All Sectors

CISA Confirms Windows Task Host Flaw Exploited by Ransomware Gangs. On August 18, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) updated its Known Exploited Vulnerabilities (KEV) Catalog, warning that ransomware groups are actively exploiting a high-severity privilege-escalation flaw in Windows Task Host. Tracked as Common Vulnerabilities and Exposures (CVE) record CVE-2025-60710, the vulnerability stems from improper link resolution within the host process container on Windows 11 and Windows Server 2025 systems. Local cyber threat actors with low-privilege access exploit the flaw to obtain full SYSTEM privileges on unpatched devices. CISA has not publicly disclosed further details about the specific ransomware campaigns involved. Florida critical infrastructure network defenders operating modern Windows environments must prioritize deploying vendor security patches.

Federal Agencies Warn Medusa Ransomware Has Impacted Over 500 Critical Infrastructure Organizations. On August 18, 2026, the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the Department of Health and Human Services (HHS) updated their joint advisory, AA25-071A, regarding Medusa ransomware. The variant has compromised more than 500 critical infrastructure organizations across multiple sectors. Affiliates purchase initial access from brokers who exploit unpatched edge appliances and remote services. Once inside, actors execute living-off-the-land commands, such as net share and recursive PowerShell directory queries, staging stolen files in directories excluded from antivirus scanning and using rate-limited Rclone processes to evade network traffic thresholds. Florida water and wastewater utilities, chemical processors, food and agriculture operators, and manufacturing plants operating internet-exposed Siemens S7 controllers must immediately remove all such devices from public internet access.

Federal Agencies Warn of Active Campaign Targeting Siemens Programmable Logic Controllers. On August 19, 2026, the National Security Agency (NSA), the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), the Department of Energy (DOE), and the Environmental Protection Agency (EPA) issued joint advisory AA26-231A. The advisory warns that threat actors are conducting active capability development and reconnaissance against internet-exposed Siemens S7 Series Programmable Logic Controllers (PLCs) across multiple infrastructure sectors. Adversaries utilize artificial intelligence tools to adapt open-source communications libraries, generating Python attack scripts disguised as legitimate operational technology (OT) monitoring software to communicate over Transmission Control Protocol (TCP) port 102. Florida utility operators, chemical processors, and manufacturing plants must immediately remove exposed industrial controllers from the public internet.

CISA Advisory Highlights Red Team Findings to Help Organizations Assess Risk, Identify Threats, and Enable Effective Incident Response. On August 25, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) published advisory AA26-237A, ‘A Tale of Two SOCs,’ detailing simultaneous red-team assessments of a Government Services and Facilities Sector organization and a Water and Wastewater Systems Sector organization. Both assessments used identical tradecraft — exploiting default credentials on an internet-facing web application, then abusing Active Directory misconfigurations to achieve a full domain compromise, cloud access, and access to sensitive business systems. The Government Services and Facilities organization’s Security Operations Center (SOC) failed to detect the intrusion amid thousands of false-positive alerts; the Water and Wastewater Systems organization isolated compromised hosts within minutes and blocked further access at its OT boundary. CISA noted that no assessed organization has implemented Conditional Access for workload identities. Florida government agencies and water utilities managing hybrid IT and cloud architectures should prioritize alert tuning and adopt workload-identity Conditional Access policies.

CISA Adds Six Known Exploited Vulnerabilities to Catalog. On August 26, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. The additions comprise six Common Vulnerabilities and Exposures (CVE) records: a memory buffer flaw in Citrix NetScaler Application Delivery Controller (ADC) and Gateway (CVE-2026-8452), a remote code execution bug in Microsoft SQL Server (CVE-2019-1068), an Ajax.NET Professional deserialization flaw (CVE-2021-23758), and three privilege escalation flaws: a Linux kernel out-of-bounds write flaw (CVE-2022-0995) and two Red Hat-specific userland vulnerabilities in libuser (CVE-2015-3246) and the Automatic Bug Reporting Tool, or ABRT (CVE-2015-5287). Florida critical infrastructure operators deploying Citrix perimeter gateways, legacy Microsoft SQL Server instances, or Red Hat Enterprise Linux systems should patch immediately. Florida critical infrastructure operators deploying Citrix perimeter gateways or legacy database servers should patch immediately to block initial access and local privilege escalation.

China-Affiliated Threat Actors Leverage Open-Source AI Models to Scale Intrusion Operations. In August 2026, cybersecurity researchers reported that state-affiliated Chinese cyber actors have more than doubled their attack volume by integrating open-source AI models — primarily DeepSeek — into reconnaissance and malware-development workflows. Groups including Grimfengxi and Huapi used AI to generate exploit code and map targets. Critically, documented autonomous AI-driven exploitation attempts did not achieve compromise on their own; researchers found that confirmed intrusions still required manual attacker follow-through, indicating AI currently accelerates reconnaissance and tooling more than it enables fully autonomous breaches. Florida critical infrastructure defenders should recognize that adversary AI-assisted tooling is compressing reconnaissance timelines even though human operators remain necessary to complete successful intrusions.

Aurora Ransomware Operators Deploy AI Coding Agent to Facilitate Live Enterprise Network Exploitation. On August 27, 2026, cybersecurity researchers disclosed that affiliates of the Aurora Ransomware-as-a-Service (RaaS) operation used the Cursor Artificial Intelligence (AI) coding assistant to conduct hands-on network exploitation across ten victim organizations. Cyber threat actors supplied the agent with compromised credentials, commanding it to configure proxy tunnels and scan internal subnets using custom Lightweight Directory Access Protocol (LDAP) scripts. The actors paired these actions with a Linux encryptor targeting VMware ESXi hypervisors, terminating virtual machines to encrypt virtual disk files. The agent, built on Anthropic’s Claude Sonnet model, required multiple command attempts for most tasks, and operators partially bypassed its safety controls by falsely framing the exploitation as an authorized penetration test — demonstrating that AI coding agents both reduce attacker workload and remain exploitable through social engineering even within the tooling itself. Florida critical infrastructure administrators maintaining virtualized server clusters and cloud-connected developer environments must restrict unmonitored development agents and enforce strict hypervisor access controls.

TerminalFix Campaign Abuses Fake Cloudflare Prompts to Deploy Reverse Tunnels. On August 30, 2026, cybersecurity researchers disclosed an evasion-focused social engineering campaign dubbed TerminalFix that targets enterprise organizations across multiple sectors. Compromised websites present users with fraudulent verification checks, prompting them to paste PowerShell scripts directly into Windows Terminal. The script initiates Dynamic Link Library (DLL) sideloading to execute a Python-based reverse-tunnel implant that routes Transmission Control Protocol (TCP) traffic through an encrypted WebSocket channel. The payload conducts automated Active Directory (AD) reconnaissance and network topology mapping. Florida critical infrastructure network defenders should restrict user command-line execution and audit workstation egress.

All Sectors Recommendations:

• Immediately deploy vendor security updates across all internet-facing perimeter infrastructure, prioritizing Citrix NetScaler Application Delivery Controller (ADC) and Gateway appliances, database platforms, and enterprise web integrations to mitigate the impact of automated exploit scripts.
• Apply patches for the Windows Task Host container flaw and for enterprise Linux kernels to close local privilege-escalation pathways, while enforcing application control policies to restrict unauthorized command-line execution and Dynamic Link Library (DLL) sideloading on endpoints.
• Disconnect all Siemens S7 Programmable Logic Controllers (PLCs) and industrial control devices from direct internet exposure, routing operational access through encrypted Virtual Private Networks (VPNs) protected by phishing-resistant Multi-Factor Authentication (MFA), and inspecting Transmission Control Protocol (TCP) port 102 for unauthorized communications.
• Restrict network access to VMware ESXi hypervisors and centralized management interfaces to isolated administrative subnets, enforce immutable offline backups for virtual disks, and prohibit unapproved artificial intelligence execution agents on enterprise developer systems.
• Audit enterprise security exclusions to eliminate blind spots used to stage adversary tools, inspect outbound network traffic for long-lived WebSocket reverse tunnels, and monitor for throttled data exfiltration attempts that leverage living-off-the-land utilities such as Rclone.

Chemical Sector

No sector-specific incidents, advisories, or operationally relevant reporting were identified during this reporting period.

Commercial Facilities Sector

Operation CameraSwarm Compromises Over 14,500 Surveillance Devices Globally. On August 19, 2026, cybersecurity researchers disclosed that a threat campaign dubbed Operation CameraSwarm compromised more than 14,530 Dahua surveillance devices and IP cameras. The cyber threat actors compromised the large majority of devices — over 12,300 of roughly 14,530 — through credential attacks against weak or default passwords. A smaller subset was reached via two authentication-bypass vulnerabilities (CVE-2021-33044 and CVE-2021-33045) and a Peer-to-Peer (P2P) relay technique targeting devices behind Network Address Translation (NAT). Attackers built persistent administrator accounts on compromised video systems. Florida commercial facilities, entertainment resorts, and physical security administrators operating networked video cameras must enforce strong, unique administrative credentials, disable unused peer-to-peer services, and isolate camera subnets from corporate environments.

