Nextgov/FCW - Cybersecurity

AI, once relegated to helping hackers with certain tasks, can now power every stage of a cyberattack

David DiMolfetta — Mon, 13 Jul 2026 21:00:00 -0400

Just two years ago, hackers were tapping into generative artificial intelligence to probe targets, translate technical material and troubleshoot malicious code. The technology sped up some key parts of a cyber operation, but other stages remained solely in human hands.

That line is now beginning to blur. In a range of cyberattacks observed over the past year, AI systems generated commands, tested vulnerabilities and helped hackers move through victim networks, sometimes carrying out thousands of commands with less human direction than researchers had previously seen, according to research released Monday night by cybersecurity firm Check Point.

It means AI has now been used in some form at every stage of a cyberattack, from identifying targets to exploiting vulnerabilities to stealing data, to help hackers achieve their goals.

The shift does not yet amount to fully autonomous hacking, a top company executive told Nextgov/FCW, but it shows that AI is moving from an occasional aid to an extra set of hands throughout the entirety of an intrusion process. The findings also highlight how rapidly the global cyber ecosystem has adopted AI, with the technology now embedded across every part of an offensive operation rather than confined to isolated tasks.

“We watched criminal groups breach government agencies at scale, using AI as the primary operator rather than a background assistant,” the Check Point report says. In most cases, the AI model’s role was revealed by the attacker’s own mistakes or monitoring by the AI provider, rather than tools or safeguards deployed by the victim organization.

For these AI-enabled pursuits, hackers have used open-source models and purpose-built malicious AI tools sold on the dark web, but major commercial providers remain their primary choice, company threat intelligence lead Sergey Shykevich said in an interview.

The research points to the Gentlemen ransomware group as one instance of how AI is being folded into routine criminal operations. Members compared mainstream commercial models based largely on which imposed the fewest restrictions and used AI to help build internal tools, including a management platform developed in three days.

The findings also highlight VoidLink — a sophisticated toolkit for remotely controlling infected computers — that researchers initially believed had taken a team several months to build. Check Point later found that a single developer produced roughly 88,000 lines of working code in under a week using a commercial AI coding tool.

Hackers tend to first choose U.S. AI models like ChatGPT or Claude because their responses are generally considered higher-quality, but they have a tougher time exploiting those families of models because of stronger guardrails designed to prevent malicious use of the tools, Shykevich said. When those attempts fail, they then pivot to Chinese-made AI platforms that have lower guardrails.

“They are trying to jailbreak those [Western] models, but when they are not successful, they just go to DeepSeek, Qwen and Trae,” he said, referring to a trio of AI models and platforms originating in China. Qwen is a suite of AI and large language models developed by Alibaba, while Trae is an AI-backed code editor and programming platform built by ByteDance. Ransomware gangs have been heavily leaning on those Chinese models to help generate code for their exploits, he noted.

Chinese AI models have recently grown more capable and widely used for coding tasks. Beijing has discussed restricting overseas access to some advanced models, underscoring their growing national security value and their appeal to cybercriminals seeking tools to help with their exploits.

When asked how these new dynamics involve targeting U.S. government and critical infrastructure organizations, Shykevich said there are certainly higher and faster levels of exploitation attempts, though he assessed that’s due to a combination of AI-enabled speed and geopolitical tensions.

He said that, in an ideal world, security flaws should now be patched within several hours of discovery, though he immediately acknowledged that would be next to impossible. The Cybersecurity and Infrastructure Security Agency recently revamped its remediation timeline guidance, ranging from three days for the highest-risk flaws to 60 days for lower-priority issues.

The move is part of CISA’s response “to the current threat landscape where AI software services can assist threat actors to find and exploit vulnerabilities,” the agency said last month.

The findings come as the latest tranche of frontier AI models is showing sharp gains in their ability to perform cybersecurity tasks. OpenAI last week released GPT-5.6, which it called its strongest cybersecurity model yet, reporting substantial gains over its predecessor on benchmarks testing exploit development and proof-of-concept generation.

The Trump administration, meanwhile, has given the National Security Agency, CISA and other federal officials until Aug. 1 to develop a classified process for benchmarking the advanced cyber capabilities of frontier AI models and determining which systems need additional government scrutiny.

“The most significant shift this report documents is not a new technique. It is pace,” the Check Point report says. “A vulnerability now becomes a working exploit within hours of disclosure. Phishing campaigns run at a quality and volume no human team could match. Intrusions span dozens of targets simultaneously, with AI handling the operational work between check-ins. Security teams working at human speed cannot match that cadence.”

]]>

Russian hackers exploit weak router security to breach critical infrastructure, Western allies warn

David DiMolfetta — Mon, 13 Jul 2026 15:34:00 -0400

Russian state-backed hackers tied to Moscow’s FSB Federal Security Service are continuing to breach critical infrastructure networks around the world by exploiting routers and other networking devices protected by weak credentials or running outdated technology, the United States and 12 partner nations warned Monday.

The joint advisory said operators from FSB’s Center 16 signals intelligence unit have been working to opportunistically compromise infrastructure organizations across the communications, defense industrial base, energy, financial services, government facilities and health care sectors using the poor router configurations.

The advisory was issued by the NSA, Cybersecurity and Infrastructure Security Agency, FBI and Defense Department Cyber Crime Center, alongside agencies from Australia, Canada, New Zealand and others.

“This is an ongoing issue that has impacted various U.S. and foreign networks across multiple sectors,” the National Security Agency said in a statement accompanying the advisory.

Center 16 operators have also exploited Cisco’s Smart Install feature, web portals used to manage network devices and at least two Cisco vulnerabilities. One of the flaws was logged Monday in CISA’s Known Exploited Vulnerabilities catalog, which tabulates cyber vulnerabilities that have been leveraged by hacker groups.

The guidance comes the same day the United Kingdom and European Union formally blamed Center 16 for a failed December 2025 cyberattack against Poland’s energy grid. UK officials said the operation could have cut electricity to roughly 500,000 people during the winter.

“We strongly condemn Russia’s behaviour and misuse of this cyber ecosystem, targeting public services and critical infrastructure, causing disruptions and financial losses,” EU foreign policy chief Kaja Kallas said.

Former U.S. officials urged organizations to shore up their routers’ cyberdefenses.

“Organizations should treat internet-facing network infrastructure as a priority attack surface by eliminating default credentials, restricting management interfaces, and ensuring that routers receive the same level of monitoring and patching as other critical systems,” said Matt Hartman, the chief strategy officer at Merlin Group who has held several senior roles at the Cybersecurity and Infrastructure Security Agency.

“Organizations should assume that a router or other perimeter device will eventually be compromised. The objective is not simply to prevent the initial intrusion, but to ensure that the compromise cannot spread and create operational consequences,” said Lou Eichenbaum, the former chief information officer at the U.S. Department of the Interior and current federal chief technology officer at ColorTokens.

]]>

DHS network intrusion was twice ruled a false positive before breach confirmed

David DiMolfetta — Mon, 13 Jul 2026 11:24:00 -0400

Department of Homeland Security personnel twice dismissed signs of cyber intruders inside the agency’s Homeland Security Information Network as harmless activity, allowing hackers to remain undetected inside for weeks and eventually steal credential files, according to an internal incident readout viewed by Nextgov/FCW.

HSIN was breached about two months ago, Nextgov/FCW first reported in late June. The network houses sensitive, unclassified data that’s shared between federal, state, local, industry and overseas partner organizations.

Department investigators have still not determined the affiliation of the hackers, according to two people with knowledge of an ongoing probe into the incident. DHS may send staff to brief Congress on the hack in a classified setting in the coming weeks, added the people, who spoke on the condition of anonymity to communicate the department’s thinking.

Between May 15 and May 24, the infiltration was detected by analysts inside FEMA, where they observed the hackers had altered files on testing and live servers, used a legitimate web-server program to run malicious code and deleted activity logs that could have exposed their movements, according to the readout. The activity was ruled a false positive.

Between May 25 and June 3, the hackers used similar methods aiming to leave scant trace of their activity, setting off more alerts that were again dismissed as benign. On June 4, they installed hidden backdoors and stole credential data — typically employed to verify users’ identities and grant access to accounts or systems — where personnel then declared a breach was active.

It’s not clear why the intrusion was deemed benign two times over such a wide timeframe, but the incident highlights how a mistaken assessment can give hackers significantly more time to deepen their access into a target’s environment. The hack involved techniques meant to mask activity as normal, which, generally speaking, can make it very difficult for analysts to determine what is legitimate or not, one of the people said.

It’s also unclear what materials, if any, were copied from HSIN systems, though the fact that hackers targeted credential files indicates they sought out access to accounts or systems beyond what they could initially reach.

"The Department of Homeland Security is aware of a recent cyber incident involving a specific, unclassified legacy information sharing environment," a DHS spokesperson wrote in the same statement it provided earlier this month that confirmed the hack. "We immediately took action to isolate the affected systems, mitigate the vulnerability, and launch a comprehensive forensic investigation. There is no indication that classified networks were impacted, and the system remains operational for our partners. As this is an ongoing investigation, we cannot provide further operational details at this time."

Approved users lean on the network to securely access data, exchange requests with partner agencies, coordinate safety and security for planned events, respond to incidents and share information needed to protect their communities, per its website.

