CISA, FBI and NSA warned that Iranian-linked actors are targeting internet-connected PLCs in U.S. critical infrastructure, while a Massachusetts hospital diverted ambulances after a cyberattack. Investigators tracked cloud data theft to abused authentication tokens after a SaaS integrator breach, and the DOJ disrupted a GRU-linked DNS hijacking botnet as NIST advanced an AI risk profile for critical infrastructure operators broadly.

This cycle reinforces a DFIR reality: exposure risk often stems from basics—overshared cloud content, weak identity controls, and stale permissions—rather than exotic zero-days. APT credential-harvesting keeps accelerating through cheap infrastructure, so defenders should treat identity telemetry and web artifacts as primary evidence. Cross-border fraud arrests also show why disciplined logging and financial tracing matter during incident response and prosecutions worldwide.