FBI and CISA warn critical infrastructure operators on third-party ICS integrator access
The FBI and CISA published a fact sheet advising critical infrastructure owners and operators to limit access granted to third-party ICS integrators. The agencies recommend applying the principle of least privilege in OT environments, warning that excessive third-party access could let malicious cyber actors compromise critical infrastructure and cause disruptive or destructive effects.
Sources and evidence
Attributed quotes
“Critical infrastructure owners and operators should maintain caution when granting third-party ICS integrators high levels of access or control over industrial processes, ensuring the principle of least privilege (PoLP), is applied.”
“Not adopting principles such as PoLP could expose owners and operators to malicious cyber actors seeking to compromise critical infrastructure, possibly providing sensitive access to pathways that actors can exploit to cause disruptive and destructive effects to equipment and critical functions.”
Summary last validated Sep 29, 2026
Reader actions
Report an issue
Use this for an incorrect summary, wrong source, duplicate story, or wrong category. Submissions are private and do not change the story automatically.
Related coverage
- security
Microsoft urges early testing of post-quantum certificate ecosystems
Microsoft published guidance urging organizations to begin testing certificate ecosystems for post-quantum authentication now, highlighting its PQC TLS Pilot Program as a way to advance future readiness. The post appeared on the Microsoft Security Blog.
- security
CISA: Chinese Government-linked Hackers Target US Critical Infrastructure
CISA published an advisory stating Chinese government-linked cyber threat actors, enabled by China-based Integrity Technology Group, combine automated scanning, botnets, and hands-on exploitation to steal sensitive data from organizations worldwide, including US critical infrastructure. Tactics include cross-site scripting and password spraying on Microsoft Exchange servers, VPN persistence, and email and credential exfiltration via scripts.
- security
Cisco Talos Ties UAT-11985 to AI-Assisted Google AitM Phishing
Cisco Talos identified an APT spear-phishing campaign, tracked as UAT-11985, targeting individuals affiliated with Taiwan research organizations. The operation used legitimate public event themes and impersonated reputable academic and policy institutions, delivering real-time Google adversary-in-the-middle phishing.
- security
Cisco Talos details malware techniques for evading AI analysis
Cisco Talos published research on "AI-analysis evasion," describing real-world techniques malware authors use to obstruct or defeat automated AI analysis layers. The blog examines the current state of these evasion methods, which are designed to interfere with AI-driven malware detection and analysis pipelines.
- security
OpenAI disrupts AI-enabled false-front influence operations
OpenAI said it disrupted two AI-enabled influence operations that used false-front journalists and a think tank to spread geopolitical messaging. The company announced the takedowns on its blog, describing the campaigns as using AI to pose as media figures and an institutional research outlet.