Loading story…
CISA released its 2026 Election Infrastructure Security Plan, committing to expand coordination, threat-intelligence sharing, and technical assistance for state and local election officials ahead of the midterms. The agency will designate its 10 regional directors as election-security advisers, use fusion centers to distribute intelligence, and provide a free near-real-time information-sharing platform to election officials and state intelligence hubs.
The commitments follow staffing and program reductions that state officials say weakened established relationships with CISA, while the proposed fiscal 2027 budget would eliminate the agency's dedicated election-security program. The plan does not specify staffing, funding, whether prior election-adviser positions will be restored, or how the proposed platform will operate. Classified assessments reportedly identify Russian covert online influence activity aimed at eroding confidence in the elections, but found no evidence that voting machinery has been compromised in a way that would affect votes.
See the actors and campaigns active against you right now.
6 events from the most recent confirmed update back to the earliest known activity.
CISA released its 2026 Election Infrastructure Security Plan, assigning its 10 regional directors as election-security advisers and offering state and local officials technical assistance, fusion-center intelligence sharing, and no-cost access to a near-real-time information-sharing platform. The plan did not specify staffing, funding, platform details, or restoration of dedicated election-adviser roles.
CISA said it used the information-sharing model later proposed for election officials during the 2026 World Cup.
The administration reportedly delivered an overdue assessment of foreign threats to the midterms and briefed lawmakers and congressional staff. Classified assessments reportedly found Russian covert online operations intended to undermine confidence in the elections and deepen political divisions, but no evidence of voting-machine compromise affecting voting.
ODNI assigned two officials to coordinate election-threat intelligence after transferring many Foreign Malign Influence Center responsibilities to other offices.
Michigan Deputy Secretary of State Aghogho Edevbie told lawmakers that local election officials had lost contact with CISA personnel they previously relied on following staffing and program reductions.
Mojave Research said its federal voting-system research ended after it identified serious security weaknesses in voting machines used in Puerto Rico in 2024. The company said it found no evidence that the weaknesses were exploited or altered votes.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcenextgov.com
Open sourcesubscriber.politicopro.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The White House’s fiscal year 2027 budget proposal would cut about **$707 million** from the Cybersecurity and Infrastructure Security Agency, shrinking the agency by roughly 30% and narrowing its mission to federal civilian network defense and critical infrastructure protection. Budget documents and reporting say the plan would reduce spending on personnel, contractors, equipment, mission support, stakeholder engagement, and international affairs, while also eliminating CISA’s election security program and ending support for the Elections Infrastructure Information Sharing and Analysis Center. The proposal also restructures some Department of Homeland Security functions, including changes tied to the Office of Countering Weapons of Mass Destruction, while preserving selected technical efforts such as `CIRCIA` implementation and cybersecurity planning support for the 2028 Los Angeles Olympics. The proposed cuts have drawn warnings from state officials, industry groups, former agency personnel, and cybersecurity experts who say CISA’s reduced role could weaken threat intelligence sharing, incident response coordination, election security assistance, and cross-sector risk management. Multiple reports note that CISA has already faced layoffs, funding pressure, and leadership instability, and critics argue that further reductions could fragment national cyber defense at a time of continued intrusions linked to Russia, China, and Iran and growing concern over AI-enabled threats. The administration says the changes would eliminate waste, duplicative programs, and activities tied to misinformation work, but the final budget is expected to face significant congressional scrutiny.
Jun 29, 2026
A DHS “minibus” appropriations package would direct the Cybersecurity and Infrastructure Security Agency (**CISA**) to maintain “sufficient” staffing to execute its statutory missions, including support to federal civilian agencies and state/local/tribal/territorial partners. The accompanying congressional language also calls for maintaining at least **10 regional field offices** and having at least **one Cyber Security Advisor per state or territory**, while continuing to fund election security activities (including regional election security advisers and the Elections Infrastructure ISAC). The bill would provide **$2.6B for CISA**, down from roughly $3B previously cited in the reporting. The same funding package would extend authorization for the **Technology Modernization Fund (TMF)**—which had lapsed—through **Sept. 30** (end of FY2026), enabling continued federal IT modernization investments that are often tied to cyber risk reduction. It would also extend several cybersecurity-related statutory authorities, including the **Cybersecurity Information Sharing Act of 2015**, preserving a legal framework for private-sector sharing of cyber threat intelligence with U.S. government entities under specified liability protections. Separately, CISA leadership turmoil was reported as internal pushback halted an attempted management-directed reassignment of CISA CIO **Robert Costello**, adding to concerns about decision-making and stability amid ongoing pressure from persistent threats to federal networks and critical infrastructure.
Jun 29, 2026
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has retired six cybersecurity assessment and support programs for critical-infrastructure operators following budget reductions and a workforce decline of roughly one-third. Discontinued services include Cyber Resilience Reviews, Ransomware Readiness Assessments, Incident Management Reviews, and Cyber Infrastructure Surveys, leaving organizations to use a self-service questionnaire, Cybersecurity Performance Goals, and potentially older open-source CSET assessment modules. The reductions are expected to weigh most heavily on under-resourced water utilities, municipalities, hospitals, and other operators that relied on CISA regional-adviser support. Acting Director Nick Andersen said CISA must rapidly address aging technology, accumulated technical debt, and AI-driven risks that could overwhelm infrastructure operators with vulnerabilities. About 250 selected candidates are awaiting security clearances as the agency seeks to fill operational, cybersecurity, infrastructure-security, emergency-communications, and regional roles; Homeland Security has identified roughly 600 positions for refilling. No timeline was provided, and the administration's fiscal 2027 budget request separately proposes eliminating approximately 867 CISA positions, including funded vacancies.
Sep 9, 2026