Slovenian Casinos Reopen After Cyberattack Knocked Gaming Systems Offline. On August 31, 2026, gaming and hospitality operator Hit announced the phased reopening of its facilities following a cyberattack that forced six casinos in Nova Gorica, Slovenia, to shut down for three days. The intrusion disrupted internal servers, knocking gaming systems offline, disabling customer loyalty platforms, and forcing hotel reception desks and cafes to issue handwritten receipts. While information technology (IT) personnel restored basic slot machine functionality, table games remained unavailable. Florida hospitality resorts, gaming venues, and commercial entertainment facilities face similar operational continuity risks due to unauthorized enterprise access and server disruptions.

Commercial Facilities Sector Recommendations:

• Disable Peer-to-Peer (P2P) cloud connectivity features and remote viewing services across all Internet Protocol (IP) cameras and network video recorders where vendor cloud hosting is not operationally necessary.
• Isolate physical security systems, surveillance video infrastructure, and Point-of-Sale (POS) terminals onto dedicated Virtual Local Area Networks (VLANs) that are logically and physically separated from corporate administrative networks.
• Apply vendor firmware patches across all camera hardware to remediate legacy authentication-bypass flaws and replace factory-default credentials with complex, centrally tracked administrative passphrases.
• Maintain tested, manual operational contingency procedures, including offline transaction processing and paper logging, to ensure hospitality venues and gaming facilities sustain essential services during enterprise server outages.

Communications Sector

New Mirai Variant Evooo1Bot Targets Edge Devices With Stealth and Proxy Capabilities. On August 13, 2026, cybersecurity researchers reported that a newly identified Linux malware variant, dubbed Evooo1Bot, is actively compromising internet-facing network hardware. Built upon the Mirai botnet codebase, the malware targets routers, firewalls, and cameras manufactured by Alcatel, D-Link, Mitsubishi Electric, Netgear, Tenda, and Telesquare. Beyond conventional Distributed Denial-of-Service (DDoS) capabilities, Evooo1Bot incorporates encrypted Command-and-Control (C2) channels, honeypot-evasion logic, and a default credential sniffer. Crucially, the malware establishes Socket Secure (SOCKS) proxies on infected devices, enabling cyber threat actors to conceal their origin and pivot into internal enterprise networks. Florida telecommunications providers and network administrators must audit edge gateways and eliminate default credentials.

Dysphoria Botnet Compromises Over 290,000 Routers and Edge Devices. On August 14, 2026, security researchers reported that the Dysphoria botnet had compromised approximately 296,000 internet-facing routers, gateways, and network cameras globally. Cyber threat actors exploit weak administrative credentials and known remote code execution vulnerabilities in embedded Linux systems, using Universal Plug and Play (UPnP) port mapping to create unauthorized inbound routes. The botnet employs blockchain-based domain resolution via Ethereum Name Service (ENS) and Solana Name Service (SNS) for command-and-control resilience, transforming infected devices into residential proxy networks that anonymize malicious traffic. Florida telecommunications providers and network operators must audit edge appliances, disable automated port forwarding, and enforce strong authentication.

China-Linked Espionage Actor Compromises Core Cisco Routers and Authentication Servers. On August 31, 2026, incident response investigators disclosed that a Chinese state-sponsored espionage group tracked as Fire Ant compromised Cisco Internetwork Operating System (IOS) XR core routers and Terminal Access Controller Access-Control System (TACACS+) authentication servers. Sygnia identified two purpose-built tools associated with the intrusion: TacTap, which harvests credentials directly from the TACACS+ authentication process as administrators log in, and BridgeAgent, a Linux backdoor disguised as the Zabbix monitoring service on management hosts. Florida communications service providers and telecommunications operators must immediately audit edge routing infrastructure, TACACS+ authentication servers, and Linux management hosts for these indicators. The cyber threat actors altered router command paths to conceal malicious tunnels, filtered logging messages to blind telemetry, and hooked authentication daemons to harvest plaintext administrator credentials. Attackers leveraged this position to capture live network traffic and probe downstream critical systems. Florida communications service providers and telecommunications operators must immediately audit edge routing infrastructure and out-of-band management planes.

HPE Patches Critical ArubaOS-CX Remote Code Execution Flaw. On September 1, 2026, Hewlett Packard Enterprise (HPE) released urgent security updates for its ArubaOS-CX switch operating system, addressing a maximum-severity vulnerability tracked as Common Vulnerabilities and Exposures (CVE) record CVE-2026-73749. The flaw originates from multiple buffer overflow defects within an internal system daemon, enabling unauthenticated remote actors to send crafted network packets that execute arbitrary code with elevated privileges. The vulnerability affects multiple switch firmware branches, including 10.10 through 10.18 releases. Florida telecommunications providers, campus network operators, and enterprise data centers using Aruba core switching infrastructure must apply vendor firmware patches immediately or isolate switch management planes.

Cisco Warns of Unpatched Secure Email Flaws and Patches Critical Switch Vulnerabilities. On September 2, 2026, Cisco disclosed two unpatched vulnerabilities, tracked as CVE records CVE-2026-20354 and CVE-2026-20355, affecting the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption functionality in Cisco Secure Email Gateways. The issues allow adversary-in-the-middle positioning to recover plaintext email contents. Simultaneously, Cisco issued emergency security patches for critical remote code execution flaws in Nexus 9000 series switches (CVE-2026-20212) and Cisco IOS XR software (CVE-2026-20274). Florida communications service providers, enterprise network operators, and data routing hubs deploying Cisco perimeter infrastructure must apply switch patches and restrict unauthenticated network access to management interfaces.

Threat Actors Exploit Vulnerabilities in TP-Link Archer AX55 Edge Routers. In early September 2026, researchers disclosed two vulnerabilities affecting TP-Link Archer AX55 v4 wireless routers. The flaws could allow attackers with local network access to execute code through the EasyMesh service or recover administrator credentials from captured HTTP login traffic. Neither vulnerability is currently confirmed as actively exploited in the wild or remotely exploitable from the public internet. Florida telecommunications providers, critical infrastructure personnel, and small businesses using affected TP-Link hardware should promptly update router firmware, disable unnecessary EasyMesh functionality, and restrict management access to trusted local devices.

Communications Sector Recommendations:

• Verify the integrity of Cisco Internetwork Operating System (IOS) XR software images and kernel binaries against vendor cryptographic hashes to detect unauthorized modifications and intercepted daemons.
• Isolate Terminal Access Controller Access-Control System (TACACS+) authentication servers and router control planes on physically separated, dedicated out-of-band management networks with restricted administrative access.
• Disable Universal Plug and Play (UPnP) functions and unauthenticated Socket Secure (SOCKS) proxy routing across all customer premises equipment and enterprise routing hardware to prevent automated external port mapping.
• Audit perimeter network devices to eliminate default administrative credentials, disable legacy protocols including Telnet, and inspect Domain Name System (DNS) traffic for queries resolving decentralized blockchain domain naming systems.

Critical Manufacturing Sector

Clop Extortion Group Deploys Custom Web Shell for Mass Windchill Exploitation. On August 18, 2026, security researchers reported that the Clop extortion gang deployed a custom JavaServer Pages (JSP) web shell targeting PTC Windchill and FlexPLM Product Lifecycle Management (PLM) servers. Exploiting a critical remote code execution vulnerability (CVE-2026-12569), the attackers targeted internet-exposed servers across manufacturing and aerospace companies, stealing proprietary engineering blueprints, computer-aided designs, and supply chain records. The web shell executes within the legitimate application process, directly querying internal database connections to decrypt administrative passwords and locate stored intellectual property. Florida manufacturers and aerospace suppliers utilizing PLM software must patch immediately and audit web application directories for unauthorized JSP files.

Critical Manufacturing Sector Recommendations:

• Apply vendor security updates immediately to PTC Windchill and FlexPLM servers to remediate the Common Vulnerabilities and Exposures (CVE) record CVE-2026-12569 and prevent unsafe object deserialization.
• Remove Product Lifecycle Management (PLM) server interfaces from direct public internet exposure, and place application portals behind an enterprise Virtual Private Network (VPN) that requires phishing-resistant Multi-Factor Authentication (MFA).
• Inspect application web roots and servlet directories for unrecognized JavaServer Pages (JSP) files, abnormal file modification timestamps, or scripts referencing unusual Hypertext Transfer Protocol (HTTP) header parameters.
• Audit database query logs and engineering file vaults for anomalous, bulk data-export operations originating from internal web application service accounts.

Dams Sector

No sector-specific incidents, advisories, or operationally relevant reporting were identified during this reporting period.

