Loading story…
Defense Secretary Pete Hegseth issued a September 22 memorandum directing U.S. Cyber Command and the Defense Intelligence Enterprise to prioritize detection, collection, analysis, and response against foreign threats to the 2026 U.S. elections. The order characterizes election protection as a “no-fail mission,” directs Cyber Command to employ its existing authorities against prospective foreign cyberattacks, and calls for coordination with the Department of Homeland Security; it does not identify adversaries, provide new resources or deadlines, or confirm use of the former NSA–Cyber Command Election Security Group.
The directive restores Defense Department emphasis on an enduring mission previously supported by the joint USCYBERCOM–NSA Election Security Group, which identified adversary activity, shared intelligence with public- and private-sector partners, and disrupted operations targeting democratic processes. It arrives amid reductions and reorganizations of election-security and foreign-influence programs at the FBI, ODNI, and CISA. CISA has released an election-security plan centered on regional advisers and a threat-sharing platform, while officials face growing concern that AI may let foreign actors scale cyber-enabled influence campaigns.
See the actors and campaigns active against you right now.
7 events from the most recent confirmed update back to the earliest known activity.
CISA released an election-security plan identifying its 10 regional directors as election-security advisers and providing a free threat-sharing platform for election officials, state intelligence hubs, and federal partners.
Defense Secretary Pete Hegseth signed a memorandum directing U.S. Cyber Command and the Defense Intelligence Enterprise to prioritize foreign threats to the 2026 elections. The directive calls for election-threat intelligence collection, use of Cyber Command's existing authorities against potential foreign cyberattacks, and coordination with DHS.
NSA and U.S. Cyber Command stood up their joint Election Security Group again to align intelligence sharing, domestic defense support, and disruption of foreign election threats.
The Department of Homeland Security designated election security as a critical-infrastructure component.
An ODNI overhaul shifted many Foreign Malign Influence Center responsibilities to other offices; ODNI later assigned two officials to coordinate election-threat intelligence.
The administration reorganized intelligence-community coordination of foreign-influence work and reduced election-security support at CISA.
The second Trump administration dismantled the FBI's Foreign Influence Task Force as part of changes to federal foreign-influence and election-security efforts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
nextgov.com
Open sourcensa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
US Cyber Command and the NSA have repeatedly used covert cyber operations to blunt foreign election interference, including ejecting Iranian hackers from a municipal website used to post unofficial 2020 results before false information could be spread and disrupting Russian influence operators targeting voters ahead of the 2024 election. Officials said the 2020 intrusion did not affect voting, ballot tabulation, or certified results, and described the broader mission as a joint effort with CISA, the FBI, DHS, and other agencies to counter cyberattacks, troll farms, fake websites, and AI-enabled propaganda tied to Russia, Iran, China, North Korea, and non-state actors. At the same time, the US government has reduced parts of the election security apparatus built after 2016. Reporting says the Trump administration put CISA election security staff who worked with states on leave and dismantled or downsized programs across ODNI, the FBI, the State Department, and CISA that tracked and exposed foreign influence campaigns. Current and former officials warned that the cuts weaken coordination with state and local election officials, reduce visibility into ongoing threats, and leave the country less prepared for future elections even as harassment of election workers and concern over the safety of cyber personnel have pushed agencies to keep some leadership roles out of public view.
Jun 29, 2026
US Cyber Command secretly targeted at least two Russian companies involved in covert online influence activity ahead of the 2024 US election, according to reporting that said the operation was part of a wider federal effort with the FBI, DHS, and other agencies to expose and disrupt foreign meddling aimed at voters in key swing states. The campaign reportedly pushed anti-Ukraine and anti-politician narratives, and officials said the US action slowed the Russian operation even though propaganda content continued through Election Day. The activity fits a longer pattern of Russian interference in US politics, following earlier US government findings that Moscow targeted election systems in 2016 and subsequent Justice Department charges against Russian individuals and companies tied to interference operations. Officials and former officials warn that many of the structures built after the 2016 election to counter foreign influence have since been dismantled, reduced, or paused, including functions at ODNI, the FBI, the State Department, and CISA. The rollback comes despite continued threats from Russian, Chinese, and Iranian-linked actors using fake websites, AI-enabled propaganda, and cyber activity affecting election infrastructure, raising concerns that the United States has less visibility and fewer coordinated defenses in place for future elections.
Jun 29, 2026
CISA released its 2026 Election Infrastructure Security Plan, committing to expand coordination, threat-intelligence sharing, and technical assistance for state and local election officials ahead of the midterms. The agency will designate its 10 regional directors as election-security advisers, use fusion centers to distribute intelligence, and provide a free near-real-time information-sharing platform to election officials and state intelligence hubs. The commitments follow staffing and program reductions that state officials say weakened established relationships with CISA, while the proposed fiscal 2027 budget would eliminate the agency's dedicated election-security program. The plan does not specify staffing, funding, whether prior election-adviser positions will be restored, or how the proposed platform will operate. Classified assessments reportedly identify Russian covert online influence activity aimed at eroding confidence in the elections, but found no evidence that voting machinery has been compromised in a way that would affect votes.
Sep 25, 2026