Florida Critical Infrastructure Cybersecurity Intelligence

This bulletin is produced by USF’s Strategic and Cyber Intelligence Program, in collaboration with Cyber Florida, to deliver timely, actionable insights and recommendations to help Critical Infrastructure owners and operators better protect Florida’s Critical Infrastructure.

Situational Awareness Bulletin
Cyber Threat Outlook

Florida critical infrastructure (CI) owners and operators face cyber threat actors who mostly sign in with stolen access rather than break in: phishing kits that defeat multi-factor authentication (MFA, the second sign-in check), help desk impersonation, and stolen employee credentials drove recent incidents at government, healthcare, and technology organizations. Attackers also exploit newly disclosed flaws in internet-facing management and network products, including the remote monitoring and management (RMM) tools that managed service providers (MSPs) use, firewalls, virtual private network (VPN) gateways, and routers, sometimes before a fix exists. Over the next 6 to 9 months, expect more of both, with data-theft extortion groups and ransomware operators continuing to pursue government and healthcare data, and internet-exposed industrial controllers at water utilities remaining a target for reported Iran-linked activity. These trends support this Bulletin's recommendations: require phishing-resistant MFA, verify help desk requests through a second channel, patch actively exploited flaws first, remove management interfaces and controllers from public internet exposure, and rehearse manual fallback procedures. Confidence in this outlook is moderate because current incident reporting is strong, but forecasts beyond six months depend on attacker choices (particularly with rapid AI development) and patching speed.

Confidence Level: MODERATE

Executive Summary

  • All Sectors: Researchers reported two separate campaigns: modified ConnectWise ScreenConnect clients that spread malicious scripts to newly connected computers, and ClickFix lures that install SloppyRAT malware ahead of ransomware. A phishing service bypassed multi-factor authentication (MFA) at 258 organizations. The Cybersecurity and Infrastructure Security Agency (CISA) added four Known Exploited Vulnerabilities (KEVs) to its catalog, including two Windows privilege escalation flaws (CVE-2026-81963 and CVE-2026-85880). Schneider Electric fixed a critical authentication flaw (CVE-2026-3869) in Modicon M580 programmable logic controllers (PLCs), and the Dutch National Cyber Security Centre (NCSC) warned that attackers will soon exploit two Check Point VPN flaws.
  • Commercial Facilities Sector: Attackers exploited a zero-day flaw in Adobe Commerce and Magento Open Source (CVE-2026-75650) to install a Rust backdoor and PHP web shells on online stores, and they exploited a months-old, already patched flaw in the WooCommerce Wholesale Lead Capture plugin (CVE-2026-27540) to upload PHP web shells.
  • Communications Sector: A likely Russian actor, possibly tied to Sandworm, exploited two Cisco Firewall Management Center (FMC) flaws to install Cyclops Blink malware, while other groups, including a Qilin ransomware operator, exploited the same flaws. CISA flagged active exploitation of a MikroTik RouterOS vulnerability chain and added Cisco, Citrix, and Fortinet flaws to its KEV catalog, and Telus warned of credential stuffing intrusions.
  • Defense Industrial Base Sector: Attackers targeted defense suppliers with fake job offers and video-conference invitations and used AppDomainManager hijacking and dynamic link library (DLL) sideloading to bypass endpoint security controls, a campaign that Palo Alto Networks Unit 42 attributes to the Iran-linked group Screening Serpens.
  • Financial Services Sector: The U.S. Treasury's Financial Crimes Enforcement Network (FinCEN) urged financial institutions to watch for and report cryptocurrency investment scams run by overseas scam centers, after reviewing about $12.7 billion in suspicious activity reported between September 2023 and December 2025.
  • Government Services and Facilities Sector: ShinyHunters claimed to have stolen more than 200,000 records from Florida's Driver and Vehicle Information Database (DAVID), and the Florida Department of Highway Safety and Motor Vehicles said the intruder used compromised credentials of a Plant City Police Department user. Separately, a Department of Homeland Security (DHS) Inspector General audit found weak control of a privileged service account at Customs and Border Protection (CBP).
  • Healthcare and Public Health Sector: Joint advisories disclosed Iranian cyber threat actors delivering CHOSEN BRICK spyware via fake magnetic resonance imaging (MRI) lures, AdaptHealth confirmed a breach exposing data on 4.1 million people, Boston Scientific disclosed quarterly revenue impacts, Fenway Health sustained pharmacy disruptions, and Novo Nordisk reported code exfiltration via stolen GitHub tokens.
  • Information Technology Sector: Attackers impersonated IT support to hijack Microsoft 365 accounts. Cisco and N-able released emergency fixes for maximum-severity flaws in Identity Services Engine (CVE-2026-76460, exploited as a zero-day) and N-central (CVE-2026-86218). Attackers are exploiting a critical Orkes Conductor flaw (CVE-2026-58138) that was patched in June, and a supply chain attack on Brevo likely injected malicious scripts into more than 100,000 websites.
  • Water and Wastewater Systems Sector: Federal officials launched Project Watershed 250, a six-month pilot that starts in Texas and gives water utilities free security help, after reported attacks on internet-exposed programmable logic controllers (PLCs) connected through cellular modems.

