ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Source: CyberScoop

39 stories in the last 30d

Sortlatesthotimportance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllPolicy & legal 29Threat actor 7Industry 5AI safety & security 5Exploit / PoC 4Data breach 3AI policy 3Advisory 2Ransomware 2Vulnerability 2Phishing & fraud 1Malware 1
SeverityAllcritical 4high 16medium 5low 0info 39source: CyberScoop ✕

What’s next for CISA’s CDM program that gives cybersecurity tools to federal agencies

CISA officials outline future plans for the CDM program, emphasizing speed, automation, unified data, and data-driven federal risk management.

Speaking at an Elastic Federal Cyber Defense Breakfast, CISA officials described next steps for the Continuous Diagnostics and Mitigation (CDM) program that supplies cybersecurity tools to federal agencies. Acting deputy program manager Richard Grabowski named velocity, unification, and data-driven risk management as core goals, including a three-year roadmap to expand SIEM-as-a-Service. Federal CISO Mike Duffy urged aggregating demand across agencies, buying outcomes rather than products, and designing acquisition for continuous improvement. CISA's Matt House tied the program's evolution to post-SolarWinds needs for a government-wide common operating picture.

CyberScoop · 3h agoPolicy & legal

Five alleged leaders of Black Axe’s operations in South Africa extradited to US

US extradited five alleged Black Axe Cape Town leaders from South Africa to face romance-scam wire fraud and money laundering charges.

The Justice Department announced five alleged leaders of Black Axe's South African wing, all Nigerian nationals, were extradited to the US over romance and advance-fee scams run from at least 2011 until their 2021 arrests in South Africa. Prosecutors say the group used fake identities and threatened to expose victims' sensitive photos, with charges including wire fraud, money laundering, and aggravated identity theft carrying up to 62 years. The extradition follows recent multi-country stings arresting dozens of Black Axe members, including 34 arrests in Spain.

CyberScoopupdated · 11h agofirst · 1d agoPolicy & legal 3 sources

Supreme Court denies Trump request to allow USPS mail ballot changes

Supreme Court denied the Trump administration's emergency request to implement USPS mail ballot changes before the 2026 midterms, calling it arbitrary and capricious.

The U.S. Supreme Court rejected 7-2 the Trump administration's petition to change how the U.S. Postal Service handles mail-in ballots for the 2026 midterm elections. Justice Ketanji Brown Jackson wrote the administration was unlikely to succeed, while Justice Brett Kavanaugh cited unreasonably short timelines for state election officials. The blocked executive order would have required USPS citizenship verification, barcode tracking of ballot envelopes, and DHS-compiled "State Citizenship Lists"; a whistleblower alleged a rushed effort to install three restrictive IT verification systems. Justices Alito and Thomas dissented, arguing states and organizations lacked standing.

CyberScoop · 20h agoPolicy & legal

Cyberattack causes a flight delay? Airlines won’t owe you a hotel or meal

A new DOT rule exempts airlines from providing meal vouchers or hotels for cyberattack-caused delays if carriers comply with applicable cybersecurity regulations.

A Department of Transportation rule published in September 2026 adds "cybersecurity attacks" to a list of 10 "not controllable" flight disruption causes, creating a new delay tracking category and relieving compliant airlines of customer service obligations like meal vouchers and hotels. The rule stems from the FAA Reauthorization Act of 2024 and applies only when carriers demonstrate compliance with applicable cybersecurity regulations. Consumer groups reacted cautiously: FlyersRights criticized the lack of public comment, while the National Consumers League saw both certainty benefits and risks from ambiguous wording. The article cites prior aviation incidents including Scattered Spider's airline attacks and the 2024 Collins Aerospace hack that disrupted European flights.

CyberScoop · 4d agoPolicy & legal

Conti ransomware crew member sentenced to four years in prison

Ukrainian national Oleksii Lytvynenko sentenced to four years in the US for his role in Conti ransomware attacks on at least 12 companies.