HSIN has been used to support ongoing World Cup games and recent America250 events, Senate Intelligence Committee Vice Chairman Mark Warner, D-Va., said in a statement after the breach was reported.

“The information in HSIN, while not classified, is highly sensitive, and its exposure risks national security,” he said at the time.

As the United States hosts World Cup matches nationwide, the hack could raise questions about whether the intruders gained access to security plans, interagency communications or emergency response plans for one of the world’s most visible sporting events. It’s also possible that World Cup data was not a target.

Nation-state and criminal hackers routinely target U.S. systems to gather intelligence, steal sensitive information and maintain access to government networks. In February, a suspected China-linked breach of an FBI surveillance system likely exposed the phone numbers of people the bureau was monitoring. Last fall, a widespread breach at FEMA let hackers make off with employee data from both the disaster management office and U.S. Customs and Border Protection.

Editor's note: This article has been updated to include a statement from DHS.

]]>

Pentagon opens applications for cyber apprenticeship program

Edward Graham — Wed, 08 Jul 2026 17:36:00 -0400

The Department of Defense announced this week that it officially opened the application window for its Cyber Registered Apprenticeship Program, a new initiative to onboard more skilled cybersecurity professionals into its workforce.

DOD’s Office of the Chief Information Officer, which is directing the program, said on Monday that the job posting is now open through July 17 on the government’s USAJobs hiring site. The annual salary for the apprenticeship is listed as $22,584.

Cyber RAP, as the pilot is being called, was first announced in late April by the Pentagon. The 12-month apprenticeship is designed, in large part, to prioritize skills-based hiring over academic experience — part of a broader Trump administration push to place greater emphasis on experience over educational requirements in the federal hiring process.

“This program bypasses traditional academic gatekeeping to value what truly matters: raw aptitude, patriotic drive, and hands-on capability over traditional academic credentials,” DOD Chief Information Officer Kirsten Davies said in a statement. “By unlocking this untapped potential, we are actively forging America's elite cyber workforce of the future from the ground up."

In a recent interview with Nextgov/FCW, Davies said President Donald Trump and Defense Secretary Pete Hegseth “have given us a mandate to really get after skills-based training,” and added that she has also worked to eliminate degree requirements “because if threat actors can be script kiddies and teenagers, then we need to be employing great skills where the skills are and figuring out how to incorporate them.”

The Cyber RAP posting only requires that candidates be over 18 years of age, are U.S. citizens and have the ability to obtain and maintain a government security clearance. The pilot trains apprentices for entry-level DOD positions, including as cyber defense analysts, cyber defense infrastructure support specialists and cyber defense incident responders.

The program includes two developmental tracks with different academic requirements, which the department said are designed “to accommodate different agency missions and standards.”

DOD says “the core Technical Specialist Pathway focuses on rapid, hands-on technical skill acquisition for general [Pentagon] civilian cyber roles and explicitly does not require a college degree,” while “the Defense Manpower Data Center (DMDC) Agency Pathway is tailored for specialized placements within the DMDC and requires candidates to hold an accredited degree to meet that specific agency's qualification standards.”

Speaking at the SAP NOW summit in Washington, D.C., last month, Davies said that the apprenticeship had “already generated more than 70,000 inquiries,” even though it had not yet been officially launched.

]]>

House Homeland committee seeks briefing on DHS network hack

David DiMolfetta — Tue, 07 Jul 2026 17:53:00 -0400

House Homeland Security Committee staff are requesting a briefing from the Department of Homeland Security on the breach of the agency’s Homeland Security Information Network, according to a committee aide with knowledge of the matter.

Staffers are hoping to be briefed on the intrusion — first reported by Nextgov/FCW last week — by Friday, said the aide, who spoke on the condition of anonymity because the matter is sensitive.

Hackers are believed to have penetrated HSIN sometime between late May and early June, though their affiliation and whether any contents were pilfered from the platform is unclear, a person familiar with the matter previously said.

Approved users lean on the network to securely access data, exchange requests with partner agencies, manage operations, coordinate safety and security for planned events, respond to incidents and share mission-critical information needed to protect their communities, according to its website. HSIN carries unclassified but sensitive information shared among federal, state, local, territorial, tribal, international and private-sector partners.

The intrusion comes as the U.S. oversees security for World Cup games across the country, placing added scrutiny on the systems federal, state and local officials use to coordinate major events. A breach of the platform may raise concerns about whether hackers gained insight into security planning, interagency coordination or response procedures surrounding one of the most visible international events hosted predominately in the United States.

Senate Intelligence Committee Vice Chairman Mark Warner, D-Va., said last week that the network is being used to support the World Cup and America250 events. He added that it played a key role for emergency responders during last year’s mid-air collision between an American Airlines flight and an Army Black Hawk helicopter outside Washington, D.C.

“The information in HSIN, while not classified, is highly sensitive, and its exposure risks national security,” Warner said. “DHS and DOJ must thoroughly investigate who breached HSIN, what the attackers accessed, and ensure all DHS partners are provided with timely information and the tools necessary to mitigate any associated risks from the breach.”

When asked by Nextgov/FCW about the committee briefing request, a department spokesperson sent the same statement it provided last week that confirmed the hack.

The statement said staff “immediately took action to isolate the affected systems, mitigate the vulnerability, and launch a comprehensive forensic investigation,” and added that an investigation is ongoing and more details can’t be provided.

]]>

CISA expects to finalize key cyber reporting rule by September

David DiMolfetta — Mon, 06 Jul 2026 17:13:00 -0400

The Cybersecurity and Infrastructure Security Agency expects to finalize a bedrock cybersecurity incident reporting rule in September, requiring critical infrastructure providers to report major hacks directly to the cyberdefense agency, according to a regulation document published last week.

The Cyber Incident Reporting for Critical Infrastructure Act requires critical infrastructure entities to report substantial incidents to CISA within 72 hours and ransomware payments within 24 hours.

CIRCIA’s underlying measure in Congress first passed in 2022, though the final rule has been delayed for some time. CISA published the first procedural notice for the rule in April 2024 and missed the statutory October 2025 final-rule deadline. Last month, the agency held additional stakeholder town halls to further discuss the directive after a now-resolved shutdown of the Department of Homeland Security in the spring delayed scheduling of those meetings.

CIRCIA is significant because CISA has historically relied on voluntary cooperation from critical infrastructure operators, and the law would move a major piece of that relationship into a mandatory reporting regime.

The directive grew out of post-SolarWinds and Colonial Pipeline concerns that voluntary reporting left the government blind to major cyber incidents. Russia’s invasion of Ukraine added urgency by raising fears that geopolitical conflict could spill into attacks on U.S. critical infrastructure.

]]>

Hackers breached DHS information-sharing network, people familiar say

David DiMolfetta — Tue, 30 Jun 2026 11:11:00 -0400

A key Department of Homeland Security information-sharing database was accessed by an unknown threat actor in recent weeks, potentially exposing sensitive data exchanged between federal, state, local and industry partners, according to two people familiar with the matter.

DHS investigators are probing the intrusion of the Homeland Security Information Network, said both people, who spoke on the condition of anonymity because the incident is sensitive. The hackers’ affiliation and whether any documentation was pilfered from the system are both unclear.

The department’s Office of Intelligence and Analysis has conducted a damage assessment of the intrusion, which is believed to have occurred sometime between late May and early June, said one of the people. The hackers targeted HSIN servers and a SharePoint system used for collaboration efforts, the person added.

The intrusion comes as the U.S. is overseeing security for World Cup games across the country, placing added scrutiny on the systems federal, state and local officials use to coordinate major events. A breach of the platform could raise concerns about whether hackers gained insight into security planning, interagency coordination or response procedures surrounding one of the most visible international events hosted predominately in the United States.

The platform supports real-time communication, document sharing, alerts, web conferencing and incident management. It’s also used to exchange information about persons of interest and potential threats to help agencies maintain situational awareness during emergencies and events.

“The Department of Homeland Security is aware of a recent cyber incident involving a specific, unclassified legacy information sharing environment. We immediately took action to isolate the affected systems, mitigate the vulnerability, and launch a comprehensive forensic investigation,” a department spokesperson said after this story published. “There is no indication that classified networks were impacted, and the system remains operational for our partners. As this is an ongoing investigation, we cannot provide further operational details at this time."

The development would not be the first time HSIN has faced security problems. In 2023, an access misconfiguration linked to a contractor’s coding error caused restricted HSIN data to be exposed to unapproved users inside the platform, according to a memo obtained by Nextgov/FCW.

The error let information intended for a limited set of authorized users be made available more broadly across HSIN, including sensitive U.S. person data and other personally identifying information. The full consequences of that misconfiguration are still unclear, according to a third person. Wired previously reported that incident.

Nation-state groups and criminal hackers routinely target U.S. systems to collect intelligence, steal sensitive information, disrupt operations or gain footholds inside government networks. In February, a suspected China-linked breach of an FBI surveillance system likely revealed phone numbers of targets being monitored by the bureau, Nextgov/FCW previously reported.

Editor's note: This article has been updated to include comment from DHS.

]]>

Secret Service phone security lapses put US officials at risk, watchdog says

David DiMolfetta — Fri, 26 Jun 2026 12:13:00 -0400

The Secret Service failed to effectively secure and manage mobile devices used for official business, including during protective operations, creating risks that adversaries could intercept sensitive communications and use them to target U.S. leaders and other protectees, according to a watchdog report issued Thursday.

