Search: “US Coast Guard”

Coast Guard, FBI board US-bound foreign ships in order to probe for cyberattacks

US Coast Guard and FBI boarded two foreign tankers bound for the US after indications their vessel networks were compromised, investigating possible Iranian involvement.

The Coast Guard and FBI conducted joint offshore security boardings of two commercial ships in the Gulf of Mexico on August 21 and 24 to examine their operational and IT systems following indications both networks were compromised. The vessels reportedly carried oil and natural gas, and one was hacked in the Strait of Gibraltar and lost communications for over 30 hours. No operational disruptions, vessel instability, or environmental impacts have been reported, and authorities are investigating whether Iran or another group exploiting US-Iran tensions was behind the attacks.

CyberScoop·updated 18:46 UTC · 2h ago·first 14:48 UTC · 6h agoData breach in the wild 2 sources

Coast Guard says it is monitoring cyberattack that disrupted North Carolina's ports

CyberScoop·Aug 7, 14:24 UTC · Aug 7, 2026Exploit / PoC in the wild

Florida water agency latest to confirm cyber incident as feds warn of nation

A ransomware gang hit Florida's St. Johns River Water Management District as CISA warned of IRGC-linked CyberAv3ngers attacks on exposed Unitronics water-sector PLCs.

The St. Johns River Water Management District, which oversees Florida drinking-water supply planning, confirmed suspicious activity in its IT environment and said containment measures were implemented; a ransomware gang claimed the attack and shared samples of stolen data. Separately, CISA, FBI, NSA, EPA and Israel's INCD warned that IRGC-affiliated CyberAv3ngers are actively compromising Israeli-made Unitronics Vision Series PLCs in the water sector using default credentials since at least November 22. The group, motivated by opposition to Israel-linked products, defaces controller interfaces and could cause deeper cyber-physical effects. Shadowserver found at least 539 Unitronics PLC instances still exposed online, and CNN reported fewer than 10 US water facilities faced recent attacks.

The Record·Sep 8, 00:00 UTC · 8d agoRansomware in the wild 3 sources

Scammers are getting smarter about where they target you

Malwarebytes data shows scammers tailor fraud by platform: 90% of toll scams arrive via email/SMS and MrBeast is now the most impersonated person.

Malwarebytes threat research analyzed global scam data from April 15 to July 14, 2026, across more than 20 scam types, finding each type favors a specific channel such as email, SMS, phone, or social media. Roughly nine in ten toll scams arrive by email or text, about half of IRS scams come by phone, and MrBeast is impersonated in about 30% of impersonation scams. The most impersonated brands are Google, Microsoft, Apple, Roblox, and Amazon, and Malwarebytes blocks around 500,000 phishing websites daily. Gaming scams on Roblox, Steam, Discord, and Minecraft increasingly carry losses of $1,000 or more, with 15-19% activity spikes in mid-2026.

Malwarebytes Labs·Sep 2, 12:45 UTC · 14d agoPhishing & fraud

Cyber Command turns to veteran of intelligence agencies for top AI role

US Cyber Command appoints Rear Adm. Ronzelle Green as chief AI officer as its AI budget grows from $5M to $138M.

US Cyber Command has named Ronzelle Green, previously head of research and development at the National Geospatial-Intelligence Agency, as its new Chief Artificial Intelligence Officer, replacing Brig. Gen. Reid Novotny. The command's 'AI for Cyber Operations' budget request grew from $5 million in fiscal 2026 to $138 million in fiscal 2027, aiming to let cyber operators process data and respond to threats faster than humans alone. Sources say Green's priority will be consolidating fragmented AI pilot programs across the organization, in contrast to the NSA's more established Artificial Intelligence Security Center created in 2023.

The Record·Sep 10, 18:25 UTC · 6d agoAI policy 2 sources1· 1 read

Batten the Hatches: Cybersecurity with Military Mariners

Interviews with 20 U.S. Navy and Coast Guard mariners reveal informal, safety-oriented shipboard cyber risk models that may delay attribution and containment.

