Florida Critical Infrastructure Cybersecurity Intelligence

This bulletin is produced by USF’s Strategic and Cyber Intelligence Program, in collaboration with Cyber Florida, to deliver timely, actionable insights and recommendations to help Critical Infrastructure owners and operators better protect Florida’s Critical Infrastructure.

Situational Awareness Bulletin

Cyber Threat Outlook

Florida’s critical infrastructure operators face an accelerating wave of attacks against the software and network equipment that connects their organizations to the internet, with attackers exploiting newly disclosed flaws within days of disclosure and, in several cases, before a fix even exists. Over the next six to nine months, three patterns will likely dominate the threat landscape: mass-exploitation campaigns against widely used enterprise software, illustrated by the Oracle PeopleSoft vulnerability behind the ShinyHunters extortion campaign that has already struck a national insurance regulator; continued compromise of network perimeter devices, including firewalls, virtual private networks (VPNs, which let remote users connect securely to a private network), and routers that organizations rely on for both security and connectivity; and the abuse of trusted third-party cloud integrations, where attackers steal credentials from one vendor to reach every customer connected to it. Nation-state actors, particularly those linked to Iran and Russia, continue probing government and public safety systems abroad for techniques that could migrate to U.S. targets. For Florida operators, the most effective defenses remain unglamorous but proven: patch internet-facing systems quickly, require multifactor authentication everywhere it is available, and rehearse manual backup procedures so operations can continue if digital systems fail.

Confidence Assessment – High

Executive Summary

All Sectors: Prioritize risk-based vulnerability management across all sectors as automated exploitation of internet-facing vulnerabilities has surpassed credential theft as the leading initial access method for cyber intrusions. Iran-linked threat groups continue demonstrating the ability to disrupt public-safety alerting and operational technology (OT) systems abroad, most recently by silencing emergency sirens in Israel through a known firmware flaw in widely deployed alerting hardware — a technique that could be replicated against the same hardware wherever it is deployed, including in Florida. Florida organizations should accelerate remediation of actively exploited vulnerabilities, inventory any of the affected alerting hardware in their environment, and strengthen identity-centric security controls.

Commercial Facilities: Isolate internet-connected surveillance systems and third-party business platforms, as newly disclosed, high-severity H.VIEW camera vulnerabilities (CVSS 7.2 and 8.6) and recent extortion campaigns demonstrate these technologies remain attractive attack vectors. No vendor patch is currently available for the camera flaws, so isolation is the primary defense. Organizations should rotate privileged credentials, segment backup infrastructure, and monitor for unauthorized administrative activity.

Communications: Strengthen communications infrastructure security as Cisco Secure Digital Wide Area Network (SD-WAN) zero-day exploitation and new Federal Communications Commission (FCC) emergency communications security requirements highlight increasing operational risks. Florida communications providers should prioritize patching, review administrative access controls, and validate continuity procedures supporting emergency communications.

Critical Manufacturing: Apply firmware and software updates rapidly as active exploitation of Ubiquiti UniFi and PTC Windchill platforms continues to threaten manufacturing environments and industrial supply chains. Organizations should restrict access to management interfaces and strengthen segmentation between operational technology and enterprise networks.

Financial Services: Review third-party platform security following the National Association of Insurance Commissioners (NAIC) breach, which was caused by the same Oracle PeopleSoft zero-day vulnerability (CVE-2026-35273) covered under All Sectors above, and demonstrates continuing risks associated with financial reporting and regulatory operations. Financial institutions running Oracle PeopleSoft should treat patching that vulnerability as a financial-sector priority, not only a general IT task, and should enforce least-privilege principles, strengthen authentication controls, and monitor for unauthorized access to sensitive financial data.

Government Services and Facilities: Increase behavioral monitoring, drawing on newly published research showing how the Russian Advanced Persistent Threat (APT) group Gamaredon evolved its PowerShell-based malware and command-and-control tradecraft in 2025. Gamaredon’s documented campaigns remain focused on Ukrainian government and military targets, but its techniques — including abuse of legitimate cloud and tunneling services to hide infrastructure — illustrate broader nation-state tradecraft worth incorporating into defensive planning. Government organizations should validate endpoint detection capabilities and conduct recurring integrity reviews of administrative workstations and privileged accounts.

Healthcare and Public Health: Strengthen third-party access controls as CyberAv3ngers continues targeting public-safety communications while ransomware operators maintain pressure on healthcare providers through data theft and extortion. Healthcare organizations should validate backup and recovery procedures, monitor for data leakage, and ensure continuity plans support uninterrupted patient care.

Information Technology: Remediate Known Exploited Vulnerabilities affecting internet-facing enterprise infrastructure as active exploitation of Palo Alto GlobalProtect, LiteSpeed cPanel, and Joomla vulnerabilities continues to increase operational risk. Organizations should restrict administrative privileges, strengthen endpoint monitoring, and review browser extension security policies.

Water and Wastewater Systems: Enhance remote-access security as recent federal guidance regarding last-mile funding and National Institute of Standards and Technology (NIST) remote-access security reinforces the need for resilient operational technology architectures. Utilities should implement continuous operational technology integrity monitoring and validate manual fallback procedures to maintain essential services during cyber incidents.

All Sectors

Securing The Nation Against Advanced Cryptographic Attacks On June 22, 2026, President Trump signed an Executive Order directing the accelerated transition to Post-Quantum Cryptography (PQC) across federal systems to address emerging “harvest now, decrypt later” threats. Adversaries are increasingly collecting encrypted information with the expectation that future quantum computing capabilities will enable decryption of sensitive data. While the directive establishes federal migration timelines through 2031, Florida critical infrastructure owners and operators should begin identifying cryptographic dependencies, inventorying high-value assets, and coordinating with their Sector Risk Management Agencies (SRMAs) to support long-term cryptographic modernization and reduce future operational risk.

ShinyHunters Hacked Hundreds Leveraging Oracle Bug Throughout June 2026, the ShinyHunters cybercrime group conducted coordinated attacks by exploiting vulnerabilities in widely deployed enterprise platforms, including Oracle PeopleSoft, to compromise organizations across multiple sectors. The campaign exploited CVE-2026-35273, a CVSS 9.8 unauthenticated remote code execution flaw in the PeopleSoft Environment Management Hub component, between May 27 and June 9, 2026, before Oracle issued mitigation guidance on June 10. Rather than targeting a single organization, the campaign focused on shared enterprise infrastructure to steal personally identifiable information (PII), financial records, and proprietary business data for extortion. While the campaign affected organizations across government, healthcare, financial services, and other sectors, Google Mandiant’s investigation found that 68 percent of identified targets were in higher education, making it the sector hit hardest by this specific campaign. Because Oracle enterprise resource planning solutions are widely used across government, healthcare, financial services, and commercial organizations, Florida critical infrastructure operators should immediately assess internet-facing Oracle environments, validate backup integrity, and monitor for indicators of unauthorized access.

Cybercriminals Allegedly Hacked Tens of Thousands of Fortinet Firewalls Used by Major Companies All Over the World A large-scale credential exposure campaign compromised administrative and Secure Sockets Layer Virtual Private Network (SSL VPN) credentials associated with more than 73,000 Fortinet FortiGate appliances worldwide. The exposed credentials could enable cyber threat actors to bypass network perimeters, modify firewall configurations, establish persistent access, and conduct lateral movement within enterprise environments. Fortinet characterized the activity as “a resharing of data from previous incidents, as well as bruteforcing of credentials, and is not related to any recent incident or advisory.” Given the widespread deployment of Fortinet technologies throughout Florida government agencies and critical infrastructure sectors, organizations should immediately validate administrative credentials, review firewall configurations, rotate compromised credentials, and prioritize risk-based remediation to prevent unauthorized network access.