The Department of Homeland Security’s inspector general determined Secret Service employees routinely relied on personal phones for official work, including during domestic and overseas protective assignments, because government-issued devices lacked key tools needed to communicate with law enforcement, foreign partners and other officials.

Those personal devices were not managed or secured by the government, creating vulnerabilities that could expose operational details, employee information, contacts, location data, photos and other sensitive material, the report said.

Adversaries “could have intercepted and exploited Secret Service information, placing at risk our Nation’s leaders, other protectees, and employees — especially when unsecured devices were used overseas,” the inspector general wrote.

The audit grew out of broader reviews of the Secret Service following the July 13, 2024 attempted assassination of then-former President Donald Trump at a campaign rally in Butler, Pennsylvania. During those reviews, the watchdog said it learned that Secret Service personnel frequently used personal cellphones for official business, raising security and federal records concerns.

One episode described in the report connects the issue directly to the Butler security breakdown. Shortly before the attempted assassination, a Secret Service employee used a personal device to receive a picture message from local law enforcement of the would-be assassin because of reliability concerns with the employee’s government-issued phone. The employee told investigators that prior issues had prevented them from sending text messages with images using government equipment.

The watchdog also found that, after the attack, another employee had to take extra steps to email a photo of the would-be assassin to colleagues because a known issue prevented them from simply forwarding the image by text on a government-issued device.

The report points much of the blame at the Secret Service’s Office of the Chief Information Officer, which is responsible for setting mobile device security standards, managing government-issued devices and ensuring compliance with agency policies.

Secret Service employees told investigators that government-issued devices often lacked commercial messaging apps commonly used by foreign police, military officials, embassy drivers, State Department personnel and other partners overseas. Some also said they needed personal devices to access websites blocked on government phones, including sites used to research restaurants where a protectee was scheduled to dine.

Employees also cited reliability problems. According to the report, government-issued devices frequently disconnected from the Secret Service virtual private network, and about 12% of wireless help desk tickets involving mobile devices were related to VPN issues.

The watchdog found that the use of personal devices had become routine and expected during foreign assignments. Of 24 employees and supervisors interviewed about international travel reimbursement records, 23 said they relied on personal devices, with most saying they needed them during nearly every foreign assignment.

The inspector general also reviewed call and text records and found more than 15,000 instances in which employees sent or received calls from colleagues’ personal phones while working protective events. It found about 24,000 text messages between personal devices and government-issued phones, though its analysis did not include communications made solely between personal devices or through messaging apps.

The report also found that Secret Service mobile devices used overseas lacked required mobile threat defense software designed to provide real-time protection from malware, cyberattacks and other threats. The Secret Service did not begin installing that software on any government-issued mobile devices until August 2025, despite DHS policy requiring it for devices used outside the United States.

The watchdog also found that the Secret Service did not consistently wipe data from government phones after employees returned from international missions, even though agency policy required employees to wipe devices within 24 hours of returning to the United States. One employee told investigators their phone had never been wiped over the course of eight years and 20 international trips, including travel to high-risk countries. Another employee reported 15 trips over eight years and estimated their phone had been wiped only four times.

The Secret Service concurred with all five watchdog recommendations, including recommendations to improve its process for identifying mobile device needs, strengthen cybersecurity training, communicate that personal devices are not allowed for official business and update app vulnerability testing policies.

]]>

The hidden market turning home internet connections into cover for hackers

David DiMolfetta — Thu, 25 Jun 2026 06:00:00 -0400

Swaths of consumer streaming devices and passive-income services are quietly turning Americans’ home internet connections into cover for cybercrime, fraud and foreign-linked hackers, according to a new investigation that found suspicious behavior from devices and apps sold through major online marketplaces.

The report from the Digital Citizens Alliance and cyber compliance firm risk3sixty focuses on residential proxy networks, which let users route their web traffic through real household internet connections.

That disguise is what makes the market valuable for cyberspies: Many threat detection tools treat home internet connections as more trustworthy than traffic from known malicious networks. When cybercriminals or state-backed hackers piggyback on those home platforms, they gain a powerful way to hide their activity, and the digital breadcrumbs trace back to an unsuspecting household.

In a hypothetical attack on a federal agency, a hacker could route their activity through ordinary home internet connections instead of foreign servers. That could make suspicious login attempts or other traffic appear to come from real U.S. homes, causing investigators to initially trace them back to unsuspecting users whose connections were used as cover.

That arrangement poses unsuspecting risks for ordinary people, DCA Executive Director Tom Galvin told Nextgov/FCW. “Because someone has gained access to your IP connection … if you’re a criminal engaging in financial fraud or distribution of [child sexual abuse material] over a residential IP connection, and you get caught, law enforcement isn’t going to the criminal, they’re going to the home.”

“You basically run the risk of having everything in your house turn into a potential exit node, and … in addition to the privacy or the IP reputation concerns, there are potential legal repercussions,” Steven Guris, risk3sixty’s threat intelligence lead, said in the same interview.

In one case, the report cited a VSeeBox V5 Pro — a TV streaming product — purchased through Walmart that connected to a server based in China when powered on. It sent detailed device information and received commands that included the ability to install or uninstall apps, reboot the device and perform a factory reset. Walmart told the researchers that the product was no longer available on its site and that the company removes listings when violations are detected.

In another, the investigators signed up for Honeygain, a service marketed to students and other users as a way to earn extra money from unused bandwidth, and monitored how the connection was used. They observed traffic involving entities in China and Russia, including traffic tied to a U.S. Treasury Department-sanctioned bank, though the researchers said they found no indication that Honeygain knew how those connections were being used. Honeygain did not provide a statement for the report.

Residential proxies are sold through websites that openly advertise proxy access, by companies that bundle home internet connections from apps or devices and resell them and, in some cases, on dark web markets with guides for using them in fraud.

The findings call the illicit use of home internet connections the “blood diamonds” of the digital age, arguing that the market lets companies profit from connections that may have been gathered deceptively.

“By the time a blood diamond reaches a jewelry store it is several layers from the forced labor that mined the gem and funded civil wars. The jewelers that sold blood diamonds could perhaps claim ignorance, but major players had knowledge,” the report says. “The same is true for residential proxies. The retailers who ultimately sell IP connections to businesses, state actors and cybercriminals may not have sourced the connections, but they are part of an ecosystem built on deception and crimes.”

The FBI has previously warned that residential proxies can be cobbled together through free virtual private networks, compromised internet-connected devices, malware and passive-income apps that route other people’s traffic through users’ home connections. The bureau has taken steps to disrupt hackers that rely on proxy networks to hide their pursuits and plans to conduct more related takedowns.

But the report suggests the problem extends far beyond individual law enforcement activity. It estimates more than 20 million U.S. IP connections are collected each year for residential proxy services. Researchers also tracked roughly 26 million unique residential IP addresses over 30 days and found that nearly half appeared across multiple proxy providers, suggesting that once a home connection enters the market, it can be resold or reused across several platforms.

The DCA is launching a public awareness campaign around the issue, Galvin said. The alliance has also been engaging with U.S. officials to discuss the matter, though he declined to name specific agencies and individuals involved.

The campaign will include public service announcements and social media videos warning about risks from free apps, unauthorized streaming devices and aging home routers, along with guidance on filing complaints with the FBI’s Internet Crime Complaint Center. The group also plans to develop a free app that would let consumers check whether their IP connection has been hijacked, he said.

“We’re not moralists, but it is our job, we think, to tell people what are the risks, so they can make intelligent decisions,” Galvin said. “We just want them to know what they’re doing and when they’re doing it.”

]]>

Planned NDAA amendment would codify CISA’s role in cyber vulnerability program

David DiMolfetta — Thu, 18 Jun 2026 15:52:00 -0400

A contracting scare that briefly cast uncertainty over a key cyber vulnerability-tracking program is prompting lawmakers to add a measure to the annual defense authorization bill that would establish the program within the Cybersecurity and Infrastructure Security Agency.

The proposal would formally house the Common Vulnerabilities and Exposures program under CISA, require a joint modernization plan with the National Institute of Standards and Technology and push officials to improve the public vulnerability data used by agencies, companies and security researchers to assess cyber risk, according to the text of the planned amendment viewed by Nextgov/FCW.

CVE provides a standardized methodology for logging publicly known security vulnerabilities. Each flaw is assigned a unique identifier, designed to help researchers, vendors and officials more effectively communicate about the same issue. It first launched in 1999, and is used today by organizations across the private sector and the national intelligence enterprise.

The program faced a contracting debacle last spring when MITRE, the non-profit research giant that funds much of CVE’s functions, warned of an imminent end to federal backing for the project during an efficiency-driven purge of several contracts at CISA.

The matter was addressed within hours amid outcry from the cybersecurity community, but it ignited discussions over the long-term stability of a system that much of the cybersecurity community deems critical for day-to-day work.

The proposed NDAA measure is significant because, if passed, it would give CISA a formal, legal role in managing the premier global catalog used across the cybersecurity world to identify, track and prioritize software flaws.

The amendment text reviewed by Nextgov/FCW does not name a sponsoring lawmaker. CISA declined to comment on the proposed measure.

The proposal would also create a 15-member CVE Board to set the program’s policies and priorities, with permanent seats for CISA, NIST and top-level CVE authorities. Rotating members would come from industry, academia, the research community and foreign governments.