The study conducts semi-structured interviews with 20 military mariners from U.S. Navy and Coast Guard vessels to understand how service members recognize and respond to cyber risk aboard ships. Unique consequences of compromising military systems identified include weapon takeover and purposeful geopolitical escalation. Cybersecurity is organizationally abstract on ships, so mariners build cyber risk models from informal experience rather than formal instruction. A safety-oriented incident-response model creates resilience but may delay cyber attribution and containment.

arXiv cs.CR·Sep 11, 13:04 UTC · 5d agoResearch

Is Someone Hacking DoD Refrigerators?

Refrigeration outages hit commissaries at seven US military installations, with hacking suspected but not confirmed by the Pentagon.

Refrigeration disruptions were reported at Defense Commissary Agency commissaries at Fort Irwin, F.E. Warren AFB, Fort Huachuca, Naval Station Newport, Columbus AFB, Travis AFB, and Naval Air Station Lemoore. A defense official acknowledged awareness of a possible refrigeration disruption, but the services and Pentagon declined to provide details. The post is speculative, arguing the coincidence of outages suggests possible hacking, though no evidence or attribution is provided.

Schneier on Security·Aug 31, 18:21 UTC · 16d agoData breach

10th August – Threat Intelligence Report

North Carolina Ports suffered a cyberattack forcing Wilmington and Morehead City operations onto manual processes; the authority says it is contained.

Check Point's weekly threat intelligence bulletin reports that North Carolina Ports, the US authority operating the ports of Wilmington and Morehead City among others, suffered a cyberattack. The incident forced some operations onto manual processes. The authority claims it has contained the attack.

Check Point Research·Aug 10, 13:53 UTC · Aug 10, 2026Data breach

Securing Your Business: The Vital Role of Cyber Insurance | Huntress

Huntress explains cyber insurance coverage types, insurer security requirements, and the shift toward documented evidence of controls.

Huntress outlines first-party and third-party cyber insurance coverage, including business interruption, data recovery, extortion, privacy liability, and regulatory fines. Insurers now commonly require EDR, MFA, security awareness training, patching, tested backups, least-privilege access, and incident response plans. With ransomware accounting for 91% of insurance losses in H1 2025 and average US breach costs at $10.22 million, underwriters increasingly demand evidence packs rather than self-attestation.

Huntress·Sep 1, 16:00 UTC · 15d agoIndustry

White House Launches Pilot Program in Texas to Protect Water Infrastructure

White House launches Project Watershed 250, giving Texas water providers federal and private-sector cybersecurity resources amid rising nation-state threats to critical infrastructure.

The White House launched Project Watershed 250, a pilot program providing water providers in Texas with federal and private-sector cybersecurity resources. The initiative comes amid rising nation-state threats targeting water utilities and other critical infrastructure in the United States.

Infosecurity Magazine·Sep 1, 12:45 UTC · 15d agoPolicy & legal

ATF responds to 'major' cybersecurity incident after ransomware gang's claims

The ATF is responding to a major cybersecurity incident claimed by a ransomware gang, with the US Justice Department investigating the breach.

The US Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) acknowledged a 'major' cybersecurity incident after a ransomware gang claimed responsibility for an attack. The US Justice Department is investigating the breach. Available reporting provides limited technical detail, and the scope of data theft and operational impact remains unclear.

The Register · Security·Aug 27, 15:25 UTC · 20d agoRansomware

Shattering the Dream – When a Job Offer Becomes a Zero-Day Attack

Check Point details an Operation Dream Job wave using trojanized PDF viewers to hit defense, aerospace, and aviation targets since early 2026.

Since early 2026, Check Point Research has tracked a wave of the Operation Dream Job campaign primarily targeting the global defense sector, with emphasis on aerospace and aviation companies. The threat actor distributes modified PDF viewers that execute malicious payloads embedded in specially crafted files, delivered under fake job-offer pretexts. Check Point characterizes the operation as a zero-day attack.

Check Point Research·Aug 11, 17:30 UTC · Aug 11, 2026Threat actor in the wild

U.S. Offers $10 Million Reward for Iranian IRGC Cyber Chief Linked to Critical Infrastructure Attacks

The U.S. State Department offered up to $10 million for information on Amir Yaryab, an IRGC cyber chief linked to critical infrastructure attacks.

