News

US, Allies Highlight Russian-State Cyber Actor “Star Blizzard” Spear-phishing Campaigns
December 7, 2023 — U.S. Cyber Command’s Cyber National Mission Force, alongside interagency and foreign partners, issued a joint Cybersecurity Advisory highlighting advanced spear-phishing campaigns from Russia-based malicious cyber actors... MORE

An illustration accompanying a joint Cybersecurity Advisory

About the Cyber National Mission Forces
December 6, 2023 — U.S. Cyber Command’s Cyber National Mission Force has rapidly evolved to meet the needs of the Nation and has participated in or responded to almost every national crisis the U.S. has faced... MORE

“Building Resilience”: U.S. returns from second defensive Hunt Operation in Lithuania
September 12, 2023 — U.S. Cyber Command’s Cyber National Mission Force recently concluded their second defensive hunt operation to Lithuania, building upon relationships and experiences from their previous deployment to the country in May 2022. U.S. cyber operators spent months alongside their counterparts from Lithuania’s Information Technology and Communications Department, part of the country’s Ministry of the Interior. The teams analyzed key networks, identified and prioritized by the partner, for evidence of malicious cyber activity while identifying vulnerabilities... MORE

CNMF and Partners Illuminate Multiple Nation-State Exploitation Efforts
September 7, 2023 — FORT GEORGE G. MEADE, Md. – U.S. Cyber Command’s Cyber National Mission Force, alongside Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency, and the Federal Bureau of... MORE

CNMF and Partners Illuminate Multiple Nation-State Exploitation Efforts
September 7, 2023 — U.S. Cyber Command’s Cyber National Mission Force, alongside Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency, and the Federal Bureau of Investigation released a public joint seal cybersecurity advisory, “Multiple Nation-State Threat Actors Exploit CVE-2022-47966 and CVE-2022-42475,” on Sept. 7. The CSA provides information on an incident at an Aeronautical Sector organization. Nation-state advanced persistent threat (APT) actors exploited CVE-2022-47966 to gain unauthorized access through the organization’s public-facing application, establish persistence and move laterally within the network. Advance persistent threat actors often scan internet-facing devices for vulnerabilities that can be easily be exploited and will continue to do so... MORE

“Shared threats, shared understanding”: U.S., Canada and Latvia conclude defensive Hunt Operations
May 10, 2023 — “Shared threats, shared understanding”: U.S., Canada and Latvia conclude defensive Hunt Operations... MORE

Cyber National Mission Force discloses IOCs from Ukrainian networks
July 20, 2022 — FORT GEORGE E. MEADE, Md.-- In close coordination with the Security Service of Ukraine, USCYBERCOM’s Cyber National Mission Force is disclosing these indicators of compromise. In the last few months,... MORE

Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks
February 24, 2022 — Summary Actions to Take Today to Protect Against Malicious Activity Search for indicators of compromise. Use antivirus software. Patch all... MORE

Iranian intel cyber suite of malware uses open source tools
January 12, 2022 — To better enable defense against malicious cyber actors, U.S. Cyber Command’s Cyber National Mission Force has identified and disclosed multiple open-source tools that Iranian intelligence actors are using in networks around the world... MORE

New CNMF initiative shares malware samples with cybersecurity industry
November 5, 2018 — Today, the Cyber National Mission Force posted its first malware sample to the website VirusTotal in an effort to share unclassified malware samples it believes will have an impact on improving global cybersecurity... MORE