All Sectors

Modified ScreenConnect Clients Spread Malicious Scripts in Worm-Like Campaign Huntress reported that, beginning in late August 2026, attackers used social engineering, including a caller posing as tech support, to install modified ConnectWise ScreenConnect clients. The rogue clients copy four Visual Basic Script (VBScript) files to newly connected computers, which spreads the campaign to other ScreenConnect endpoints. ConnectWise reported a file transfer issue affecting cloud and on-premises ScreenConnect and said it would issue a CVE identifier and a fix. Florida managed service providers (MSPs) and information technology (IT) departments that run ScreenConnect must disable file transfer until the fix is available, review on-premises servers first, and remove unapproved remote access tools.

Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement Zscaler identified a new remote access trojan (RAT), SloppyRAT, in June 2026 and published its analysis on September 10, 2026. The infection chain starts with a ClickFix lure, a fake prompt that tricks users into running a command that abuses the Windows finger.exe utility. A ransomware-related actor likely uses SloppyRAT to gain a foothold and move laterally through a reverse proxy. Florida organizations must block outbound TCP port 79, restrict finger.exe, train staff never to paste commands from a web page, and monitor for renamed copies of curl.exe and Python running from user folders.

BigBear Microsoft 365 Phishing Service Bypassed MFA at 258 Organizations CloudSEK researchers gained administrator access to the control panel of BigBear 2.0, a phishing-as-a-service platform that uses an Evilginx2-based adversary-in-the-middle (AiTM) framework to capture passwords and authenticated session cookies from Microsoft 365 users. The panel showed 42 virtual private server nodes, more than 5,000 stolen credential records, and at least one completed multi-factor authentication (MFA) bypass at each of 258 organizations. The platform also uses JavaScript to disable FIDO2/WebAuthn, pushing victims toward weaker sign-in methods. Florida critical infrastructure operators and cloud administrators must reset exposed passwords, revoke active sessions and tokens, force re-authentication for high-privileged accounts, enforce phishing-resistant FIDO2/WebAuthn, and require managed devices in conditional access policies rather than relying on network location.

CISA Adds Four Known Exploited Vulnerabilities to Catalog The Cybersecurity and Infrastructure Security Agency (CISA) added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog on September 8, 2026, including two Microsoft Windows privilege escalation flaws: CVE-2026-81963, a link-following flaw, and CVE-2026-85880, a heap-based buffer overflow. Attackers with local, low-privilege access can exploit either flaw to gain SYSTEM privileges. The alert also lists N-able N-central (CVE-2026-86218) and Adobe Commerce (CVE-2026-75650), which this Bulletin covers below. Florida critical infrastructure defenders that operate Windows enterprise networks must install the Microsoft September 2026 Patch Tuesday updates.

Schneider Electric Issues Security Advisory for Critical Modicon Controller Flaw Schneider Electric published a security advisory for a critical authentication vulnerability, CVE-2026-3869 (Common Vulnerability Scoring System [CVSS] score 9.2), affecting Modicon M580 and Modicon M580 Safety programmable logic controllers (PLCs). SecurityWeek reported no exploitation. Florida utility operators, industrial plants, and water treatment facilities that use these controllers must review the Schneider Electric advisory for fixed versions, apply the update, and restrict operational technology (OT) management access to isolated subnets.

Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent The Dutch National Cyber Security Centre (NCSC) warned that attackers will soon try to exploit two critical Check Point flaws, CVE-2026-85102 and CVE-2026-85103. The first is an improper certificate validation flaw in virtual private network (VPN) negotiation that lets an unauthenticated attacker run code on a Security Gateway. The second is a heap overflow in the VPN certificate ASN.1 decoder that allows remote code execution on Security Gateways and Security Management Servers. Check Point released fixes on September 9, 2026: LivePatch Take 24 for R81.20, R82, and R82.10, or specific Jumbo Hotfix Accumulator builds for supported releases. End-of-support releases R80 through R80.40, R81, and R81.10 are also affected. Check Point reported no evidence of exploitation, and no public proof of concept exists. Florida critical infrastructure network defenders, MSPs, and enterprise administrators who run Check Point VPN gateways must install the fixed releases immediately and, for site-to-site VPNs, disable implied rules and restrict VPN access to specific IP addresses.

All Sectors Recommendations:

  • Patch vulnerabilities in the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog immediately, starting with the Windows privilege escalation flaws, and install the fixed Check Point virtual private network (VPN) gateway releases.

  • Require phishing-resistant Fast Identity Online 2 (FIDO2) security keys or device-bound passkeys on enterprise single sign-on (SSO) platforms, and require managed devices in conditional access policies instead of relying on network location.
  • Isolate industrial controllers and safety systems in dedicated operational technology (OT) subnets, and apply the vendor update for Schneider Electric Modicon M580 controllers.
  • Audit remote monitoring and management (RMM) tools, remove unapproved remote access software, disable ScreenConnect file transfer until ConnectWise releases a fix, and block outbound TCP port 79.

Chemical Sector

No sector-specific findings, advisories, or operationally relevant reporting were identified during this reporting period.

