Cyber Incidents USA 2026-27

[Commonground]

New CISA Guidance Helps Critical Infrastructure Detect, Observe and Impede Malicious Cyber Activity​

Provides Practical Approaches to Implementing Cyber Decoy Strategies Aligned to MITRE Engage and ATT&CK Frameworks
Released September 16, 2026

WASHINGTON – Today, the Cybersecurity and Infrastructure Security Agency (CISA) released guidance that helps critical infrastructure owners and operators implement realistic decoy systems and information assets to quickly detect and disrupt malicious activity occurring in their networks, which will ultimately improve their cyber defenses. Using Cyber Decoys to Strengthen Detection and Response is the first guide from CISA that offers a detailed explanation of the defensive cyber decoy process.

Continued: https://www.cisa.gov/news-events/ne...t-observe-and-impede-malicious-cyber-activity

 

[Commonground]

[please see post #79. https://flutrackers.com/threads/cyber-incidents-usa-2026-27.1039752/post-1041306]​

Coast Guard, FBI investigating after 2 oil tankers bound for US hit with cyberattacks: Sources​

September 16, 2026,
U.S. authorities said there were no reports of "operational disruptions."

The Coast Guard and FBI are investigating after two oil tankers bound for the U.S. were hit with suspected cyberattacks last month, prompting American authorities to launch investigations into both incidents, sources told ABC News.

Continued: https://abcnews.com/Politics/coast-guard-fbi-investigating-after-2-oil-tankers/story?id=136482324

 

[Commonground]

USCG, FBI assess OT and IT systems aboard two oil tankers following suspected foreign cyberattacks​

SEPTEMBER 17, 2026
Excerpt:

...This disclosure comes as American utility company CenterPoint Energy said it became aware in September of an online post by a third party claiming to have obtained a dataset containing certain customer information, prompting the company to activate its cybersecurity incident response protocols and launch an investigation with third-party cybersecurity experts.

“The Company’s delivery of electric and gas services has not been impacted and remains operational and undisrupted,” CenterPoint detailed in an SEC filing this week. “As of the date of this filing, the Company does not believe it is reasonably likely that there will be a material impact on the Company’s financial condition or results of operations.”...

...https://industrialcyber.co/industrial-cyber-attacks/uscg-fbi-assess-ot-and-it-systems-aboard-two-oil-tankers-following-suspected-foreign-cyberattacks/

 

[Commonground]

Using Cyber Decoys to Strengthen Detection and Response​

Publish Date September 16, 2026
CISA developed this guidance to help defensive teams at varying levels of cybersecurity maturity plan and implement cyber decoy strategies that strengthen their detection and response capabilities. Many organizations struggle to detect adversaries who use legitimate credentials, native tools, and living off the land (LOTL) techniques to conduct discovery, move laterally, and access data. Cyber decoys are assets that appear to be legitimate systems, accounts, or data, but are designed to distract adversaries, detect their presence, or facilitate collection of cyber threat intelligence (CTI). As organizations adopt Zero Trust models, they should assume that a malicious threat actor may gain some level of access to their environment and plan accordingly.

Cyber decoys complement Zero Trust by:

continued: https://www.cisa.gov/resources-tools/resources/using-cyber-decoys-strengthen-detection-and-response

 

[Commonground]

Cybersecurity Exercise to Strengthen Resilience​

Released September 18, 2026
Washington, DC – The Cybersecurity and Infrastructure Security Agency (CISA) hosted Cyber Storm X this week, a four-day national cybersecurity exercise designed to test and ultimately strengthen the nation’s resilience. This year’s exercise included 2,000 participants from across the public and private sectors and marks the tenth exercise in the 20-year history of Cyber Storm. The biennial exercise brings together the people who manage the services our nation relies on, including water, energy, and other vital sectors. During the exercise, participants practice how they would respond to a major cyber incident affecting critical infrastructure.

“Cyber Storm helps critical infrastructure owners and operators understand how we would manage a large-scale cyber incident,” said Acting CISA Director Nick Andersen. “Exercises strengthen our national resilience by making sure our plans, policies, and partnerships are ready when we need them. As a nation, we need the ability to respond swiftly and effectively to critical threats. That’s exactly what Cyber Storm does and why it’s a vital exercise for our nation’s security.”

