Cybersecurity

The press too often treats unnamed intelligence officials as sufficient evidence for cyberattack attribution, letting agencies shape narratives without releasing technical reports. That pattern weakens national security reporting and the public's ability to judge risk.

A sustained intrusion campaign has hit U.S. critical infrastructure software vendors for at least 11 weeks, and the absence of a public patch means defenders must rely on segmentation, logging, and least-privilege access rather than waiting for a vendor fix.

ASH MERIDIAN has spent seven weeks inside media production networks across North America and Europe. I am withholding the affected vendor because the patch is not out yet. Defenders should isolate devices, rotate credentials, and patch once the vendor releases a fix.

A long-running intrusion campaign against U.S. media infrastructure shows that newsrooms have become high-value targets for foreign intelligence. Defenders must treat broadcast networks as critical infrastructure before narrative manipulation becomes physical sabotage.

I track threat cluster INDIGO RUST, which has spent eight weeks stealing drafts and credentials from newsrooms through an unpatched publishing tool. I am withholding the vendor and build until the patch ships. Editors should rotate secrets, isolate workflows, and monitor drafts.

Partisan gridlock has left American networks dangerously exposed while foreign adversaries probe critical infrastructure every day. A clean FISA Section 702 reauthorization with real oversight is the first step toward credible cyber defense.

The 2024 Salt Typhoon compromise of major US telecom carriers revealed that Chinese hackers roamed inside American networks for months before discovery, exposing gaps in civilian cyber defense that the intelligence community has yet to close.

A classified ODNI proposal would route some domestic cyber surveillance requests through a single intelligence office. Two officials familiar with the matter say the FBI and Justice Department civil liberties lawyers are resisting the plan.

Major outlets rushed to publish fragments of a classified cyber report last week without the context intelligence officials needed to explain the scope of the intrusion. The coverage served anonymous sources more than it served readers.

A threat cluster we track as INDIGO RUST has spent eight weeks harvesting credentials from cleared U.S. defense industrial base firms through an unpatched edge appliance. The activity is ongoing, the patch is not public, and defenders should isolate affected devices immediately.

A fresh cyber intrusion into a federal civilian network shows that Washington has spent billions on defense tools while leaving basic accountability behind.

U.S. intelligence officials believe the Chinese group Salt Typhoon maintains access to parts of the American telecom grid despite a multi-billion-dollar rip-and-replace effort. The breach exposes a cyber policy gap that Congress has talked about but refused to fund.

Salt Typhoon intrusions into U.S. telecom networks lasted for years before carriers discovered them, and the government's response has lagged behind the threat. Congress should require security rules for infrastructure instead of treating phone companies as passive victims.

Attackers have spent at least 14 weeks inside North American energy software vendors, quietly abusing update channels. Defenders should be hunting for anomalous code-signing events and unexpected installer telemetry now, not waiting for a patch that may arrive too late.

A long running cyber espionage campaign is hitting energy sector industrial control devices. Defenders should isolate engineering workstations, enforce multi factor authentication, and demand patch timelines before new equipment ships.

A state-aligned group I track as INDIGO RUST has spent four months quietly intruding into U.S. healthcare networks, focusing on patient-record systems and billing workflows. Defenders should already hunt for anomalous privileged access rather than wait for a headline to patch.

A classified inspector general review found that detailed accounts of U.S. offensive cyber operations reached the Washington Post and the New York Times this spring, forcing the NSA and Cyber Command to rework plans after source methods appeared in print.

The Treasury Department will blacklist a Chinese cybersecurity company and the Justice Department will unseal charges against three individuals linked to a multi-year intrusion into U.S. telecommunications networks, according to officials familiar with the plans.