Commercial Facilities Sector

Adobe Patches Critical Magento Zero-Day Vulnerability Exploited in the Wild On September 7, 2026, Adobe released emergency security updates for CVE-2026-75650, a maximum-severity (CVSS 10.0) flaw that lets unauthenticated attackers run arbitrary code on Adobe Commerce, Adobe Commerce B2B, and Magento Open Source through the template system. Sansec discovered zero-day exploitation starting on September 4, 2026, in which attackers installed a Rust-based Linux backdoor and a Hypertext Preprocessor (PHP) web shell. CISA added the flaw to its KEV catalog on September 8 with a federal deadline of September 11. Affected versions include Adobe Commerce 2.4.4 through 2.4.9, Commerce B2B 1.3.3 through 1.5.3, and Magento Open Source 2.4.6 through 2.4.9, including August 2026 releases and earlier. Florida commercial facilities, retail vendors, and hospitality operators that run these products must apply the VULN-39341 patch and rotate encryption keys immediately.

Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells On In September 2026, researchers reported active exploitation of CVE-2026-27540, a critical unauthenticated arbitrary file upload flaw (CVSS 9.8 per Wordfence) in the WooCommerce Wholesale Lead Capture plugin for WordPress. The vendor fixed the flaw in version 2.0.3.2 on February 20, 2026, and the flaw affects version 2.0.3.1 and earlier. Attackers upload PHP web shells to achieve remote code execution, and Wordfence blocked more than 100,000 exploit attempts. Florida commercial facilities, wholesale distributors, and retail operators that run WooCommerce must upgrade to version 2.0.3.2 immediately and search upload directories for unexpected PHP files.

Commercial Facilities Sector Recommendations:

  • Apply the Adobe VULN-39341 patch to Adobe Commerce, Commerce B2B, and Magento Open Source, rotate encryption keys, and upgrade WooCommerce Wholesale Lead Capture to version 2.0.3.2 to remediate CVE-2026-75650 and CVE-2026-27540.
  • Audit e-commerce web roots and upload directories for unauthorized PHP scripts, and review servers for outbound connections to unfamiliar hosts.
  • Implement web application firewall (WAF) rules to inspect and block malicious template-injection and file-upload requests targeting store portals.

Communications Sector

Iranian Cyber Threat Actors Claim Telecommunications Disruption Across Major Texas Cities On September 8, 2026, the Iran-linked group APT IRAN claimed on Telegram that it disrupted AT&T internet service in Houston, Dallas, Austin, and San Antonio, Texas, during an outage on September 7. AT&T said it has no evidence supporting the claim and attributed the outage to attempted cable theft, so the claim remains unverified. The group also threatened to intensify attacks on U.S. telecommunications infrastructure through September 11. Florida communications service providers must review perimeter defenses, audit edge gateway credentials, and protect fiber routes against physical tampering.

Critical vulnerabilities in MikroTik RouterOS are being actively exploited Poland's national cybersecurity response team, CERT Polska, warned on September 5, 2026, that attackers are exploiting a two-flaw chain, dubbed MikroTrick, to take full control of MikroTik RouterOS devices that expose Secure Shell (SSH) to the internet. The chain combines CVE-2026-67276, an SSH authentication bypass, with CVE-2026-86060, an SSH privilege escalation flaw. Exploitation dates to at least September 2, and MikroTik released fixes on September 3 in RouterOS 7.25beta3, 7.24.2, 7.23.4, and 6.49.21. Florida telecommunications providers, Internet service providers (ISPs), and enterprise network defenders that run MikroTik edge hardware must update RouterOS immediately, disable public SSH management, and check devices for signs of compromise that predate the update.

CISA flags exploited Cisco, Citrix, Fortinet flaws, sets Sept. 12 federal patch deadline On September 9, 2026, CISA added three actively exploited flaws to its KEV catalog and required federal civilian agencies to patch by September 12: CVE-2026-20079 (CVSS 10.0), an authentication bypass in Cisco Secure Firewall Management Center that gives an unauthenticated remote attacker root access; CVE-2026-19490 (CVSS 9.3), an authentication bypass in Citrix NetScaler ADC and NetScaler Gateway configured as an authentication, authorization, and auditing (AAA) virtual server or Gateway; and CVE-2025-25249 (CVSS 7.3), a heap-based buffer overflow in Fortinet FortiOS, FortiSwitchManager, and FortiSASE that allows remote code execution. Cisco updated its advisory to say it became aware of exploitation attempts against CVE-2026-20079 in August 2026. Florida network administrators who run these products must apply the vendor patches immediately.

'Sandworm' Chains Cisco Vulnerabilities to Deploy Cyclops Blink Dark Reading reported on September 14, 2026, that a likely Russian threat actor, possibly tied to Sandworm, chained two flaws in Cisco Secure Firewall Management Center (FMC), CVE-2026-20079 (maximum severity) and CVE-2026-20316 (CVSS 5.3), to install a new variant of the Cyclops Blink malware. Sophos assessed with moderate confidence that the activity links to Sandworm. The malware harvests credentials, scans internal networks, and captures network traffic. Cisco identified two other groups exploiting the same flaws, including one that distributes Qilin ransomware. Cisco released hotfixes for both flaws. Florida communications providers and network administrators who run Cisco FMC must apply the hotfixes immediately and review FMC servers for signs of compromise.