This year’s exercise focused on a scenario involving a nation-state adversary targeting the transportation systems sector, including rail and ports, along with the water and wastewater systems sector. The exercise allowed participants to test response plans, practice coordination, and strengthen information sharing in a safe environment. Cyber Storm X included over two hundred organizations across all levels of government and the private sector.

CISA will now collaborate with participating organizations to identify lessons learned from the exercise. We will use these findings in a public after-action report that captures observations, analyses, and recommendations. CISA is committed to providing access to a wide range of cybersecurity tools and training opportunities, with exercises being a critical part of that toolkit to enhance our nation’s cyber preparedness.

For more information, please visit Cyber Storm X: National Cyber Exercise

CISA Hosts Cyber Storm X, Nationwide Cybersecurity Exercise to Strengthen Resilience | CISA

www.cisa.gov

 

[Commonground]

[please see https://flutrackers.com/threads/cyber-incidents-usa-2026-27.1039752/post-1041350]​

Another Tanker Suffers Failure as Crew Suspect Cyber Attack​

September 18, 2026
(Bloomberg) — A liquefied natural gas tanker bringing fuel from the US to Europe suffered a systems failure that the crew reported as a suspected cyber attack, according to people familiar with the matter.
-snip-
The suspected hacking of the Vivit Africa LNG follows other incidents in late August, when two oil and gas tankers off the US coast were boarded by the Coast Guard and Federal Bureau of Investigation due to potential cyberattacks.

Another Tanker Suffers Failure as Crew Suspect Cyber Attack

A liquefied natural gas tanker bringing fuel from the US to Europe suffered a systems failure that the crew reported as a suspected cyber attack, according to people familiar with the matter.

gcaptain.com

 

[Commonground]

Gemini hacked three companies in first known breakout by Google's AI​

Posted about 9h ago
Google's Gemini AI model has accessed the internet and hacked other companies during a test of its cybersecurity capabilities, in the first known example of the company's artificial intelligence systems autonomously committing such an act.

The hacks occurred in May during a test conducted by Irregular, an independent company that conducts cybersecurity evaluations.
-snip-
Google told the WSJ it didn't consider it necessary to disclose the incidents earlier because its model stopped the hacking upon learning the companies were real and did not cause harm to them.


Continued: https://www.abc.net.au/news/2026-09-19/gemini-google-ai-hacks-three-companies/107172128

 

[Commonground]

Colorado

Foreign hackers breach two more US water utilities, threaten safety of Colorado residents​

Published September 18, 2026
Foreign actors hacked two Colorado water utilities' computer systems last month, changing pumping cycles, disabling alarms and altering equipment settings before operators regained control, state officials said Thursday.

"These were brief incidents, and the risks were quickly addressed by the providers themselves, who subsequently alerted the state," Polis spokeswoman Eric Maruyama said in a statement.

The hackers altered equipment settings, disabled remote access and alarms and changed pumping cycles, according to the governor's office

The water utility systems that were impacted provide drinking water to approximately 400 people.

Continued: https://www.foxnews.com/politics/fo...-utilities-threaten-safety-colorado-residents

 

[Commonground]

Colorado
‘Foreign actors’ briefly hacked two small Colorado water utilities last month, state says

Foreign actors gained access to two small water utility systems in Colorado late last month, state officials confirmed, just weeks after hackers with suspected links to Iran had attempted to access similar systems elsewhere in the United States.

continued: https://www.denverpost.com/2026/09/18/colorado-water-systems-hacking-iran-concerns/

 

[Commonground]

Kansas

Ransomware attack on Kansas county will affect some services​

Posted: Sep 18, 2026 / 12:23 PM CDT
Updated: Sep 18, 2026 / 05:30 PM CDT

WICHITA, Kan. (KSNW) — A Kansas county’s government says it has been hit by a ransomware attack.

Ellis County discovered the attack on parts of its information technology systems Thursday morning.

Officials said they “immediately took steps to contain the disruption” by isolating the affected systems and enlisting the help of cybersecurity experts.