Defense Industrial Base Sector

Iranian Espionage Group Expands Toolset With Backdoor and Reverse SSH Tunnel. On August 26, 2026, threat researchers reported that an Iranian-aligned cyber espionage group, Tortoiseshell, expanded its malware capabilities targeting aerospace and defense contractors across the United States and partner nations. The cyber threat actor deployed a modular C++ backdoor alongside a reverse Secure Shell (SSH) tunneling tool disguised as the legitimate Windows Terminal Server library wtsapi32.dll. Loaded via Dynamic Link Library (DLL) search-order hijacking, the utility abuses the native Windows OpenSSH client to channel command traffic into secured networks. Florida Defense Industrial Base (DIB) suppliers and aerospace engineering facilities must monitor endpoints for unauthorized DLL placements and unexpected outbound SSH tunnels.

Suspected Russian Hackers Abuse Google OAuth and WhatsApp Linking to Hijack Accounts. On August 20, 2026, cybersecurity researchers disclosed that suspected Russian cyber espionage groups UNC6293, UNC7005, and UNC5976 are exploiting authentication workflows to target the defense sector. The cyber threat actors use two distinct techniques. UNC5976 lures targets to fake file-sharing pages that redirect through the legitimate Google OAuth login, then capture the resulting authentication token via malicious cloud-hosted scripts — no rogue application or consent grant is required, meaning standard OAuth application approval controls do not mitigate this specific attack. UNC7005 uses fraudulent WhatsApp device linking and Microsoft device code phishing, including malicious Quick Response (QR) codes, to attach attacker-controlled devices to victim accounts and bypass Multi-Factor Authentication (MFA). Critically, these campaigns target victims’ personal email, messaging, and cloud accounts rather than corporate-managed accounts, creating a monitoring blind spot for organizational security teams. Florida Defense Industrial Base contractors must extend authentication-security awareness, and monitoring to employees’ personal Google, Microsoft, and WhatsApp accounts.

Department of Defense Launches Mobile SCIF Initiative for Secure Space Network. On September 3, 2026, the United States Department of Defense (renamed the Department of War) announced the launch of the Secure Space Network initiative to design, produce, and deploy approximately 50 transportable Sensitive Compartmented Information Facilities (SCIFs) nationwide. Led by the Office of Industrial Base Growth, the initiative addresses physical security barriers by providing accredited, deployable workspaces at military bases and industry hubs. The program enables non-traditional defense suppliers and commercial technology vendors to handle classified space information and classified programs without erecting expensive fixed infrastructure. Florida defense contractors and aerospace engineering suppliers that are expanding into classified programs benefit from improved regional access to accredited, secure environments.

Defense Industrial Base Sector Recommendations:

• Audit file systems for unauthorized instances of system dynamic link libraries, specifically wtsapi32.dll outside the System32 directory, and enforce Dynamic Link Library (DLL) search-order protections across enterprise endpoints.
• Restrict the execution of the native Windows OpenSSH client on user workstations and monitor network egress for unauthorized, long-lived Secure Shell (SSH) reverse tunnels.
• Enforce administrative approval workflows for all third-party Open Authorization (OAuth) application integrations across cloud tenants to prevent malicious application consent grants.
• Deploy phishing-resistant Multi-Factor Authentication (MFA) utilizing hardware security keys and train personnel to identify and reject fraudulent Quick Response (QR) code pairing prompts.

Emergency Services Sector

No sector-specific incidents, advisories, or operationally relevant reporting were identified during this reporting period.

Energy Sector

All Sectors

Hackers Target US Firms in FastJson Zero-Day Attacks Cyber threat actors are actively exploiting a critical remote code execution (RCE) zero-day vulnerability in the FastJson open-source Java library (versions 1.2.68 through 1.2.83). Unauthenticated attackers send specially crafted JavaScript Object Notation (JSON) payloads to execute arbitrary operating system (OS) commands on host servers. Imperva reports that FastJson 1.x is no longer actively maintained, so it is unlikely to receive a security update. Because FastJson is a foundational dependency embedded across enterprise Java applications in Florida’s financial, healthcare, and commercial sectors, organizations should immediately audit application manifests and deploy vendor patches.

Hackers Pose as IT Helpdesk on Microsoft Teams to Deploy GoGRPC Backdoor A sophisticated social engineering campaign is targeting enterprise users via Microsoft Teams. Cyber threat actors impersonate internal IT helpdesk personnel via Microsoft Teams voice calls and persuade employees to approve a Quick Assist remote-support session, after which PowerShell staging scripts deploy a custom Go-based backdoor (GoGRPC) that blends its command-and-control traffic with legitimate enterprise traffic. Because Microsoft Teams is universally deployed across Florida’s critical infrastructure perimeters, security teams should update employee awareness training and enforce strict authentication policies for internal IT communications.

Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks. Palo Alto Networks Unit 42 identified an operational shift in which a Chinese-speaking threat actor deployed autonomous artificial intelligence (AI) agent frameworks to execute end-to-end attack chains. The AI agent autonomously performed reconnaissance and attempted exploitation across seven vulnerabilities, but these autonomous attempts did not achieve compromise; confirmed data exfiltration resulted from separate, manually directed exploitation of a Citrix NetScaler vulnerability. This development signals a narrowing window for defender intervention across all critical infrastructure perimeters in Florida, requiring automated detection and response capabilities.

CISA, NSA, and FBI Release 2026 Minimum Elements for a Software Bill of Materials & Open Source Software Security Principles The Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), and Federal Bureau of Investigation (FBI) issued joint authoritative guidance establishing updated minimum elements for Software Bill of Materials (SBOM) and open-source software (OSS) risk management. The guidelines provide an operational framework for identifying nested open-source dependencies, verifying code provenance, and managing third-party software risk. Florida critical infrastructure operators should update vendor procurement contracts and software governance policies to mandate compliance with these federal supply chain standards.

All Sectors Recommendations:

• Deploy, verify, and maintain emergency security updates across all enterprise web applications and edge network appliances to remediate unauthenticated remote code execution (RCE) paths.
• Enforce, validate, and monitor phishing-resistant Fast IDentity Online 2 (FIDO2) hardware tokens and device-bound passkeys across all cloud, single sign-on (SSO), and remote management portals to mitigate adversary-in-the-middle (AiTM) session theft.
• Identify, isolate, and disable direct internet exposure for all operational technology (OT) assets, specifically industrial programmable logic controllers (PLCs) and human-machine interfaces (HMIs) managing critical public utilities.
• Update, educate, and test employee security awareness training to recognize internal Microsoft Teams helpdesk impersonation, social engineering lures, voice phishing (vishing) calls, and prompt injection attempts.
• Harden, tune, and audit Software Bill of Materials (SBOM) procurement requirements, open-source dependency manifests, and third-party vendor access boundaries in accordance with joint CISA, NSA, and FBI supply chain standards.

Chemical Sector

No sector-specific incidents, advisories, or operationally relevant reporting were identified during this reporting period.

Commercial Facilities Sector

Midnight Blizzard Deploys CaptiveCrunch AiTM Infrastructure to Target Travelers Russian state-sponsored group Midnight Blizzard (Advanced Persistent Threat 29 [APT29]) is executing a global campaign targeting hospitality networks, hotels, and conference centers. The actors compromise captive-portal Wi-Fi gateways to deploy “CaptiveCrunch” adversary-in-the-middle (AiTM) infrastructure, serving custom malware (CornFlake and ChocoShell) and harvesting corporate Microsoft 365 credentials from business travelers. Because Florida’s hotel and convention-center industry hosts a high volume of business travelers, corporate security teams should treat hotel and conference Wi-Fi as untrusted statewide.

Commercial Facilities Sector Recommendations:

• Audit, secure, and monitor public-facing Wi-Fi captive portals and venue gateway hardware against “CaptiveCrunch” adversary-in-the-middle (AiTM) redirection, Domain Name System (DNS) poisoning, and certificate-spoofing attacks.
• Mandate, enforce, and verify compulsory Virtual Private Network (VPN) usage and phishing-resistant multi-factor authentication (MFA) for all corporate employees connecting to public, hotel, or conference Wi-Fi networks.
• Isolate, segment, and protect commercial building automation systems (BAS / KNX protocol), smart lighting, physical access hardware, and guest Wi-Fi networks from core corporate administration plans.
• Patch, update, and validate enterprise resource planning (ERP) systems, including Oracle E-Business Suite and control panel (cPanel) web environments, to protect client personal data, financial records, and reservation systems.

Communications Sector

Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Zimbra The Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), and National Security Agency (NSA) issued a joint cybersecurity advisory warning of active phishing campaigns conducted by Russian state-sponsored cyber threat actors (LAUNDRY BEAR) targeting the Zimbra Collaboration Suite. The cyber threat actors exploit zero-day vulnerability CVE-2025-66376, deploying an automated payload (Ulej) that executes when an email is viewed in the webmail portal. Florida telecommunications providers and regional Internet Service Providers (ISPs) utilizing Zimbra must remain vigilant against these zero-click webmail threats.

