencies to existing  Defense Department rules that cover the same subject. The 72-hour notice also is deliberately aligned with forthcoming rules from the Cybersecurity and Infrastructure Security Agency (CISA) for critical infrastructure owners and operators to report major cyber incidents under the Cybersecurity Incident Reporting for Critical Infrastructure Act (CIRCIA).

The CUI rules require contractors to adhere to minimum electronic security standards for protecting that sensitive information. Experts said the rules could expose contractors who fail to comply with cybersecurity guidelines to penalties under the False Claims Act, a lever that the federal government has been using increasingly since 2022 to punish contractors over lackluster cyber safeguards.

It’s “going to be a sea change for a lot of companies,” said Trayce Howard, a government contracts partner at Wiley Rein. 

“If it’s finalized in the form that it’s in now, it will be a fairly significant change for federal contractors,” said Ryan Burnette, a partner at Covington focused on government contracts and technology.

Susan Cassidy, another partner at Covington who advises government contractors, said the proposed regulation is part of a journey that began as far back as an executive order in 2010, when officials realized they couldn’t have sufficient, consistent requirements for protecting CUI given that so many agencies used different terminology for it: “sensitive but unclassified,” “for official use only,” and more.

The proposed rule is intended to “make it easier for contractors to comply with one set of standards, rather than many different types of standards” for the protection of CUI and the reporting on CUI incidents such as breaches, she said.

One industry source who spoke on condition of anonymity was candid about the difficulties CUI poses.

“CUI can be painful for many industry stakeholders because it’s not always clear what constitutes CUI,” the source said. “Many contractors will say they don’t necessarily know exactly what CUI is, despite their best efforts. Information from agencies isn’t always clearly marked as CUI.”

The reporting requirements

An earlier draft of the rule gave industry groups more heartburn: It had an 8-hour standard for reporting CUI incidents, rather than 72, and it required reporting of suspected incidents as well.

Still, a number of industry groups objected to the 72-hour standard, despite it being part of a much-sought after attempt to align federal breach reporting notification standards under CIRCIA.

The Aerospace Industries Association, for instance, said in filed comments that it “reiterates concerns with these compressed timelines which will be difficult and costly for industry to comply with,” in reference to the 72-hour standard. “AIA recommends extending these timelines to 30 calendar days to accommodate improved reporting while reducing compliance costs.”

The industry source said that “72 hours is largely a policy decision, based on extensive public-private deliberation,” rather than one based on any study of what’s best.

Another point of discussion about the reporting rule as written is where contractors report incidents.

“While the 72-hour reporting window is a significant improvement over the 8-hour window in the January 2025 proposal, the June 2026 rulemaking still appears to require reporting to agency -specific points of contact … rather than to a single centralized hub,” the Chamber of Commerce wrote in its comments.

Cassidy said “it will be interesting to see how centralized reporting into CISA, which is the other place where civilian agencies go, is handled, and whether there’s coordination with DOD or whether or not we still see two separate streams going through.”

The standards

The other major aspect of the proposed rule is that contractors handling CUI would have to abide by certain cybersecurity standards set by the National Institute of Standards and Technology known as SP 800-171, which Howard and her Wiley coauthors said would be imposed “on a broader group of contractors than ever before.” Some contractors might also have to meet other cybersecurity requirements, too.

“Another thing that will affect contractors is they’re going to have to flow down these requirements to their subcontractors,” she said. “So they’re going to have to identify what CUI am I giving to my subcontractors, and do some sort of oversight to make sure that their subcontractors are appropriately handling CUI.”

Howard and other experts predict that the rules could expand who might be subjected to False Claims Act punishments.

“I do think that this creates some significant False Claims at risk for contractors,” she said. This is going to encompass a whole new universe of contractors that may not be quite ready for that… contractors that have been working for civilian agencies exclusively have not been subject to this before.”

Final steps

The next steps aren’t 100 percent clear. Howard said a final rule could arrive by the end of the year. Cassidy said either an interim rule could take effect soon, or a final rule could be issued. Burnette said a final rule might be farther away, though the Trump administration has made it clear it wants everything finalized before the end of its term.

That means contractors need to get ready, he said.

“I think contractors should really be looking at this, preparing for it in certain ways, at least by recognizing at a high level, where this is headed and the types of activities and steps they need to be doing internally,” Burnette said. “Some of the minutia and the details, those are still subject to ironing out. But generally speaking, if you look at this rule compared to the rule that we saw early last year, they are much more similar than they are different. So we are starting to see  some crystallization here of the requirements, and we’re starting to get an idea what might change and what is most likely baked at this point.”

The Office of Management and Budget did not respond to requests for comment.

The post Major rules for federal contractors handling sensitive data are nearing the finish line appeared first on CyberScoop.

FortiBleed, a credential compromise campaign targeting Fortinet firewalls and VPN gateways, is an ongoing threat that can lock users out of their Fortinet accounts and also lead to ransomware attacks, the FBI and Secret Service said in an alert published Tuesday.

“Affected organizations may find themselves locked out of their systems if threat actors disable accounts or change passwords, requiring remediation steps beyond standard patching and password resets,” the alert states. “In addition, the FortiBleed attack chain has been observed as an initial entry point for ransomware affiliates.”

When it was first uncovered earlier this year, SOCRadar verified more than 86,644 compromised devices across 194 countries. Ensar Seker, chief information security officer of the company, told CyberScoop that “in our later investigation, we identified more than 400,000 or 450,000 firewalls targeted by the wider operation.”

There are different aspects of the operation that make comparisons imprecise over time, but overall the numbers “show the campaign is broader and more serious than we understood at the beginning,” Seker said.

The attackers can disable accounts or change passwords to lock users out with the access they gain, making standard password resets and patching insufficient, the government alert reads.

The alert also warns that initial access brokers are making use of the FortiBleed attack to provide access to ransomware affiliates, including INC/Lynx and Payload.

The government warning provides additional confirmation about the most worrisome elements of FortiBleed, Seker said.

“What stands out for me is that FortiBleed is still an active threat, and attackers are using stolen credentials to access the exposed Fortinet devices, create new administration accounts, and in some cases, lock the real owners out,” he said. “The FBI and the Secret Service also confirm that the success can lead to ransomware attacks as well.” 

The FBI and Secret Service recommend that Fortinet customers restrict external management or remove internet administration entirely, reset credentials, set up multifactor authentication, review firewall and VPN users for unauthorized changes, review logs for potential lateral movement, and enable secure credential storage.

The agencies are seeking any information and indicators of compromise that organizations can share, including IP addresses and any usernames the attackers use.

The post Alert: FortiBleed remains active campaign, can lock out users or lead to ransomware attacks appeared first on CyberScoop.