North Korean Hiring Fraud Runs on AI and US Laptop Farms Research released in June 2026 identified a sophisticated North Korean employment fraud campaign that combines stolen identities, artificial intelligence-assisted interviews, and U.S.-based laptop farms to infiltrate technology companies. One documented case, publicized in June 2026 but originating from a June 2025 job application, involved an individual posing as a Florida-based artificial intelligence architect who applied for a position at risk-intelligence firm Nisos. Nisos identified the deception during its interview process before extending an offer, then used the engagement to gather intelligence on the broader fraud operation. This activity demonstrates the growing insider threat posed by fraudulent remote hiring schemes. Florida organizations should strengthen identity verification procedures, validate candidate credentials, monitor for anomalous endpoint activity during onboarding, and incorporate insider-threat detection into hiring and human resources security processes. Two technical indicators thsat may be useful for detection are: (a) the use of PiKVM hardware to allow remote, hard-to-detect control of ‘laptop farm’ devices, and (b) the use of Astrill VPN, a service frequently associated with North Korean IT-worker operations, as a connection pattern.

All Sectors Recommendations:

• Inventory cryptographic assets and develop a phased migration strategy for Post-Quantum Cryptography (PQC) in coordination with applicable Sector Risk Management Agencies (SRMAs).

• Audit internet-facing enterprise applications and external gateways to identify vulnerabilities, unauthorized access, and indicators of compromise before they are exploited.

• Enforce phishing-resistant multi-factor authentication, rotate privileged credentials regularly, and continuously monitor remote access infrastructure for unauthorized administrative activity.

• Strengthen hiring and insider-threat detection processes by validating candidate identities, monitoring endpoint activity during onboarding, and identifying indicators associated with fraudulent remote employment campaigns.

• Conduct recurring tabletop exercises and business continuity drills to validate incident response, backup recovery, and operational resilience across all critical infrastructure sectors.

Chemical Sector

No sector-specific incidents, advisories, or operationally relevant reporting were identified during this biweekly reporting period.

Commercial Facilities Sector

CISA Warns H.VIEW HV-500S6 Cameras: Command Injection & Malicious File Upload Risk On June 25, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) released advisory ICSA-26-176-05 identifying high-severity vulnerabilities affecting H.VIEW HV-500S6 Internet Protocol (IP) cameras running firmware version IPCAM_V4.06.88.251229. The vulnerabilities, tracked as Common Vulnerabilities and Exposures (CVE)-2026-55975 and CVE-2026-56414, allow authenticated attackers to execute operating system commands and upload malicious files capable of establishing persistent access. Because these cameras are commonly deployed within commercial facilities, retail environments, warehouses, and public venues, successful exploitation could provide cyber threat actors with an initial foothold into enterprise networks. Florida commercial facility operators should prioritize firmware updates, isolate surveillance devices from critical business networks, and continuously monitor camera management interfaces for unauthorized activity.

Commercial Facilities Sector Recommendations:

• Identify all deployed H.VIEW HV-500S6 devices and verify whether vulnerable firmware versions remain in operation.

• Because H.View did not respond to CISA’s coordination request, and no vendor patch is currently available, CI operators should prioritize network isolation or removal of affected devices, while organizations attempt direct outreach to the vendor. Apply vendor firmware updates and remove unsupported devices from production environments whenever possible.

• Restrict camera management interfaces from direct internet exposure by implementing network segmentation and firewall protections.

• Rotate administrative credentials, disable unnecessary accounts, and continuously monitor surveillance systems for unauthorized configuration changes or suspicious activity.

• Validate incident response procedures for physical security systems to ensure surveillance infrastructure can be restored quickly following a cyber incident.

Communications Sector

Malicious Hackers Exploit Cisco Zero-Day for Highest Access Level at Communications Service Provider Mandiant disclosed on June 24, 2026, that attackers had exploited a Cisco Catalyst Software-Defined Wide Area Network (SD-WAN) Manager zero-day vulnerability (CVE-2026-20245) months earlier, escalating from administrative access first obtained in late 2025 to full root-level control by March 2026. While the attackers established unauthorized peering connections and created root-level privilege escalation, each component exploited separate vulnerabilities: CVE-2026-20127 or CVE-2026-20182 for initial access; CVE-2026-20245 for privilege escalation to root. This is the seventh actively exploited Cisco SD-WAN zero-day disclosed in 2026, indicating a sustained, not isolated, attacker focus on this product line. Because Cisco SD-WAN technologies are widely deployed across government agencies, telecommunications providers, utilities, and other Florida critical infrastructure sectors, exploitation of this vulnerability could enable unauthorized network access, service disruption, and lateral movement across enterprise environments. Florida organizations should prioritize patching, review administrative accounts, and continuously monitor SD-WAN infrastructure for signs of compromise.

FCC Passes New Cybersecurity Rules for Emergency Systems, Undersea Cables On June 25, 2026, the Federal Communications Commission (FCC) adopted new cybersecurity requirements to strengthen the security of the Emergency Alert System (EAS), Wireless Emergency Alerts (WEA), and undersea cable infrastructure. The updated submarine cable rules tighten some cybersecurity and equipment-sourcing requirements while also streamlining the national-security review process for cable operators that self-certify to high security standards, in a trade-off intended to accelerate buildout. Because Florida relies heavily on undersea cable networks and statewide emergency communications to support public safety and disaster response, compliance with these requirements will strengthen operational resilience and reduce the risk of service disruption during cyber incidents.

Communications Sector Recommendations:

• Patch Cisco Catalyst Software-Defined Wide Area Network (SD-WAN) infrastructure immediately to remediate known vulnerabilities and reduce the risk of unauthorized administrative access.

• Audit privileged accounts and configuration changes regularly to identify unauthorized users, rogue administrative accounts, or suspicious modifications.

• Implement the Federal Communications Commission’s (FCC) cybersecurity requirements for the Emergency Alert System (EAS) and Wireless Emergency Alerts (WEA), including strong authentication and timely patch management.

• Review business continuity and disaster recovery procedures supporting communications infrastructure to ensure essential services remain available during cyber incidents.

• Monitor network traffic and system logs continuously for indicators of compromise affecting routing infrastructure, emergency communications systems, and undersea cable connectivity.

Critical Manufacturing Sector

CISA Warns of Max Severity Ubiquiti Flaws Exploited in Attacks The Cybersecurity and Infrastructure Security Agency (CISA) added multiple high-severity vulnerabilities affecting Ubiquiti UniFi Operating System (OS) devices to the Known Exploited Vulnerabilities (KEV) Catalog after confirming active exploitation in the wild. The vulnerabilities (CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910) allow unauthenticated attackers to bypass security controls and gain unauthorized access to affected systems. Because Ubiquiti networking equipment is widely deployed across manufacturing facilities, distribution centers, and industrial operations, exploitation could disrupt production networks and enable lateral movement into operational technology environments. Florida critical manufacturing organizations should prioritize firmware updates, restrict internet exposure of management interfaces, and continuously monitor network infrastructure for indicators of compromise.

First-Ever Exploitation of PTC Windchill Vulnerability Discovered in the Wild Cyber threat actors are actively exploiting a critical remote code execution vulnerability (CVE-2026-12569) affecting PTC Windchill and FlexPLM Product Lifecycle Management (PLM) platforms. The vulnerability results from improper input validation and allows unauthenticated attackers to execute arbitrary code with system-level privileges. Following confirmed exploitation, CISA added the vulnerability to its Known Exploited Vulnerabilities Catalog (KEV) and directed organizations to remediate affected systems by June 28, 2026. This is the first PTC product vulnerability ever added to CISA’s KEV catalog, signaling new attacker interest in a previously untargeted vendor. Because Product Lifecycle Management platforms support engineering design, manufacturing operations, and supply chain coordination, successful exploitation could disrupt production processes, expose proprietary engineering data, and impact critical manufacturing operations across Florida.