Communications Sector Recommendations:

• Patch, update, and inspect all Zimbra Collaboration Suite and webmail installations immediately to remediate zero-click email exfiltration flaws (CVE-2025-66376) and hunt for custom Ulej backdoor artifacts.
• Perform, review, and document comprehensive security audits on regional Internet Service Provider (ISP) routing infrastructure, telecommunications data centers, and subsea cable landing stations to block session hijacking.
• Deploy, update, and verify immediate vendor patches for enterprise video conferencing clients (such as Zoom CVE-2026-53412) to remediate unauthenticated account takeover and privilege escalation risks.
• Establish, test, and maintain redundant, out-of-band communication channels and manual fallback workflows to sustain critical Emergency Alert System (EAS), Wireless Emergency Alerts (WEA), and public safety voice services during network outages.

Critical Manufacturing Sector

No sector-specific incidents, advisories, or operationally relevant reporting were identified during this reporting period.

Dams Sector

No sector-specific incidents, advisories, or operationally relevant reporting were identified during this reporting period.

Defense Industrial Base Sector

2026 Minimum Elements for a Software Bill of Materials (SBOM) The Cybersecurity and Infrastructure Security Agency (CISA), alongside the National Security Agency (NSA), the Federal Bureau of Investigation (FBI), and international partners, released the updated 2026 Minimum Elements for a Software Bill of Materials (SBOM). Superseding the 2021 baseline, this comprehensive update expands the scope of software supply chain transparency to explicitly include artificial intelligence (AI) software, open-source software, and Software-as-a-Service (SaaS). By introducing new data fields—such as cryptographic component hashes, licensing details, and generation context—the guidance shifts SBOMs from static compliance documents into dynamic, machine-readable records. These enhancements are designed to facilitate machine-speed automated analysis, empowering organizations to better identify, assess, and mitigate risks across their software ecosystems. Defense contractors operating near Florida’s major military installations must integrate these updated SBOM elements into their software procurement pipelines.

Defense Industrial Base Sector Recommendations:

• Audit, integrate, and mandate compliance with Cybersecurity and Infrastructure Security Agency (CISA) 2026 Software Bill of Materials (SBOM) minimum elements across all defense contractor software development and procurement pipelines.
• Enforce, segment, and verify strict, air-gapped least-privilege divisions between supplier-administered Information Technology (IT) networks and classified defense software assembly lines.
• Sanitize, restrict, and monitor connected generative AI coding assistants to low-privilege environments and scrub untrusted user comments in GitHub pull requests to prevent prompt injection.

Emergency Services Sector

No sector-specific incidents, advisories, or operationally relevant reporting were identified during this reporting period.

Energy Sector

Mustang Panda Targets India’s Government and Energy Sectors Researchers identified a cyber espionage campaign by the China-linked cyber threat group Mustang Panda targeting government agencies and energy organizations in India. The campaign employed SHARDLOADER to establish initial access and MINIRECON to conduct reconnaissance while abusing legitimate cloud services, including Zoho WorkDrive, to stage malicious payloads and obscure command-and-control communications. The use of trusted cloud platforms demonstrates the continued evolution of state-sponsored tradecraft designed to evade traditional security controls. Because Florida’s electric utilities and energy operators rely on cloud-based collaboration and administrative services, organizations should monitor for unauthorized use of trusted cloud platforms, strengthen endpoint detection capabilities, and review network activity for indicators of reconnaissance or persistence associated with advanced persistent threat (APT) operations.

New APT Group Targets Power Grids in Three Countries With AI-Crafted Malware Researchers identified a newly tracked advanced persistent threat (APT) group, Armored Likho, conducting cyber espionage operations against electric power providers and government organizations in multiple countries. The campaign deployed the AI-assisted BusySnake information-stealing malware while exploiting CVE-2025-9491 to gain initial access and establish persistence within targeted environments. The activity demonstrates the continued evolution of nation-state tradecraft targeting critical energy infrastructure through advanced malware and stealthy persistence mechanisms. Because Florida’s electric utilities and energy providers operate essential infrastructure that supports public safety and economic stability, organizations should promptly remediate known vulnerabilities, monitor scheduled tasks and endpoint activity for indicators of compromise, and strengthen detection capabilities to detect advanced persistent threat activity targeting operational and enterprise networks.

Energy Sector Recommendations:

• Harden perimeter gateways against advanced persistent threat actors targeting power grid routing infrastructure.
• Monitor commercial cloud synchronization utilities for anomalous data collection patterns or payload staging attempts.
• Isolate internal energy management operations from administrative corporate networks using strict network segmentation rules.

Financial Services Sector

Billion-Dollar Lender Suffers Data Breach, Warns Unauthorized Threat Actor Launched Ransomware Attack A U.S. financial institution disclosed that an unauthorized cyber threat actor launched a ransomware attack against its parent company’s network, potentially exposing sensitive customer information and disrupting business operations. Although investigators continue assessing the full scope of the incident, the breach highlights how compromises affecting parent organizations can cascade into subsidiary financial institutions through shared infrastructure and interconnected business systems. Because Florida’s financial institutions frequently rely on centralized corporate networks and shared technology services, organizations should review network segmentation between parent and subsidiary environments, strengthen ransomware preparedness, and continuously monitor for unauthorized access and potential data exfiltration across interconnected systems.

RedWing MaaS Packages Android Banking Trojan With 2FA Interception Security researchers identified RedWing, a new Android Malware-as-a-Service (MaaS) platform that enables cybercriminals to deploy banking malware capable of credential theft, intercepting one-time passwords (OTPs), and bypassing two-factor authentication (2FA). By lowering the technical barrier to entry, the service allows less-skilled cyber threat actors to conduct sophisticated financial fraud campaigns against mobile banking users. The malware also supports remote device control and credential harvesting, increasing the likelihood of account compromise. Because financial institutions and their customers increasingly rely on mobile banking applications, Florida organizations should strengthen mobile device management (MDM) policies, educate users about the risks of sideloading applications, monitor for suspicious authentication activity, and encourage the use of phishing-resistant authentication methods where available.

Financial Services Sector Recommendations:

• Review network segmentation points connecting parent architectures to local financial infrastructure to prevent cascading compromises.
• Enforce robust mobile device management settings to block untrusted application sideloading on corporate hardware.
• Audit single sign-on logs for anomalous session tracking markers indicating multi-factor authentication bypass attempts.

Food and Agriculture Sector

No sector-specific incidents, advisories, or operationally relevant reporting were identified during this reporting period.

Government Services and Facilities Sector

Hackers Breach Foreign Office Systems Using Stolen Fortinet Credentials The United Kingdom’s Foreign, Commonwealth & Development Office and multiple local government organizations experienced unauthorized access after cyber threat actors used previously stolen Fortinet firewall credentials to compromise government systems. The incident demonstrates how administrative credentials stolen during earlier campaigns can continue to provide attackers with access to sensitive government networks long after the initial compromise. Because Fortinet appliances are widely deployed across Florida state agencies and local governments, organizations should immediately audit firewall administrative accounts, rotate exposed or legacy credentials, enforce multi-factor authentication (MFA), and monitor for unauthorized remote access attempts associated with compromised perimeter devices.

Government Services and Facilities Sector Recommendations:

• Rotate perimeter firewall administrative credentials immediately to mitigate exposure from legacy data leaks.
• Enforce multi-factor authentication requirements strictly across all privileged remote access and virtual private networks.
• Review security logs for unauthorized configuration adjustments on edge defense appliances or internet-facing gateways.

Healthcare and Public Health Sector

No sector-specific incidents, advisories, or operationally relevant reporting were identified during this reporting period.

Information Technology Sector

Hijacked npm and Go Packages Use VS Code Tasks to Deploy Python Infostealer Cybersecurity researchers identified two hijacked npm packages and 16 compromised Go packages designed to infect Windows, Linux, and macOS developer systems. The malware hides execution inside a Microsoft Visual Studio Code task that activates when a trusted project folder is opened, retrieves encrypted JavaScript through blockchain transaction data, establishes a Socket.io backdoor, and deploys a Python information stealer. The campaign targets browser credentials, password managers, cloud tokens, GitHub data, cryptocurrency wallets, and developer artifacts. Florida organizations should remove affected packages, inspect developer systems for hidden folder-open tasks, and rotate potentially exposed credentials, tokens, application programming interface keys, and cloud secrets.

Critical Dell Wyse Management Suite Vulnerabilities Could Let Attackers Compromise Systems Multiple critical vulnerabilities were identified in Dell Wyse Management Suite (WMS) that could allow attackers to compromise enterprise thin-client management environments through remote exploitation. The flaws affect the software used to administer Dell thin clients centrally and, if left unpatched, could grant attackers elevated privileges and unauthorized control over managed endpoints. Because Wyse Management Suite is commonly deployed to manage enterprise endpoint infrastructure across government, healthcare, education, and commercial environments, successful exploitation could disrupt centralized device management and expose sensitive enterprise systems. Florida organizations using Dell Wyse Management Suite should immediately apply the latest security updates, restrict administrative access to management servers, monitor for unauthorized administrative activity, and review endpoint management systems for indicators of compromise.