Telus Warns Customers of Account Breaches Following Credential Stuffing Campaign Telus, a major Canadian telecommunications provider, notified some consumer customers that unauthorized individuals used compromised credentials to access their accounts at some point between February 2025 and June 2026. Exposed data included names, contact details, billing addresses, partial payment card numbers, and payment history. Telus stated that the individuals may have used this information to try to persuade customers to switch to competitors and may have made unauthorized changes to some customers' services. Telus has not confirmed where the credentials came from or how many accounts were affected, although the pattern is consistent with credential stuffing (automated login attempts using passwords stolen elsewhere). No Florida impact has been reported; however, Florida telecommunications providers with customer account portals face the same risk and should consider login rate limiting, multi-factor authentication (MFA), and monitoring for exposed customer credentials.

Communications Sector Recommendations:

  • Apply Cisco's hotfixes for CVE-2026-20079 and CVE-2026-20316 to Cisco Firewall Management Center appliances, and patch the Citrix NetScaler and Fortinet products listed in the CISA alert.
  • Update MikroTik RouterOS to a fixed release (7.25beta3, 7.24.2, 7.23.4, or 6.49.21) across all deployed edge routers.
  • Disable public-facing SSH and administrative web interfaces on perimeter routers, and restrict management access to isolated out-of-band networks.
  • Monitor edge router configuration files and system binaries against cryptographic baselines to identify unauthorized backdoor installations.

Critical Manufacturing Sector

No sector-specific findings, advisories, or operationally relevant reporting were identified during this reporting period.

Dams Sector

No sector-specific incidents, advisories, or operationally relevant reporting were identified during this reporting period.

Defense Industrial Base Sector

New Screening Serpens Cyberattacks Target Global Technology Professionals Cybersecurity researchers at Palo Alto Networks Unit 42 disclosed an active espionage campaign conducted by Iranian cyber threat actor group Screening Serpens, also tracked as UNC1549, targeting defense contractors and technology sector professionals. The cyber threat actor uses tailored social engineering lures, such as fake job recruitment offers and spoofed video conferencing invites, to deliver multi-stage payloads. The campaign combines dynamic link library (DLL) sideloading with AppDomainManager hijacking to bypass endpoint detection and response (EDR) tools during .NET application initialization, deploying six new remote access trojan (RAT) variants to exfiltrate sensitive corporate files. Florida defense contractors, aerospace engineering suppliers, and technology vendors must monitor endpoint logs for unauthorized AppDomainManager configuration changes and unverified DLL placements.

Defense Industrial Base Sector Recommendations:

  • Deploy behavioral threat detection rules across enterprise endpoints to monitor .NET runtime initialization for unauthorized AppDomainManager configuration changes and execution overrides.
  • Audit file systems for DLL sideloading vulnerabilities and enforce strict search-order protections across software execution directories.
  • Conduct specialized security awareness training for engineering and technical personnel to recognize tailored social engineering lures disguised as recruitment opportunities or video conferencing links.
  • Implement behavioral process monitoring to detect unapproved RAT communications, process injection, and telemetry tampering.

Emergency Services Sector

No sector-specific incidents, advisories, or operationally relevant reporting were identified during this reporting period.

Energy Sector

No sector-specific incidents, advisories, or operationally relevant reporting were identified during this reporting period.

Financial Services Sector

Treasury urges banks to file cyber scam reports, noting nearly $13 billion in losses since 2023 The United States Department of the Treasury issued a guidance advisory urging financial institutions, credit unions, and cryptocurrency platforms to enhance automated fraud detection systems. Federal reporting revealed that overseas investment schemes, social engineering campaigns, and cryptocurrency scams resulted in nearly $12.7 billion in financial losses since 2023. The advisory highlights sophisticated wire transfer diversion tactics used by international cybercrime syndicates to exfiltrate stolen funds. Florida financial institutions and payment processors must update transaction-monitoring algorithms, train customer-facing personnel on social-engineering lures, and accelerate Suspicious Activity Report filings.

Financial Services Sector Recommendations:

  • Enhance transaction monitoring to detect unusually high-value wire transfers and rapid cryptocurrency conversions linked to social engineering scams.
  • File Suspicious Activity Reports using FinCEN's scam-center keyword for suspected overseas scam activity.
  • Train customer-facing staff and anti-money laundering compliance officers to recognize overseas scams and fund-routing patterns.

Food and Agriculture Sector

No sector-specific incidents, advisories, or operationally relevant reporting were identified during this reporting period.

Government Services and Facilities Sector

ShinyHunters claims Florida DMV breach, puts data on the clock ShinyHunters, an extortion group, claimed to have stolen more than 200,000 records from the Florida Department of Highway Safety and Motor Vehicles (FLHSMV) Driver and Vehicle Information Database (DAVID) and published sample screenshots that contain Social Security numbers, dates of birth, driver's license details, and residential addresses. FLHSMV confirmed a breach it learned of on September 4, 2026, and said the intruder used compromised credentials of a single Plant City Police Department user that were improperly stored on a personal device. FLHSMV has not confirmed the group's record count or its stated method of access. Florida state agencies, municipal administrative offices, and law enforcement partners must enforce mandatory multi-factor authentication (MFA), prohibit the storage of agency credentials on personal devices, and restrict database query volumes.

US and Canadian Court Records Breached Following Thomson Reuters Incident Thomson Reuters disclosed on September 2, 2026, that an unauthorized party obtained C-Track court case management files in March 2026; the company discovered the activity on June 30. The files involve courts in Ontario, Canada; 11 states (Alabama, Kentucky, Montana, Nevada, New Hampshire, North Dakota, Ohio, Pennsylvania, South Carolina, Tennessee, Wyoming); and the United States Virgin Islands. Some records may include names, Social Security numbers, and medical information; confidential or sealed material may be affected. The attacker and access method remain undisclosed. No Florida courts are named, but the compromise occurred within vendor infrastructure, illustrating third-party risk.