Critical Manufacturing Sector Recommendations:

• Apply vendor firmware and software updates (UniFi OS Server 5.0.8, released in May 2026) immediately to all affected Ubiquiti UniFi Operating System and PTC Windchill platforms.

• Restrict public access to management interfaces by implementing network segmentation, virtual private networks, and firewall protections.

• Monitor network traffic, authentication logs, and administrative activity for indicators of compromise or unauthorized configuration changes.

• Validate backup and recovery procedures for engineering, manufacturing, and Product Lifecycle Management systems to minimize operational disruption following a cyber incident.

• Conduct regular vulnerability assessments of industrial control and supporting enterprise systems to identify and remediate emerging risks before exploitation occurs.

Dams Sector

No sector-specific incidents, advisories, or operationally relevant reporting were identified during this biweekly reporting period.

Defense Industrial Base Sector

No sector-specific incidents, advisories, or operationally relevant reporting were identified during this biweekly reporting period.

Emergency Services Sector

Team82 Documents Iran-Linked CyberAv3ngers Escalating Cyber-Psychological Warfare Against Civilian Alert Systems Claroty’s Team82 documented CyberAv3ngers exploiting a known firmware vulnerability (CVE-2024-41700) in Barix audio-over-IP devices to silence Israeli emergency sirens and manipulate public alerts. Rather than focusing solely on system disruption, the group seeks to manipulate emergency alerts to create confusion, erode public trust, and disrupt emergency response operations. Barix has released a patch, though it must be applied manually. Because the same vulnerable Barix hardware is also deployed in U.S. public safety and emergency alerting infrastructure, including in Florida, municipalities should treat this as a warning to inventory and patch any Barix devices in their environment rather than evidence of direct targeting.

Emergency Services Sector Recommendations:

• Isolate public safety communication systems and critical alerting infrastructure from internet-facing networks whenever operationally feasible.

• Conduct tabletop exercises involving ransomware, cyber-physical attacks, and emergency communications disruptions to improve organizational preparedness.

Energy Sector

Florida Critical Infrastructure Cybersecurity Intelligence

This bulletin is produced by USF’s Strategic and Cyber Intelligence Program, in collaboration with Cyber Florida, to deliver timely, actionable insights and recommendations to help Critical Infrastructure owners and operators better protect Florida’s Critical Infrastructure.

Situational Awareness Bulletin #11-2026

Cyber Threat Outlook

Over the next six months, Florida critical infrastructure owners and operators will have to navigate a threat environment in which adversaries are moving faster, and defenders are falling further behind. The 2026 Verizon Data Breach Investigations Report (DBIR) documented that automated exploitation of unpatched software vulnerabilities surpassed credential theft as the leading cause of data breaches for the first time in the report’s nineteen-year history, accounting for 31% of confirmed breach entry points. Artificial intelligence is the primary accelerant, compressing the window between a vulnerability’s public disclosure and its active weaponization from months to hours. CISA’s new Binding Operational Directive (BOD) 26-04 formally codifies this reality by replacing flat patching timelines with a graduated, risk-tiered model that mandates remediation within as few as three days, with mandatory forensic analysis to assess whether systems are already compromised, or the highest-risk vulnerabilities.

Iranian state-sponsored actors continue to escalate beyond espionage into active disruption and data destruction targeting water, energy, and defense-adjacent infrastructure. Ransomware groups are expanding their reach through supply chain and third-party vendor compromise. Against this backdrop, the contraction of federal cybersecurity grant funding means organizations cannot wait for external support. Priorities must shift toward risk-tiered vulnerability management aligned with BOD 26-04, network segmentation between operational technology and information technology environments, validated offline backups, and supply chain governance, particularly for software dependencies and cloud storage configurations.

Confidence – High

Executive Summary

• All Sectors: Automated vulnerability exploitation has officially surpassed credential theft as the primary initial access vector. Driven by frontier AI capabilities, adversaries are weaponizing exploits at machine-speed, necessitating risk-tiered remediation under CISA BOD 26-04, which mandates patch-and-forensic-triage within three days for the highest-risk exposed assets. Iranian state actors have shifted from espionage to active data-wiping and OT disruption. Third-party and vendor-related breaches continue to rise sharply, making supply chain auditing and Zero Trust principles essential.
• Commercial Facilities: Unauthenticated remote code execution vulnerabilities in Magento servers (CVE-2026-45247) remain under active exploitation. RCI Hospitality Holdings reported a data breach impacting approximately 40,000 individuals.
• Defense Industrial Base: Department of Defense officials emphasized integrating cyber capabilities into all military operations and strengthening foundational cybersecurity across the defense industrial base. Iranian state actors continue targeting software suppliers and infrastructure connected to the aerospace and defense sectors to establish persistent espionage footholds in supply chains.
• Energy: High-severity vulnerabilities were disclosed in Hitachi Energy grid control systems (RTU500 and MACH HiDraw).
• Financial Services: The financially motivated group JINX-0164 targeted cryptocurrency firms using custom macOS malware delivered through fake recruiter lures to steal credentials and access CI/CD environments.
• Food and Agriculture: Brazilian food delivery platform iFood suffered a data breach exposing sensitive personal information of 1.2 million users, highlighting risks to food supply chain platforms from identity-focused data theft.
• Government Services and Facilities: The White House accelerated AI adoption through NSPM-11 while tightening control over AI model evaluations. Chinese state-sponsored actors continue targeting government and defense personnel via LinkedIn recruitment lures. The city of St. Paul, Minnesota successfully completed a comprehensive systems recovery following a severe ransomware attack.
• Healthcare and Public Health: DentaQuest suffered a major data breach exposing sensitive records of approximately 2.6 million accounts. India-based wearable health tech startup Ultrahuman reported a data breach involving unauthorized access to customer wellness data.
• Information Technology: The National Security Agency (NSA) launched a centralized hub for Zero Trust Implementation Guides (ZIGs). Microsoft’s June 2026 Patch Tuesday addressed nearly 200 vulnerabilities. Actively exploited zero-days affected Veeam, Cisco SD-WAN, Palo Alto Networks PAN-OS, Google Chrome, and Acer Wave 7 mesh routers. Multiple supply chain attacks targeted npm and PyPI repositories through the Miasma and Hades campaigns, variants of the self-replicating Shai-Hulud worm, which infected over 100 packages and extended into Microsoft Azure and GitHub repositories. Cisco released patches for a high-severity server-side request forgery (SSRF) vulnerability.
• Transportation Systems: SpeedX exposed over 840 million sensitive logistics and customer records. Qilin ransomware claimed responsibility for an attack on the New York/New Jersey Shipping Association.
• Water and Wastewater Systems: CThe U.S. Government Accountability Office (GAO) warned that many drinking water and wastewater utilities across the United States continue to lack fundamental cybersecurity protections. Water and wastewater systems face persistent, aggressive targeting from Iranian-sponsored entities.

All Sectors

Implementation Guidance for Prioritizing Security Updates Based on Risk BOD 26-04 In response to AI-assisted threat actors narrowing the gap between patch release and mass-exploitation, federal defensive frameworks have overhauled vulnerability remediation. Organizations should look to align their enterprise response with CISA’s Binding Operational Directive (BOD) 26-04. Rather than treating all vulnerabilities with a flat, Common Vulnerability Scoring System (CVSS)-based urgency, defense must be tiered dynamically based on asset exposure, Known Exploited Vulnerabilities (KEV) status, and adversary automation capability. Vulnerabilities meeting the highest-risk criteria, those actively exploited, automatable, and yielding total system control, require remediation and forensic triage within three days. Lower-risk combinations receive graduated timelines up to the next system upgrade cycle. BOD 26-04 formally revokes BOD 22-01, invalidating existing flat 14-day KEV remediation policies. CI organizations supporting federal agencies must update their vulnerability management processes accordingly.