Critical SimpleHelp Vulnerability Exploited for Malware Delivery Security researchers confirmed that cyber threat actors are actively exploiting CVE-2026-48558, a critical authentication-bypass vulnerability affecting SimpleHelp Remote Monitoring and Management (RMM) software, to deliver the Djinn Stealer malware. Successful exploitation allows attackers to forge OpenID Connect identity tokens, bypass authentication, and compromise managed systems through trusted remote administration infrastructure. Because SimpleHelp and similar RMM platforms are widely used by managed service providers supporting critical infrastructure, a successful compromise can provide attackers with broad access across multiple client environments. Florida organizations should immediately apply vendor security updates, monitor RMM servers for unauthorized authentication events, investigate suspicious OpenID Connect token activity, and review managed endpoints for indicators of Djinn Stealer infection.

Adobe Patches Seven Max-Severity ColdFusion Vulnerabilities Adobe released security updates addressing seven maximum-severity vulnerabilities affecting ColdFusion and Adobe Campaign Classic, including flaws that could allow pre-authentication remote code execution with minimal attacker interaction. Researchers observed active threat interest in these vulnerabilities, prompting Adobe to recommend Priority 1 patching within 72 hours for affected systems. Because ColdFusion continues to support enterprise web applications across government, education, healthcare, and commercial organizations, exploitation could provide attackers with an initial foothold into critical business environments. Florida organizations should immediately apply Adobe security updates, identify internet-facing ColdFusion servers, restrict unnecessary external access, and monitor web application logs for indicators of attempted exploitation.

Progress Kemp LoadMaster Flaw Could Let Attackers Execute Commands Remotely Researchers warned that cyber threat actors are actively exploiting CVE-2026-8037, a pre-authentication command injection vulnerability affecting Progress Kemp LoadMaster load balancers following the public release of proof-of-concept exploit code. Successful exploitation could enable attackers to execute arbitrary commands on vulnerable devices, granting unauthorized access to enterprise network infrastructure at the perimeter of critical environments. Because LoadMaster appliances are widely deployed to manage traffic across enterprise applications and critical infrastructure services, Florida organizations should immediately apply vendor security updates, restrict access to management interfaces, review administrative logs for suspicious requests, and continuously monitor perimeter devices for indicators of compromise.

Phantom Squatting: Hallucinated Web Domains Target AI-Assisted Developers Palo Alto Networks Unit 42 researchers identified a new supply chain threat known as Phantom Squatting, in which cyber threat actors register internet domains generated by artificial intelligence (AI) hallucinations to deceive developers using AI coding assistants. When AI tools reference nonexistent software packages, repositories, or websites, attackers can register those domains and distribute malicious code or phishing content to unsuspecting users. The technique exploits trust in AI-generated recommendations rather than software vulnerabilities, creating a new attack vector against software development environments. Because Florida government agencies, defense contractors, and technology organizations increasingly rely on AI-assisted development tools, they should validate AI-generated package references, verify repository authenticity before downloading software, monitor newly registered domains that resemble development resources, and implement software supply chain verification practices throughout development pipelines.

JADEPUFFER: First Agentic Ransomware Operation Targets Langflow AI Servers Security researchers identified JADEPUFFER, the first documented autonomous, agentic ransomware operation capable of conducting multiple stages of an attack with minimal human intervention. The campaign targets internet-exposed Langflow artificial intelligence middleware, allowing attackers to gain initial access, automate reconnaissance, execute malicious actions, and deploy ransomware through AI-assisted workflows. The emergence of autonomous ransomware represents a significant evolution in cyber threat capabilities by reducing attacker workload and accelerating intrusion timelines. Because Florida organizations are increasingly integrating AI development platforms into enterprise environments, they should identify and secure exposed Langflow instances, promptly apply vendor security updates, restrict unnecessary internet exposure, and continuously monitor AI infrastructure for indicators of unauthorized access and malicious automation activity.

New ChocoPoC RAT Targets Vulnerability Researchers Through Fake GitHub Exploits Cybersecurity researchers identified a new remote access trojan (RAT) known as ChocoPoC, which targets security researchers, vulnerability analysts, and DevSecOps personnel by embedding malware within fraudulent GitHub proof-of-concept repositories. Rather than exploiting software vulnerabilities directly, attackers rely on trusted research workflows to convince users to execute malicious code disguised as legitimate exploit demonstrations. Once installed, the malware enables credential theft, remote access to systems, and delivery of additional payloads while compromising systems used for vulnerability research. Because Florida government agencies, managed service providers, defense contractors, and enterprise security teams routinely evaluate proof-of-concept exploit code, organizations should isolate malware testing environments, verify repository authenticity before execution, restrict the use of untrusted code on production systems, and monitor developer workstations for suspicious outbound connections and unauthorized access to credentials.

Citrix Patches NetScaler Vulnerabilities Including New HTTP/2 Bomb Attack Citrix released security updates addressing multiple high-severity vulnerabilities affecting NetScaler ADC and NetScaler Gateway, including protections against the newly identified HTTP/2 Bomb denial-of-service attack. The vulnerabilities, including CVE-2026-10816 and CVE-2026-8451, could allow attackers to exhaust system resources, disrupt remote access services, or trigger memory-related failures in internet-facing appliances. Because NetScaler products are widely deployed to provide secure remote access across government agencies, healthcare organizations, educational institutions, and commercial enterprises, successful exploitation could significantly impact critical business operations. Florida organizations should immediately apply Citrix security updates, review internet-facing NetScaler deployments, monitor gateway logs for unusual HTTP/2 traffic and denial-of-service activity, and validate remote access resilience as part of business continuity planning.

FBI Warns TeamPCP Targets Software Supply Chains and Cloud Secrets The Federal Bureau of Investigation (FBI) issued a FLASH advisory warning that the TeamPCP cybercriminal group is conducting large-scale software supply chain attacks targeting developers and organizations supporting critical infrastructure. The campaign focuses on stealing cloud access tokens, Secure Shell (SSH) keys, Kubernetes secrets, and application programming interface (API) credentials to compromise development environments and enable lateral movement across enterprise cloud infrastructure. By targeting trusted software development and continuous integration/continuous deployment (CI/CD) pipelines, TeamPCP increases the risk of downstream compromises affecting multiple organizations. Because Florida’s defense contractors, government agencies, and technology providers rely heavily on cloud-native development environments, organizations should secure cloud credentials, rotate exposed access tokens and SSH keys, implement least-privilege access controls, and continuously monitor CI/CD pipelines for unauthorized access to credentials and suspicious repository activity.

Cavern Manticore: Exposing an Iran-Linked Modular C2 Framework Check Point Research identified Cavern Manticore, an Iran-linked advanced persistent threat (APT) campaign employing a highly modular command-and-control (C2) framework designed to target information technology providers and government networks. The operation incorporates mixed-mode C++/CLI and .NET Native AOT compilation techniques to improve stealth, evade traditional detection methods, and maintain persistent access within compromised environments. Researchers observed sophisticated modular tooling that enables flexible payload deployment and long-term espionage operations against enterprise networks. Because information technology providers frequently serve as trusted partners supporting Florida government agencies and critical infrastructure organizations, defenders should monitor for anomalous compilation artifacts, reconstruct metadata during malware analysis, strengthen endpoint detection capabilities, and investigate suspicious command-and-control communications indicative of state-sponsored activity.

Hackers Can Use 9 of the Most Popular AI Tools to Assemble Massive Botnets Security researchers demonstrated a new attack technique known as HalluSquatting, in which cyber threat actors exploit hallucinations generated by artificial intelligence (AI) coding assistants to distribute malicious software and assemble large-scale botnets. By exploiting AI-generated references to nonexistent software packages and repositories, attackers can register fraudulent resources that developers may unknowingly trust and install. The research highlights how AI-assisted development workflows can introduce software supply chain risks without exploiting traditional software vulnerabilities. Because Florida government agencies, defense contractors, and technology organizations are increasingly integrating AI-assisted development tools into their software engineering processes, organizations should validate AI-generated package references, verify repository authenticity before installation, implement software supply chain controls, and require human review of AI-generated code recommendations.

Dialogflow CX Rogue Agent Flaw Enabled AI Chatbot Data Theft Security researchers disclosed a critical “Rogue Agent” vulnerability affecting Google Dialogflow CX, demonstrating how improperly secured AI chatbot environments could be manipulated to execute unauthorized code, maintain persistence, and facilitate data theft. The flaw exploits weaknesses in permission boundaries and conversational AI workflows, allowing attackers to inject malicious logic into enterprise chatbot environments and potentially access sensitive organizational information. As AI-powered customer service and automated business applications become more common, weaknesses in conversational AI platforms present an expanding enterprise attack surface. Because Florida government agencies, healthcare organizations, financial institutions, and private-sector critical infrastructure operators increasingly rely on AI-driven customer interaction platforms, organizations should review Dialogflow CX deployments, validate permission boundaries, implement strict input validation, and continuously monitor AI agents for unauthorized code execution and abnormal data access.