It would also put greater weight behind vulnerability enrichment — the process of adding context about a flaw’s severity and how hackers may exploit it — by making it part of CVE’s formal mission and directing the program’s board to set policies for what information CVE records should include.

Earlier this year, EU cybersecurity chief Hans de Vries told an audience at the RSAC Conference in San Francisco that Europe wants to assist with and help modernize the program.

In the same discussion, a top House Homeland Security Committee staffer previewed the measure.

“While CISA is certainly authorized to execute this program, it’s not specifically tasked with doing it, which, as an oversight committee, makes it harder for us to hold an agency accountable for executing a task,” said Moira Bergen, who leads cyber policy work for the Democratic side of the panel.

The House Armed Services Committee approved its version of the fiscal 2027 defense bill earlier this month, sending it to the Rules Committee ahead of expected floor consideration. The Rules panel has told members to submit proposed amendments by 5 p.m. Thursday.

The Senate Armed Services Committee also advanced its own version of the bill last week. Once both chambers pass their versions, negotiators from both chambers will have to reconcile differences between the two before a final defense policy package can reach the president.

Editor's note: This article has been updated to note that CISA declined comment.

]]>

CISA now has full Mythos Preview access, people familiar say

David DiMolfetta — Wed, 17 Jun 2026 17:21:00 -0400

The Cybersecurity and Infrastructure Security Agency now has full access to Anthropic’s flagship Mythos Preview model, according to a U.S. official and a second person familiar with the matter.

The cyberdefense agency received access around a week ago, the official said. Both sources spoke on the condition of anonymity to discuss internal deliberations.

The White House Office of the National Cyber Director has not yet set clear parameters for how the agency should use the model, the official added.

The lack of parameters echoes earlier Nextgov/FCW reporting showing federal tech leaders have privately complained that ONCD has not adequately briefed them on implementing or using the model for vulnerability scanning.

CISA did not respond to a request for comment.

Over the last few months, Anthropic surgically rolled out Mythos Preview to select organizations and recently expanded this effort — dubbed Project Glasswing — to partners in industry and other nations. The model has been distributed through a non-public process on grounds that, in the wrong hands, it can significantly boost adversaries’ hacking capabilities.

CISA was not included in an initial Mythos rollout, Axios reported in April. Last week, Nextgov/FCW reported that agency access to the model was imminent.

Mythos Preview is different from Anthropic’s similar-sounding Mythos 5 successor model, which the U.S. effectively banned over the weekend via an export control mechanism alongside the AI company’s Fable 5 model. The move has caused uproar across the cyber and AI community.

Both Mythos 5 and Mythos Preview have only been made available to vetted providers via Project Glasswing.

The Trump administration’s approach to AI has shifted in recent months as officials confront an emerging class of models that can rapidly identify vulnerabilities across computer networks, becoming a major driver of discussions over how AI systems could reshape the future of cybersecurity.

Models like Mythos can help federal agencies identify vulnerabilities faster by analyzing large amounts of software and system data, then surfacing weaknesses and possible attack paths for human defenders to review. Conversely, cyber operators in the intelligence community and Defense Department can also use such models to accelerate their offensive hacking operations.

]]>

US officials see Iran cyber threat persisting despite preliminary deal

David DiMolfetta — Wed, 17 Jun 2026 10:44:00 -0400

The preliminary U.S.-Iran agreement reached over the weekend likely won’t stop cyber operations launched by Tehran and Iran-aligned hacking groups at American systems, five current and two former U.S. officials told Nextgov/FCW.

Most of them were granted anonymity because they were not authorized to publicly discuss forward-looking perspectives of Iranian cyber activity after the agreement.

Cyber conflict is “definitely part of warfare that keeps going” and is pretty “accepted” as an “ongoing normal course of business,” one of the officials said, adding that cyber activity may decelerate, but that it “definitely won’t stop.”

There is “no chance” Iran and any affiliated parties would cease or slow down in cyberspace, a second official opined.

Hacking activity could decrease temporarily, said one of the former officials, but if pro-Iran hacking collectives don’t like any finalized resolution, they may conduct cyberattacks to express their issues, as Iran’s central government doesn’t always have the best control of these groups.

“There has always been anti-U.S. activity” from such “hacktivist” groups that align with Iran but aren’t backed by the regime directly, this former official added.

Their outlook aligns with past conclusions that cyber operations continue regardless of the status of a given conflict and that U.S. cyber teams have remained on alert for Iranian-linked activity against American networks as Washington pursues a diplomatic solution with Tehran.

Since the war broke out Feb. 28, experts expected the conflict would greatly test U.S. cyber defenses. What followed was a series of apparent Iran-linked cyber incidents, including an attack on medical technology giant Stryker, the targeting of FBI Director Kash Patel’s personal email account and various warnings from federal agencies about cyber intrusions on U.S. critical infrastructure.

On June 11, the California Water Service said it was investigating claims that Iranian hackers breached its systems. An assessment from Dataminr concluded that the group may have reached a customer billing database belonging to the utility. Nextgov/FCW also obtained a screenshot that appeared to show a customer billing account receipt accessed by the hackers.

A spokesperson said Tuesday that there are “no known operational disruptions” to water, wastewater and billing systems, and that it was working with state and federal government officials in its investigation.

The preliminary U.S.-Iran memorandum reached Sunday aims to halt nearly four months of fighting and set up a formal signing in Geneva later this week. But the agreement leaves major disputes unresolved, including regional flashpoints involving Israel and Hezbollah. It also appears to leave out mentions of cyber.

“The Iranians have targeted U.S. assets with malicious cyber activity for the last 15 years with espionage and some prepositioning for disruptive attacks,” said Meredith Burkart, the FBI’s former chief of cyber policy. “Unless there has been a material change in their cyber workforce, or a cyber specific component of the deal was reached, I would expect such targeting to continue.”

“I don’t know if these deals really ever include minimizing cyber activity,” another one of the current officials told Nextgov/FCW. Certain targets may be deemed off limits, “but we’ve always seen activity” continue in the digital space, added the official.

The deal also remains fragile, even on its central nuclear terms. CIA Director John Ratcliffe and others raised concerns about Iran’s willingness to make the nuclear concessions Washington wants in a final agreement, Axios reported Tuesday.

Tehran’s hackers have grown more organized, more coordinated and more willing to use artificial intelligence for influence operations in recent months — and have demonstrated many of those capabilities since the war with Iran began, Israel’s top cyberdefense official told Nextgov/FCW last month.

The U.S. intelligence community assessed this year that Iran and affiliated proxy groups remain a persistent cyber threat to American networks and critical infrastructure, and they intend to target the U.S. and its allies.

]]>

Warner presses CISA on whether staff cuts weakened regional cyber support

David DiMolfetta — Tue, 16 Jun 2026 09:00:00 -0400

Sen. Mark Warner, D-Va., is pressing the Cybersecurity and Infrastructure Security Agency for records on staffing levels and vacancies across its regional offices, warning that workforce cuts over the last year may have weakened the agency’s ability to support state and local governments facing cyber threats.

In a Tuesday letter to acting CISA Director Nick Andersen that was first shared with Nextgov/FCW, the vice chairman of the Senate Intelligence Committee asked the agency to provide both headquarters and regional organizational charts from January 2025, October 2025 and the present day, along with details on vacancies and explanations as to why employees left their posts.

The letter also asks CISA for data going back to January 2023 on services provided to state and local governments, including how many requests the agency received and fulfilled, as well as how quickly it responded.

The request comes after Warner introduced the Guaranteeing Universal Access to Cybersecurity Act — legislation first reported by Nextgov/FCW — that would restore funding for the Multi-State Information Sharing and Analysis Center, or MS-ISAC, a key cyber intelligence-sharing hub used by many state and local governments.

“The Trump administration’s dramatic reduction of Cybersecurity & Infrastructure Security Agency (CISA) staff, defunding of the MS-ISAC, and cutting over $700 million in CISA’s proposed fiscal year 2027 budget demonstrates a dangerous underestimation of the threats facing our nation from adversaries and criminals who seek to destabilize our national security, economy, public health, and safety,” the senator wrote.

CISA is working to hire around 330 employees in the coming months, Andersen said last week. The agency has lost a significant share of its workforce over the past year after the Trump administration moved to reduce and restructure the cyber shop through a mix of layoffs, early retirement offers, transfers and program cuts. Some 180 job offers are expected by the end of June.

Warner said efforts to boost staffing are “welcome” but “they appear insufficient given the scale of threats facing our nation’s cybersecurity and critical infrastructure, particularly at the state level.”

His letter asks CISA to respond by June 26.

“CISA does not reply to congressional correspondence in the press and works directly with Congress to address their questions,” an agency spokesperson said.

The letter flags concerns from governors, mayors, state chief information officers and others about CISA’s ability to provide services. State and local officials, cybersecurity groups and former officials have repeatedly warned that reductions in federal support leave smaller governments more vulnerable to cyberattacks, especially with midterm elections coming in November.

CISA has encouraged state and local governments to seek help from its regional teams, though half of the agency’s ten regional directors are serving in an acting capacity, the letter adds. One CISA regional website also appears to misspell the name of its acting director, Warner wrote, referring to the spelling of Region 2 Director Mohamed Telab, whose first name is written as “Mohammed.”