All Sectors Recommendations:

• Enforce phishing-resistant multi-factor authentication and strict least-privilege policies on all remote access and managed service links.
• Isolate all public-facing virtual network computing instances behind virtual private networks (VPN) requiring multi-factor authentication.
• Establish automated vulnerability tracking and scanning mechanisms to outpace accelerated machine-assisted exploitation windows.
• Conduct technical audits of contractor-managed code environments, cloud storage setups, and cloud collaboration platform configurations.

Chemical Sector

No sector-specific incidents, advisories, or operationally relevant reporting were identified during this biweekly reporting period.

Commercial Facilities Sector

Mirasvit Vulnerability Exploited to Execute Code on Magento Servers After a critical-severity vulnerability (CVE-2026-45247) in the Mirasvit Full Page Cache Warmer for Magento 2 extension was exploiteded, that CVE was added to the KEV catalog. This PHP object injection flaw, carrying a Common Vulnerability Scoring System (CVSS) score of 9.8, allows unauthenticated remote actors to execute arbitrary code on Magento and Adobe Commerce servers. Exploitation requires no login or special access. A single crafted web request to any vulnerable storefront page is sufficient to trigger full server compromise. The extension, intended to optimize page caching and speed, currently provides a direct pathway for full system compromise and unauthorized data access. Mirasvit released a patch in version 1.11.12. Organizations running any earlier version should update immediately or disable the extension if patching is not immediately possible.

Nightclub Giant RCI Says Data Breach Affects 40,000 Individuals RCI Hospitality Holdings, one of the largest adult nightclub and sports bar operators in the United States, reported a data breach impacting approximately 40,000 individuals. The incident was traced to an insecure direct object reference (IDOR) vulnerability discovered in March 2026 within an IIS web server managed by the company’s internet services subsidiary. The IDOR flaw permitted unauthorized access to personal data of approximately 40,000 independent contractors, including names, dates of birth, Social Security numbers, and driver’s license numbers. Customer records and financial systems were not accessed. This breach highlights the persistent risk of data extortion and PII exposure within large-scale commercial hospitality environments.

Commercial Facilities Sector Recommendations:

• Perform comprehensive vendor risk assessments for any third parties processing corporate personally identifiable information.
• Deploy data loss prevention tools and end-to-end encryption on storage repositories hosting consumer or employee records.
• Formulate incident response scripts addressing pure data extortion, detailing communication pathways for multi-stage extortion tactics.
• Implement continuous monitoring on corporate file-sharing networks to flag unusual outbound data transfer volume.

Communications Sector

No sector-specific incidents, advisories, or operationally relevant reporting were identified during this biweekly reporting period.

Critical Manufacturing Sector

No sector-specific incidents, advisories, or operationally relevant reporting were identified during this biweekly reporting period.

Dams Sector

No sector-specific incidents, advisories, or operationally relevant reporting were identified during this biweekly reporting period.

Defense Industrial Base Sector

DOD Wants to Integrate Cyber in All Operations, and Integrate Security into AI Department of Defense officials emphasized integrating cyber capabilities into all military operations and strengthening foundational cybersecurity across the defense industrial base. Officials warned that vulnerabilities among contractors and suppliers can directly affect military readiness and operational effectiveness.

Iran Threat Overview and Advisories Iranian advanced persistent threat (APT) groups continue targeting software suppliers and infrastructure components connected to the aerospace and defense sectors. These long-term campaigns show direct correlations with broader geopolitical activity, deploying custom backdoors and implants to establish highly persistent espionage footholds across supply chain dependencies. Moving forward, Florida’s expansive aerospace clusters and defense contractors must validate code provenance and verify that administrative accesses across engineering pipelines strictly adhere to rigorous internal authorization mechanisms. Florida’s aerospace and defense manufacturing clusters, including Space Coast suppliers and aerospace contractors, represent direct targets for Iranian APT supply chain campaigns.

Defense Industrial Base Sector Recommendations:

• Conduct rigorous, ongoing evaluations of software sub-vendors, tracking any indicators of long-term state espionage campaigns.
• Deploy endpoint detection and behavioral tracking systems to uncover unauthorized administrative access or unusual remote connections.
• Validate the cryptographical signing and provenance of external software additions prior to introduction into production networks.
• Apply strict least-privilege divisions between supplier-administered assets and core defense software assembly lines.

Emergency Services Sector

No sector-specific incidents, advisories, or operationally relevant reporting were identified during this biweekly reporting period.

Energy Sector

Florida Critical Infrastructure Cybersecurity Intelligence

This bulletin is produced by USF’s Strategic and Cyber Intelligence Program, in collaboration with Cyber Florida, to deliver timely, actionable insights and recommendations to help Critical Infrastructure owners and operators better protect Florida’s Critical Infrastructure.

Situational Awareness Bulletin #10-2026

Cyber Threat Outlook

Over the next six to nine months, Florida’s critical infrastructure operators face escalating pressure from three reinforcing threats: Iranian state-sponsored actors targeting energy, water, and transportation OT systems; financially motivated extortion groups exploiting third-party vendors in education, healthcare, and commercial facilities; and automated vulnerability exploitation that is closing the gap between disclosure and weaponization faster than most organizations can patch. The 2026 Verizon Data Breach Investigations Report confirmed that exploitation of unpatched vulnerabilities has surpassed credential theft as the leading breach entry point — a structural shift that favors well-resourced adversaries and penalizes organizations slow to remediate. CISA’s CI Fortify initiative signals that federal planners now treat destructive OT attacks as a near-term contingency, not a theoretical risk. The campaign against LA Metro and ongoing Iranian targeting of gas-station tank gauges and PLCs in water and energy systems demonstrate transferable risk to Florida’s ports, utilities, and transit networks. Critical infrastructure owners should treat supply chain vendors, contractor-managed cloud accounts, and internet-exposed OT devices as the highest-priority attack surface for the foreseeable future.

Confidence – High

Executive Summary

• All Sectors: CISA’s CI Fortify initiative and continued Iranian OT targeting require Florida operators to test manual fallback procedures and close contractor access gaps.
• Commercial Facilities: ShinyHunters breached 7-Eleven, exposing personal data on 185,300 individuals after holding the data for ransom and then leaking it publicly.
• Communications: Major U.S. telecoms launched the C2 ISAC, a new sector-specific threat-sharing body; a Huawei zero-day caused a nationwide telecom outage in Luxembourg.
• Critical Manufacturing: Nitrogen ransomware breached Foxconn’s North American facilities, exfiltrating 8 TB of data and disrupting production; Four-Faith router exploitation continues at scale.
• Defense Industrial Base: Iranian APT Seedworm (MuddyWater) maintains persistent access inside a U.S. defense and aerospace software supplier using the previously undocumented Dindoor backdoor.
• Energy: NEMA and NERC warn of growing data-center grid strain; Iranian actors have breached unprotected automatic tank gauge systems at gas stations across multiple states.
• Government Services and Facilities: ShinyHunters’ Canvas breach directly hit USF and multiple Florida school districts; Chelan County’s full network shutdown illustrates ransomware risk for Florida municipalities; federal cyber grant reauthorization is in jeopardy.
• Healthcare and Public Health: OpenLoop Health breach exposed 716,000 individuals; a ransomware attack at another hospital allegedly caused an infant’s death; NYC Health + Hospitals vendor breach exposed 1.8 million patients.
• Information Technology: Exploited vulnerabilities in Drupal, Gitea, Notepad++, and SonicWall SSL-VPN, combined with GitHub supply chain compromises and novel blockchain-based malware, expand attack surface across developer and CI environments.
• Transportation Systems: Iranian state-linked actors breached LA Metro in a destructive attack that required weeks of recovery — directly transferable risk to Florida ports, transit, and aviation.
• Water and Wastewater Systems: CISA CI Fortify guidance is directly applicable to Florida water utilities, which face continued Iranian PLC targeting and reduced federal support.