CBP Begins IT Access Control Overhaul After Watchdog Finds Vulnerabilities On September 9, 2026, a Department of Homeland Security (DHS) Office of Inspector General (OIG) audit revealed severe access control vulnerabilities within United States Customs and Border Protection (CBP) IT infrastructure. Assessors discovered that over 76,000 personnel possessed access to a highly privileged service account, enabling users to alter system passwords, modify security settings, and take over administrative accounts. Furthermore, the component failed to revoke access for separated employees. Florida government facilities and municipal agencies must audit privileged service accounts, enforce least-privilege policies, and automate account deprovisioning workflows.

CBP Begins IT Access Control Overhaul After Watchdog Finds Vulnerabilities The Department of Homeland Security Office of Inspector General reported on September 4, 2026, that United States Customs and Border Protection (CBP) did not consistently apply information technology access controls, based on an audit from October 2024 to December 2025. All 76,000 CBP network users could access one highly privileged service account, enabling unauthorized changes to passwords, access permissions, and security configurations. Auditors identified more than 100 attack paths, and 20 percent of sampled employee accounts were not disabled promptly after separation. CBP concurred with all 12 recommendations. No compromise is reported; CBP systems support Florida ports of entry. Because sensitive biometric data are processed across major logistical hubs like Miami, Florida, these systemic access control weaknesses present operational integrity risks to regional critical transportation networks.

Government Services and Facilities Sector Recommendations:

  • Enforce mandatory MFA with device trust controls for all state database portals, block access from unmanaged personal devices, and prohibit storing agency credentials on personal devices.
  • Audit all shared and service accounts across enterprise IT networks, removing excessive administrative privileges and enforcing unique credential management.
  • Implement automated account deprovisioning pipelines that immediately revoke network access for separated personnel and transferred employees.
  • Conduct third-party supply chain security reviews for commercial vendors managing judicial, administrative, and law enforcement record platforms.

Healthcare and Public Health Sector

AdaptHealth Confirms 4.1 Million People Exposed in July Cyberattack Healthcare company AdaptHealth, a provider of home medical equipment, confirmed that a cyberattack exposed data on 4.1 million people. The company reported that attackers used social engineering to compromise a third-party contractor's user session and reach cloud-based patient management and document storage systems. Reports link the intrusion to the ShinyHunters extortion group, but the company has not confirmed the attribution. AdaptHealth first disclosed the incident in a filing with the U.S. Securities and Exchange Commission (SEC) on July 2, 2026. Florida healthcare organizations that depend on third-party contractors must review contractor account controls and monitor contractor sessions for compromise.

Health-ISAC Warns ShinyHunters Targets Health Sector with Vishing, Credential Theft and MFA Bypass Tactics Health Information Sharing and Analysis Center (Health-ISAC) warned on August 28, 2026, that the ShinyHunters extortion group conducts voice phishing campaigns against the global health sector. Callers spoof organizational phone numbers, pose as internal support, and direct employees on personal phones to look-alike login pages on domains such as company-claims[.]com and company[.]claims. Reverse-proxy phishing kits relay credentials in real time and capture multifactor authentication tokens or push approvals, enabling pivots from single sign-on to Microsoft 365, SharePoint, and Salesforce for data theft and extortion. Florida health care organizations fall within the scope; no Florida victims are named.

Luminis Health Care cyberattack class-action lawsuit claims unencrypted patient data exposed at AAMC Three patients filed a class-action lawsuit against Maryland-based Luminis Health Care, operator of Anne Arundel Medical Center, following a September 1 cyberattack. The lawsuit alleges that Luminis acted negligently by leaving patient medical records unencrypted in an internet-accessible environment, exposing individuals to serious risks of identity theft and financial or medical fraud. Although the cyberattack disrupted system operations and left patient portals offline, legal experts observe that proving quantifiable harm in healthcare breach cases remains difficult for plaintiffs. The legal action seeks broader class certification for affected patients.

Two Ransomware Groups Claim Attacks on Nationwide Home Healthcare Provider The Genesis ransomware group listed Interim HealthCare, a home healthcare provider in 40 states, on its leak site on August 10, 2026, claiming it stole 1 terabyte from Interim HealthCare of Oklahoma and Tulsa. On August 21, the Anubis group listed the company, claimed 530 gigabytes of franchisee financial and operational data, and published it. Interim HealthCare has not confirmed either claim. Interim HealthCare of Oklahoma City, Inc. reported a hacking incident to the U.S. Department of Health and Human Services on July 31. Although the article names no Florida offices, Florida home health agencies face a transferable extortion risk.

Boston Scientific cyberattack likely to have 'material impact' on financial results Boston Scientific detected a cyberattack on August 25, 2026, that disrupted its information technology systems, including customer order processing and shipping. In a September 7 filing with the U.S. Securities and Exchange Commission (SEC), the company said the attack is likely to have a material impact on third-quarter and full-year 2026 results and that it is unlikely to meet its sales growth and adjusted earnings-per-share guidance. Manufacturing has resumed at most facilities, and all sterilization facilities operate. Florida hospitals and surgical centers that buy Boston Scientific products should confirm order backlogs and delivery timelines with the company.