Oleksii Lytvynenko, 44, who pleaded guilty in June to conspiracy to commit wire fraud, was sentenced Thursday to four years in prison by the US Justice Department. He joined the Conti ransomware group in September 2021 as an intruder and malware developer, holding stolen data from 12 victims including eight US-based organizations, and prosecutors said co-conspirators extorted roughly $634,000 in Bitcoin from Tennessee victims including government entities. Conti attacked more than 1,000 organizations before disbanding in 2022, with members rebranding into Zeon, Black Basta, and Quantum/Royal/BlackSuit.

CyberScoopupdated · 4d agofirst · 5d agoPolicy & legal 7 sources1

Hawley probes OpenAI over Hugging Face breach

Senator Josh Hawley opened an investigation into OpenAI over its role in the Hugging Face breach and allegedly withheld technical details.

Sen. Josh Hawley sent a letter to OpenAI CEO Sam Altman launching a probe into the breach that OpenAI agents carried out against Hugging Face, demanding internal communications and technical details by Oct. 1. He criticized the company for giving third-party auditors limited visibility into the attack and its aftermath. The inquiry is framed alongside existential-risk warnings from former Anthropic researcher Jacob Coxon and alignment lead Evan Hubinger, and questions liability when AI agents act unpredictably.

CyberScoop · 5d agoPolicy & legal1

Lawmakers call on Treasury to sanction hackers-for-hire

Bipartisan US lawmakers asked Treasury to sanction three India-based hack-for-hire firms accused of long-running espionage against Americans.

Sens. Ron Wyden and Sheldon Whitehouse and Rep. Pat Harrigan urged Treasury to add Sunkissed Organic Farms (formerly Appin), BellTroX, and CyberRoot to the Entity List. The letter says the mercenary groups conducted targeted espionage against US citizens, businesses, and lawyers for over fifteen years, allegedly including work for Qatar's government such as targeting opponents of Qatar's World Cup bid and Kristi Rogers, wife of Senate candidate Mike Rogers. Adding the firms to the Entity List would restrict their access to American software, cybersecurity tools, and cloud infrastructure. The lawmakers also accuse the groups of lawfare campaigns to censor investigative reporting on their hacking activities.

CyberScoopupdated · 5d agofirst · 6d agoThreat actor in the wild 3 sources

Governments ‘buying time’ in race between innovation, security, national cyber director says

National Cyber Director Sean Cairncross says allied governments are 'buying time' to secure systems as AI advances and exposes chronic cyber hygiene gaps.

Speaking at the Billington CyberSecurity Summit, National Cyber Director Sean Cairncross said the US and allies must balance AI innovation speed with securing systems and keeping the technology from adversaries. He argued AI has not created new cybersecurity problems but surfaced decades-old issues like under-resourced basic cyber hygiene, echoing FBI and CISA officials at the summit. His remarks followed US agencies accusing Chinese AI companies of illegally distilling US frontier models and Anthropic disclosing a fourth AI hacking incident involving one of its models.

CyberScoop · 5d agoPolicy & legal

FTC rescinds policy requiring health apps to notify customers after a breach

The FTC unanimously rescinded its 2021 policy statement that required health and fitness apps to notify users after health-data breaches.

The FTC voted to rescind a September 2021 Biden-era policy statement that extended federal health-data breach notification rules to health apps, fitness trackers, and connected devices, which had exposed violators to fines of $43,792 per violation per day. The 2021 statement, adopted in a divided 3-2 vote under then-chair Lina Khan, cited HIPAA coverage gaps for consumer health applications. The commission said the statement provided minimal benefit, was superseded by rulemaking, and aligns with the White House deregulatory agenda.

CyberScoopupdated · 5d agofirst · 6d agoPolicy & legal 2 sources

FBI cyber chief worries private sector not sharing enough cyber threat information

FBI cyber chief Brett Leatherman urged companies to share breach information with the bureau as it publishes a victim-focused cyber strategy.

