Loading story…
A significant cybersecurity breach at the Federal Emergency Management Agency (FEMA) resulted in the exposure of sensitive employee data from both FEMA and U.S. Customs and Border Protection (CBP). The incident began on June 22, when attackers exploited compromised credentials to gain unauthorized access to FEMA's Citrix virtual desktop infrastructure. This access enabled the hackers to exfiltrate data from Region 6 servers, which are responsible for overseeing five southern states and nearly 70 tribal nations. The breach was facilitated by the CitrixBleed 2.0 vulnerability, a widely publicized flaw that allows attackers to bypass authentication controls in Citrix environments. The Department of Homeland Security (DHS) determined that FEMA's IT staff had failed to implement essential security measures, including multi-factor authentication, timely patching of critical vulnerabilities, and addressing known risks. As a result of these failures, multiple senior FEMA technology officers were dismissed on August 29, and the agency underwent a significant IT leadership restructuring. DHS Secretary Kristi Noem publicly criticized FEMA's technology leadership for resisting audits and providing misleading information to oversight officials. The breach was described as 'widespread,' with internal presentations and meeting notes confirming that the incident led to the theft of employee data from both FEMA and CBP. The compromised data resided on servers connected to states along the southern U.S. border, increasing the potential impact of the breach. In response, FEMA has initiated a comprehensive overhaul of its IT security posture, including the appointment of acting CIO Diego Lapiduz to lead recovery and remediation efforts. Additional security measures and staff restructuring are underway to prevent similar incidents in the future. The incident has drawn attention to the critical importance of enforcing basic cybersecurity hygiene and the risks posed by unpatched vulnerabilities in widely used remote access solutions. The breach underscores the need for federal agencies to maintain rigorous security controls and to respond swiftly to emerging threats. The exposure of employee data from both FEMA and CBP raises concerns about potential identity theft and further exploitation by malicious actors. The incident has also prompted broader scrutiny of cybersecurity practices across federal agencies, particularly regarding the use of Citrix and other remote access technologies. The failure to address the CitrixBleed 2.0 vulnerability in a timely manner was a key factor in the success of the attack. FEMA's response includes not only technical remediation but also significant organizational changes to restore trust and improve oversight. The breach serves as a cautionary tale for other government agencies and organizations relying on similar technologies. Ongoing investigations aim to determine the full scope of the data compromised and to identify the threat actors responsible. The event highlights the persistent challenges faced by large organizations in maintaining effective cybersecurity defenses against sophisticated attacks.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Public reporting and follow-on coverage disclosed that FEMA employee data had been exposed in the breach. The later report reinforced that the incident involved compromised personnel information tied to the earlier disclosed attack.
A cyber breach affected the Federal Emergency Management Agency and U.S. Customs and Border Protection, allowing attackers to steal employee data. Reporting described the incident as widespread and impacting personnel information at both agencies.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
US Senator Bill Cassidy has demanded answers from Cisco regarding critical vulnerabilities in its Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) devices, specifically CVE-2025-20333 and CVE-2025-20362, which have been actively exploited by threat actors. The senator's letter to Cisco CEO Chuck Robbins follows reports that at least one federal agency was breached as a direct result of these flaws, though Cisco has not publicly confirmed the breach. The vulnerabilities prompted the Cybersecurity and Infrastructure Security Agency (CISA) to issue an emergency directive, requiring all federal civilian agencies to identify affected devices, review logs for signs of compromise, and apply Cisco's patches within 24 hours. Devices that had reached end of support were ordered to be removed from service entirely. Cisco acknowledged that exploitation of these vulnerabilities had been ongoing since at least May, when government incident responders involved Cisco in investigations of compromised ASA 5500-X firewalls. Attackers were observed deploying implants, executing commands, and exfiltrating data from affected systems well before the vulnerabilities were publicly disclosed. The exploitation campaign, known as ArcaneDoor, was attributed by Cisco to a Chinese-linked threat group identified as UAT4356, which has targeted government systems globally since November 2023. Senator Cassidy's letter raises concerns about Cisco's transparency regarding the impact of these vulnerabilities on both government and private sector customers. He questioned whether Cisco has identified specific threats to its customers, how it communicates security issues, and whether CISA's guidance to federal agencies is also being provided to private organizations. The senator emphasized the critical role Cisco plays in national infrastructure, noting that vulnerabilities in its products could jeopardize access to essential services for millions of Americans. Cisco has not responded to media requests for comment on the senator's inquiries or the reported breach. The emergency directive from CISA underscores the severity of the risk, highlighting the widespread use of ASA appliances in both government and large enterprise environments. The incident has drawn attention to the need for rapid patching and clear communication from vendors when critical vulnerabilities are discovered. Security agencies in both the US and UK have issued urgent advisories, warning of active exploitation and the necessity for immediate remediation. The ongoing investigation seeks to determine the full scope of the compromise and whether additional agencies or organizations have been affected. The situation has reignited debate over the security of widely deployed network infrastructure and the responsibilities of vendors in managing and disclosing vulnerabilities. The case also illustrates the persistent threat posed by sophisticated state-linked actors targeting critical government systems. As the response continues, both public and private sector organizations are urged to review their exposure and ensure all relevant patches are applied without delay.