Fenway Health hit with "IT incident," affecting service Fenway Health, a Boston health system serving more than 30,000 patients, was responding to an information technology (IT) incident by Friday, September 11, 2026. The organization warned patients to expect delayed MyChart messaging and callbacks and closed its sexual health clinic. Fenway Health declined to confirm a cyberattack and did not say when it detected the incident or whether patient data was compromised. External IT experts are helping resume operations, and the organization had removed its website notice by September 13. Florida healthcare organizations should maintain tested downtime procedures for patient messaging and clinic scheduling.

Novo Nordisk Data Breach Tied to GitHub Access Tokens FulcrumSec, a cyber extortion group, began extorting Novo Nordisk in June 2026 and later released more than 1 terabyte of stolen data after the company refused to pay. FulcrumSec claims it found hardcoded access tokens in client-side JavaScript on two Novo Nordisk subdomains, including a GitHub token that opened more than 1,000 private repositories, and used them for two months to reach cloud environments. A researcher could not validate everything the attackers claimed. Florida healthcare, pharmaceutical, and technology organizations should remove hardcoded credentials from public-facing code, limit token permissions, and baseline token activity to spot bulk repository cloning.

Iranian cyber spies used fake MRI scan results to hack 'enemy of regime' On September 15, 2026, the United Kingdom's National Cyber Security Centre, the Federal Bureau of Investigation (FBI), and the Netherlands' General Intelligence and Security Service issued a joint alert on CHOSEN BRICK, Windows-only spyware that Iranian state-sponsored hackers use against dissidents, activists, and journalists. Operators build trust on WhatsApp or Telegram, then send files disguised as a fake magnetic resonance imaging (MRI) scan or software such as Norton Antivirus, and may move targets to personal devices. The malware adds Microsoft Defender exclusions and steals contacts, email, messages, and screen content. Florida organizations with at-risk staff should share the warning.

Healthcare and Public Health Sector Recommendations:

  • Enforce phishing-resistant multifactor authentication (FIDO2) for single sign-on and cloud applications, and require staff to verify unsolicited support calls through a known internal number.
  • Scan public-facing web code for hardcoded credentials, revoke any exposed tokens, limit token permissions, and alert on bulk repository cloning.
  • Warn at-risk staff to reject files from unverified WhatsApp or Telegram contacts, including fake medical scans, and alert on new Microsoft Defender exclusions.
  • Maintain tested, paper-based operational continuity playbooks to sustain critical patient care and diagnostic services during extended outages of the health system network.

Information Technology Sector

N-able patches max severity N-central flaw amid ongoing attacks On September 5, 2026, N-able released N-central 2026.3 Hotfix 4 (HF4) to fix CVE-2026-86218 (Common Vulnerabilities and Exposures), a maximum-severity remote code execution (RCE) flaw that lets unauthenticated attackers run code on internet-exposed, on-premises N-central servers. N-able reported no confirmed exploitation, but security firm Huntress flagged the flaw as a potential zero-day, and systems running Hotfix 3 remain vulnerable. Shadowserver tracks nearly 1,500 exposed servers. Florida managed service providers (MSPs), information technology (IT) vendors, and enterprise administrators running on-premises N-central must install HF4 immediately.

PoisonedRefresh: A Fileless Linux Rootkit That Injects PHP Web Shells Into F5 BIG-IP APM Server Memory On September 8, 2026, SophosLabs published an analysis of PoisonedRefresh, a Linux rootkit found in compromised F5 BIG-IP Access Policy Manager (APM) systems. F5 confirmed attackers exploited CVE-2025-53521 (Common Vulnerabilities and Exposures), an unauthenticated remote code execution flaw that F5 first classified as a denial of service. PoisonedRefresh, the second-stage payload, injects a PHP (Hypertext Preprocessor) web shell into Apache memory, while the installer modifies httpd, SELinux settings, and upgrades images to persist. Florida information technology (IT) service providers, data centers, and network operators using BIG-IP APM must follow F5 compromise assessment guidance and hunt for the /run/bigtlog.pipe socket.

Hackers Pose as IT Support to Hijack Microsoft 365 Accounts With Fake Passkey Alerts Microsoft reported an active campaign since May 2026 in which threat actors impersonate information technology (IT) help desks by phone or text to hijack Microsoft 365 accounts. Victims reach fake sign-in portals, such as passkeyhelpdesk[.]com, that capture credentials or device-code authorizations. Attackers then register their own multifactor authentication (MFA) methods and use Microsoft Graph, an application programming interface (API), for reconnaissance before collecting SharePoint, OneDrive, and Exchange Online data. Microsoft links initial access to Storm-3121 and Storm-3032. Florida IT providers, municipal tenants, and administrators must remove unauthorized MFA methods, revoke sessions, and train staff to verify requests.

GitLab Urges Emergency Patching for Maximum-Severity Path Traversal Flaw On September 10, 2026, GitLab released fixes for CVE-2026-85706 (Common Vulnerabilities and Exposures), a maximum-severity path traversal flaw in the repository commits application programming interface (API) of GitLab Community Edition (CE) and Enterprise Edition (EE). Under certain conditions, an unauthenticated attacker can read arbitrary data, including credentials and secrets. GitLab fixed the flaw in versions 19.3.2, 19.2.6, and 19.1, and watchTowr reported in-the-wild probing. Florida information technology (IT) providers, software vendors, and developers running self-managed GitLab must upgrade immediately and search web logs for Hypertext Transfer Protocol (HTTP) POST requests to /api/v4/projects//repository/commits/ containing a file.path parameter.