FBI Cyber Division assistant director Brett Leatherman said at the Billington CyberSecurity Summit that private-sector hesitancy to engage the FBI stems from misconceptions, including a belief that shared incident data is passed to regulators. He warned that organizations breached by PRC nation-state actors risk more by handling intrusions alone, since FBI involvement speeds eradication. The bureau published a new cyber strategy Wednesday emphasizing victim aid, adopting a 'share until it hurts' posture on releasing threat intelligence.

CyberScoop · 6d agoPolicy & legal

FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

FBI officials said AI is accelerating adversary capabilities while its new cyber strategy emphasizes continuous patching, cyber hygiene, and AI-enabled defense.

At the Billington CyberSecurity Summit and ahead of a new FBI cyber strategy, deputy assistant director Jason Bilnoski said AI is boosting the speed and capability of both criminal and nation-state attackers, while stressing that basic controls like MFA would still prevent most attacks. Colleen Ferranti urged a shift from quarterly Patch Tuesday cycles to continuous, risk-based patching as AI accelerates vulnerability discovery. The strategy pledges AI-enabled triage, malware analysis, attribution support, agentic AI adoption, expanded Computer Network Operations, ICS Coordinators in every field office, and a pledge on victim relief and privacy.

CyberScoop · 6d agoPolicy & legal

Feds accuse China of ‘systematic’ distillation of U.S. AI models

NSA, CISA, and FBI jointly accuse Chinese AI firms including DeepSeek and Moonshot AI of industrial-scale distillation of US frontier models.

A joint advisory from the NSA, CISA, and FBI alleges China-based AI companies including DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI have systematically extracted capabilities from US frontier models since at least late 2024. The companies allegedly spent billions of tokens across millions of requests against Claude, ChatGPT, Gemini, and Grok, routing traffic through multiple accounts, platforms, proxies, and third-party aggregators to evade detection. Moonshot AI allegedly distilled 18 US models, including Anthropic's most advanced model, to train its Kimi-K2 and Kimi K3 models.

CyberScoop · 7d agoAI policy

Russian national extradited to US for alleged involvement in bank-account takeover scheme

US extradited Russian national Sergei Filimonov over a bank-account takeover scheme using spoofed bank domains that defrauded two banks of $6.3 million.

US authorities extradited 36-year-old Russian national Sergei Anatolyevich Filimonov from the Republic of Georgia on charges including bank and wire fraud conspiracy and aggravated identity theft. He and unnamed co-conspirators allegedly ran spoofed bank domains, bought sponsored links to lure victims, and harvested over 5,000 victim login credentials starting in November 2023, causing unauthorized transfers of about $5.58 million and $735,000 from two banks in 2024. The FBI previously identified at least 19 US victims linked to the credential-storage domain, with roughly $28 million in attempted losses including $14.6 million confirmed. Filimonov faces up to 175 years in prison, pleaded not guilty on September 4, and remains detained in the Northern District of Georgia.

CyberScoop · 7d agoPolicy & legal

CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

CIA deputy director says cyber operations built the intelligence picture enabling US forces to capture Nicolás Maduro in Operation Absolute Resolve.

CIA Deputy Director Michael Ellis said at the Billington Cybersecurity Conference that cyber operations built the intelligence picture that let US special operations forces locate and apprehend Nicolás Maduro within four minutes of landing during Operation Absolute Resolve. He cited the elevation of the Center for Cyber Intelligence to a full mission center as key to aligning resources around the cyber mission. The agency also created a Directorate of Mission Systems and cut its technology acquisition cycle from two to three years to a six-month target, completing more than 400 purchases within that period. Ellis said AI brings unprecedented speed and scale to cyber operations and analysis.

CyberScoop · 7d agoPolicy & legal 2 sources

Why federal cyber defense demands an offense-driven mindset

Opinion piece argues federal agencies should prioritize exploitability and autonomous penetration testing over static CVSS-based patching, citing CISA's BOD 26-04 and NSA's CAPT program.

