Situación Nacional de Ciberseguridad - Junio 2026 - USA

Threats and active campaigns in the USA

Ransomware and extortion in the USA

The most visible threat was Silent Ransom Group, which operated as a hybrid extortion campaign. It did not rely on mass file encryption, but on data theft and later blackmail. That tactical shift matters because it moves the burden from technical recovery to exposure containment, access tracing, and confirming whether the group had physical presence at sites. The group also used legitimate remote access tools and leak sites as pressure mechanisms.

The legal sector was the most exposed, but it was not the only one. The material also points to financial services, insurers, and professional organizations. The physical tactic, in which an operator poses as technical support, reduces automated alerts and exploits internal friction between reception, IT, and end users. From a defensive standpoint, it forces a rethink of visitor controls, identity validation, and removable media handling.

Fraud and phishing in the USA

The only clearly identifiable case in this category was the combination of phishing, vishing, and impersonation of IT staff within the Silent Ransom Group campaign. The group used emails, phone calls, and in-person deception to gain access, then exfiltrated data from corporate systems at US firms. The provided material did not include any other financial fraud or large-scale phishing case that was confirmed enough to highlight separately.

APT and hacktivism in the USA

The June material did not include enough verified incidents to assign APT or hacktivist campaigns with the same level of certainty as the rest of the note. The dominant threat signal came from extortion, active exploitation, and tighter regulation.

Critical vulnerabilities affecting the USA

The June material does not include four critical issues with the same level of corroboration and technical detail. Even so, these references are enough to show a pattern, active exploitation in file transfer software, enterprise networks, email, and mobile devices. The spread across attack surfaces means the month should be treated as a sign of broad pressure, not as an isolated incident tied to a single vendor.

Regulation and compliance in the USA

On June 22, the White House signed the executive order Securing the Nation Against Advanced Cryptographic Attacks, identified as EO 14412. The order makes it U.S. policy to migrate federal systems to NIST-approved post-quantum cryptography standards and to support critical infrastructure operators in that transition. OMB then turned that policy into M-26-15, a phased plan that starts with strategy and inventory in 2026 and runs through full migration in 2035.

The toughest deadlines are the most immediate. High-value federal assets and high-impact systems must use PQC for key establishment no later than December 31, 2030, and for digital signatures no later than December 31, 2031. Each agency must also name a migration lead, submit plans within 120 days, and align execution with NIST IR 8547. For contractors, the FAR Council must propose a rule within 180 days that carries the requirement into federal procurement. That makes post-quantum cryptography a purchasing requirement, not just a technical preference.

In telecommunications, the FCC approved two new rules that change how EAS and WEA are protected. Operators will have to replace default passwords, apply firmware updates quickly, segment devices, and verify the source of alerts before issuing them. This is not a cosmetic adjustment. The goal is to prevent hijacking or spoofing of alerts that can trigger immediate operational and social harm.

The FCC also updated the submarine cable regime for the first time since 2001. The rules expand oversight of capacity agreements and downstream customers, restrict technologies and services linked to foreign adversaries, and introduce direct licensing for SLTE. They also create a deemed waiver regime for certain applicants that can demonstrate high security standards and incident-free operations. The mix of tighter oversight and conditional exemptions points to a more granular policy than in prior years.

Privacy regulation also moved forward. Massachusetts approved its Consumer Data Privacy Act, which gives consumers rights of access, correction, deletion, portability, and opt-out from targeted advertising. The law bans the sale of precise geolocation data, limits the handling of sensitive data, and allows private lawsuits. At the same time, Minnesota joined the opposition to the SECURE Data Act, and the debate in the federal House showed a clear partisan split over the scope of federal preemption in privacy. The month ended with a compliance agenda that ranged from state privacy to cryptography, including telecom, AI, and incident reporting.

Most affected sectors in the USA

The sectors with documented incidents were seven, but they did not all face the same kind of pressure. Legal was hit hardest by Silent Ransom Group. That detail matters, because law firms handle high-value data, rely on third parties, and depend on fast response times, which makes any breach that affects confidentiality costly.