All Sectors

CISA Unveils New Initiative to Fortify America’s Critical Infrastructure The Cybersecurity and Infrastructure Security Agency (CISA) launched the CI Fortify initiative on May 5, 2026, urging critical infrastructure operators, particularly in energy, water, and government facilities, to prepare for “weeks to months” of information technology/operational technology (IT/OT) isolation and manual operations in the event of sustained state-sponsored cyber campaigns. The guidance emphasizes proactive network segmentation, offline backups of system configurations, and regular drills of manual fallback procedures. It is important to note that the initiative’s planning assumption is that adversaries may already have a foothold inside OT networks during a conflict scenario, requiring operators to plan for continuity under a ‘communications-degraded’ environment in which external vendors, internet connectivity, and third-party dependencies may be unavailable. This is directly relevant to Florida, whose hurricane-prone utilities, ports, and water systems already face compounded risks from Iranian-linked OT targeting campaigns that continue to probe internet-exposed programmable logic controllers.

CISA Adds Seven Known Exploited Vulnerabilities to Catalog CISA added seven new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on May 21, 2026, based on confirmed active exploitation in the wild. The additions include CVE-2026-41091 (a link-following vulnerability) in the Microsoft Malware Protection Engine that enables local privilege escalation to SYSTEM level) and CVE-2026-45498 (Microsoft Defender denial of service), along with several legacy but still-weaponized flaws. These vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to federal, state, local, and critical infrastructure entities. Florida operators of Microsoft Defender, Windows systems, and related OT environments should apply patches immediately to prevent privilege escalation and service disruption. Organizations that disable automatic Microsoft Defender engine updates, including some OT-adjacent environments, should verify manually that engine version 1.1.26040.8 or later is installed.

Verizon DBIR 2026: Vulnerability Exploitation Overtakes Credential Theft as Top Breach Vector Verizon’s 2026 Data Breach Investigations Report (DBIR) found that vulnerability exploitation surpassed credential theft as the leading initial access vector in confirmed breaches. The DBIR analyzed more than 31,000 security incidents, of which more than 22,000 were confirmed breaches. Approximately 31% of breaches involved exploitation of unpatched vulnerabilities, highlighting the growing impact of internet-facing systems and delayed remediation cycles. Third-party involvement also rose sharply, reaching 48% of confirmed breaches. That represents a 60% year-over-year increase underscoring the growing risk of vendor and contractor access across CI environments. The report emphasized that organizations continue to struggle with patch management timelines and exposure to third-party applications. These findings reinforce concerns that cyber threat actors are increasingly prioritizing automated exploitation of known vulnerabilities across critical infrastructure sectors.

CISA Admin Leaked AWS GovCloud Keys on Github A public GitHub repository managed by a CISA contractor (Nightwing) inadvertently exposed credentials for several highly privileged Amazon Web Services (AWS) GovCloud accounts as well as a large number of internal CISA systems. The leak prompted legislators to request an urgent classified briefing within 24 hours. This incident underscores persistent third-party and supply chain risks, where basic credential hygiene and repository security failures can have cascading effects. Notably, the contractor had disabled GitHub’s built-in secret-scanning protections, underscoring that policy-level controls are insufficient without enforced technical guardrails that prevent circumvention. Florida critical infrastructure owners and operators should apply the same rigorous scrutiny to contractor-managed code repositories and third-party cloud environments that they apply to external vendors.

Security Update for LiteSpeed cPanel Plugin CISA added CVE-2026-48172, a critical privilege-escalation vulnerability in the LiteSpeed user-end cPanel plugin (before version 2.4.5), to its Known Exploited Vulnerabilities catalog after confirming active exploitation in the wild. The flaw allows any authenticated cPanel user, including low-privileged or compromised accounts, to execute arbitrary scripts with root privileges, meaning a single compromised hosting account on a shared server is sufficient for full system takeover. LiteSpeed resolved the issue in version 2.4.5. This development is highly relevant to Florida state agencies, school districts, municipal utilities, and other critical infrastructure entities that use cPanel-hosted web services for public-facing systems.

FBI Warns Extortion Hackers are Visiting US Law Firms to Steal Data The FBI has issued a warning about the Silent Ransom Group (SRG), a cyber extortion gang with roots in the Conti ransomware syndicate that is actively targeting U.S. law firms using an unusually bold mix of phishing, fake IT calls, and in-person office visits. The group’s tactics are exceptionally hard to detect: attackers use legitimate remote management tools and transfer stolen data through trusted platforms such as Google Drive and Microsoft OneDrive, blending in with normal IT activity. Notably, SRG deploys no ransomware encryption — systems remain fully operational throughout the attack with no locked files or ransom screens, making the intrusion effectively invisible until an extortion email arrives. SRG’s reach extends beyond legal services—the FBI notes the group has also hit organizations in healthcare, insurance, and financial sectors. This is pertinent to all Florida critical infrastructure sectors, and law firms frequently hold sensitive legal, financial, and corporate data for CI operators. SRG has been active since at least 2022. They have compromised data from more than 38 law firms, with at least 100 confirmed attacks as of Spring 2026.

All Sectors Recommendations:

• Implement phishing-resistant multi-factor authentication and the principle of least privilege on all managed service provider remote access connections to prevent adversaries from pivoting into downstream municipal utility networks.
• Identify all internet-facing VNC instances and secure them behind a virtual private network with multi-factor authentication to prevent unauthorized manipulation of industrial controls.
• Develop and test manual fallback procedures for all life-safety services to ensure operational resilience during a sustained cyber outage.
• Shift toward automated vulnerability management to reduce exposure windows as artificial intelligence-assisted exploitation compresses the time between disclosure and weaponization.
• Audit all third-party and contractor-managed code repositories, cloud credentials, and privileged service accounts, and the use of cloud collaboration tools (such as Google Drive and Microsoft OneDrive) for exposed secrets or misconfigured access controls.
• Immediately inventory, patch, or isolate systems affected by newly added CISA KEVs to prevent active exploitation.

Chemical Sector

No sector-specific incidents, advisories, or operationally relevant reporting were identified during this biweekly reporting period.

Commercial Facilities Sector

185,000 Likely Impacted by 7-Eleven Data Breach 7-Eleven has confirmed that it was the victim of a data breach. An April 8, 2026 breach of 7-Eleven systems, via their Salesforce environment, exposed personal information (including names, dates of birth, email addresses, phone numbers, and physical addresses) affecting roughly 185,300 individuals. The ShinyHunters extortion group claimed responsibility, initially demanding ransom and later offering the data for sale on a Russian hacking forum. This incident highlights ongoing risks to commercial facilities from extortion groups like ShinyHunters, which have also targeted education vendors serving Florida school districts and higher-education institutions.

Commercial Facilities Sector Recommendations:

• Conduct regular third-party risk assessments of vendors and service providers that handle customer or employee personally identifiable information (PII).
• Implement robust data encryption, access controls, and data-loss-prevention monitoring on systems containing sensitive personal or financial data.
• Develop and regularly test incident response playbooks specifically for data-extortion campaigns, including protocols for ransom demands and mandatory breach notification.
• Monitor closely for anomalous data exfiltration, especially involving legitimate cloud storage and file-sharing platforms commonly abused by groups like ShinyHunters.
• Provide targeted security awareness training for staff on advanced social engineering, phishing, and impersonation tactics used in these extortion operations.

Communications Sector

Telecom Sector Launches its Own Private ISAC Major U.S. telecommunications providers launched the Communications Cybersecurity Information Sharing and Analysis Center (C2 ISAC) to improve coordination against AI-enabled cyberattacks, espionage, and nation-state threats targeting communications infrastructure. The initiative aims to strengthen collaboration between telecommunications companies and government cybersecurity partners. Officials warned that adversaries continue targeting telecom infrastructure to support surveillance, espionage, and operational disruption campaigns. This development is relevant to Florida as the state’s extensive network of MSPs provides foundational support for municipal utilities and local government services.