Critical Gitea Flaw Under Active Exploitation, Researchers Warn Security researchers warned that cyber threat actors are actively exploiting CVE-2026-20896, a critical vulnerability (CVSS 9.8) affecting Gitea, a widely used self-hosted Git repository management platform. Successful exploitation could enable attackers to remotely compromise vulnerable Gitea instances, granting unauthorized access to source code repositories and the development infrastructure that supports enterprise software development and CI/CD operations. Because many organizations rely on self-hosted code repositories to manage proprietary software and operational technology projects, exploitation could lead to intellectual property theft and compromise of the software supply chain. Florida organizations using Gitea should immediately apply the latest security updates, restrict administrative access through source IP allowlisting, review repository activity for unauthorized access, and monitor development infrastructure for indicators of compromise.

AI Coding Tools Tricked into Hacking Developer Machine via Decades-Old Technique Security researchers demonstrated a new attack technique known as GhostApproval, showing how widely used AI coding assistants—including Claude, Cursor, and Amazon Q Developer—can be manipulated through a long-standing symbolic link (symlink) vulnerability to perform unauthorized actions on a developer’s workstation. By exploiting weaknesses in file approval workflows, attackers can deceive AI coding tools into modifying or accessing unintended files, potentially leading to remote code execution and compromise of development environments. The research highlights emerging risks associated with integrating AI assistants into software development workflows without sufficient security controls. Because Florida’s technology companies, government agencies, and defense contractors increasingly rely on AI-assisted software development, organizations should promptly apply vendor security updates, audit AI coding assistant permissions, strengthen sandbox protections, and require human validation of file operations initiated by AI development tools.

Threat Actor Uses Agentic AI to Compromise AWS Cloud in 72 Hours Security researchers analyzed a real-world attack in which a single cyber threat actor used agentic artificial intelligence (AI) tools to compromise an Amazon Web Services (AWS) cloud environment in approximately 72 hours. The incident demonstrated how AI-assisted automation can dramatically accelerate reconnaissance, privilege escalation, and lateral movement within cloud infrastructures, reducing the time required to compromise enterprise environments. Researchers noted that the attack highlighted the growing capability of AI to enhance offensive cyber operations rather than introducing new software vulnerabilities. Because Florida government agencies, critical infrastructure operators, and private-sector organizations increasingly rely on AWS cloud services, organizations should strengthen identity and access management (IAM), enforce least-privilege permissions, continuously monitor cloud activity for automated privilege escalation, and update incident response procedures to address AI-assisted attack techniques.

Large-Scale Exploitation Campaign Targeting Website Content Management Systems (CMS) The Australian Cyber Security Centre (ACSC) warned of a large-scale campaign targeting vulnerable content management systems (CMS) through unauthenticated file upload and deserialization vulnerabilities. Cyber threat actors have been exploiting internet-facing CMS platforms to deploy web shells, establish persistent access, and facilitate follow-on ransomware and data extortion operations. Researchers observed attackers leveraging these techniques to compromise publicly accessible websites that support government, commercial, and critical infrastructure organizations. Because Florida organizations rely extensively on CMS platforms to host public-facing services and operational websites, administrators should immediately apply security updates, review web servers for unauthorized file uploads and web shells, restrict unnecessary administrative access, and continuously monitor web application logs for indicators of exploitation.

AI Gateways Are the Keys to the Kingdom Security researchers highlighted the growing security risks associated with artificial intelligence (AI) gateways, demonstrating how a real-world compromise of an enterprise AI gateway enabled attackers to gain unauthorized access to cloud-hosted AI infrastructure and consume cloud computing resources. The research emphasizes that AI gateways have become high-value targets because they broker authentication, application programming interface (API) requests, and communications between enterprise applications and large language models (LLMs). A successful compromise could enable attackers to carry out lateral movement, access unauthorized data, and abuse cloud-based AI services. Because Florida government agencies, healthcare organizations, financial institutions, and critical infrastructure operators are rapidly adopting enterprise AI platforms, organizations should strengthen identity and access management (IAM) controls around AI gateways, continuously monitor AI service activity for anomalous API usage, restrict unnecessary permissions, and regularly audit AI infrastructure for unauthorized access.

Information Technology Sector Recommendations:

• Patch internet-facing applications, remote management platforms, and enterprise technologies to remediate actively exploited vulnerabilities.
• Verify software packages and code repositories to reduce supply chain risks from malicious dependencies.
• Rotate exposed cloud credentials and application programming interface keys to secure development infrastructure.
• Restrict permissions for generative artificial intelligence assistants and validate all automated code recommendations.
• Enhance endpoint detection capabilities to identify command-and-control communications, unauthorized authentication, and credential theft.

Nuclear Reactors, Materials, and Waste Sector

No sector-specific incidents, advisories, or operationally relevant reporting were identified during this reporting period.

Transportation Systems Sector

Maritime Phishing Campaign Targets South Korean Shipping and Logistics Organizations Researchers identified a cyber campaign targeting South Korean maritime organizations through phishing emails and business email compromise (BEC) infrastructure designed to steal credentials and gain unauthorized access to shipping and logistics networks. The operation leveraged the RedLine Stealer malware and supporting command-and-control infrastructure to compromise organizations involved in maritime transportation and global supply chain operations. The campaign demonstrates the continued targeting of shipping organizations as high-value entry points into international logistics networks supporting critical infrastructure. Because Florida’s seaports and maritime transportation systems play a vital role in domestic and international commerce, transportation organizations should strengthen phishing awareness training, implement multi-factor authentication (MFA) for business email accounts, monitor for unauthorized credential use, and continuously review network activity for indicators associated with RedLine Stealer and business email compromise campaigns.

2025 CTIME Report Highlights Growing Maritime Cyber Threats The U.S. Coast Guard released its 2025 Cyber Trends and Insights in the Marine Environment (CTIME) report, revealing a 17% year-over-year increase in maritime cyber incidents. Phishing drove 43% of initial access events, representing an 18-point rise. The Coast Guard also warned that out-of-the-box artificial intelligence cybersecurity platforms failed to detect simulated attacks unless explicitly tuned for the operating environment. Additionally, “Dark Fleet” vessels presented severe network risks, including unattended remote access tools and hardware designed for Automatic Identification System (AIS) spoofing. These vulnerabilities present a severe, escalating risk to Florida’s massive commercial port and maritime logistics network.

Transportation Systems Sector Recommendations:

• Train maritime logistics personnel to isolate unverified freight communications and prevent credential harvesting schemes.
• Tune cloud-hosted artificial intelligence security monitoring platforms specifically to match local port infrastructure traffic baselines.
• Establish redundant, out-of-band communication workflows to protect local delivery tracking fleets from tracking vulnerabilities.

Water and Wastewater Systems Sector

No sector-specific incidents, advisories, or operationally relevant reporting were identified during this reporting period.

Supplement:

Adversary Watch (Early July 2026)

This is a periodic operational intelligence analytic product for Florida’s Critical Infrastructure (CI) Managers, Planners, and CISOs to provide an integrated synthesis of recent CI-focused Threat Actor Campaigns, IT/OT TTPs, and Defensive Posturing. This issue covers trends in the period July 1-July 14 2026

1. Threat Actor & Campaign Matrix

Russia-Nexus (FSB Centre 16 / Turla, NoName, Armored Likho)

• Strategic Intentions: Espionage and prepositioning for CI sabotage. Operations specifically target power grids to disrupt communications between renewable energy assets and central power distribution networks. The GRU and Russian military are also actively testing CI response times via drone incursions and projecting continental-scale electronic warfare (GPS/PNT jamming).

• Sustained Capabilities: FSB Centre 16 exploits poorly configured edge routing devices, IP cameras, and legacy management protocols (SNMP) to monitor physical logistics and establish footholds. Armored Likho utilizes the evasive, Python-based BusySnake Stealer to target electric power operators.

• Targeted CISA Sectors: Energy, Water/Wastewater, Transportation Systems (Maritime), and Government Facilities.

China-Nexus (PLA/MSS / Salt Typhoon, UAT-7810)

• Strategic Intentions: Expanding Military-Civil Fusion doctrine to embed stealthy intelligence collection within global telecommunications and edge hardware for potential wartime disruption. Operations also heavily target the U.S. innovation base to steal AI product roadmaps.

• Sustained Capabilities: UAT-7810 relies heavily on custom malware (“SHORTLEASH”) to convert unpatched enterprise edge devices and network-attached storage into Operational Relay Box (ORB) networks, enabling obfuscated secondary attacks.

• Targeted CISA Sectors: Telecommunications, Defense Industrial Base (DIB), Energy, and Information Technology.