Continued: https://www.ksn.com/news/state-regi...k-on-kansas-county-will-affect-some-services/

 

[Commonground]

Utah

Eagle Mountain internet service goes down again amid cyberattack​

Sun, September 20, 2026 at 6:15 PM
Updated Sun, September 20, 2026 at 10:29 PM

EAGLE MOUNTAIN, Utah (KUTV) — Direct Communications said a cyberattack caused internet outages and service disruptions for customers throughout Eagle Mountain.

The company said Sept. 19 that its network experienced unusually high traffic consistent with a distributed denial-of-service, or DDoS, attack.
The disruption also affected the company’s upstream network providers, causing slow speeds, packet loss and complete service outages.

-snip-
In a Sunday evening update, Direct Communications said service had briefly stabilized but continued to go in and out throughout the day as the company responded to the cyberattack. Service was down again, the company said.

... https://kutv.com/news/local/cyberattack-prompts-internet-outages-across-eagle-mountain

 

[Commonground]

(TLP:CLEAR) Vulnerability Notification – F5 BIG-IP APM Actively Exploited​

Created: Wednesday, September 23, 2026 - 12:04
Categories: Cybersecurity, Security Preparedness

ACTION MAY BE REQUIRED for utilities using F5 BIG-IP Access Policy Manager (APM) configured as an OAuth Authorization Server (an APM access policy and an OAuth authorization server profile configured on a virtual server). Utilities that outsource technology support may need to consult their service providers for assistance with remediation actions.

Summary: A critical remote code execution vulnerability affecting F5 BIG-IP Access Policy Manager (APM) is being actively exploited in the wild. Tracked as CVE-2026-94127 (CVSS 9.8), the heap-based buffer overflow vulnerability affects BIG-IP APM deployments configured as an OAuth Authorization Server. Successful exploitation could allow an unauthenticated remote attacker to send specially crafted traffic to an affected virtual server and gain full control of the system. Deployments using APM strictly as an OAuth Client / Resource Server, without OAuth authorization server profiles configured, are not affected.

F5 has confirmed exploitation of the vulnerability, which it discovered internally. On September 22, CISA added CVE-2026-94127 to its Known Exploited Vulnerabilities (KEV) catalog and directed federal agencies to remediate it within three days.

Analyst Note: This vulnerability is particularly concerning for utilities because BIG-IP APM is a widely deployed network access and identity management solution that controls access to enterprise applications and networks. According to F5, the flaw resides in the data plane rather than the control plane, so restricting access to the BIG-IP management interface does not prevent exploitation. BIG-IP systems running in Appliance mode are also vulnerable. A compromised access gateway could provide attackers with a foothold inside trusted network environments, potentially enabling lateral movement, credential theft, or access to systems that support OT environments.

F5 has released engineering hotfixes for affected versions. No other F5 products, including other BIG-IP modules, BIG-IQ, F5OS, NGINX, and F5 Distributed Cloud services, are affected. F5 evaluates only software versions that have not reached End of Technical Support (EoTS), so utilities running EoTS versions of BIG-IP are encouraged to upgrade to a supported, fixed version.

Affected Versions:
Continued: https://www.waterisac.org/tlpclear-vulnerability-notification-f5-big-ip-apm-actively-exploited

 

[Commonground]

FBI
Sept. 23, 2026

Considerations for Critical Infrastructure Operators Working With Third-Party ICS Integrators

Introduction

The Federal Bureau of Investigation (FBI) and Cybersecurity and Infrastructure Security Agency (CISA)—

hereafter referred to as the “authoring agencies”—have published this fact sheet to highlight

considerations for critical infrastructure entities to reduce risk and minimize vulnerabilities when working

with third-party industrial control system (ICS) integrators.

ICS is an umbrella term referring to integrated networks of hardware and software designed to monitor and

automate physical processes, encompassing specialized control systems and devices, such as supervisory

control and data acquisition (SCADA) systems and programmable logic controllers. Third-party integrators

provide varying types of services for ICS, such as control system design, installation, operational data

analysis, device support and service, and daily operational control.