The U.S. State Department's Rewards for Justice program offers up to $10 million for information identifying or locating Amir Yaryab, who allegedly oversees the Cyber Operations Command of Iran's IRGC Cyber-Electronic Command (IRGC-CEC). Officials tie him to units called Shahid Hemmat and Shahid Shushtari conducting cyber and information campaigns against defense, telecommunications, energy, and finance sectors across the US, Europe, and the Middle East, and to groups including CyberAv3ngers and Dadeh Afzar Arman. CyberAv3ngers compromised at least 75 Unitronics Vision Series PLCs, including 34 in US water and wastewater facilities, between November 2023 and January 2024.

Cyber Security News·Sep 8, 09:14 UTC · 8d agoPolicy & legal

I Think the Military Commissary Freezers Were Hacked

Refrigeration failures at six-plus US military commissaries prompt speculation of a cyber attack on DeCA's remote monitoring systems; Pentagon acknowledges possible disruption.

The author documents near-simultaneous freezer and refrigeration failures at confirmed installations including Fort Huachuca, F.E. Warren AFB, Fort Irwin and Travis AFB on August 26-27, with freezers entering defrost mode that heated and spoiled food. DeCA's Remote Monitoring Control System controls defrost across roughly 182 locations, and an unverified comment attributed the Fort Huachuca failure to a network issue. Stars and Stripes and Military Times independently reported the multi-base failures, and the Pentagon acknowledged a 'possible refrigeration disruption,' though no evidence of hacking has been confirmed.

Lobsters · security·Sep 3, 03:20 UTC · 13d agoData breach

WatchGuard security advisory (AV26-865)

Canada's Cyber Centre warns WatchGuard Dimension and Fireware OS vulnerabilities affect multiple versions and urges administrators to apply available updates.

The Canadian Centre for Cyber Security issued advisory AV26-865 (August 31, 2026) noting that WatchGuard products are affected by vulnerabilities as of August 27, 2026. Affected products include Dimension prior to 2.3.1 and Fireware OS prior to 12.12.2, 12.5.20, and 2026.2.2. Users and administrators are encouraged to review the advisory link and apply updates as they become available.

Canadian Centre for Cyber Security·Aug 31, 19:00 UTC · 16d agoAdvisory

Trump Targets Foreign Technology in New U.S. Power Grid Security Order

Trump's Executive Order 14420 declares a national emergency to restrict foreign-made bulk-power grid equipment over cyber, sabotage and supply-chain risks.

Executive Order 14420, signed August 26, declares a national emergency regarding the foreign supply of bulk-power system electric equipment to the United States. It empowers the Energy Secretary to restrict transactions with designated Covered Foreign Entities involving equipment, software, firmware, digital services, maintenance services, and remote-access capabilities. Covered equipment includes transformers, generators, inverters, RTUs, PLCs, intelligent electronic devices, and protective relays, with transmission rated 69 kV or higher in scope while local distribution is excluded. Already-installed foreign equipment may be subject to identification, isolation, monitoring, or replacement requirements, with phased compliance and pre-qualified vendor exemptions permitted.

Security Affairs·Aug 28, 18:00 UTC · 19d agoPolicy & legal

The EU CRA's Real Question: What Shipped, and When Did You Know?

ActiveState argues the EU CRA's 24-hour ENISA exploit-notification duty, effective September 11, 2026, makes current SBOMs and provenance visibility a legal necessity.

An ActiveState essay warns that the EU Cyber Resilience Act's reporting obligations take effect on September 11, 2026, requiring manufacturers of products with digital elements sold into the EU to notify ENISA within 24 hours of learning a vulnerability is actively exploited, with a fuller report within 72 hours. The law's engineering requirements only apply from December 11, 2027, leaving a visibility-first runway, and Article 13 requires the SBOM to stay current unlike one-time artifacts generated under US Executive Order 14028. The author contrasts the 24-hour notification clock with an industry-average 55 days to remediate high or critical vulnerabilities and recommends automated SBOM regeneration or consuming pre-vetted, attested open source components.

BleepingComputer·Sep 8, 20:24 UTC · 8d agoPolicy & legal

WatchGuard security advisory (AV26-847)

Canada's Cyber Centre advises that WatchGuard Agent versions before 1.25.13.0000 are affected by vulnerabilities and urges administrators to apply updates.