Autonomous AI & High-Tier Cybercriminals (JADEPUFFER, The Gentlemen, Hyadina, TeamPCP)

• Strategic Intentions: Rapid scaling of extortion, data theft, and supply chain compromise.

• Sustained Capabilities: JADEPUFFER represents a severe escalation: an “agentic” LLM actor autonomously navigating the kill chain from initial access to destructive database encryption without human operators. The Gentlemen have rapidly scaled to account for 17% of global ransomware attacks. Hyadina neutralizes EDR via kernel drivers, while TeamPCP extracts cloud access tokens and Kubernetes secrets via supply chain compromises.

• Targeted CISA Sectors: Cross-sector (heavy focus on Healthcare, IT, and Commercial Facilities).

2. Integrated TTP & Vulnerability Analysis

Primary Initial Access Vectors

• Edge Device & Perimeter Exploitation: Edge infrastructure remains the primary ingress vector. Threat actors are actively exploiting Citrix NetScaler SAML identity providers (CVE-2026-8451), Gitea reverse-proxy authentication (CVE-2026-20896), and Ubiquiti UniFi OS command injection (CVE-2026-50746). The “FortiBleed” campaign harvested configurations from over 73,000 Fortinet devices, currently facilitating INC and Lynx ransomware deployments.

• Supply Chain Poisoning: Lazarus Group and APT37 are compromising legitimate developer accounts to inject obfuscated loaders into open-source ecosystems (npm, Packagist).

Specific IT-to-OT Pivot Techniques

• Centralized Platform Hijacking: Threat actors are breaching IT/OT boundaries by compromising centralized management and middleware. Active exploitation of SimpleHelp RMM (CVE-2026-48558) grants administrative control over OT networks. Similarly, exploitation of Oracle E-Business Suite (CVE-2026-46817) and SharePoint (CVE-2026-45659) directly threatens logistics and DIB supply chains.

• Embedded Local Exploitation: Vulnerabilities in the FatFs filesystem library (embedded in millions of industrial controllers) allow threat actors with physical access to execute arbitrary code on OT assets via compromised USB/SD media.

• EDR Blinding: The Hyadina ransomware operation uses the PoisonX kernel driver to neutralize conventional endpoint detection mechanisms prior to execution.

3. Cross-Source Trends

• Convergence of Cyber and Physical Threats: Ransomware affiliates are escalating digital extortion by issuing credible threats of physical violence against organizational leadership and their families. Simultaneously, the maritime sector is experiencing a resurgence in physical piracy and drone incursions layered with tailored RedLine infostealer/BEC campaigns against logistics providers.

• Widespread PNT/GPS Degradation: Geopolitical electronic warfare (primarily Russian-led) is causing severe positioning, navigation, and timing (PNT) failures on a continental scale, resulting in critical dependencies for commercial aviation and maritime networks.

• IoT Botnets Threatening Adjacent OT: The rapid proliferation of Golang-based malware (Apex2, c2c/meow) targeting exposed Linux and IoT devices for DDoS botnets presents a high spillover risk to physically adjacent OT environments across Water and Agricultural sectors.

4. Defensive Implications

Immediate Prioritized Defensive Controls

• Edge & Middleware Triage: Florida CI operators must immediately patch or isolate Citrix NetScaler, Gitea instances, Oracle E-Business Suite, and SimpleHelp RMM interfaces.

• Fortinet Credential Rotation: Operators utilizing Fortinet firewalls must assume compromise if historical patching was delayed; CISOs must mandate absolute credential rotation and audit VPN configurations for unauthorized persistence.

• Disable Vulnerable On-Premises File Sharing: Isolate or completely disable on-premises Progress ShareFile Storage Zone Controllers facing active exploitation.

CI/OT Tailored Mitigation & Detection

• Zero-Trust for Distributed OT: Florida energy planners must mandate strict zero-trust segmentation between central distribution networks and remote renewable generation hardware (e.g., solar arrays) to block Russian FSB sabotage efforts.

• PNT Resilience: Florida maritime ports and aerospace corridors must immediately audit backup navigation mechanisms and implement resilient, non-GPS-dependent timing synchronization protocols.

• IoT Air-Gapping: Sectors relying on distributed sensors must strictly isolate IoT networks from core OT environments, disabling public-facing administrative ports and enforcing strict egress filtering.

• Physical Media Policies: Disable AutoRun and ban unvetted USB/SD cards near industrial controllers to mitigate the unpatched FatFs library vulnerabilities.

5. Intelligence Gaps

• Unverified Physical OT Manipulation: The Russian-linked hacktivist group NoName publicly claims they breached a Quebec water treatment plant with the capability to covertly manipulate physical OT assets (pumps, chlorine dosing). However, precise telemetry confirming successful physical manipulation downstream remains unverified.

• Decentralized Cybercriminal Infrastructure: While a key member of Scattered Spider was arrested, the collective has shifted to a decentralized model. The operational readiness, command structure, and remaining shared infrastructure of these independent clusters lack clear definition.

• Initial Intrusion Vectors: The specific vulnerability exploited by the “Breach Boyz” to steal sensitive PII at the Rogers County Jail remains unconfirmed by third-party auditors, limiting the ability to establish preventative indicators for other emergency services facilities.

No sector-specific incidents, advisories, or operationally relevant reporting were identified during this biweekly reporting period.

Financial Services Sector

NAIC Confirms June Data Breach The National Association of Insurance Commissioners (NAIC) confirmed a data breach involving unauthorized access to its PeopleSoft financial reporting environment on or about June 11, 2026. This breach was caused by the same Oracle PeopleSoft zero-day (CVE-2026-35273) already covered as a separate item under All Sectors earlier in the bulletin. Cyber threat actors temporarily accessed sensitive data repositories before the activity was identified, contained, and remediated. The scope of the breach is disputed: the attacker has published a large volume of data, while NAIC maintains the group is unlikely to hold the full scope of regulatory data it has claimed, and confirms no personally identifiable information or payment data was accessed. Nevertheless, the incident highlights the continued risk posed by third-party platforms supporting regulatory reporting and financial operations. Because Florida insurers and the Florida Office of Insurance Regulation rely on similar enterprise systems to exchange regulatory information, organizations should strengthen third-party risk management, continuously monitor privileged access, and validate security controls protecting financial reporting environments.

Financial Services Sector Recommendations:

• Conduct recurring third-party risk assessments of regulatory reporting platforms and financial service providers to identify authentication, access control, and configuration weaknesses.

• Enforce least-privilege access controls and multifactor authentication for users with access to sensitive financial reporting systems.

• Monitor authentication logs, privileged account activity, and data access events continuously for indicators of unauthorized access or credential misuse.

• Review business continuity and incident response procedures to ensure regulatory reporting operations can continue during third-party cybersecurity incidents.

• Coordinate with third-party vendors to validate incident notification procedures and recovery responsibilities following security events.

Food and Agriculture Sector

No sector-specific incidents, advisories, or operationally relevant reporting were identified during this biweekly reporting period.

Government Services and Facilities Sector

Russia APT ‘Gamaredon’ Upgrades Arsenal, Requiring New Defenses The Russian state-sponsored Advanced Persistent Threat (APT) group Gamaredon, also known as Aqua Blizzard, has expanded its malware toolkit by deploying more sophisticated PowerShell-based downloaders and enhanced command-and-control evasion techniques. These updates improve the group’s ability to maintain persistent access while avoiding traditional signature-based detection methods. ESET’s research documents that Gamaredon’s 2025 campaigns exclusively targeted Ukrainian government and military institutions. There is currently no evidence the group is specifically targeting U.S. or Florida government entities directly. The group’s evolving techniques, however — including new PowerShell-based downloaders and abuse of legitimate cloud and tunneling services to conceal command-and-control infrastructure — reflect broader nation-state tradecraft trends that Florida government organizations should incorporate into defensive planning. Florida state and local government organizations should consider proactive measures to strengthen behavioral monitoring, restrict unauthorized PowerShell execution, and continuously monitor outbound network communications for indicators of malicious activity associated with advanced persistent threats.

Government Services and Facilities Sector Recommendations:

• Implement PowerShell execution controls, including Constrained Language Mode, to reduce the risk of unauthorized script execution.

• Monitor endpoint and network telemetry continuously for anomalous PowerShell activity and command-and-control communications.

• Conduct recurring integrity reviews of administrative workstations and privileged accounts to identify persistence mechanisms or unauthorized system modifications.

• Strengthen endpoint detection and response capabilities to improve visibility into advanced persistent threat activity.

• Exercise incident response procedures focused on nation-state cyber threats targeting government networks and essential public services.

Healthcare and Public Health Sector

H-ISAC TLP Green: Ransomware Data Leak Sites Report The Health Information Sharing and Analysis Center (H-ISAC) Traffic Light Protocol (TLP): Green Ransomware Data Leak Sites Report provides healthcare organizations with timely visibility into ransomware groups actively publishing victim data on extortion sites. By monitoring these disclosures, organizations can identify emerging ransomware campaigns, validate potential compromises, and prioritize defensive actions before operational impacts escalate. Because healthcare providers remain frequent ransomware targets, Florida hospitals, clinics, and public health organizations should integrate external threat intelligence with internal security monitoring, continuously assess third-party vendor risk, and validate backup recovery capabilities to support uninterrupted patient care during cyber incidents.

