CISA cyber & ICS and DC3 (DoD Cyber Crime Center / DCISE) threat products relevant to the DIB — each read by dex into a categorized card: the gist, why it matters, who's affected, and what to do.
Nation-state
RCE
CISA
2026-10-08
Chinese government-linked actors use automated and hands-on tools to steal data from critical infrastructure.
Chinese government-linked cyber threat actors, enabled by the Integrity Technology Group, are combining automated scanning tools, large-scale botnets, and hands-on exploitation techniques to target and steal sensitive data from organizations worldwide, including US critical infrastructure sectors. These actors exploit vulnerabilities by using scanning tools, cross-site scripting attacks, and password spraying on Microsoft Exchange servers, while establishing persistence through VPN software and exfiltrating emails and credentials using scripts.
AFFECTEDMicrosoft Exchange serversVPN software
▸ DO Disable unused services and ports, sanitize web application inputs, implement multifactor authentication, and apply timely patches.
#rce#state-sponsored#exploited-in-wild#mitigations#dib-sector
Nation-state
CISA
2026-09-08
China-based AI companies are running industrial-scale knowledge distillation campaigns to extract proprietary capabilities from U.S. frontier AI models.
China-based AI companies are conducting systematic, malicious knowledge distillation campaigns against U.S. AI companies to extract proprietary model functionalities. The NSA, CISA, and FBI are issuing this joint advisory to alert organizations and recommend mitigations against these targeted extraction activities.
AFFECTEDClaudeGPTGeminiGrok
▸ DO Review and restrict access to proprietary AI models and monitor for unauthorized distillation attempts.
#state-sponsored#apt#mitigations#ai
Nation-state
CISA
2026-07-23
Russian state-supported actors are exploiting a zero-day in Zimbra Collaboration Suite to steal email data via phishing.
Russian state-supported cyber actors, known as LAUNDRY BEAR, have been targeting Western organizations using the Zimbra Collaboration Suite since at least July 2025. They are exploiting a zero-day vulnerability (CVE-2025-66376) to covertly acquire email data, demonstrating their continued use of phishing and novel exploits.
AFFECTEDZimbra Collaboration Suite
▸ DO Patch Zimbra Collaboration Suite immediately and hunt for compromised email accounts.
#state-sponsored#exploited-in-wild#phishing#mitigations