Cybersecurity has long drawn bipartisan support in Washington, but CISA has become a recurring target of GOP scrutiny over its past work countering election-related disinformation. Since last year, Trump administration officials have sought to “refocus” the agency’s mission, arguing that CISA had strayed too far from its core tasks.

Last week, the House Appropriations Committee approved some $2.35 billion for CISA in the coming 2027 fiscal year — around $253 million below its fiscal 2026 level and about $135 million below the Trump administration’s initial FY27 budget request.

Editor’s note: This story was updated to include a comment from CISA.

]]>

US seizes alleged China-linked sites targeting security clearance holders

David DiMolfetta — Wed, 10 Jun 2026 15:15:00 -0400

The FBI and Justice Department seized 13 websites allegedly used by Chinese intelligence operatives to target current and former U.S. officials and military personnel with access to classified government information.

In a press release, the DOJ said the domains were designed to look like legitimate consulting firms and were used to advertise vague, well-paid consulting roles aimed at security clearance holders. The campaign, which allegedly began in November 2023, sought to entice Americans into producing research reports or sharing insider information on topics of interest to the Chinese government, according to court documents.

The seized domains included sites associated with firm names like Centrik Global Consulting, Rightinfo Consulting, Finnacle-Vesper Consulting, CYDF Consulting, Pulse Wave Global, Catalyst Global Solutions, Horizzen, GeoIndopacific, SafeSec Group and others.

The campaign relied on familiar job-market platforms and freelance sites to advertise positions such as “Senior Analyst” and “International Affairs Consultant.”

The Justice Department said the operators used aliases, fake personas, stolen identities and artificial intelligence-generated photographs to make the companies appear credible. The alleged scheme also involved encrypted messaging apps, including Telegram, overseas payments, cryptocurrency and online payment accounts registered under false names, according to an affidavit filed in support of the seizure warrants.

The takedowns mark the latest U.S. government effort to disrupt foreign intelligence schemes that blend online recruiting and financial incentives to reach Americans with access to sensitive national security information.

Waves of federal layoffs over the past year have pushed thousands of government employees and contractors into an uncertain job market. That disruption has created renewed collection opportunities for foreign intelligence services.

Nextgov/FCW reported in January that a suspected Chinese intelligence outfit contacted a former senior State Department official late last year and offered payment for an assessment of U.S. policy priorities in Venezuela. The person who contacted the former official claimed to be affiliated with a sham consulting firm that had previously surfaced in research first reported by Nextgov/FCW last September, that assessed the firm was part of a broader network of fake companies tied to China.

The U.S. has sought to further publicize targeting efforts. In a rare public disclosure, Army Deputy Chief of Staff for Intelligence Lt. Gen. Anthony R. Hale issued a memo in November warning that foreign adversaries are targeting soldiers, civilians and their families through fake companies and phony recruiters. The advisory was sent to more than a million personnel across the Army, and later to members of the media, marking an unusually direct acknowledgment of the threat.

]]>

CISA directive revamps how agencies prioritize vulnerable systems

David DiMolfetta — Wed, 10 Jun 2026 14:28:00 -0400

The Cybersecurity and Infrastructure Security Agency released a binding directive Wednesday requiring federal agencies to rethink how they prioritize vulnerability fixes across government networks.

The directive sets remediation deadlines based on several factors, including whether a flaw is publicly exposed, already known to be exploited, automatable by attackers or capable of giving hackers control of an affected system.

It establishes new timelines to patch security flaws, from three days for the highest-risk vulnerabilities to 60 days for lower-priority items. Some vulnerabilities that are not publicly exposed, not known to be exploited and not automatable by adversaries can be deferred until the affected system receives a scheduled major upgrade.

The policy marks a significant shift in federal cyber management by pushing agencies to focus remediation resources on flaws that could be the most impactful if leveraged by hackers, rather than treating all vulnerabilities as equally urgent.

The move is also part of CISA’s response “to the current threat landscape where AI software services can assist threat actors to find and exploit vulnerabilities,” the agency says.

“CISA is leading and collaborating with federal civilian agencies to stay ahead of our adversaries as tactics, technologies and vulnerabilities change,” agency acting director Nick Andersen said in a statement. “While this directive is a mandate for federal agencies, CISA strongly encourages all partners to adopt similar actions in their vulnerability management policy.”

The directive is an acknowledgment that agencies cannot protect every system equally through patch mandates and must instead focus their often limited resources on the vulnerabilities and networks whose compromise could cause the greatest damage. Federal agencies are a constant target for hackers because of the sensitive data often stored on their networks.

In an initial analysis at one large civilian agency, CISA found that “only 1% of vulnerability instances fall into the three-day category,” while more than 60% could be deferred until the next system upgrade, according to a blog post by Chris Butera, the agency’s acting executive assistant director for cybersecurity, and Jonathan Spring, a senior technical adviser.

In a call with reporters, Butera said that CISA has engaged with others in the government and that officials hope the move “will not require additional work” for agencies but help them better prioritize patching.

“We do believe the agencies should be able to meet the three-day deadline,” he said when asked whether the directive’s patching mandates are realistic. “Why we didn’t choose, for example, a 24-hour deadline, is because we think three days is a deadline that is both fast and agencies will be able to meet it.”

The administration’s AI posture has evolved in recent months as officials grapple with cyber-focused models that can quickly surface weaknesses across computer networks.

President Donald Trump recently signed an AI security executive order encouraging developers to submit powerful new models for a 30-day government review before public release. He also signed a separate memorandum aimed at accelerating the government’s use of advanced AI across the military and intelligence community.

On Wednesday, Senate Intelligence Committee Vice Chairman Mark Warner, D-Va., introduced legislation requiring the CISA to update cybersecurity plans for each of the nation’s 16 critical infrastructure sectors, citing concerns that fast-evolving AI tools will accelerate threats to essential services, Nextgov/FCW first reported.

]]>

Warner proposes overhaul of critical infrastructure cyber plans as AI threats rise

David DiMolfetta — Wed, 10 Jun 2026 09:00:00 -0400

Senate Intelligence Committee Vice Chairman Mark Warner, D-Va., is introducing legislation Wednesday requiring the Cybersecurity and Infrastructure Security Agency to update cybersecurity plans for each of the nation’s 16 critical infrastructure sectors, citing concerns that fast-evolving artificial intelligence tools will accelerate threats to essential services.

The Combat Emerging Threats to Critical Infrastructure Act, first shared with Nextgov/FCW, would direct CISA to work with federal sector risk management agencies to update sector-specific plans within one year of enactment. It would also require CISA to reassess those plans every two years, issue revised versions and send copies to Congress after completion.

“As AI continues to rapidly evolve, we must ensure our cybersecurity defenses keep up with the threats of the moment,” Warner said in a prepared statement. “It’s critical that government works closely with industry, regulators and cybersecurity experts to develop and regularly update the plans we need to protect our critical infrastructure from increasingly sophisticated malicious actors, including those enabled by AI.”

The sector plans serve as the government’s basic playbook for managing cyber and physical risks across major parts of the economy.

In 2024, National Security Memorandum 22 reaffirmed CISA’s role as the national coordinator for critical infrastructure security and resilience, and it called for sector-specific plans to be updated on a biennial basis. But that cadence hasn’t been consistently maintained, and some sector cybersecurity plans have not been updated in more than a decade, Warner’s office said.

CISA did not immediately respond to a request for comment about the legislation.

The measure comes as officials grapple with how advanced AI systems could reshape cyber defense and offense. Anthropic’s Claude Mythos, a powerful cybersecurity-focused AI model, has become a leading example in Washington of how such tools could change the threat landscape.

The bill would also require the updated plans to account for threats like AI-enabled hacking and deepfakes. Another provision focused on financial services would require CISA to work with the Treasury Department on a process for assessing whether future quantum computers could undermine encryption used to protect digital assets.

The legislation covers key sectors like energy, communications, transportation and the defense industrial base. CISA would have to send the updated plans to relevant congressional committees within 30 days of completing them.

The measure is backed by the National Electrical Manufacturers Association.

“Manufacturing is a critical pillar of America’s economy, and the electroindustry provides the essential technologies that every other critical infrastructure sector is built upon,” said Brian Papp, managing director of government relations at NEMA. “As cyber and supply chain threats continue to evolve, the Combat Emerging Threats to Critical Infrastructure Act will help ensure security plans remain current, strengthen operational resilience, and equip manufacturers to address emerging risks, protect critical operations, and bolster American competitiveness.”

CISA is expected to release a binding operational directive Wednesday that would task agencies with rethinking how they manage risks to federal networks by prioritizing vulnerabilities that demand the most urgent attention, a shift informed in part by AI-enabled cyber threats.

]]>

New CISA directive would reshape how agencies prioritize cyber risk, official says

David DiMolfetta — Tue, 09 Jun 2026 12:51:00 -0400

The Cybersecurity and Infrastructure Security Agency plans to release a binding directive on Wednesday that tasks the federal government with rethinking how it manages risks to its networks and prioritizing cyber vulnerabilities that demand the most urgency, agency acting director Nick Andersen said.

The goal is to push agencies to focus less on the sheer number of known cyber vulnerabilities and more on the risks those flaws pose if they’re exploited by hackers, said Andersen, who added that the cyber community needs to “be okay with saying there are some systems that are less important than others.”

“If we try to say that everything is equally as important, then absolutely nothing’s going to be important,” he told an audience of industry professionals at a Tuesday event held by cybersecurity firm Axonius.