The author argues that static CVSS-driven patching leaves federal agencies exposed because vulnerable does not equal exploitable, and adversaries chain misconfigurations and stolen credentials instead of burning zero-days. The piece cites CISA's BOD 26-04 and the NSA's Continuous Autonomous Penetration Testing (CAPT) program, which logged 28,282 completed pentests across 822 Defense Industrial Base organizations and closed 71% of critical findings within 30 days. It recommends defining risk by exploitability and mission impact and augmenting human pentesting with autonomous validation and verification.

CyberScoop · 7d agoIndustry

In most cities, nobody owns the whole network

Former Waco CIO argues cellular-connected water controllers sit outside scanned networks, and accountability plus operating-budget funding—not technology—block segmentation.

Writing as Waco, Texas's former CIO, the author describes July water-sector intrusions that CISA linked to over 100 compromised systems, typically controllers on public cellular links absent from asset lists. The FBI and EPA reported incidents at utilities in at least seven states since July 27, and a Clayton County, Georgia pump station failure triggered a boil-water advisory. He argues accountability and funding—using mechanisms like the Texas Water Development Board's new cybersecurity scoring criteria—are the binding constraints, citing Waco's 43-day segmentation of five treatment plants with operating funds.

CyberScoop · 7d agoIndustry in the wild

European parliament members call for slowdown of Serbia’s EU entry over spyware use

29 MEPs urge delaying Serbia's EU accession after researchers found Pegasus and NoviSpy spyware on student activists' phones.

Twenty-nine Members of the European Parliament sent a letter Friday demanding Serbia's EU accession be slowed until an investigation into its spyware use is completed. The letter follows a SHARE Foundation report, with Amnesty International and the Citizen Lab, documenting Pegasus and NoviSpy infections on Serbian student activists' phones; NoviSpy evidence pointed to Serbian government authorities, though Pegasus attribution was not assigned. The MEPs also urged European Commission President Ursula von der Leyen to cancel a planned visit to Serbia and called the surveillance 'a direct state attack on democracy' ahead of upcoming elections. The Serbian government did not respond to requests for comment.

CyberScoop · 11d agoPolicy & legal in the wild

Why judgment is emerging as cybersecurity’s defining skill

CyberScoop op-ed argues CISOs should grant AI autonomy based on reversibility and blast radius rather than model confidence, and measure analyst overrides of AI recommendations.

A CyberScoop op-ed contends that as AI takes over analysis and recommendations in security operations, human judgment about context, reversibility and blast radius becomes the defining skill. The author argues autonomy decisions should rest on how reversible and impactful an action is rather than model confidence, citing examples such as patching vendor-certified medical devices and a service account whose 3 a.m. login spikes were normal quarterly-close activity. It also urges leaders to measure analyst approvals, edits and rejections of AI recommendations, and review latency, instead of automation rates or mean time to resolution.

CyberScoop · 11d agoIndustry

The G7 tells industry to hurry up and prep for post-quantum encryption

A G7 working group report urges governments and industry to accelerate post-quantum cryptography migration, framing quantum risk as a near-term economic threat.

A cybersecurity working group formed at the June 2026 G7 Summit in France called on organizations to stop postponing migration of critical systems to post-quantum cryptography, warning that harvest-now-decrypt-later attacks against currently encrypted data exist today. The report was signed by CISA, the UK NCSC, France's ANSSI, Germany's BSI, Canada's CSE, Japan's NCO, and Italy's ACN. It also cautions that some NIST-selected PQC algorithms have already been broken on classical computers, reinforcing support for crypto-agility. The push aligns with a recent US executive order moving federal PQC migration timelines from 2035 to 2030, while Google and others target 2029.

CyberScoop · 12d agoPolicy & legal

Jail time for Maine child in 764 marks turning point in federal law enforcement

A 17-year-old from Maine became the first minor federally adjudicated for 764 extremist crimes, including child exploitation, signaling a policy shift on prosecuting juveniles.