The Canadian Centre for Cyber Security relayed WatchGuard's advisory (AV26-847) noting that WatchGuard Agent prior to 1.25.13.0000 is affected by vulnerabilities. Users and administrators are encouraged to review the WatchGuard Endpoint Security Prime advisories and apply the available updates.

Canadian Centre for Cyber Security·Aug 25, 19:09 UTC · 22d agoAdvisory

The Smishing Deluge: China-Based Campaign Flooding Global Text Messages

Unit 42 attributes a global smishing campaign with 194,000+ phishing domains impersonating tolls, banks, and couriers to the Smishing Triad.

Palo Alto Unit 42 attributes ongoing smishing texts about toll violations and package misdelivery to the Smishing Triad, targeting U.S. residents since April 2024. Researchers identified 194,345 FQDNs across 136,933 root domains registered since January 2024, mostly via Hong Kong registrar Dominet (HK) Limited with Chinese nameservers and hosting concentrated on U.S. cloud services. The decentralized campaign impersonates banking, cryptocurrency, e-commerce, healthcare, law enforcement, and social media services, and its scale points to a large phishing-as-a-service operation. Phishing pages harvest national ID numbers such as Social Security numbers, home addresses, payment details, and login credentials.

Palo Alto Unit 42·Aug 17, 12:45 UTC · Aug 17, 2026Phishing & fraud in the wild1

Why federal cyber defense demands an offense-driven mindset

Opinion piece argues federal agencies should prioritize exploitability and autonomous penetration testing over static CVSS-based patching, citing CISA's BOD 26-04 and NSA's CAPT program.

The author argues that static CVSS-driven patching leaves federal agencies exposed because vulnerable does not equal exploitable, and adversaries chain misconfigurations and stolen credentials instead of burning zero-days. The piece cites CISA's BOD 26-04 and the NSA's Continuous Autonomous Penetration Testing (CAPT) program, which logged 28,282 completed pentests across 822 Defense Industrial Base organizations and closed 71% of critical findings within 30 days. It recommends defining risk by exploitability and mission impact and augmenting human pentesting with autonomous validation and verification.

CyberScoop·Sep 8, 18:30 UTC · 8d agoIndustry

US Sanctions Mabna Institute Hackers for Iranian Cyber-Attacks

US sanctions individuals tied to Iranian hacking-for-hire group the Mabna Institute over cyber-attacks.

The United States has imposed sanctions on individuals connected to the Mabna Institute, an Iran-based hacking-for-hire group. The move targets the actors behind Iranian cyber-attack operations. Sanctions are a government enforcement action rather than a new technical threat.

Infosecurity Magazine·Aug 25, 09:10 UTC · 22d agoPolicy & legal

Operational Resilience: IT Security Risks with Reduced Staffing | Huntress

Huntress blog advises security teams on managing change, risk, and incident response during reduced-staffing holiday periods.

The article discusses how holiday-period staffing reductions change organizational risk profiles around change management, monitoring, and incident response capability. It argues against blanket change freezes when critical vulnerabilities with high exploitation probability demand patching, and stresses retaining decision-making authority, escalation paths, and recovery knowledge. It concludes by promoting Huntress Managed Response, which lets the Huntress SOC take predefined containment actions on confirmed threats without customer intervention.

Huntress·Sep 15, 14:00 UTC · 1d agoIndustry

Billion-dollar boat seller MarineMax reports cyberattack to SEC

The Record·Aug 5, 00:00 UTC · Aug 5, 2026Policy & legal

Communicating Under Pressure: Best Practices for Service Providers

CISA, FBI, and international partners issued guidance on crisis communications for service providers during IT and OT outages, emphasizing clarity, transparency, and backup channels.

CISA, the FBI, and international partners published guidance on planning and executing clear, timely, audience-appropriate communications during IT and OT service outages, whether caused by cyber threat actors, human error, or natural hazards. The guidance stresses clarity, accountability, and transparency, and warns that outages at one organization can cascade across interconnected systems. It recommends critical infrastructure owners assume telecommunications may be unreliable and integrate backup communication methods into crisis plans, and points to CISA's CI Fortify initiative for OT isolation and recovery resources.

CISA Advisories·Sep 2, 12:00 UTC · 14d agoAdvisory

US military disabled ad tracking on troops’ devices following reports of targeted attacks

US DoD disabled ad tracking on troops' devices after foreign adversaries targeted service members using commercially bought location data.