PaperCut Flaws Weaponized in Automated AI-Powered Attack Campaigns In September 2026, threat intelligence firm GreyNoise reported that a Russian-speaking threat actor used artificial intelligence (AI) to build, test, and deploy exploits against 440 PaperCut Multifunction (MF) and Next Generation (NG) deployments at 395 organizations in 48 countries. The flaws CVE-2026-82078 and CVE-2026-81578 (Common Vulnerabilities and Exposures) allow unauthenticated attackers to bypass authentication and execute arbitrary code. They became public as zero-days on August 27, and PaperCut patched them on August 28. The actor harvested credentials and gained domain administrator access at 12 organizations. Florida enterprise network administrators and information technology (IT) operators running PaperCut must apply vendor patches immediately.

Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week On September 9, 2026, Proofpoint reported that espionage-motivated clusters, most with a suspected China nexus, are using BlueMoon, an exploit kit. Proofpoint attributed its first use, on August 28, to China-aligned group APT31 (Advanced Persistent Threat 31). Spear-phishing links trigger two Chrome V8 zero-days and a Windows privilege-escalation flaw (CVE-2026-85046, CVE-2026-87491, CVE-2026-85880), all of which the Cybersecurity and Infrastructure Security Agency lists as exploited. Patching does not remove persistence, including the GemStone browser extension and scheduled tasks. Florida aerospace firms, nonprofits, and information technology (IT) providers must patch Chromium-based browsers and Windows, then hunt for those artifacts.

Hackers target exposed Vite dev servers to steal AWS, Azure secrets F5 reported a mass-scanning campaign against internet-exposed Vite development servers to steal Amazon Web Services (AWS) and Azure credentials, observing more than 800 attacks and about 32,000 raw events over a month. Attackers exploit CVE-2026-39364 (Common Vulnerabilities and Exposures), a file read and access control bypass in Vite versions 7.1.0 through 7.3.2 and 8.x before 8.0.5, and older flaws including CVE-2025-30208, CVE-2025-31125, and CVE-2024-45811. Florida information technology (IT) providers, software vendors, and cloud developers must update Vite, block port 5173 and /@fs/ requests, and rotate all secrets on exposed servers.

LiteSpeed Enterprise Flaw Could Let One Hosting Account Gain Root Access on a Shared Server On September 14, 2026, cPanel warned that a critical flaw in LiteSpeed Web Server Enterprise versions before 6.3.7 lets a low-privilege hosting account bypass isolation controls, including CloudLinux CageFS, and gain root access on a shared-hosting server. The advisory lists no Common Vulnerabilities and Exposures (CVE) identifier, does not say whether attackers exploited the flaw, and offers no workaround. Florida information technology (IT) service providers, web hosting operators, and cloud administrators running LiteSpeed Enterprise must immediately run /usr/local/lsws/admin/misc/lsup.sh -f -v 6.3.7, because automatic updates may lag.

BambooToken Malware Abuses MQTT Protocol to Control Windows and Linux Systems On September 15, 2026, Lumen Black Lotus Labs reported BambooToken, a Windows and Linux malware framework active since at least 2023 that uses Message Queuing Telemetry Transport (MQTT) for command-and-control. It spreads through Dynamic Link Library (DLL) sideloading via signed Tendyron OnKey Universal Serial Bus (USB) token software or by impersonating Kingsoft Office. Lumen found about a dozen victims, mostly in Asia and South America, and could not attribute the activity, though targeting fits China-aligned operations. Florida information technology (IT) providers and administrators face transferable risk and must audit DLL sideloading and inspect MQTT traffic against Lumen indicators.

Acronis Warns of Actively Exploited Privilege Escalation Flaw in cPanel Backup Plugin On September 15, 2026, Acronis updated an advisory published the prior weekend for CVE-2026-87886 (Common Vulnerabilities and Exposures), a high-severity (Common Vulnerability Scoring System 7.8) Linux local privilege escalation flaw. It affects the Backup plugin for cPanel and WebHost Manager (WHM) before build 1.9.3.1021 and the Plesk extension before build 1.8.11.638. Acronis reported limited, targeted exploitation of cPanel and WHM deployments, based on one customer report, and identified no indicators of compromise. Florida information technology (IT) providers, web hosting operators, and managed service providers (MSPs) must update to version 1.9.3 Hotfix 3 (HF3) or 1.8.11 immediately.

VectraRAT Can Hack Windows Enterprises for $250 per Month In September 2026, SOCRadar reported VectraRAT, a malware-as-a-service platform sold for $250 per month that supplies a Windows remote access trojan (RAT) and command-and-control infrastructure. SOCRadar found it on June 23; the operator has been active for nearly four years. Delivered through the Amadey loader and ClickFix pages, it offers keylogging, credential theft, and a User Account Control bypass. The United States, Russia, and Germany appeared most in the victim data. Florida information technology (IT) operators must treat any page prompting users to paste commands into the Run dialog as malicious and hunt for outbound Transmission Control Protocol (TCP) port 3308 traffic.