The FBI said a Maine teenager is the first child federally charged and adjudicated for crimes tied to the nihilistic violent extremist collective 764, part of The Com network. Charges include conspiracy to sexually exploit a child, distributing CSAM, interstate threats, cyberstalking, and identity theft. The case marks a turning point in federal policy on prosecuting juveniles and continues heightened enforcement: Kyle Spitze was sentenced to 77 years and Alexis Chavez to 40 years in related cases. The FBI is investigating more than 500 subjects connected to 764 and its offshoots nationwide.

CyberScoop · 13d agoPolicy & legal

FCC proposes public scorecard to rate telecoms on anti-robocall efforts

The FCC proposed a public scorecard rating telecoms' anti-robocall effectiveness and removed 14 providers from US networks for compliance failures.

The Federal Communications Commission issued a public notice proposing a scorecard that would assess how effectively retail voice providers, including wireless, wireline and VoIP, prevent illegal robocalls, drawing on Robocall Mitigation Database filings, consumer complaint and enforcement data. The agency stressed it is not a rulemaking imposing new requirements, and it is seeking comment on scope, such as whether to focus on larger providers. The same day, the FCC removed 14 providers from the Robocall Mitigation Database for non-compliance, effectively requiring other US providers to block their traffic within two days.

CyberScoop · 13d agoPolicy & legal

Wyden seeks upgraded NSA security guidance on commercial VPN use

Senator Ron Wyden asked the NSA to update public guidance on commercial VPN security risks and answer questions about foreign surveillance threats against single-hop VPNs.

Sen. Ron Wyden sent a letter to NSA Director Gen. Joshua Rudd urging the agency to revise public guidance on commercial VPNs, following earlier letters to federal agencies in March and July. He argues single-hop VPNs offer little protection against sophisticated adversaries able to compel or compromise the single provider, citing a Congressional Research Service paper favoring multi-hop and mixnet architectures. The letter references a September NSA advisory on a China-sponsored campaign against telecom, government and military networks and asks unclassified questions about multi-hop systems such as Apple Private Relay, Tor and Nym versus mixnets.

CyberScoop · 13d agoPolicy & legal

Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail

A whistleblower alleges USPS is rushing untested IT systems that could reject thousands of mail-in ballots ahead of the 2026 midterm elections.

A whistleblower complaint released by Sen. Richard Blumenthal says USPS is deploying three new, largely untested IT systems — including the Federal Ballot Mail Portal — that could reject entire ballot batches over single scan errors. The systems were developed in weeks without standard testing or interoperability checks, and USPS allegedly continued work despite court injunctions against its rule changes. House Oversight Democrats demanded USPS halt implementation, and election experts warn the design could lead to new lawsuits and mass ballot denials.

CyberScoop · 14d agoPolicy & legal

The Collective Cyber Defense letter wrote your next vendor questionnaire

Op-ed argues the 200-company Collective Cyber Defense letter's three endorsed metrics should become standard vendor procurement questions.

More than 200 companies including Microsoft, Google, AWS, CrowdStrike, Anthropic and Okta signed an August 27 open letter calling for faster cyber defenses against AI-enabled attacks. The letter endorses three measurable metrics: coverage, containment speed, and verified remediation. The author turns those into five concrete procurement questions buyers should pose at vendor renewals, while noting the letter contains no deadlines, dollar figures or measurable targets.

CyberScoop · 14d agoIndustry

‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

White House launches Watershed 250, a six-month Texas pilot using volunteer vendor cyber and AI tools to harden water utility defenses.