Huawei Zero-day Attack Behind Last Year’s Crash of Luxembourg’s Entire Telecoms Network An attack exploiting a previously undisclosed vulnerability in Huawei enterprise router software caused a nationwide telecom outage in Luxembourg, disrupting mobile, landline, and emergency communications for more than three hours. As of this reporting, the vulnerability has not been publicly disclosed or assigned as a CVE identifier. Because no CVE has been assigned, operators cannot rely on standard vulnerability management tools to identify this exposure — network inventory and manual review of Huawei equipment are the only current detection paths. This incident highlights persistent supply-chain risks associated with Chinese-manufactured networking equipment in critical communications infrastructure. Florida’s telecommunications providers, managed service providers, and municipal utilities that rely on similar enterprise routing and OT networking hardware should review Huawei equipment inventories and consider immediate segmentation or replacement strategies where feasible.

Communications Sector Recommendations:

• Enforce strict multi-factor authentication and the principle of least privilege on all managed service provider remote access connections to prevent adversaries from pivoting into downstream municipal utility networks.
• Monitor telecommunications and managed service provider environments continuously for unauthorized affiliate activity or staging of data exfiltration tools that typically precede ransomware deployment.
• Prepare contingency plans to immediately sever or isolate administrative access from managed service providers if anomalous activity or cascading ransomware attempts are detected.
• Inventory all enterprise routers and OT networking hardware for Huawei or other high-risk vendors and implement strict network segmentation or accelerated replacement to mitigate undisclosed zero-day supply-chain risks.

Critical Manufacturing Sector

Ransomware Hackers Claim Breach at Foxconn, Major Electronics Manufacturer for Apple, Google, and Nvidia The Nitrogen ransomware group claimed responsibility for breaching Foxconn’s North American facilities in Mount Pleasant, Wisconsin and Houston, Texas, alleging theft of more than 11 million files totaling 8 terabytes (TB) of data, including confidential instructions, internal project documentation, technical drawings (including circuit board layouts and integrated circuit documentation), financial files, and temperature sensor records — tied to projects for Apple, Intel, Google, Dell, Nvidia, and AMD. The affected plants have resumed normal production, but the incident highlights downstream supply chain risk to U.S. critical manufacturing. This is highly relevant to Florida, where ports in Jacksonville, Tampa, and Miami serve as key logistics hubs for electronics and aerospace components.

CVE-2024-9643: Four-Faith Router Authentication Bypass Fuels Botnet Activity CrowdSec researchers reported a surge in exploitation of Common Vulnerabilities and Exposures (CVE)-2024-9643, a critical authentication-bypass flaw with hard-coded credentials in Four-Faith F3x36 industrial cellular routers. The activity has escalated into large-scale botnet campaigns targeting utilities, warehouses, and critical infrastructure. These routers are commonly deployed in remote monitoring and operational technology (OT) environments. Florida municipal utilities, water systems, and energy providers using similar industrial routers should immediately inventory, patch, or isolate these devices.

CVE-2026-8153: Command Injection in the PolyScope 5 Dashboard Server Universal Robots disclosed and patched a critical command injection vulnerability (CVE-2026-8153) in the Dashboard Server interface of its PolyScope 5 operating system used on collaborative robots deployed across operational technology environments. The flaw allows unauthenticated remote attackers to execute arbitrary commands, potentially compromising system integrity and physical security safety. Collaborative robots are widely used in manufacturing, energy, and logistics facilities. This development is highly relevant to Florida’s aerospace, critical manufacturing, and port logistics clusters that employ Universal Robots systems.

Critical Manufacturing Sector Recommendations:

• Harden remote access gateways and segment manufacturing networks from corporate IT systems to limit lateral movement during supply-chain ransomware incidents.
• Implement immutable offline backups of engineering schematics and design files to ensure rapid recovery without paying ransoms.
• Conduct immediate third-party risk assessments of electronics and component suppliers to identify exposure from large-scale breaches such as the Foxconn incident.
• Inventory all collaborative robots and industrial cellular routers (Universal Robots PolyScope and Four-Faith F3x36) for exposed interfaces and apply available patches or implement strict network segmentation.

Dams Sector

No sector-specific incidents, advisories, or operationally relevant reporting were identified during this biweekly reporting period.

Defense Industrial Base Sector

Iran-Linked Seedworm Maintains Persistent Access in U.S. Defense Supply Chain Networks Symantec reporting (continuing through recent days) describes Iranian APT Seedworm targeting the Israeli operation of a U.S. software company that supplies defense and aerospace. The campaign, which began in early February 2026, is ongoing, and that the activity correlates with U.S. and Israeli military strikes on Iran. The attack using a new Dindoor backdoor and a second, separate Python-based backdoor called Fakeset on networks of a U.S. airport and nonprofit, to engage in espionage and potential follow-on disruption against defense-related environments in the U.S. and allied countries. This activity underscores persistent supply-chain risks to the Defense Industrial Base from Iranian cyber threat actors. Florida’s aerospace clusters and defense contractors should conduct immediate third-party risk assessments of software suppliers.

Defense Industrial Base Sector Recommendations:

• Conduct rigorous and recurring third-party risk assessments of all software suppliers and service providers supporting defense and aerospace operations, with focused scrutiny on potential Iranian-linked activity.
• Implement continuous monitoring and behavioral analytics to detect persistent access, backdoors (such as Dindoor), and anomalous activity originating from supply-chain compromises.
• Enforce strict network segmentation and least-privilege principles between supplier-managed systems and critical internal networks to limit lateral movement.
• Verify the integrity of all third-party software updates and components prior to deployment in operational environments.
• Develop and regularly test incident response plans tailored to nation-state supply-chain attacks involving long-term espionage and potential disruptive follow-on operations.

Emergency Services Sector

No sector-specific incidents, advisories, or operationally relevant reporting were identified during this biweekly reporting period.

Energy Sector

US Annual Electricity Consumption to Grow 55% by 2050: NEMA The National Electrical Manufacturers Association (NEMA) forecast shows accelerating electricity demand from data centers, straining U.S. utilities and raising affordability concerns. Florida utilities are already experiencing similar grid pressure from artificial intelligence (AI)-driven data-center growth.

NERC 2026 Summer Reliability Assessment North American Electric Reliability Corporation’s (NERC) 2026 Summer Reliability Assessment warned that accelerated electricity demand, rapid growth of large data-center loads, and extreme heat conditions may strain portions of the North American electric grid. The assessment highlighted increasing operational pressure associated with AI-driven infrastructure expansion, maintenance outages, and periods of reduced renewable energy generation. Several regions may experience elevated reserve shortfalls during sustained peak-demand conditions. Florida utilities may face similar reliability and operational challenges during hurricane season and summer heat events.

Hackers Have Breached Tank Readers at US Gas Stations; Officials Suspect Iran is Responsible U.S. officials suspect Iranian-linked actors are responsible for a series of breaches targeting automatic tank gauge (ATG) systems. Notably, the affected systems were internet-exposed and unprotected by passwords, which represents a basic configuration failure. CI operators should immediately verify that all ATG systems are removed from the public internet or placed behind password-protected access controls. The attacks focus on operational technology used for real-time inventory and distribution management rather than traditional information technology (IT) networks. The attackers capability, however, was limited to manipulating display readings, not actual fuel levels or distribution flows. U.S. officials suspect Iranian-linked actors are responsible, though a lack of forensic evidence means definitive attribution has not been confirmed. If confirmed, the activity would represent continued Iranian interest in disrupting or gathering intelligence on U.S. energy infrastructure. The incidents are highly relevant to Florida’s extensive fuel distribution networks, ports, and municipal energy providers that rely on similar tank-gauge and monitoring systems.