“It’s going to be really hard for us, if one day we have to have those hard conversations with people about how we knew better and how we didn’t prioritize risk appropriately, how we didn’t make the hard choices,” he added.

The remarks are an acknowledgment that agencies cannot protect every system equally through patch mandates, and must instead focus their often limited resources on the vulnerabilities and networks whose compromise could cause the greatest damage.

Federal agencies are a constant target for hackers. For years, adversaries have compromised government systems for access to emails, employee records and other sensitive data.

Government agencies also oversee industry sectors such as energy, healthcare, telecommunications and water, meaning their cyber staff must also weigh how disruptions could ripple across critical services.

On the sidelines of the event, Andersen told reporters that artificial intelligence-backed cyber threats are one factor informing discussions around the directive, but he said CISA’s work on the AI ecosystem still predates the release of powerful systems such as Anthropic’s Mythos.

The administration’s approach to AI has shifted in recent months as officials confront a new class of cyber-focused models that can rapidly identify vulnerabilities across computer networks, becoming a major driver of discussions over how advanced AI systems could reshape both defensive and offensive cyber operations.

President Donald Trump recently signed an AI security executive order that encourages developers to submit powerful new models to a 30-day government review before public release. On Friday, he signed a memorandum aimed at speeding up government use of advanced AI across the military and intelligence community.

“Is the [directive] a recognition that we’re in a different dynamic environment with a shorter timeline to weaponization and exploitation? Yeah, that’s certainly a part of it,” Andersen said. “But well before these last couple of months, this is a conversation that we were having about this ever-shrinking window we have for addressing vulnerabilities today.”

“It’s too exceedingly easy for malicious cyber actors to be able to exploit [vulnerabilities] as soon as they’re published and be able to take advantage of the fact that a lot of people are just not as well-resourced as we would like, and they’re not as able to quickly have a continuous patch cycle to be able to address some of these devices,” he added.

]]>

CISA unveils President’s Cup Cybersecurity Competition winners

Alexandra Kelley — Tue, 09 Jun 2026 12:03:00 -0400

The Cybersecurity and Infrastructure Security Agency on Tuesday announced the winners of its 7th annual cybersecurity contest that brings federal employees together to test digital security strategies and responses.

The winners of the President’s Cup Cybersecurity Competition competed across three categories. For the Defense Track Champion, the “sheriffsparks” team from the U.S. Navy won, and the Offensive Track Champion winner was team “bdubya” from the U.S. Army.

The final winner of the Teams Champion category is the U.S. Army and U.S. Marine Corps’ “ENOENTHUSIASM” team.

The President’s Cup, an initiative established by President Donald Trump in an executive order during his first term in office, aims to test and harness the cybersecurity knowledge of federal workers across the government. Tasks in the challenge feature simulations of “high-stakes cyber operations requiring precision, resilience, and deep technical knowledge,” per the press release. Examples of scenarios include incident response, analyzing digital forensics, reverse engineering and threat hunting.

“The President’s Cup features the best cybersecurity talent the U.S. government has to offer,” said CISA Acting Director Nick Andersen in the press release. “These champions rose above an elite field, securing victory through sharp analysis, decisive action, and advanced cyber tradecraft. We congratulate this year’s winners and thank everyone who participated in the seventh annual President’s Cup.”

The President’s Cup began in January, with finalists competing to the end of May. CISA said that over 800 individuals and 200 teams entered to compete in the 2026 Cup.

While the competition aims to reward and highlight cybersecurity talent and promote cybersecurity education within the federal workforce, it also aims to bring levity and fun to digital defense and government work.

Michael Harpin, the cyber training branch chief at CISA, told Nextgov/FCW in 2024 that the President’s Cup isn’t meant to simply be an extension of daily work.

“We do want to have some fun with the participants and not to make it too regimented,” Harpin said. “But we do also want to focus that these are real-life skills and tasks that they would have to do within a cybersecurity workforce.”

]]>

Warner unveils bill to restore cyber information-sharing program funding

David DiMolfetta — Fri, 05 Jun 2026 16:02:00 -0400

Sen. Mark Warner, D-Va., is introducing legislation to permanently fund a cybersecurity information-sharing program used by thousands of state, local, tribal and territorial governments, after the Trump administration ended federal support for the effort last year.

The measure would require the Cybersecurity and Infrastructure Security Agency to provide funding for the Multi-State Information Sharing and Analysis Center, or MS-ISAC, a nonprofit-run program that offers services like threat intelligence and incident response assistance to roughly 19,000 government entities nationwide.

Under former Homeland Security Secretary Kristi Noem, DHS terminated CISA’s funding agreement with the Center for Internet Security, which operates MS-ISAC, and barred certain federal grant funds from being used for membership fees. Critics argued the move weakened a key mechanism for sharing cyber threat information with smaller governments that often lack dedicated cybersecurity resources.

Warner’s legislation would direct CISA to enter into a new agreement with the Center for Internet Security to provide cybersecurity services and threat intelligence at no cost to state, local, tribal and territorial entities. It would also authorize $50 million annually beginning in fiscal year 2027 and require the cyberdefense agency to report to Congress on its efforts to restore and expand participation.

In a letter sent Thursday to Homeland Security Secretary Markwayne Mullin, Warner urged the department to restore support for the program and reverse broader cuts to CISA. The senator argued that eliminating MS-ISAC funding left communities with fewer resources to detect and respond to cyber threats and more vulnerable to attacks.

“This is too important to let politics get in the way. I will stand alongside anyone committed to ensuring that when our adversaries test our critical infrastructure, it holds fast,” Warner wrote to Mullin. “I want to work with you to achieve that end and ask that you reach out to me directly to coordinate — because the question is not whether our critical infrastructure will be targeted, but whether we will be ready when it is.”

John Gilligan, president and CEO of the Center for Internet Security, did not directly address the bill but told Nextgov/FCW in a statement that MS-ISAC has supported cyber stakeholders for more than two decades and has received congressional funding for at least 20 years.

“In fiscal year 2025, the appropriated funding was $27 million,” he said.

“The Cybersecurity and Infrastructure Security Agency (CISA) communicates with our state and local partners regularly and provides them with timely threat intelligence, expertise, no-cost tools and resources these partners need to defend against risks. This includes working with the Multi-State Information Sharing and Analysis Center (MS-ISAC) to share cybersecurity information and guidance. State and local governments seeking assistance are encouraged to contact our CISA regional teams who can help assess risk, strengthen defenses, enhance resilience, and respond immediately to incidents," said CISA Chief External Affairs Officer Christine Serrano Glassner in a statement.

DHS did not immediately respond to a request for comment.

Warner also sent separate letters to governors nationwide warning that states may need to take a more active role in defending critical infrastructure as cyber threats grow and federal cybersecurity programs face continued uncertainty. He encouraged them to conduct infrastructure audits, expand participation in regional threat-sharing organizations and identify under-resourced operators that need cyber assistance.

The effort comes as some lawmakers continue to scrutinize staffing reductions, budget cuts and program eliminations at CISA. State and local officials, cybersecurity groups and former officials have repeatedly warned that reducing federal support leaves smaller governments more vulnerable to ransomware and other cyberattacks, especially with midterm elections coming in November.

MS-ISAC was established in 2003 and has long served as one of the core hubs for cyber threat information sharing between federal agencies and state and local governments. Smaller jurisdictions often lean on the center for services they can’t afford to finance on their own.

Editor's note: This article has been updated to include comment from CISA.

]]>

New coalition will enter legal debate over industry’s role in government cyber missions

David DiMolfetta — Thu, 04 Jun 2026 17:45:00 -0400

A new Washington initiative seeks to shape policy debates over how the government and private sector collaborate on cyber operations, a conversation that will inevitably raise complex questions about the legal authorities governing industry’s role, participants say.

Venable’s Center for Cybersecurity Policy and Law launched the Cyber Operations Policy Coalition this week, seeking to be a “trusted forum for collaboration among industry, government, legal experts, academia, and civil society to help develop policy frameworks for collective cyber defense,” according to its mission statement.

At a launch event Wednesday, current and former officials concurred that stakeholders will need to confront unresolved questions about legal authorities, liability and the rules of the road for companies before deeper public‑private cyber operations can truly scale.

Legal expertise will be “key to the success” of integrating industry and government more closely, Katie Sutton, assistant secretary of defense for cyber policy and the principal cyber advisor to the defense secretary, said in a discussion held at the event.

“We talk about authorities — everything is under what authorities do I have, what authorities does Cyber Command have, under what authorities is this operation happening? [There are] a lot of well-defined authorities from a government perspective. Industry actually has quite a few authorities that they can bring to bear too, because they run this domain,” Sutton added.

“We can’t be in a model … asking permission every time a certain step is going to be taken. That’s going to require a lot of the unsexy work we heard about the legal and policy foundations, the understanding of liability and everything that surrounds that,” said Tonya Ugoretz, who heads PwC’s Cyber & Risk Innovation Institute and previously served in senior roles at the FBI and the Office of the Director of National Intelligence.

Unlike traditional military domains, cyber conflict often runs through privately owned networks, forcing the government to rely on companies that may be both targets of foreign activity and essential partners in responding to it.

The U.S. has sought to integrate cyber activity into military operations, lending the debate urgency as the White House more openly discusses offensive cyber operations and as private companies are drawn deeper into the market for cyber tools. The advent of advanced cyber-focused frontier AI models has also contributed to the discussions.

