Loading story…
CISA issued 22-page guidance, “Using Cyber Decoys to Strengthen Detection and Response,” urging critical-infrastructure owners and operators to use realistic decoy systems, accounts, data, honeypots, and honeytokens to expose intruders already present in their networks. The agency describes the approach as a comparatively low-cost, high-fidelity detection capability that distracts adversaries, generates actionable alerts, and gathers threat intelligence.
The guidance complements Zero Trust and assume-compromise strategies, particularly for organizations with limited security staff or budgets. CISA recommends placing decoys where legitimate interaction is rare, configuring high-fidelity alerts, and using lures, tripwires, and artifacts to observe attacker behavior; it outlines a scalable three-phase deployment process covering preparation, execution, and analysis and feedback without requiring major architectural changes.
See the actors and campaigns active against you right now.
1 event from the most recent confirmed update back to the earliest known activity.
CISA released its 22-page "Using Cyber Decoys to Strengthen Detection and Response" guidance for critical-infrastructure owners and operators. The guide recommends deceptive systems, accounts, data, honeytokens, and related mechanisms to detect, divert, and observe adversaries who have gained network access.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA has revised its **Insider Threat Mitigation Guide** with updated case studies, statistics, and resources to help security, HR, and organizational leaders build or assess insider-risk programs at any maturity level. The guidance addresses risks created by hybrid and remote work, adverse employee separations, and AI-enabled manipulation and deception, while broadening its scope from data protection to physical security, violence prevention, access control, and visitor screening. The agency urges organizations to identify behavioral warning signs and improve preparedness and early-risk detection because trusted users, contractors, vendors, machine identities, and AI agents can misuse, compromise, or unintentionally expose organizational assets through otherwise legitimate credentials and workflows. Recommended measures include least-privilege and just-in-time access, identity and behavioral analytics, governance for non-human identities, adaptive controls for high-risk actions, data-loss prevention, and continuous security education.
Sep 10, 2026
CISA, the Australian Cyber Security Centre, the FBI, and other international partners released **CI Fortify – Advice for isolating vital systems**, a joint guidance package aimed at helping critical infrastructure operators keep essential services running during cyberattacks and major disruptions. The guidance tells organizations to identify minimum vital operational technology and supporting systems, map dependencies and network connections, and establish physical or logical isolation points so critical functions can be separated from corporate, internet-facing, and other less-trusted environments when needed. The agencies said operators should build and regularly test graduated isolation plans, with a preference for **physical isolation** where feasible, and prepare to sustain operations manually until reconnection is safe. The guidance was issued against a backdrop of persistent threats from state-backed and criminal actors, including activity previously linked to **Volt Typhoon** and **Salt Typhoon**, and warns that isolation itself creates risks such as reduced patching, lower external visibility, and increased exposure from removable media that must be addressed in advance.
Sep 2, 2026
The UK government is moving to update the Computer Misuse Act (CMA), originally enacted in 1990, to better protect ethical hacking and legitimate cybersecurity research. The lack of exemptions for researchers in the original law has long been a concern, and recent recognition of the growing scale of cybercrime and the need for robust research has prompted calls for reform. The changes aim to ensure that cybersecurity professionals can conduct research without fear of prosecution, reflecting the evolving threat landscape and the importance of proactive defense. In parallel, the UK's National Cyber Security Centre (NCSC) has highlighted the value and risks of cyber deception technologies such as honeypots and decoy accounts. Findings from the NCSC's Active Cyber Defense 2.0 program indicate that, when properly implemented, these tools can provide valuable threat intelligence and disrupt attacker confidence. However, the NCSC warns that poor implementation can generate noise, create vulnerabilities, or foster a false sense of security, emphasizing the need for clear strategy and ongoing management. The NCSC is working to help organizations invest in and deploy these technologies effectively as part of a modern defense strategy.
Jun 29, 2026