Jun 29, 2026
CISA has issued an alert regarding the active exploitation of two critical vulnerabilities: a local file inclusion/remote code execution (LFI/RCE) flaw in *Gladinet CentreStack* and *Triofox* (CVE-2025-11371), and an OS command injection vulnerability in *Control Web Panel* (CWP) (CVE-2025-48703). Both vulnerabilities have been added to the Known Exploited Vulnerabilities (KEV) Catalog following evidence of in-the-wild attacks, and are considered significant risks for organizations, especially those in the federal enterprise. Federal Civilian Executive Branch (FCEB) agencies are mandated by Binding Operational Directive (BOD) 22-01 to remediate these vulnerabilities by the specified due date to protect against ongoing threats. CISA strongly recommends that all organizations, not just federal agencies, prioritize patching these vulnerabilities as part of their vulnerability management practices to reduce exposure to cyberattacks leveraging these flaws.
Jun 29, 2026
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive requiring all federal agencies to immediately patch critical vulnerabilities in F5 devices and software following the discovery of a nation-state cyber intrusion. CISA identified that a sophisticated threat actor, linked to China, has been actively exploiting vulnerabilities in F5 products, posing an imminent threat to federal networks. The vulnerabilities allow attackers to gain unauthorized access to embedded credentials and API keys, which can be leveraged to move laterally within affected networks. This access enables the exfiltration of sensitive data and the establishment of persistent access, potentially resulting in a full compromise of targeted information systems. F5 disclosed that the threat actor had maintained long-term, persistent access to its BIG-IP development environment and engineering knowledge management platforms, leading to the exfiltration of files. CISA’s Emergency Directive 26-01 mandates that all Federal Civilian Executive Branch (FCEB) agencies apply the latest vendor-provided updates to at-risk F5 devices and software, including F5OS, BIG-IP TMOS, BIG-IQ, and BNK / CNF, by October 22, 2025. Agencies are also instructed to follow F5’s Quarterly Security Notification for further mitigation steps. The directive was issued despite ongoing challenges such as a government shutdown and the lapse of the Cybersecurity Information Sharing Act of 2015, underscoring the urgency and severity of the threat. CISA’s acting director emphasized the alarming ease with which these vulnerabilities can be exploited and warned that the risks extend beyond federal agencies to any organization using F5 technology. The agency highlighted the potential for catastrophic compromise of critical information systems if the vulnerabilities are not addressed promptly. The directive is part of a broader effort to protect federal networks from nation-state adversaries and to ensure the security of sensitive government data. CISA’s response follows a pattern of nation-state actors targeting widely used enterprise technologies to gain access to high-value networks. The agency’s public statements and technical guidance stress the importance of immediate action and cross-sector vigilance. F5’s own disclosures and cooperation with CISA have been critical in identifying the scope of the intrusion and the necessary remediation steps. The incident has raised concerns about the security of supply chains and the potential for similar attacks on other technology vendors. Federal agencies are being closely monitored for compliance with the directive, and CISA is providing ongoing support and threat intelligence updates. The event highlights the persistent and evolving nature of nation-state cyber threats targeting critical infrastructure and government systems.
Jun 29, 2026