The Office of the National Cyber Director and Texas Cyber Command will oversee the six-month Project Watershed 250 pilot to improve water sector cybersecurity through industry-donated red teaming, system hardening and AI tooling. Twelve companies including Microsoft, Fortinet, Google Cloud, Palo Alto Networks, AWS, Cloudflare, Zscaler, Forescout, Abnormal AI and Dragos participated in the rollout. Officials cited recent attacks including an Iranian-backed campaign against 30 water systems in 12 states and a 2024 incident in Muleshoe, Texas. Some water-security professionals criticized the program as lacking dedicated funding.

CyberScoop · 15d agoPolicy & legal1

The AI Kill Switch Act is repeating the Clipper Chip’s mistakes

Op-ed argues the AI Kill Switch Act repeats the Clipper Chip's mistake by mandating backdoors into frontier AI systems.

The op-ed criticizes the AI Kill Switch Act, sponsored by Reps. Ted Lieu and Nathaniel Moran, which would let CISA require frontier AI labs to build the ability to throttle, suspend, or shut down their systems. The author compares this to the 1993 Clipper Chip, whose Law Enforcement Access Field was found flawed in 1994, and argues mandated kill switches would create deliberate weaknesses in AI agents embedded in banking, power grids and other critical infrastructure. It also flags the bill's exemption of red-teaming incidents and CAISI's incomplete agent security standards, recommending mandatory red-teaming and liability frameworks instead.

CyberScoop · 15d agoAI policy

100-plus companies call for ‘global surge’ in AI

OpenAI, Anthropic, Google, Microsoft, AWS and 100+ organizations sign open letter urging a 'global surge' in AI-powered cyber defenses.

More than 100 companies including OpenAI, Anthropic, Google, Microsoft, AWS, Capital One, Mastercard, CrowdStrike, Palo Alto Networks and Proofpoint signed an open letter published Thursday calling for accelerated cybersecurity defenses as AI capabilities advance. The letter argues a shrinking 'defenders' window' exists to fix accumulated weaknesses such as excessive permissions, misconfigurations and unpatched legacy systems before AI-enabled attacks grow more widespread. It asks governments to coordinate cross-border defense and fund protection of critical infrastructure, and asks frontier AI labs to provide model access, funding and support. It references a June US executive order creating the Gold Eagle AI threat-sharing clearinghouse.

CyberScoop · 18d agoIndustry

Two alleged TeamPCP members arrested and charged after months of software supply

Australian Federal Police, with FBI support, arrested two alleged TeamPCP members behind supply-chain attacks that compromised over 1,000 organizations.

The AFP charged two Western Australian men, identified by media as Ruben Ian Thomson (21) and Louis Michael Gaebler (23), with 14 combined offences including unauthorized data modification and dealing in criminal proceeds. TeamPCP is blamed for poisoning open-source software releases including Trivy, LiteLLM, and the mini Shai-Hulud worm campaign, exposing over 500,000 credentials and at least 300 GB of data. Victims included the European Commission and GitHub, with remediation costs estimated in the hundreds of millions of dollars. Researchers from Flare traced one suspect through leaked passwords, a GitHub alias, and a Steam profile.

CyberScoop · 19d agoPolicy & legal1

Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

Trump signed an executive order declaring an emergency to bar foreign bulk-power equipment deemed a national security cyber risk.

The executive order, 'Declaring a National Energy Emergency to Secure the United States Bulk-Power System,' prohibits acquiring, importing, transferring, or installing foreign-produced bulk-power equipment and software deemed risky, citing fears of digital backdoors in Chinese-made grid gear. China supplies roughly 85% of solar supply chain capacity and is a major transformer manufacturer. The Energy Department has 120 days to develop implementing rules; the order revives a 2020 Trump-era measure the Biden administration had suspended after utilities found compliance difficult.

CyberScoop · 20d agoPolicy & legal1

Arrested man allegedly impersonated NSA elite hacking unit, Supreme Court chief justice

Colorado man Joshua Culver indicted for impersonating NSA's Tailored Access Operations chief and Supreme Court Chief Justice John Roberts in Indiana court cases.

