Loading story…
The United States is facing an escalating threat landscape, with cyberattacks from nation-state adversaries such as China, Russia, North Korea, and Iran becoming more sophisticated and coordinated. These adversaries are not only sharing cyber intelligence and best practices among themselves but are also leveraging advanced tactics, including exploiting third-party vulnerabilities and supply chain weaknesses. Recent high-profile incidents, such as the SolarWinds, MOVEit, and Crowdstrike Linux breaches, have demonstrated the devastating impact that a single compromised vendor can have on thousands of organizations. The traditional approach to third-party risk management, which relies on static checklists and periodic audits, is no longer sufficient, as attackers exploit the gaps between assessments. Intelligence-led, continuous monitoring of vendor ecosystems is now essential to detect and respond to emerging threats in real time. The speed at which attackers weaponize vulnerabilities has dramatically increased, with the average time to exploit (TTE) dropping from 63 days in 2019 to about 5 days in 2023, and even turning negative in 2024. This means attackers are now exploiting vulnerabilities before patches are even available, often by infiltrating disclosure pipelines or accessing leaked code repositories. As a result, organizations can no longer rely solely on timely patching and must instead focus on engineering resilience, rapid detection, containment, and recovery. The need for robust, real-time threat information sharing between the private sector and the federal government is more urgent than ever. Legislative efforts, such as the Protecting America from Cyber Threats Act, aim to reauthorize and expand the Cybersecurity Information Sharing Act of 2015, providing modernized legal protections and clarifying roles to facilitate more effective collaboration. Information sharing not only enhances technical defenses but also supports the mental resilience of CISOs, who benefit from peer collaboration and early warnings about emerging threats. The collective defense enabled by information sharing allows organizations to better understand the scale and scope of threats, prioritize responses, and reduce the cost and impact of breaches. As adversaries continue to innovate and accelerate their attacks, the U.S. must adapt by fostering a culture of proactive intelligence sharing, continuous monitoring, and cyber resilience across both public and private sectors.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcerecordedfuture.com
Open sourcecio.com
Open sourcescworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. government has identified a significant and growing threat to its critical infrastructure from nation-state adversaries, as highlighted in the March 2025 Annual Threat Assessment by the Office of the Director of National Intelligence. China is described as the most active and persistent cyber threat, targeting government, private-sector, and critical infrastructure networks through campaigns such as Volt Typhoon and Salt Typhoon. These campaigns have compromised organizations in the energy, transportation, and water sectors, with attackers moving laterally within operational technology environments to potentially disrupt essential services. Russia is noted for its integration of cyberattacks with military operations, exemplified by its ongoing assaults on Ukrainian networks and attempts to gain access to U.S. critical infrastructure assets. Iran has expanded its cyber capabilities, posing major threats to U.S. networks, while North Korea is being monitored for its targeting of defense industrial base companies, particularly those involved in advanced technologies like aerospace and hypersonic systems. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) recognizes 16 critical infrastructure sectors, all of which are potential targets for these nation-state actors. In response to these threats, there is a growing emphasis on the importance of threat intelligence sharing among organizations, especially those operating within the same industry or supply chain. Sharing threat information enables companies to enhance their security posture, providing early warnings about emerging tactics, techniques, and procedures used by adversaries. This collaborative approach not only strengthens cyber resilience but also helps CISOs manage the stress associated with defending against frequent and sophisticated attacks. By leveraging a network of like-minded security leaders, organizations can proactively address critical issues and improve their ability to prevent, detect, and respond to cyber threats. The increasing frequency and sophistication of cyberattacks underscore the necessity for a united front, where information sharing becomes a key component of national and organizational defense strategies. Such collaboration is vital for early detection of threats, rapid dissemination of actionable intelligence, and coordinated responses to incidents. The integration of threat intelligence sharing into cybersecurity programs is seen as a force multiplier, enabling organizations to stay ahead of adversaries and protect critical infrastructure more effectively. As the threat landscape evolves, both government and private sector entities are urged to prioritize information sharing and collective defense measures to safeguard essential services and national interests.
Jun 29, 2026
Organizations are facing a rapidly evolving cyber risk landscape as the boundaries between IT, operational technology (OT), Internet of Things (IoT), and supply chain systems blur. The proliferation of connected devices, such as cameras, badge readers, HVAC systems, and factory controllers, has significantly increased the attack surface for enterprises. Business demands have driven the integration of IT, OT, and IoT, enabling telemetry to inform analytics and automation, but also concentrating dependencies on critical control planes like cloud consoles and APIs. This interconnectedness means that a single compromised identity provider, software updater, or remote management tool can serve as a single point of failure, potentially impacting thousands of endpoints and critical business processes. Security leaders emphasize the importance of maintaining a living inventory of assets, applying least privilege principles, and segmenting networks by function and criticality to mitigate these risks. Unknown or unmanaged devices should be treated as unsafe until proven otherwise, and where devices lack robust security features, organizations are advised to broker connections through secure gateways. The challenge is compounded by resource constraints and the long lifecycles of many IoT and OT devices, which often cannot be easily updated or replaced. The expansion of cyber risk also extends to the supply chain, where third-party vendors, contractors, and service providers can become entry points for attackers. Recent high-profile breaches have demonstrated that adversaries exploit trusted relationships to infiltrate organizations, with the fallout often affecting the victim company regardless of where the breach originated. This complexity is frequently invisible to the public and regulators, leading to reputational damage and loss of narrative control for affected organizations. Effective cyber readiness now requires extensive preparation, including scenario exercises, communication planning, and training to operate under pressure. The shift from endpoint-centric to control plane-centric risk management reflects the need to address the realities of modern, interconnected business environments. Organizations must adopt an "assume breach" mindset and focus on resilience and recovery planning, not just prevention. The evolving threat landscape demands that security strategies account for the full spectrum of connected assets and the intricate web of dependencies that define today's enterprises. As the definition of cyber risk continues to expand, so too must the approaches to visibility, segmentation, and incident response. Ultimately, the ability to manage and recover from cyber incidents hinges on preparation, visibility, and the recognition that every connected asset and relationship represents a potential risk vector.
Jul 12, 2026
Security leaders are increasingly focused on proactive defense, digital trust, and adapting to the rapidly changing threat landscape. Insights from industry experts highlight that while a majority of organizations recognize cybersecurity as a top priority, only a minority invest in proactive measures, leaving many exposed to risks from legacy systems, supply chain dependencies, and sophisticated nation-state campaigns. The integration of AI is accelerating breach timelines, and cyber insurance is evolving from a financial safety net to a measure of organizational hygiene. Public–private collaboration and intelligence sharing are seen as critical in responding to large-scale infrastructure threats, particularly those posed by nation-state actors such as China. At the same time, enterprise security strategies are being shaped by lessons learned from misconfigurations, the adoption of new frameworks, and the operationalization of Security Control Management (SCM). Experts emphasize the need for unified control selection, mapping, and enforcement to move from reactive compliance to proactive, data-driven defense. Mid-sized organizations face unique challenges due to mobility and third-party reliance, but automation and integration are enabling faster, more effective security decisions. The convergence of these trends underscores the urgent need for CISOs to address blind spots and build resilience before the next crisis emerges.
Jun 29, 2026