Per letters shared with Senator Ron Wyden, the Army, Air Force, Navy, Marine Corps, and Special Operations Command disabled advertising IDs on iPhones, Android devices, and Windows computers across the federal military enterprise. The protections rolled out earlier in 2026, with the Air Force implementing changes in July, to prevent adversaries from exploiting app-derived location data sold through data brokers. Wyden warned that personal devices brought onto military bases could still expose troops and facilities, and noted the intelligence community and FBI buy such data without warrants.

TechCrunch · Security·Sep 4, 13:21 UTC · 12d agoPolicy & legal

A Secretive DHS ‘Predictive Policing’ Unit is Analyzing Americans’ Financial Habits and Pulling Them Over

404 Media reveals DHS Border Patrol's secretive Predictive Intelligence Targeting Teams (PITT) analyzing Americans' financial activity and feeding intelligence to local police for traffic stops.

404 Media identified Predictive Intelligence Targeting Teams (PITT) in the Spokane Sector (Washington) and Laredo Sector (Texas), which review law enforcement-sensitive databases including Americans' financial activity and pass intelligence to local police. In one case, a PITT analyst flagged financial patterns associated with narcotics activity, leading Montana Highway Patrol to stop a driver for an obstructed license plate and charge him with DUI and possession with intent to distribute. CBP declined to say what financial data is monitored or whether warrants are obtained; the program extends AP's earlier reporting on ALPR-based predictive policing.

404 Media·Sep 8, 13:10 UTC · 8d agoPolicy & legal

Bipartisan Senate bill aims to prepare energy sector for Q

Bipartisan Senate bill would direct FERC to factor quantum computing threats and post-quantum cryptography into US electric grid cybersecurity reliability standards.

The Quantum Grid Utility Assurance and Resilient Defense (Quantum-GUARD) Act, introduced by Senators Mike Rounds and Chris Coons, would require FERC to consider quantum computing threats when reviewing electric reliability standards and to explore post-quantum cryptography use in both IT and OT systems, plus a technical sandbox to study quantum impacts. It aligns with NIST's post-quantum algorithm work, and a June executive order moved the federal PQC migration deadline from 2035 to 2030. Industry experts noted the hard part is upgrading infrastructure such as SCADA communications and software update integrity ahead of those deadlines.

CyberScoop·Aug 24, 19:01 UTC · 23d agoPolicy & legal

CISA's logging guidance works beyond government

CISA released its Logging Reference Architecture in August 2026 to help federal agencies meet OMB M-26-14 logging requirements, usable as a benchmark by critical infrastructure operators.

CISA's Logging Reference Architecture (LRA), released in August 2026, helps US federal civilian agencies satisfy logging requirements in OMB Memorandum M-26-14 and explicitly encourages critical infrastructure operators to use it as a benchmark. The framework is organized around continuous event monitoring and threat hunting, investigation, response, and forensics, with a federal baseline of six months searchable and one year retrievable logs. Agencies must submit Agency Logging Plans within 90 days and work toward Advanced maturity within 320 days; the guidance also treats AI outputs as derived data requiring human review and preserved metadata.

Help Net Security·Aug 24, 00:00 UTC · 23d agoAdvisory

Risky Bulletin: White House lets private companies carry out offensive cyber ops

A White House memo directs DHS to create a program letting vetted private companies conduct US-government-directed offensive cyber operations against cybercrime.

A presidential memo tasks the DHS National Coordination Center with building a program, under DOJ and DHS oversight, through which private-sector companies can conduct offensive cyber operations against large-scale cybercrime organizations. Requirements include secure facilities, vetted personnel, a $1 million escrow for damages, and written approvals co-signed by DHS and DOJ executive directors. The program must launch within 60 days, around October 11, expanding a March executive order targeting scam compounds, ransomware, and other large-scale cybercrime.

Risky Business News·Aug 14, 04:42 UTC · Aug 14, 2026Policy & legal

U.S. Defense Manufacturer IEH Hit by Phishing Attack, Exposing Potentially Export

Security Affairs·Aug 9, 16:44 UTC · Aug 9, 2026Phishing & fraud