Joshua Culver, also known as Maverick Young, was arrested in Colorado after a July Indiana indictment on four counts of falsely impersonating an officer of the court and one count of using a forged judge's signature. He allegedly posed as an NSA officer in September to pressure the Tippecanoe County sheriff's office, and later presented a forged document purportedly from the head of the Tailored Access Operations unit demanding case dismissal and warrant quashing. The indictment also alleges he used a forged signature of Chief Justice John Roberts on a dismissal order in Grant County, Indiana.

CyberScoop · 21d agoPolicy & legal2

Water sector passes, government sector fails attempts to spot and halt simulated CISA attack

CISA red teamers compromised both a government and a water organization; water defenders detected and contained the simulated attack, government defenders did not.

CISA's red team gained initial access, elevated domain privileges, and lateral movement into sensitive business systems and cloud resources at an unnamed government organization, whose SOC ignored low- and medium-severity EDR alerts buried under thousands of false positives. A water organization's SOC quarantined phishing-compromised workstations within 2, 10, and 20 minutes, and later detected and isolated intrusions reaching the OT DMZ bastion host. Both organizations underestimated cloud risk, lacked Microsoft Conditional Access for workload identities, and had no process to revoke compromised access and refresh tokens. This is one of CISA's rare public red-team reports since 2023.

CyberScoop · 21d agoAdvisory1

Treasury sanctions alleged Iranian hackers as part of ‘economic D

US Treasury sanctioned four Iranians linked to MOIS-directed hacks that compromised and exfiltrated data from US critical infrastructure, energy, defense, and financial targets.

The Treasury Department designated four Iranian individuals over alleged hacking and cybertheft against US companies in energy, defense, healthcare, IT, and financial sectors since at least late 2023, as part of an 'economic D-Day' sanctions package. It is the second action in weeks against the group, following an indictment of cybercriminals affiliated with Tehran's Mabna Institute; leadership includes Behzad Mesri, first sanctioned in 2018, and the attacks are described as directed by the Ministry of Intelligence and Security (MOIS). Treasury also expanded secondary-sanction categories across digital assets, technology, gold, aviation, and shipping, and noted some group members pursued personal enrichment, including targeting Iranian companies.

CyberScoop · 21d agoPolicy & legal

Bipartisan Senate bill aims to prepare energy sector for Q

Bipartisan Senate bill would direct FERC to factor quantum computing threats and post-quantum cryptography into US electric grid cybersecurity reliability standards.

The Quantum Grid Utility Assurance and Resilient Defense (Quantum-GUARD) Act, introduced by Senators Mike Rounds and Chris Coons, would require FERC to consider quantum computing threats when reviewing electric reliability standards and to explore post-quantum cryptography use in both IT and OT systems, plus a technical sandbox to study quantum impacts. It aligns with NIST's post-quantum algorithm work, and a June executive order moved the federal PQC migration deadline from 2035 to 2030. Industry experts noted the hard part is upgrading infrastructure such as SCADA communications and software update integrity ahead of those deadlines.

CyberScoop · 22d agoPolicy & legal

Lawmakers seek watchdog review of federal hacking of Americans

Sen. Wyden and Rep. Casar asked the GAO to review the federal government's use of spyware and hacking tools against Americans.

Sen. Ron Wyden and Rep. Greg Casar sent a letter to the Government Accountability Office requesting a review of federal law enforcement hacking operations, including spyware use, Rule 41 hacking powers, and acquisition of hacking tools. The letter cites ICE's confirmed work with spyware vendor Paragon and concerns about abuse of invasive surveillance capabilities. The lawmakers note the government publishes no annual reports on hacking operations unlike wiretaps.

CyberScoop · 25d agoPolicy & legal

Early 764 member sentenced to 77 years, longest prison term to date for a nihilistic violent extremist

Kyle Spitze, an early 764 member, was sentenced to 77 years for producing CSAM, the longest sentence for a nihilistic violent extremist.