As part of its emerging counter-advanced persistent threat planning with major providers, the Joint Cyber Defense Collaborative — a Cybersecurity and Infrastructure Security Agency-led body for coordinating public and private sector cyberdefense — is beginning to explicitly map out both defensive playbooks and potential offensive-leaning moves that might be on the table in a geopolitical crisis, according to Matt Springer, the JCDC deputy assistant director.

That would also raise fresh questions about legal risk and authorities for companies that own and operate infrastructure. “We have some potential cyber offensive options that could be taken theoretically by partners in those scenarios,” he said at the launch event. “This will get into some of the policy questions I know we wanted to touch on. That’s a dicey area.”

The discussions highlight how cybersecurity is becoming a more central arena for national security law, as officials and industry leaders examine whether existing legal frameworks are sufficient for operations that frequently require closer coordination between the government and private firms.

In the last year, top national officials have sought to highlight the role of cyber operations in their recent military achievements. A new cyber service branch is also being weighed in the must-pass annual defense bill.

]]>

NSA taps three officials for top cybersecurity positions

David DiMolfetta — Mon, 01 Jun 2026 18:22:00 -0400

The National Security Agency has internally named a trio of appointments focused on the spy agency’s cyber operations.

David Imbordino, who has overseen the NSA’s Cybersecurity Directorate in an acting capacity in recent months, has been tapped to lead the office permanently, according to two former senior national security officials familiar with the selections.

Holly Baroody — a senior United Kingdom-based NSA official and a former civilian lead in U.S. Cyber Command — will serve as Imbordino’s deputy, the second former official said. Imbordino and Baroody have served as acting officials in their respective roles since around January.

Created in 2019, the cyber directorate combines the agency’s intelligence-gathering and digital defense expertise to help protect U.S. government networks, military systems and contractors from hacking threats.

The second former official also said that Bruce Jones, a longtime agency leader with experience in both technical and operational roles, will head the NSA’s Cybersecurity Collaboration Center, a hub used to share cyber threat intelligence between the government and the private sector.

Both former officials requested anonymity to communicate their knowledge of the positions.

Nextgov/FCW has asked the NSA for comment. The Record first reported the selections.

For the last year, the signals intelligence and foreign eavesdropping giant has grappled with leadership vacuums and significant morale decline as the Trump administration has sought to taper its workforce.

Gen. Josh Rudd was confirmed in March to lead Cyber Command and the NSA in a dual-hatted manner, with Tim Kosiba joining the spy agency soon after to serve as its deputy director.

The NSA has sought to take a role in artificial intelligence policy developments, amid the recent emergence of advanced cyber-focused AI models that, in the wrong hands, could help foreign adversaries and criminal hackers more easily penetrate U.S. computer networks.

The New York Times reported last month that the White House approved some $9 billion for spy agencies like NSA to accelerate AI adoption, though shortages of advanced computing chips have constrained the use of state-of-the-art AI models on their classified systems.

]]>

Hackers are already laying groundwork to disrupt the 2026 midterms, research says

David DiMolfetta — Mon, 01 Jun 2026 06:00:00 -0400

Hackers are already preparing for the 2026 midterms, with a new report warning that campaigns, fundraising platforms, public websites and local governments could face a wave of phishing, credential theft, artificial intelligence-generated deception and foreign influence activity.

The findings, produced by cybersecurity firm Check Point, do not point to voting machines as the most likely near-term target, but instead warn that attackers are more likely to exploit infrastructure around elections — like campaign accounts and fundraising platforms — to steal credentials, impersonate trusted organizations, disrupt public information or fuel doubts about the nation’s electoral process.

The conclusions come as the Trump administration has pursued a more aggressive role in election administration, including through a March executive order aimed at tightening rules around mail-in voting and voter eligibility. The U.S. Postal Service has also proposed a rule that would require states to submit lists of voters receiving mail ballots.

The report also comes amid scrutiny of the intelligence community’s posture toward election threats under outgoing Director of National Intelligence Tulsi Gabbard. ODNI recently named two officials to coordinate the intelligence community’s election-threat mission for the 2026 cycle.

The firm does not address the administration directly. The assessment is notable, however, because it points to AI and digital threats as more immediate election security concerns, rather than the voting-procedure issues that have dominated talking points from the White House.

“Overall, the most significant 2026 risks center on the trusted accounts, platforms, services, and information channels that election-related organizations rely on to operate and maintain public trust, with election-adjacent systems presenting the more immediate source of operational exposure,” the report says.

Check Point also said it observed sustained election-related infrastructure creation in early 2026, including new websites containing terms such as “election” and “vote.”

In January, the firm identified roughly 1,300 newly registered domains containing the keyword “election” and nearly 3,000 containing “vote.” Between April 13 and May 14, it identified about 1,140 newly registered domains containing “election” and roughly 4,000 containing “vote.”

The company cautioned that those registrations do not prove malicious activity on their own, but they expand the pool of web infrastructure that could later be used for phishing, fake donation pages, impersonation or misinformation campaigns.

Check Point also found exposed credentials tied to some of the most widely used political and government platforms, including roughly 9,500 linked to ActBlue, the Democratic fundraising platform, and 6,500 linked to WinRed, its Republican counterpart. The exposed credentials are not part of a breach of these platforms, but were exposed from compromises of user data through other means.

The firm also observed smaller volumes tied to gop.com and democrats.org, the national party websites, as well as usa.gov, the federal government’s public services portal.

The company identified Russia, Iran and China as the principal state actors to monitor. AI is expected to make their influence operations easier to scale, and could be used to create more convincing phishing lures, cloned audio, manipulated images and deepfake videos.

Local governments may be especially exposed because they often operate with fewer resources, older technology and smaller security teams. Check Point cited recent ransomware incidents affecting Winona County, Minnesota, and Foster City, California, as examples of how municipal cyberattacks can disrupt public services and erode trust in government systems.

“Even when election operations are not directly affected, disruption at the local government level can still create confusion, delay public communications, and undermine confidence during politically sensitive periods,” the report says.

The findings also come as the Cybersecurity and Infrastructure Security Agency’s election security role faces new uncertainty. The Trump administration’s fiscal 2027 budget proposal would eliminate the agency’s election security program, including funds for information-sharing support to state and local officials and dedicated election security advisors.

Efforts under the Trump administration to scale back CISA and its election resources have strained relationships with state and local officials and have raised concerns that jurisdictions may be far less prepared to counter threats in November, officials in Michigan and Georgia said late last month. Sen. Mark Warner, D-Va., the vice chairman of the Senate Intelligence Committee, has also pressed DHS over reports that CISA is no longer providing the same election security training and resources it offered in prior years.

Editor's note: This article has been updated to better clarify how the ActBlue credentials were exposed.

]]>

Cyber Force? Senator pushes to create service branch under the Army

Thomas Novelly — Fri, 29 May 2026 16:59:00 -0400

A new cyber-focused military service branch would sit under the Army if one senator’s proposal comes to fruition.

Sen. Kirsten Gillibrand, D-N.Y., is spearheading a markup amendment to the Senate’s 2027 National Defense Authorization Act that would create a “Cyber Force” as the next armed service branch. The senator’s office confirmed that the amendment proposes to establish the branch under the Army, just as the Space Force and Marine Corps sit under the Air Force and Navy.

Similar provisions are reportedly being floated in the House, according to two people familiar with policy discussions. Earlier this year, Rep. Pat Fallon, R-Texas, told the Center For Strategic and International Studies that a “Cyber Force is inevitable” and “we’re going to get this done.” A Fallon spokesperson did not respond to multiple requests for comment on Friday asking about a potential amendment.

“New and escalating cyber threats on the battlefield demand a change to our current approach. The status quo and years of incremental changes are not meeting the current threat and are insufficient as that threat grows,” Gillibrand told Defense One in an emailed statement. “I believe, and many experts agree, that the creation of a dedicated Cyber Force will ensure the United States is ready to fight and win on the modern battlefield and protect our national security.”

The proposed amendment marks the latest push in a years-long effort. Gillibrand and House lawmakers have backed the idea before. In the 2025 National Defense Authorization Act, lawmakers commissioned the National Academies of Sciences, Engineering, and Medicine to study “alternative organizational models for the cyber forces of the Armed Forces.” Those findings have not been released. Details from the amendments showing what a Cyber Force might look like are not yet public, but think tanks and national security experts have already been pitching their own force designs.

A 2024 Foundation for Defense of Democracies report concluded that a Cyber Force could sit under the Army, muster about 10,000 personnel, and need a budget of around $16.5 billion. In August 2025, the FDD and the Center for Strategic and International Studies announced a commission on Cyber Force Generation. A report from those think tanks is scheduled to be released next month.

One former military official said there would be strengths to a cyber-focused service, but putting it under the Army is a bad idea. They argued that cyber would remain a secondary priority amid the branch’s many missions.

“The Army is the largest service by far,” the former official said. “Manpower-wise, it's like half the department, and it's like, ‘we'll put it under because it'll be easy for the Army to just put in another force.’ It's already hard enough to run the Army as it is.”

Mark Montgomery, a retired Navy rear admiral and an FDD senior fellow who advocates for a Cyber Force, argued that this year is an ideal time to create a new service.