Healthcare and Public Health Sector Recommendations:

• Validate backup integrity and routinely exercise disaster recovery procedures to maintain continuity of patient care during ransomware incidents.

• Monitor ransomware data leak sites continuously and correlate external reporting with internal security logs to identify potential compromises.

• Strengthen third-party vendor risk management programs and validate security controls protecting healthcare information systems.

Information Technology Sector

Palo Alto Warns of Active Exploitation of PAN-OS GlobalProtect VPN Flaw Cyber threat actors are actively exploiting an authentication bypass vulnerability (CVE-2026-0257, CVSS 7.8) affecting Palo Alto Networks GlobalProtect Virtual Private Network (VPN) gateways. The flaw allows attackers to forge authentication cookies and establish unauthorized VPN sessions; Palo Alto Networks reports no evidence of subsequent code execution or lateral movement in confirmed cases. The vulnerability only affects devices with authentication override cookies enabled and a certificate shared with another feature, not all GlobalProtect deployments. Because GlobalProtect appliances are widely deployed across government, healthcare, financial services, and other Florida critical infrastructure sectors, exploitation could enable unauthorized network access, operational disruption, and lateral movement throughout enterprise environments. Organizations should immediately apply vendor updates, restrict exposure of management interfaces, and continuously monitor authentication activity for indicators of compromise.

CISA Flags LiteSpeed cPanel Plugin Flaw Exploited for Root Privilege Escalation The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-54420 to the Known Exploited Vulnerabilities (KEV) Catalog after confirming active exploitation affecting LiteSpeed cPanel Plugin deployments. The vulnerability allows attackers with limited access to escalate privileges and potentially obtain administrative control of shared hosting environments. Because shared hosting platforms support many municipal governments, educational institutions, and small businesses throughout Florida, organizations should promptly update affected systems, review administrative privileges, and monitor hosting environments for unauthorized activity.

CISA Orders Feds to Patch Max Severity Joomla Plugin Flaw CISA directed federal agencies to remediate a critical vulnerability (CVE-2026-48907) affecting the Joomla Content Editor (JCE) plugin after adding it to the Known Exploited Vulnerabilities (KEV) Catalog. The vulnerability allows unauthenticated attackers to upload malicious PHP files and execute arbitrary code on vulnerable web servers. It is important to note that patching alone does not remove a web shell that attackers may have already planted on a compromised site before the update was applied, so defenders will need to hunt for Indicators of Compromise (IOCs) to detect them. Because Joomla is widely used to host public-facing government and organizational websites, exploitation could result in website defacement, unauthorized data access, or disruption of public services. Florida organizations should prioritize remediation, review web application security controls, and continuously monitor internet-facing websites for suspicious activity.

Google Vertex AI SDK Flaw Enables Cross-Tenant Model Hijacking Researchers disclosed a critical design flaw affecting the Google Cloud Vertex Artificial Intelligence (AI) Software Development Kit (SDK) for Python that could allow attackers to hijack machine learning model deployments across cloud environments. By exploiting predictable storage bucket naming, attackers may replace legitimate models with malicious versions capable of executing unauthorized code. Because the flaw was responsibly disclosed in March 2026 and fully patched by April 15, 2026 (SDK version 1.148.0), any actively maintained Vertex AI deployment running a current SDK should already be protected. As artificial intelligence adoption continues to expand across government and private industry, Florida organizations using Google Cloud should upgrade affected SDK versions, validate cloud storage configurations, and review software development security practices to reduce supply chain risk.

Salesforce Disables Klue Battlecards Integration Following OAuth Token Theft Cyber threat actors compromised the Klue Battlecards integration platform to steal Open Authorization (OAuth) tokens and access customer information through trusted third-party integrations, including Salesforce environments. The initial entry point was a long-dormant but still-active legacy credential, originally created for an abandoned third-party integration prototype. The incident highlights the growing cybersecurity risks associated with interconnected cloud services and software supply chain dependencies. Florida organizations should review third-party integration permissions, monitor application programming interface (API) activity for anomalous behavior, and regularly revoke unnecessary authorization tokens to reduce the likelihood of unauthorized access.

Malicious Edge Extension Abuses Native Messaging as Bridge to Malware Cyber threat actors are distributing a malicious Microsoft Edge browser extension that abuses the Chrome Native Messaging protocol to bypass browser security controls and execute malicious code on endpoint systems. This technique enables attackers to launch native processes, compromise connected applications, and establish persistent access while avoiding traditional browser protections. The campaign, dubbed ‘Edgecution,’ is linked to an initial access broker associated with the Payouts Kings ransomware operation. It originated with attackers impersonating IT support staff on Microsoft Teams and directing employees to a fraudulent ‘Outlook Updates Management Console’ page under the pretense of a spam-filter update. Because browser extensions are commonly used across enterprise and government environments, Florida organizations should restrict extension installations, monitor endpoint activity for unauthorized native messaging, and educate users on the risks associated with unapproved browser add-ons and the hazards of attackers impersonating IT staff.

Information Technology Sector Recommendations:

• Apply vendor patches immediately for Palo Alto GlobalProtect, LiteSpeed cPanel Plugin, Joomla Content Editor, and other products identified in the Known Exploited Vulnerabilities (KEV) Catalog.

• Check for existing IOCs, which have been published by the JCE security team and independent researchers, to detect existing Joomla plugin flaws.

• Review internet-facing systems routinely to identify exposed services, vulnerable applications, and unauthorized administrative interfaces.

• Strengthen cloud security by validating third-party integrations, restricting Open Authorization (OAuth) permissions, and monitoring application programming interface (API) activity for suspicious behavior.

• Upgrade Google Cloud Vertex Artificial Intelligence (AI) Software Development Kit (SDK) deployments to supported versions and implement secure software development practices for artificial intelligence environments.

• Restrict browser extension installations through enterprise policies and continuously monitor endpoints for unauthorized native messaging activity or other indicators of compromise.

• Conduct continuous vulnerability assessments and threat hunting activities to identify emerging risks before they affect business operations.

Nuclear Reactors, Materials, and Waste Sector

No sector-specific incidents, advisories, or operationally relevant reporting were identified during this biweekly reporting period.

Transportation Systems Sector

No sector-specific incidents, advisories, or operationally relevant reporting were identified during this biweekly reporting period.

Water and Wastewater Systems Sector

Last Mile Cybersecurity On June 22, 2026, the Institute for Security and Technology (IST) released a policy memorandum addressing cybersecurity gaps in federally funded infrastructure projects, particularly the lack of cybersecurity requirements tied to grant funding. The guidance emphasizes incorporating cybersecurity planning, risk assessments, and dedicated funding into infrastructure modernization efforts rather than treating cybersecurity as a separate initiative. Policy memoranda notwithstanding, Section 40126 of the Bipartisan Infrastructure Law already requires the Department of Energy to mandate cybersecurity plans for its grant recipients. Because many Florida water and wastewater utilities rely on federal funding while operating with limited cybersecurity resources, integrating security requirements into infrastructure projects will improve operational resilience and reduce long-term cyber risk.

NIST Offers Security Guidance for Water Utilities Using Remote-Access Tools The National Institute of Standards and Technology (NIST) published updated guidance in the final version of NIST Special Publication 1800-45, “Cybersecurity for the Water and Wastewater Sector: Build Architecture” to help water and wastewater utilities strengthen the security of remote-access technologies used to manage operational systems. Notably, Cybersecurity Dive’s reporting notes that remote-access weaknesses of exactly this kind “enabl[ed] several Iran-linked cyberattack campaigns against U.S. water systems.” The recommendations include restricting unnecessary remote access, implementing multifactor authentication, maintaining detailed access logs, and continuously monitoring remote connections for suspicious activity. Because remote-access technologies remain a common attack vector for cyber threat actors targeting critical infrastructure, Florida water utilities should review remote-access architectures, validate authentication controls, and strengthen monitoring capabilities to reduce operational risk.

Water and Wastewater Systems Sector Recommendations:

• Incorporate cybersecurity requirements into infrastructure modernization projects and grant-funded initiatives to improve long-term operational resilience.

• Identify and inventory all internet-facing operational technology (OT) systems, remote-access pathways, and supporting network infrastructure.

• Strengthen remote-access security by implementing multifactor authentication (MFA), network segmentation, and continuous monitoring of privileged connections.

• Conduct recurring cybersecurity assessments of operational technology environments and validate manual operating procedures to maintain essential services during cyber incidents.

• Coordinate proactively with federal and state partners to leverage available cybersecurity resources, technical assistance, and grant opportunities supporting water sector resilience.