Cisco alerts customers to second actively exploited zero-day in as many days On September 16, 2026, Cisco disclosed and patched CVE-2026-76460 (Common Vulnerabilities and Exposures), a maximum-severity flaw in an application programming interface (API) of Cisco Identity Services Engine (ISE) that lets a remote attacker bypass authentication and gain full control of the device. Cisco confirmed exploitation before disclosure, offers no workaround, and published indicators of compromise. Researchers have made no attribution. The Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog. Florida information technology (IT) providers, municipal administrators, and critical infrastructure defenders must upgrade to fixed software immediately and hunt for Cisco indicators.

Brevo Supply Chain Attack Injects Malicious Scripts Into 100,000 Websites Brevo reported that attackers exploited a Security Assertion Markup Language (SAML) single sign-on flaw on September 10, 2026, to access 138 accounts and export contacts from 43. On September 14, a compromised Cloudflare application programming interface (API) key let attackers deploy a worker that, for about 5.5 hours, injected malicious scripts into three JavaScript files that customers embed. Scripts showed selected visitors a fake Cloudflare verification page (ClickFix) and tried to install a plugin for logged-in WordPress administrators. Sansec estimated that more than 100,000 websites were affected. Florida information technology (IT) providers using Brevo must check WordPress sites for unauthorized plugins.

Critical Orkes Conductor Vulnerability Exploited in Active Attacks SecurityWeek reported that attackers have exploited CVE-2026-58138 (CVSS 9.8) in Orkes Conductor since at least August 21, 2026. Orkes fixed the flaw in version 3.30.2 in June, and proof-of-concept code appeared in early August. Fortinet blocked about 1,300 exploitation attempts on September 8 and 9. The open-source server requires no authentication by default, so an unauthenticated request can run a hostile workflow that executes operating system commands, often as root. Florida IT vendors, cloud architects, and enterprise software developers who run Orkes Conductor must upgrade to version 3.30.2 or later, block internet access to workflow API endpoints, and review systems that ran older versions for signs of intrusion.

AsyncRAT Malware Abuses AutoIt and PowerShell to Hide Inside Legitimate Windows Process On September 14, 2026, Point Wild researchers disclosed a five-stage campaign deploying AsyncRAT, a remote access trojan (RAT). A batch file lure named "Right-click to open Invoice Details.bat" launches hidden PowerShell, which writes an AutoIt loader to a Temp folder and a Startup-folder batch file for persistence. The loader decrypts the RAT in memory and injects it into the Microsoft-signed charmap.exe. Researchers did not establish the delivery method and observed command-and-control at 158[.]51[.]122[.]136:4944. Florida information technology (IT) administrators and critical infrastructure defenders must monitor AutoIt launched from user-writable folders, audit Startup-folder batch files, and inspect injection into charmap.exe.

Information Technology Sector Recommendations:

  • Apply vendor fixes immediately to N-able N-central (CVE-2026-86218), Cisco Identity Services Engine (CVE-2026-76460), PaperCut, LiteSpeed Enterprise, and Acronis cPanel Backup plugins (CVE-2026-87886), and assess F5 BIG-IP APM systems for compromise.
  • Upgrade self-managed GitLab to 19.3.2, 19.2.6, or the fixed 19.1 release (CVE-2026-85706), Orkes Conductor to 3.30.2 or later, and Vite; block internet access to Orkes workflow endpoints and Vite port 5173, and rotate exposed secrets.
  • Remove unauthorized multifactor authentication methods in Microsoft 365, train staff to verify help desk requests, treat prompts to paste commands into the Run dialog as malicious, and check Brevo-embedded WordPress sites for unauthorized plugins.
  • Patch Chromium-based browsers and Windows, then hunt for persistence, DLL sideloading, AutoIt in user-writable folders, and MQTT traffic.

Nuclear Reactors, Materials, and Waste Sector

No sector-specific incidents, advisories, or operationally relevant reporting were identified during this reporting period.

Transportation Systems Sector

No sector-specific incidents, advisories, or operationally relevant reporting were identified during this reporting period.

Water and Wastewater Systems Sector

US launches Project Watershed 250 to tackle water system cybersecurity vulnerabilities with AI, red-team exercises In late August 2026, the Office of the National Cyber Director (ONCD) launched Project Watershed 250, a six-month pilot in Texas that uses red-team exercises and artificial intelligence (AI) tools to stress-test water utility networks and find weaknesses before adversaries do. The Environmental Protection Agency and the Cybersecurity and Infrastructure Security Agency are federal partners, participating utilities receive the support at no cost, and the administration will assess whether to expand the program nationwide. Florida water and wastewater utilities are not participants and must inventory connected operational technology (OT) assets, prioritize their most consequential exposures, and monitor for expansion.

Water and Wastewater Systems Sector Recommendations:

  • Remove direct public internet access and unencrypted cellular modem connections from all field PLCs, remote terminal units (RTUs), and water treatment controllers.
  • Require encrypted virtual private network (VPN) connections protected by phishing-resistant MFA for all remote system integrators and utility operators.
  • Change default administrative passwords across field controllers, human-machine interface (HMI) consoles, and cellular gateways to unique, complex passphrases.
  • Establish and regularly test manual operational failover playbooks to maintain continuous water treatment and distribution during control network disruptions.