Loading story…
The U.S. government has identified a significant and growing threat to its critical infrastructure from nation-state adversaries, as highlighted in the March 2025 Annual Threat Assessment by the Office of the Director of National Intelligence. China is described as the most active and persistent cyber threat, targeting government, private-sector, and critical infrastructure networks through campaigns such as Volt Typhoon and Salt Typhoon. These campaigns have compromised organizations in the energy, transportation, and water sectors, with attackers moving laterally within operational technology environments to potentially disrupt essential services. Russia is noted for its integration of cyberattacks with military operations, exemplified by its ongoing assaults on Ukrainian networks and attempts to gain access to U.S. critical infrastructure assets. Iran has expanded its cyber capabilities, posing major threats to U.S. networks, while North Korea is being monitored for its targeting of defense industrial base companies, particularly those involved in advanced technologies like aerospace and hypersonic systems. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) recognizes 16 critical infrastructure sectors, all of which are potential targets for these nation-state actors. In response to these threats, there is a growing emphasis on the importance of threat intelligence sharing among organizations, especially those operating within the same industry or supply chain. Sharing threat information enables companies to enhance their security posture, providing early warnings about emerging tactics, techniques, and procedures used by adversaries. This collaborative approach not only strengthens cyber resilience but also helps CISOs manage the stress associated with defending against frequent and sophisticated attacks. By leveraging a network of like-minded security leaders, organizations can proactively address critical issues and improve their ability to prevent, detect, and respond to cyber threats. The increasing frequency and sophistication of cyberattacks underscore the necessity for a united front, where information sharing becomes a key component of national and organizational defense strategies. Such collaboration is vital for early detection of threats, rapid dissemination of actionable intelligence, and coordinated responses to incidents. The integration of threat intelligence sharing into cybersecurity programs is seen as a force multiplier, enabling organizations to stay ahead of adversaries and protect critical infrastructure more effectively. As the threat landscape evolves, both government and private sector entities are urged to prioritize information sharing and collective defense measures to safeguard essential services and national interests.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The United States is facing an escalating threat landscape, with cyberattacks from nation-state adversaries such as China, Russia, North Korea, and Iran becoming more sophisticated and coordinated. These adversaries are not only sharing cyber intelligence and best practices among themselves but are also leveraging advanced tactics, including exploiting third-party vulnerabilities and supply chain weaknesses. Recent high-profile incidents, such as the SolarWinds, MOVEit, and Crowdstrike Linux breaches, have demonstrated the devastating impact that a single compromised vendor can have on thousands of organizations. The traditional approach to third-party risk management, which relies on static checklists and periodic audits, is no longer sufficient, as attackers exploit the gaps between assessments. Intelligence-led, continuous monitoring of vendor ecosystems is now essential to detect and respond to emerging threats in real time. The speed at which attackers weaponize vulnerabilities has dramatically increased, with the average time to exploit (TTE) dropping from 63 days in 2019 to about 5 days in 2023, and even turning negative in 2024. This means attackers are now exploiting vulnerabilities before patches are even available, often by infiltrating disclosure pipelines or accessing leaked code repositories. As a result, organizations can no longer rely solely on timely patching and must instead focus on engineering resilience, rapid detection, containment, and recovery. The need for robust, real-time threat information sharing between the private sector and the federal government is more urgent than ever. Legislative efforts, such as the Protecting America from Cyber Threats Act, aim to reauthorize and expand the Cybersecurity Information Sharing Act of 2015, providing modernized legal protections and clarifying roles to facilitate more effective collaboration. Information sharing not only enhances technical defenses but also supports the mental resilience of CISOs, who benefit from peer collaboration and early warnings about emerging threats. The collective defense enabled by information sharing allows organizations to better understand the scale and scope of threats, prioritize responses, and reduce the cost and impact of breaches. As adversaries continue to innovate and accelerate their attacks, the U.S. must adapt by fostering a culture of proactive intelligence sharing, continuous monitoring, and cyber resilience across both public and private sectors.
Jun 29, 2026
U.S. officials and cybersecurity experts have highlighted the ongoing threat posed by nation-state actors, particularly the Chinese-linked group known as Salt Typhoon, which has conducted widespread cyber intrusions targeting critical American infrastructure. These campaigns have focused on stealing intellectual property, surveilling government officials, and pre-positioning within essential networks such as airports, hospitals, water treatment facilities, and telecom providers, with the intent to disrupt services or gather intelligence at a time of their choosing. The persistence and sophistication of these operations underscore the urgent need for coordinated defense efforts between government agencies and the private sector, as most critical infrastructure is privately owned or operated. Recent incidents attributed to Salt Typhoon include the compromise of multiple U.S. telecom networks, with attackers maintaining access for nearly a year before detection. These breaches exemplify the evolving nature of hybrid and cross-domain threats, where cyber intrusions can cascade into physical and reputational risks. Security leaders are being urged to adopt new, asymmetric approaches to risk management, breaking down traditional silos and ensuring that intelligence and response capabilities keep pace with the rapidly changing threat landscape.
Jul 12, 2026
US critical infrastructure faces increasing threats from both aging technology and sophisticated nation-state adversaries, prompting urgent calls for modernization and enhanced security. Experts highlight the unique challenges of operational technology (OT) environments, such as legacy systems and limited budgets, and discuss Tennessee's ambitious efforts to become the most secure state by hardening its power grids, water systems, and industrial controls. Nationally, organizations like the Institute for Critical Infrastructure Technology (ICIT) are advocating for a comprehensive vision to strengthen and modernize critical infrastructure by 2026, emphasizing the need for greater awareness, investment, and resilience against both physical and cyber threats. Recent incidents underscore the severity of the threat landscape, with Chinese state-sponsored actors reportedly pre-positioning themselves within US water utilities and other essential services, moving beyond espionage to potential disruptive and destructive operations. The growing vulnerability of basic services, such as electricity and water, has become a political and security flashpoint, with rising costs and overdue bills compounding the risks. These developments have drawn attention from policymakers, industry leaders, and the public, reinforcing the necessity for coordinated action to protect the nation's critical infrastructure from evolving cyber and physical threats.
Jun 29, 2026