Loading story…
CISA, the Australian Cyber Security Centre, the FBI, and other international partners released CI Fortify – Advice for isolating vital systems, a joint guidance package aimed at helping critical infrastructure operators keep essential services running during cyberattacks and major disruptions. The guidance tells organizations to identify minimum vital operational technology and supporting systems, map dependencies and network connections, and establish physical or logical isolation points so critical functions can be separated from corporate, internet-facing, and other less-trusted environments when needed.
The agencies said operators should build and regularly test graduated isolation plans, with a preference for physical isolation where feasible, and prepare to sustain operations manually until reconnection is safe. The guidance was issued against a backdrop of persistent threats from state-backed and criminal actors, including activity previously linked to Volt Typhoon and Salt Typhoon, and warns that isolation itself creates risks such as reduced patching, lower external visibility, and increased exposure from removable media that must be addressed in advance.
See the actors and campaigns active against you right now.
2 events from the most recent confirmed update back to the earliest known activity.
CISA published the CI Fortify page covering guidance for industrial control systems and critical infrastructure resilience.
U.S. and Australian cybersecurity agencies, alongside the FBI and other international partners, released "CI Fortify – Advice for isolating vital systems" for critical infrastructure operators. The guidance advises pre-planning how to isolate vital operational technology and supporting systems from less-trusted networks so essential services can continue during cyberattacks or major disruptions.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
8 references tracked. Mallory keeps watching after this page renders.
csoonline.com
Open sourcewaterisac.org
Open sourcesecurityweek.com
Open sourcecisa.gov
Open sourcebleepingcomputer.com
Open sourcecyber.gov.au
Open sourcecisa.gov
Open sourcecsrc.nist.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA, the UK **NCSC**, and multiple international partners released **Secure Connectivity Principles for Operational Technology (OT)** guidance aimed at reducing risk created by increased connectivity into industrial environments (e.g., industrial control systems, sensors, and other critical services). The guidance is positioned for operators of essential services facing business and regulatory pressure to enable remote monitoring and management, and it emphasizes that formerly *air-gapped* OT is now more exposed due to expanded remote access and IT/OT convergence. The guidance highlights that insecure or exposed OT connectivity is being targeted by a broad range of adversaries, including **ransomware groups**, **state-backed actors**, and **pro-Russia hacktivists** conducting opportunistic attacks against global critical infrastructure. Recommended defensive themes include **network segmentation**, **strong authentication**, continuous monitoring, and minimizing remote access paths to prevent disruptive incidents with potential real-world safety and service-delivery impacts; CISA also solicited stakeholder feedback via a product survey. Separate opinion pieces discussing AI in critical infrastructure and power redundancy risks in OT, and an industry roundup of Chinese cybersecurity companies, do not provide additional reporting on this specific guidance release.
Jun 29, 2026
CISA officials warned that a military confrontation with a peer adversary such as **Russia or China** would likely bring successful cyberattacks against U.S. critical infrastructure, causing severe disruptions across **water, power, healthcare, law enforcement, and parts of banking**. Agency leaders said operators should expect to lose reliable internet access, third-party and vendor connections, and some **SCADA** functionality, and should plan to continue delivering essential services in a degraded state rather than relying solely on traditional cyber hygiene measures. To support that shift, CISA is prioritizing operational resilience through its **CI Fortify** initiative, redirecting OT resources to conduct **75 to 100 assessments** over the next year and expand emergency planning guidance across sectors. Officials called for "ruthless prioritization" during crises, including decisions on which facilities receive limited water or power, while the EPA is preparing a national cybersecurity exercise for the water sector to test operations without supervisory control and data acquisition technology; CISA also warned that prolonged cyber-induced outages could erode public trust more sharply than natural disaster recovery delays.
Jun 29, 2026
A virtual briefing hosted by the Institute for Critical Infrastructure Technology (ICIT) argued that **telecom networks’ “crown jewels”**—including signaling pathways and subscriber identity/metadata—remain high-value targets, and that traditional perimeter defenses are insufficient against advanced adversaries. The session cited activity associated with China-linked threat actors **Salt Typhoon** and **Volt Typhoon** as illustrative of systemic telecom weaknesses, and promoted *privacy-first mobile-carrier* design choices (e.g., minimizing exposed identifiers and reducing the long-term value of compromised data) as concrete controls to reduce attack surface and limit blast radius. Separately, the U.K. **National Cyber Security Centre (NCSC)**, working with **CISA**, the **FBI**, and other international partners, released guidance titled **“Secure Connectivity Principles for Operational Technology”** aimed at reducing exposed and insecure connectivity in OT environments, including nuclear-sector contexts. The guidance outlines **eight foundational principles** intended to help organizations protect OT networks from highly capable and opportunistic actors, including **nation-state** threats, against a backdrop of accelerating IT/OT convergence and increasing rates of OT/ICS-impacting incidents reported across critical infrastructure.
Jul 12, 2026