PJM Gets Emergency Approval to Curtail Data Centers, Large Loads During Hot Weather The Department of Energy authorized PJM Interconnection to curtail power usage by large facilities with backup generation capability, including data centers, amid reserve shortages caused by extreme heat and maintenance outages. The emergency authority reflects growing operational stress on energy infrastructure that supports AI-driven data-center growth and increasing electricity demand. Grid operators continue evaluating emergency procedures to maintain system stability during high-load events. The incident also highlights increasing dependence on resilient backup-generation systems across critical infrastructure sectors.

CI Fortify: Strengthening Resilience Across Critical Infrastructure Iranian-linked actors continue to target internet-exposed PLCs and SCADA systems in the water and energy sectors. CISA’s CI Fortify guidance explicitly calls for OT isolation and manual operations readiness—directly applicable to Florida’s energy providers.

Energy Sector Recommendations:

• Verify that all operational technology (OT) assets, particularly Rockwell Automation and Allen-Bradley programmable logic controllers, are removed from the public internet or placed behind strict network segmentation.
• Store critical OT configurations and backups in immutable offline formats to enable manual operations during sustained cyber campaigns.
• Audit third-party vendor accounts and monitor for anomalous remote access to smart-grid and energy-management systems.
• Inventory and segment all operational technology assets used for fuel storage, tank monitoring, and distribution systems, ensuring they are not internet-exposed and are protected by strict network segmentation.

Financial Services Sector

No sector-specific incidents, advisories, or operationally relevant reporting were identified during this biweekly reporting period.

Food and Agriculture Sector

No sector-specific incidents, advisories, or operationally relevant reporting were identified during this biweekly reporting period.

Government Services and Facilities Sector

Aurora Lost Nearly $1.1M from City Bank Accounts After Employee Fell for Phone Scam Authorities in Aurora, Illinois are investigating a cyber-enabled fraud incident that resulted in approximately $1.1 million being transferred from municipal accounts after an employee reportedly fell victim to a phone scam. The incident reflects continuing business email compromise and social-engineering threats targeting local governments and public-sector financial operations. Cyber threat actors increasingly use impersonation techniques and financial fraud schemes to exploit municipal payment processes. Florida municipalities and tourism-dependent communities remain vulnerable to similar financially motivated cyber campaigns.

Chelan County WA Government Shuts Down Networks After Cyberattack Chelan County officials shut down all government computers, networks, and telephone systems on Memorial Day after detecting a malware attack that impacted every county department. The county’s information technology (IT) department identified the malware at 10 a.m. and immediately isolated systems as a safety precaution. Emergency services remained operational. This incident serves as a direct tactical analog for Florida’s numerous county and municipal government facilities that routinely handle high-volume administrative and public safety systems.

State IT Officials Make a Case for Cyber Grant Reauthorization Before House Subcommittee Florida’s Chief Information Officer and technology leaders from Tennessee and New York testified before the House Homeland Security Subcommittee on Cybersecurity and Infrastructure Protection regarding the now-unfunded State and Local Cybersecurity Grant Program (SLCGP). The officials highlighted how the grant program has improved state and local network defenses and urged Congress to reauthorize funding amid escalating nation-state threats and reduced federal support. This testimony is directly relevant to Florida’s municipal, county, and educational networks, which rely on these grants to maintain resilience against ransomware, operational technology (OT) targeting, and supply chain risks.

Canvas Hack: Company Pays Criminals to Delete Students’ Stolen Data Instructure (provider of the widely used Canvas learning management system) reached an agreement with the ShinyHunters group after a major breach that exposed student and staff data from 275 million records across approximately 9,000 institutions, including names, email addresses, student ID numbers, and private messages between students and instructors. across thousands of educational institutions. Instructure reportedly paid a ransom to the ShinyHunters group, receiving digital confirmation that exfiltrated data was destroyed, though no certainty exists that the cybercriminals honored the agreement. The FBI’s Internet Crime Complaint Center (IC3) issued a separate advisory on May 15, 2026 warning students and staff that ShinyHunters may directly contact individuals whose data was exposed. The incident directly impacted the University of South Florida (USF) in Tampa as well as Hillsborough County Public Schools, Pinellas County Schools, and other Florida districts, underscoring the systemic risk to Florida’s K-12 and higher-education systems that rely on third-party education vendors.

Hackers Exploited KnowledgeDeliver Zero-Day for Web Shell Deployment Attackers have exploited a zero-day vulnerability in KnowledgeDeliver, a widely used learning management system (LMS). The flaw stemmed from hardcoded ASP.NET machineKey values shared across installations. With these keys, cyber threat actors performed ViewState deserialization attacks to achieve remote code execution and deployed web shells. This incident demonstrates that cyber threat actors continue to pursue LMS platforms used by schools and government entities. The development is highly relevant to Florida’s K-12 and higher-education systems as well as municipal government facilities that rely on similar third-party administrative and education platforms.

Government Services and Facilities Sector Recommendations:

• Train staff to verify all financial requests through out-of-band channels before initiating wire transfers or payments.
• Implement strict multi-factor authentication and least-privilege controls on email and financial systems used by municipal staff.
• Conduct regular phishing simulations and rigorous vendor risk assessments of third-party learning management systems (LMS), education platforms, and administrative software to reduce exposure to supply-chain and zero-day vulnerabilities.
• Inventory, promptly patch (or isolate) all internet-facing third-party LMS and web-based administrative applications, with special attention to hardcoded credentials, shared configuration keys, and web-shell risks.
• Maintain and regularly test offline backups and manual fallback procedures for all county and municipal administrative systems to ensure continuity during ransomware or malware-induced outages.
• Advocate for and prepare contingency plans around reauthorization of the State and Local Cybersecurity Grant Program to sustain network defenses amid reduced federal support.

Healthcare and Public Health Sector

OpenLoop Health Data Breach Affects 716,000 Individuals OpenLoop Health disclosed a breach exposing names, addresses, email addresses, dates of birth, and medical information (but not Social Security Numbers) of approximately 716,000 individuals. The incident aligns with the broader pattern of persistent data-theft and extortion campaigns targeting the U.S. healthcare sector. Florida’s large healthcare network and retiree population make this a continuing high-priority risk.

Data Breach on New York Public Health System Claims 1.8M Victims, Leaking Biometric Data to Hackers NYC Health + Hospitals confirmed that a vendor-related compromise exposed sensitive patient data, including biometric data, affecting approximately 1.8 million individuals after attackers reportedly maintained access to systems for several months. Exposed information included protected health information and personally identifiable information tied to healthcare operations. The incident highlights the ongoing risks associated with third-party vendors and healthcare-sector supply chain exposure.

Hospital Ransomware Attack Led to Infant’s Death, Lawsuit Alleges A hospital ransomware attack allegedly led to an infant’s death, according to a lawsuit. The incident highlights the severe life-safety risks when ransomware disrupts critical healthcare operations and patient care systems. This is directly relevant to Florida’s large healthcare network and retiree population, where ransomware continues to threaten both patient data and care continuity.

Healthcare and Public Health Sector Recommendations:

• Isolate electronic health record systems and medical devices on segmented networks to prevent lateral movement during ransomware incidents.
• Maintain and regularly test manual downtime procedures for all critical patient care and life-safety systems to sustain operations and protect patient safety during IT outages or ransomware events.
• Perform rigorous third-party risk assessments of billing and health-data vendors to limit exposure from supply-chain breaches.
• Prioritize patient safety and life-safety system continuity in all ransomware incident response planning and conduct regular drills focused on rapid transition to manual operations.

Information Technology Sector

CISA Releases 18 New ICS Advisories Cybersecurity and Infrastructure Security Agency (CISA) released 18 new industrial control system advisories on May 14, 2026, detailing remotely exploitable vulnerabilities in products used across manufacturing, emergency communications, and supporting OT environments. Florida operators of these systems should apply patches immediately.