“Timing-wise, you need to do this in the beginning or middle of an administration, not at the end of an administration,” Montgomery said.

The proposed amendment would need to survive multiple Senate and House edits to make the final compromise NDAA.

It’s not clear if the Trump administration would support the latest bipartisan push. Last year, the Pentagon rolled out CYBERCOM 2.0, a series of policy changes aimed at beefing up the recruiting, training, and missions of the existing U.S. Cyber Command.

Katie Sutton, the assistant defense secretary for cyber policy and principal cyber advisor to Defense Secretary Pete Hegseth, defended the Cyber Command reforms during a January Senate hearing, and said a renewed command and a new service could co-exist.

“I think this is a really important debate for us all to be having about the future of the cyber warfighting domain,” Sutton told the Senate Armed Services Committee in January. “I do think one of the most common misconceptions about Cyber Command is that it is a debate between Cyber Command 2.0 and a cyber force, and they are actually separate debates that I believe both need to be had, and we need to look closely at the pros and cons of both.”

Advocates for a separate and independent cyber-focused service branch say it aligns with the Trump administration’s calls for “offensive cyber operations against those planning to kill Americans,” the White House’s new counterterrorism strategy said. It also comes as President Donald Trump and Gen. Dan Caine, the Joint Chiefs chairman, acknowledged the growing role of cyber effects in U.S. military operations in Iran and Venezuela, Defense One and sister publication NextGov/FCW have previously reported.

“The president says, ‘We've got to be more offensive’ but then you got to better generate forces to be offensive, and we don't generate enough forces to do both offensive cyber and defensive cyber operations,” Montgomery said. “A cyber force is clearly necessary.”

]]>

Commercial location data is being used to target US servicemembers, lawmakers warn

Edward Graham — Fri, 29 May 2026 13:10:00 -0400

Foreign adversaries have used commercially available data from U.S. servicemembers to target their locations in active war zones, a bipartisan group of lawmakers revealed Thursday.

In a letter to Department of Defense Chief Information Officer Kirsten Davies, fourteen members of Congress — led by Sen. Ron Wyden, D-Ore., and Rep. Pat Harrigan, R-N.C. — warned that the Pentagon “has not taken basic steps to protect U.S. military personnel from the serious counterintelligence and force protection threat posed by the collection and sale of personal information, including cell phone location data, by data brokers.”

Reuters first reported the news.

According to unclassified written responses that the lawmakers shared with their letter, U.S. Central Command revealed last month that it “has received multiple threat reports concerning adversary exploitation of commercial location data to target or surveil U.S. personnel in theater.”

This type of data can be acquired from legitimate data brokers for a nominal fee and then used to track the locations of groups of individuals, particularly those who follow set routines or are based in remote areas.

“That foreign adversaries are still able to buy location data collected from the phones of U.S. personnel serving in military hotspots is a direct result of DOD leadership’s failure to prioritize this threat and implement common sense cyber defenses recommended by federal cybersecurity experts,” the lawmakers wrote.

The Pentagon has been aware for some time now of the security vulnerabilities posed by publicly available location data from smartphones or other wearable electronic devices.

When mobile fitness app Strava released a Global Heat Map of its users’ activities in late 2017, it inadvertently gave away the locations of some U.S. military sites in the Middle East and provided precise details on the routes personnel took when they jogged. Similar location data from running app Polar also revealed the locations of military personnel, and could be used in some cases to track them to their homes.

DOD subsequently issued a directive in August 2018 that banned uses of apps and devices that share geolocation data “while in locations designated as operational areas.”

In their letter, however, the lawmakers said CENTCOM shared that it “only rolled out the capability to administratively disable location sharing on smartphones” this month. The combatant command also revealed that the Pentagon has not yet taken steps to deactivate the tracking numbers on smartphones that are used by advertisers and data brokers.

“Both iOS and Android also include an opt-in privacy setting to disable this unique advertising ID, which the National Security Agency and the Cybersecurity and Infrastructure Security Agency recommend,” the letter said. “Unfortunately, USCENTCOM confirmed that the advertising ID is still not disabled on government-issued smartphones, but stated that the Defense Information Systems Agency is currently testing a capability to do so.”

The lawmakers urged DOD to disable the advertising ID on all agency-issued smartphones and to issue guidance requiring personnel to do the same on their personal devices brought overseas or onto military facilities. They also called for the agency to remove web browsers “designed to facilitate data collection by Google and other advertising companies” from Pentagon-issued devices.

“Instead, DoD should pre-install on DoD devices and require the use by DoD personnel of privacy-focused web browsers that protect users with anti-tracking cyber defenses, such as ad blocking and the Global Privacy Control (GPC), which is already enforced by law in 12 states,” the letter said.

]]>

Iran’s hackers are coordinating more closely, Israel’s top cyberdefense official says

David DiMolfetta — Wed, 27 May 2026 15:42:00 -0400

Tehran’s hackers have grown more organized, more coordinated and more willing to use artificial intelligence for influence operations in recent months — and they have demonstrated many of those capabilities since the war with Iran began, according to Israel’s top cyberdefense official.

In a Tuesday interview, the director-general of Israel’s National Cyber Directorate, Yossi Karadi, said Iranian state-aligned groups are further sharing cyber tools among each other and using AI to polish disinformation and recruitment messages.

At the same time, Karadi said he is pressing major AI labs for controlled access to powerful models like Anthropic’s Mythos, arguing that governments need the same tools attackers are seeking to adopt.

In the last year, Iran’s state-backed hacking units have increasingly “begun to talk to each other, and then collaborate with each other, and then even sometimes exchange information” among themselves, he said. “Of course, when they work together, they can work more efficiently and better.”

During the recent war, Iran has sent hundreds of thousands of text messages to Israelis as part of a deception and influence campaign, he said.

“In some cases, they’d send messages like, ‘don’t go to the bomb shelters because they are closed,’” Karadi said, adding that other messages sought to recruit Israelis for intelligence-sharing.

For a while, those messaging campaigns were in “very bad Hebrew, so you understand, ‘okay, it’s nonsense,’” Karadi said. But more recently, AI has helped Tehran improve message quality.

In March, Israel said it bombed a key Iranian cyberwarfare operation center. Asked about how that attack and similar efforts affected Tehran’s hacking prowess, Karadi said only that the nation’s cyberactivity largely fluctuated, depending on the intensity of the conflict.

When bombing campaigns against Iran intensified, hacking activity tended to decrease because it was harder for state operatives to access physical assets like computers and other equipment needed for cyberattacks, he said. Conversely, when strikes slowed, state hacking groups would have more room to reorganize and collaborate again.

As the U.S. and Iran work to implement a peace agreement to end the war, Karadi said there is little expectation that cyber activity from either side will stop, arguing that any party can deny involvement in a cyberattack, compared to a physical strike using missiles or bombs.

“There is no ceasefire in cyber,” he said. “You cannot force any agreement on cyber.”

Over the last few months, Iran has compromised a swath of smaller Israeli organizations and a handful of American targets. Pro-Iran hackers have targeted various U.S. industrial control systems, federal officials said early last month. One group, likely state-affiliated, also claimed to have compromised medical technology giant Stryker. And just last week, researchers said Iran-linked hackers deployed a slew of cyberespionage techniques that targeted the U.S., Israel, the UAE and other Middle Eastern nations.

Asked if the cybersecurity community underestimated the strength of Iran’s hacking ecosystem, Karadi said he would only speak for Israel, and asserted they “obviously did not underestimate” Tehran. Since the 12-Day War last year, “we were in an 100% alert situation, and we have been preparing ourselves for high-scale cyber war,” he said.

The remarks provide a window into how Israeli officials believe Iran’s cyber apparatus has adapted under wartime pressure and amid negotiations now underway between the U.S. and Tehran that could end the war, which began in late February.

Karadi conducted the interview as part of a visit to Washington this week, where he said he has planned meetings with the FBI, the Cybersecurity and Infrastructure Security Agency, U.S. Cyber Command and representatives from industry.

In those meetings, he said officials have been discussing advanced cyber-focused AI models like Anthropic’s Mythos, which have quickly become central to global cyber policy talks. Asked whether Israeli institutions have been given access to those systems, he said the effort is a work in progress.

“I haven’t succeeded in it now, but hopefully I will,” he said, adding that he is trying to access such models to scan Israeli government organizations for vulnerabilities. He declined to name specific AI companies he is engaging with.

In early April, Anthropic launched Project Glasswing, an initiative with major companies designed to secure critical software across the globe using its Mythos model. It’s been withheld from public release amid concerns over its highly skilled hacking capabilities. About a month later, OpenAI unveiled GPT-5.5-Cyber, a similarly advanced model that was also reserved for verified organizations to prevent the acceleration of offensive cyber tools.

The White House and the federal government swiftly responded and worked to craft an executive order focused on AI and cybersecurity, but its signing was postponed last week amid overregulation concerns from industry.

Representing a government cyberdefense organization, Karadi said such models worry him.

“When you give [an attacker] a new tool, he needs to only use it at one time and one place. But I need to implement this tool at all the places and all the time,” he said.

He expects more of these models to proliferate in the coming months, and he considers them to now be the “main threat” in the cybersecurity world.

“I think that our world is getting more and more digital, AI-based and cloud-based,” he said. “It will take us to a permanent state of cyber warfare, some of the time against enemies that you know. But most of the time — against ghosts.”

]]>