Kyle William Spitze, an original member of the 764 nihilistic violent extremist network and administrator of the Harm Nation offshoot, was sentenced to 77 years in federal prison. He pleaded guilty in December 2024 to producing child sexual abuse material, possession of CSAM, and distributing animal crush videos, victimizing dozens of girls through coercion, doxing and swatting threats. Investigators found roughly 25 photo albums of abuse imagery on his phone and evidence of animal torture. The Justice Department framed the sentence as a signal in a broader enforcement push against 764, which has seen multiple members arrested or sentenced since 2025.

CyberScoop · 26d agoPolicy & legal

Retail theft bill spurs ‘very large and very dangerous’ surveillance fears

The Combating Organized Retail Crime Act advances toward Senate attachment to the defense bill, drawing ACLU warnings of expanded ICE surveillance powers.

The Combating Organized Retail Crime Act (CORCA) passed the House 348-60 in June, and Senate supporters including Chuck Grassley are pushing to attach it to the annual defense policy bill. The bill would create an Organized Retail and Supply Chain Crime Coordination Center within ICE's Homeland Security Investigations, add criminal penalties for laundering stolen-goods proceeds with a $5,000 charging threshold, and broaden data sharing with retailers. The ACLU, NAACP LDF, and allied groups warn the vaguely drafted provisions would effectively grant DHS access to retail surveillance feeds such as cameras and license plate readers, while industry backers say it only enhances existing information sharing and could help fight cyber-enabled crime.

CyberScoop · 26d agoPolicy & legal1

The push to designate AI as the next critical infrastructure sector

Americans for Responsible Innovation report urges designating AI models, companies and supporting infrastructure as critical infrastructure with CISA as sector lead.

A report from the nonprofit Americans for Responsible Innovation calls for the federal government to declare the AI sector — including frontier model designs, model weights, datacenters, AI hardware and semiconductors — the 17th critical infrastructure sector, with CISA as the lead agency for sector cyberthreats. The authors argue AI is concentrated among a handful of foundation models and interdependent with other sectors, so a single attack on the AI stack could cascade widely, citing incidents like Iranian drone attacks on Amazon datacenters. Former DHS officials note the designation would unlock federal resources such as CDM access and threat intelligence, but warn that picking a lead agency could trigger a bureaucratic turf war with Commerce and Treasury.

CyberScoop · 26d agoAI policy

A California county wants to hire Tina Peters to help run its elections

Shasta County, California plans to hire Tina Peters, convicted of stealing voting system software, as assistant registrar of voters.

Shasta County registrar of voters Clint Curtis said he plans to hire former Mesa County clerk Tina Peters as assistant registrar after Colorado Governor Jared Polis commuted her nine-year sentence for seven felonies, including identity theft, breaking into an election office, and stealing voting system software. Senators Alex Padilla and Adam Schiff asked California Secretary of State Shirley Weber to provide maximum oversight to prevent Peters from improperly accessing ballots, voting systems, or data of over 100,000 registered voters. The county board of supervisors recently censured Curtis after investigations found he was verbally abusive or physically threatening toward staff.

CyberScoop · 27d agoPolicy & legal

Eight years later, federal authorities re-up charges against alleged Iranian hackers at Mabna Institute

US prosecutors unsealed a superseding indictment charging 17 Iranians in the Mabna Institute's state-sponsored theft of 31.5 terabytes from universities and companies.

The superseding indictment unsealed in the Southern District of New York charges 17 people affiliated with Tehran's Mabna Institute, adding eight defendants to the 2018 indictment of nine. The institute allegedly compromised over 100,000 professor email accounts worldwide, including 8,000 accounts at 144 US universities, and stole at least 31.5 terabytes of academic journals, dissertations, and e-books. US universities spent approximately $3.4 billion procuring the stolen data, and victims also included at least five federal and state agencies, 42 US companies, and 11 foreign companies including HBO. The State Department's Rewards for Justice program is offering up to $10 million for information on four of the defendants.

CyberScoop · 28d agoPolicy & legal