GitHub Confirms Breach of 3,800 Repos via Malicious VSCode Extension GitHub confirmed that approximately 3,800 internal repositories were compromised after an employee installed a malicious Visual Studio Code extension. The incident demonstrates the growing threat posed by software supply chain compromises targeting trusted developer environments and third-party extensions. Additional organizations, including major technology firms and artificial intelligence (AI) companies, were reportedly impacted by related activity. The compromise reinforces concerns about dependency trust, extension security, and vulnerabilities in the software development ecosystem.

CISA Adds One Known Exploited Vulnerability to Catalog CISA has added CVE-2026-9082, a critical SQL injection vulnerability in Drupal Core’s database abstraction API, to its Known Exploited Vulnerabilities catalog after confirming active exploitation. The agency ordered federal agencies to patch by May 27, 2026. Drupal is widely used by government agencies, educational institutions, and critical infrastructure entities for managing large-scale websites and content. Florida state agencies, school districts, and municipal utilities running Drupal instances should apply patches immediately to prevent unauthorized database access and potential lateral movement.

Exposing Fox Tempest: A Malware-signing Service Operation Microsoft identified Fox Tempest as a financially motivated cyber threat actor operating a malware-signing-as-a-service platform used by cybercriminals and ransomware operators. The group abuses Microsoft Artifact Signing to generate fraudulent short-lived certificates that allow malicious software to appear legitimate and evade traditional security controls. The operation demonstrates the increasing sophistication of ransomware enablement services and malware delivery infrastructure. Security researchers warned that signed malware continues posing significant detection and trust challenges for defenders.

Patch Bypass Allows Hackers to Exploit Prior Flaw in SonicWall SSL-VPN Cyber threat actors continue to exploit a SonicWall Secure Sockets Layer virtual private network (SSL-VPN) vulnerability that enables attackers to bypass multifactor authentication protections during automated brute-force attacks. Researchers warned that a patch bypass allowed exploitation activity to continue despite earlier remediation efforts. SSL-VPN appliances remain at frequent targets for ransomware operators and cybercriminal groups seeking remote access into enterprise environments. Organizations relying on internet-facing VPN infrastructure continue facing elevated risks from credential attacks and remote-access exploitation.

ClearFake Abuses BSC Testnet Contracts for Resilient C2 Operations Cyber threat actors behind the ClearFake campaign have adopted a novel and highly resilient command-and-control (C2) architecture by leveraging BNB Smart Chain (BSC) testnet smart contracts. This approach embeds malicious JavaScript and instructions within immutable blockchain storage. That means that standard threat intelligence feeds and domain blocklists are ineffective against this C2 channel, so defenders must instead focus on monitoring anomalous outbound connections and JavaScript injection patterns. That makes the infrastructure effectively immune to traditional takedown efforts. The tactic expands supply-chain and developer-pipeline risks for Florida critical infrastructure entities that rely on third-party IT tools and extensions.

Hackers Host JS Malware GHOSTYNETWORKS and OMEGATECH Hackers are abusing two bulletproof hosting providers, GHOSTYNETWORKS and OMEGATECH, to run a global JavaScript (JS) malware infrastructure that powers large-scale malspam and business email compromise (BEC) activity. In March 2026, multiple malspam waves delivered a JavaScript backdoor via ZIP or RAR attachments to organizations across sectors, including energy companies and finance ministries. The financially motivated operators focus on email account compromise and BEC rather than espionage.

Gitea Vulnerability Exposes Private Container Images Without Authentication Cybersecurity researchers disclosed a security flaw in Gitea (CVE-2026-27771, CVSS 8.2) that allows unauthenticated remote attackers to pull private container images from Gitea deployments without requiring credentials. The vulnerability affects all versions prior to 1.26.2 and likely impacts more than 30,000 deployments worldwide. Florida state agencies, school districts, and critical infrastructure operators running self-hosted Gitea instances should apply the patch immediately.

Critical Notepad++ Flaw Could Enable Remote Code Execution Attacks Notepad++ has released version 8.9.6.1 to address multiple critical vulnerabilities, including CVE-2026-48778, which could allow arbitrary code execution under specific conditions involving improper handling of configuration files. The update patches flaws in versions up to 8.9.6. Developers and administrators across Florida critical infrastructure environments should update immediately to prevent potential supply-chain compromise via developer tools.

Information Technology Sector Recommendations:

• Apply all CISA Known Exploited Vulnerabilities catalog updates and the latest ICS advisories without delay.
• Immediately inventory, patch, or isolate all Drupal installations, Gitea instances, and other internet-facing web applications, prioritizing those used by government, educational, and critical infrastructure systems.
• Enforce strict package verification, code-signing validation, and security checks for all developer tools, extensions (including VSCode), and applications such as Notepad++ to prevent supply-chain and remote code execution attacks.
• Implement strong authentication and access controls on self-hosted code repositories and container registries (such as Gitea) to block unauthenticated access to private container images and source code.
• Monitor for and block malicious JavaScript malware campaigns, abuse of bulletproof hosting providers, and resilient C2 techniques such as blockchain-based infrastructure.
• Scan and restrict internet-facing remote-access services (including SSL-VPN appliances) and apply patches immediately to counter bypass techniques and automated attacks.
• Strengthen supply-chain security practices to defend against malware-signing-as-a-service operations (such as Fox Tempest) and third-party extension compromises.

Nuclear Reactors, Materials, and Waste Sector

No sector-specific incidents, advisories, or operationally relevant reporting were identified during this biweekly reporting period.

Transportation Systems Sector

Iranian Hackers Blamed for Breach of Los Angeles Transit System that Took Weeks to Recover Israeli cybersecurity firm Gambit Security attributed a March 2026 breach of the Los Angeles County Metropolitan Transportation Authority (LA Metro) to Iranian government-linked (MOSI) actors—Black Shadow–operating under a hacktivist cover persona of “Ababil of Minab”. Attackers used a virtual machine to delete critical operating system data, stole at least 700 GB of emails/backups/files, and forced multi-week network isolation and recovery. Gambit Security reported that attackers also reached a real-time rail yard control display system, crossing from administrative IT networks into OT territory — though no manipulation of physical operations has been confirmed. This incident demonstrates state-sponsored destructive capabilities against U.S. transportation OT/IT systems. Florida’s ports, transit authorities, and logistics networks that rely on similar interconnected systems should treat this as a transferable risk.

Iranian APT Targets Aviation, Software Companies with Updated Tools Iranian APT Nimbus Manticore has adopted new tactics and malware variants in campaigns against aviation and software companies. Recent operations used updated tooling that enhances persistence and evasion. This activity demonstrates continued Iranian state-sponsored focus on transportation and related supply-chain targets. Florida’s ports, aviation facilities, and transit networks should treat this as transferable risk and review vendor software supply chains.

Transportation Systems Sector Recommendations:

• Monitor maritime traffic networks and commercial port environments for localized GPS spoofing attempts or electronic warfare interference.
• Encrypt all vessel communication systems to prevent threat actors from intercepting sensitive navigation and logistics data.
• Implement redundant positioning, navigation, and timing systems to maintain safe maritime operations if primary GPS signals are disrupted.
• Audit and segment all virtual machines, remote-access tools, and OT/IT convergence points in transit and port systems to prevent destructive data-wiping attacks by state actors.

Water and Wastewater Systems Sector

CI Fortify: Strengthening Resilience Across Critical Infrastructure Iranian-linked actors continue to target internet-exposed PLCs and SCADA systems in the water and energy sectors. CISA’s CI Fortify guidance explicitly calls for OT isolation and manual operations readiness—directly applicable to Florida’s municipal water utilities.

Water and Wastewater Systems Sector Recommendations:

• Immediately remove or isolate all internet-exposed programmable logic controllers and SCADA interfaces.
• Develop and regularly test manual fallback procedures for water treatment and distribution operations.
• Monitor anomalous changes to PLC project files and HMI configurations that could indicate manipulation attempts.
• Accelerate the adoption of AI-assisted defensive tools and conduct regular third-party risk assessments of OT vendors in light of shrinking federal support for water-sector cybersecurity.