Critical infrastructure owners and operators should maintain caution when granting third-party ICS

integrators high levels of access or control over industrial processes, ensuring the principle of least

privilege (PoLP), is applied. PoLP within OT environments lends itself to granting users, processes, and

systems only the minimum access necessary to perform their assigned tasks, and no more. PoLP is

designed to protect owners and operators. Not adopting principles such as PoLP could expose owners and

operators to malicious cyber actors seeking to compromise critical infrastructure, possibly providing

sensitive access to pathways that actors can exploit to cause disruptive and destructive effects to

equipment and critical functions.

Critical infrastructure owners and operators should action the recommendations in this fact sheet to work

with integrators to ensure secure practices and frameworks are put in place to reduce the risk of malicious

actors exploiting third-party accesses to compromise critical infrastructure operational environments.

Examples of Risk and Exploitation

Continued: https://www.ic3.gov/CSA/2026/260923.pdf

 

[Commonground]

PRESS RELEASE

CISA Whitepaper Charts Path to Establishing and Maturing CVE Program Quality​

New Framework Defines Quality, Explains Strategy Alignment, Establishes Roadmap, and Provides Measurements to Success
Released September 23, 2026

Washington, DC – Today, the Cybersecurity and Infrastructure Security Agency (CISA) released a whitepaper, CVE Program: Establishing a Quality Era Framework, that outlines how we plan to implement our strategy and execute a program-wide maturation effort to the Common Vulnerabilities and Exposures (CVE) Program—the global standard for vulnerability identification—transitioning the program from its Growth Era, to a new Quality Era.

With new CVE Numbering Authorities (CNAs) and Roots joining from around the world, along with artificial intelligence (AI)-enabled technologies adding new pressures to the software lifecycle, CISA recognizes that the program has reached an inflection point and must continue evolving to meet the cybersecurity community’s needs. That’s why last year, we published our strategy outlining the six lines of effort for transitioning the CVE Program to the Quality Era.
Aligned with our strategy, this whitepaper provides key details and actions about the framework CISA is implementing to advance quality across four key dimensions:

1. Program governance that is transparent and effective,
2. Ecosystem participation that includes broad, active and global community representation,
3. Data infrastructure that is robust and supports core CVE operational functions,and
4. CVE record content that cyber defenders and users can rely on with confidence.

Continued: https://www.cisa.gov/news-events/ne...establishing-and-maturing-cve-program-quality

 

[Commonground]

(TLP:GREEN) Foreign Cyber Actors Briefly Compromised Two Small U. S. Water Utilities​

TLP:GREEN
Author: Chase Snow

Created: Thursday, September 24, 2026 - 12:33

Categories: Cybersecurity, OT-ICS Security, Security Preparedness, Members Only

(TLP:GREEN) Foreign Cyber Actors Briefly Compromised Two Small U. S. Water Utilities - WaterISAC

Access Restricted Access to the page you were trying to reach is restricted. If you are a WaterISAC member and you are already logged in, you may not have access to certain restricted material. If you believe your access permissions are incorrect or if you have any questions, please contact us...

www.waterisac.org

 

[Commonground]

(TLP:CLEAR) CISA ICS Advisories, Additional Alerts, Updates, and Bulletins – September 24, 2026​

Created: Thursday, September 24, 2026 - 12:27
Categories: Cybersecurity, Federal & State Resources, OT-ICS Security

The Cybersecurity and Infrastructure Security Agency (CISA) has published the following ICS security advisories, along with additional alerts, updates, and bulletins:

continued: https://www.waterisac.org/tlpclear-...lerts-updates-and-bulletins-september-24-2026

 

[Commonground]

2026 Election Infrastructure Security Plan​

Securing the Next 250
Publish Date. September 24, 2026

Election infrastructure requires steadfast security and resilience. It is a vital national interest and one of the Department of Homeland Security’s highest priorities to support the greater national security landscape. The American people’s confidence that their vote will be counted as cast is essential, and securing election infrastructure requires year-round diligence and close coordination between state, local, and federal partners.

Resource Materials​

2026 Election Infrastructure Security Plan

2026 Election Infrastructure Security Plan | CISA

www.cisa.gov