Loading story…
The National Security Agency is holding an invitation-only reunion at Fort Meade for former members of Tailored Access Operations (TAO), its elite foreign-network exploitation unit, to recruit alumni back into government service amid attrition and historically high turnover. NSA Deputy Director Tim Kosiba, formerly TAO's technical director, reportedly spearheaded the gathering and will encourage attendees to return as the organization rebuilds after its rebranding and reorganization as Computer Network Operations.
TAO has conducted covert intrusions into foreign computer systems and contributed to development of the Stuxnet malware. Organizers initially used the National Cryptologic Foundation and later an invitation-only Signal group to coordinate the event; some former personnel raised operational-security concerns about linking hundreds of former operators, developers, and analysts through a single communications channel.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
The NSA plans to host an invitation-only, first-of-its-kind reunion at Fort Meade for former members of its Tailored Access Operations unit. The gathering is intended to mark TAO's rebranding and recruit alumni back amid personnel attrition and historically high turnover.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The National Security Agency is undertaking its most extensive internal restructuring in at least a decade, replacing existing directorates with five mission centers focused on China, cybersecurity, artificial intelligence, combat support and global intelligence. NSA Director and U.S. Cyber Command chief Army Gen. Joshua M. Rudd reportedly announced the emerging design to senior leaders and initiated a 30-day implementation period intended to speed delivery of intelligence to operational battlefields. The agency aims to reach full operational capability by January, but key decisions remain unresolved, including the placement of Tailored Access Operations and implications for the NSA–Cyber Command relationship. Current and former officials have raised concerns that the accelerated transition could disrupt NSA operations and repeat shortcomings associated with the previous NSA21 restructuring.
Sep 15, 2026
The National Security Agency (NSA) has undergone significant leadership changes following months of instability at its highest levels. Tim Kosiba, a veteran with over three decades of federal service, has been appointed as the new deputy director of the NSA after the Trump administration removed his predecessor and other top officials, reportedly due to political pressure. Kosiba previously held key roles within the NSA, FBI, and Naval Criminal Investigative Service, and his appointment was confirmed by Defense Secretary Pete Hegseth and Director of National Intelligence Tulsi Gabbard with President Trump's approval. The agency has faced a prolonged period without a Senate-confirmed leader, contributing to uncertainty within both the NSA and U.S. Cyber Command. Simultaneously, the NSA's cybersecurity directorate is also experiencing a transition in leadership. David Imbordino, currently the directorate’s deputy chief, will serve as acting head following the retirement of Greg Smithberger, who had been leading in an interim capacity. Holly Baroody is set to return from the United Kingdom to serve as acting deputy chief. The directorate, established in 2019 to enhance intelligence sharing and collaboration with critical infrastructure, has lacked a permanent chief since early last year. These leadership changes come as the NSA continues to address evolving cyber threats, including recent advisories on malware such as BRICKSTORM, and underscores the agency’s ongoing efforts to stabilize its executive ranks and maintain operational continuity.
Jun 29, 2026
U.S. Cyber Command’s Cyber National Mission Force (CNMF) removed Air Force Lt. Col. **Jason Gargan**, a joint task force commander focused on operations against **Russia**, after he was “relieved for cause” following disagreements over operations with CNMF leadership, according to people familiar with the matter. Gargan was reassigned elsewhere within CNMF and is expected to retire by the end of 2026; the move was described as unusual for CNMF, where underperforming leaders are typically rotated rather than dismissed. The personnel action occurred amid broader senior-level churn at Cyber Command, which has reportedly been without a Senate-confirmed leader for an extended period, and as CNMF chief Maj. Gen. **Lorna Mahlock** was nominated to become Cyber Command’s next deputy chief. Separately, the **National Security Agency (NSA)** appointed intelligence community veteran **Timothy Kosiba** as deputy director with presidential approval. Reporting highlighted Kosiba’s background in network warfare and offensive cyber roles (including **Tailored Access Operations**-linked positions) and senior leadership posts supporting foreign signals intelligence and cybersecurity missions; Acting NSA and Cyber Command head **William Hartman** publicly endorsed the appointment as supporting NSA’s mission execution.
Jun 29, 2026