The second sensitive block was critical infrastructure and telecommunications. There, FCC changes on EAS, WEA and submarine cables sit alongside the reactivation of CIRCIA. Operationally, the federal government appears to be raising the baseline for controls in networks and services whose failure would have a massive impact, not only on direct operators but on national continuity.

Finance and professional services also came under pressure, more from compliance than from a major compromise case. The SEC material disclosure rule remains in force, the practical effect of the S-P amendments for certain advisers also remains in force, and the FTC Safeguards Rule continues to create overlapping obligations. For many firms, the risk is not one missing control, but the coexistence of different rules depending on entity type, registration and client.

Technology and enterprise software appeared because of active exploitation of specific products. SolarWinds, Cisco, Microsoft and Android make up a set that forces patching and hardening to take priority without waiting for an intrusion to materialize internally. Water and public utilities entered through breach claims, enough to show the sector remains on the extortion radar, although confirmation in this specific case was limited.

Trends and signals to watch in the USA

There is no month-over-month comparison baseline, because this is the first archived period with this indicator format for USA. That makes it impossible to state a statistical change from one month to the next. What can be said is that June brought a particularly dense mix of regulation and active exploitation, with the regulatory track taking precedence and several high-visibility incidents affecting enterprise products.

The main signal to watch is whether regulatory pressure turns into real execution in the second half of the year. In particular, attention will need to stay on agency PQC plan submissions in October 2026, the FAR Council proposal for contractors, and the ability of EAS, WEA and submarine cable operators to tighten controls without reducing availability. At the same time, CISA will continue pushing the incident reporting framework under CIRCIA, with expected impact across 16 sectors.

The second signal is tactical. Silent Ransom Group showed that the combination of human access, USB and legitimate remote support remains effective and profitable. If that pattern repeats, organizations will need to strengthen identity controls, reception awareness and physical visitor verification, not just EDR and MFA.

The third signal is exploitation of widely used products. Serv-U, Exchange and Catalyst SD-WAN are a reminder that attackers continue to prioritize edge tools or central administration tools. The risk for USA is not concentrated in a single vendor, but in the accumulation of exposed surfaces across email, networking, file transfer and mobile.

Recommendations for security teams in the USA

First, prioritize cryptographic inventory. The PQC migration is no longer an abstract debate. Agencies, contractors, and critical operators need to know where they use RSA, ECDH, ECDSA, DSA, and other affected algorithms, which third-party dependencies support those decisions, and which high-value systems depend on them. Without an inventory, there is no defensible timeline.

Second, strengthen controls over physical access and internal support. The Silent Ransom Group case requires a review of visitor policies, dual validation for IT staff, USB handling, RMM tool use, and procedures for reporting unannounced presence in offices. The perimeter is no longer just the network.

Third, accelerate patching for enterprise products with direct exposure. Serv-U, Catalyst SD-WAN, Exchange, and Android should not be treated as separate tickets. It is better to prioritize by exposure, privilege, and operational criticality. Where remote administration or corporate email is involved, exposure time should be reduced to the minimum.

Fourth, align compliance with operations. The new FCC, SEC, FTC, and CIRCIA rules are pushing legal, compliance, security, and operations to work from the same playbook. If an organization falls under several regulatory jurisdictions, it needs a single matrix of obligations, deadlines, and evidence.

Material limitations

The report was built exclusively from the material provided. No internet was used and no outside facts were added. Some elements appear only partially confirmed or are described by the source as uncertain, so strong conclusions were avoided on those points. That affects, for example, the mention of possible limited exploitation on Android and the early publication of the NIST draft on IoT.

In addition, although the period indicators record 15 documented incidents and 8 ransomware or extortion cases, the consolidated deep research provides a narrower subset of cases with enough detail for editorial reporting. For that reason, the note focuses only on the best corroborated facts and does not invent additional incidents to fill out the volume.

The coverage also does not include a technical annex of IoCs or TTPs because the available material does not provide hashes, domains, IPs, or a public list of tactics and techniques explicit enough for that section. Tables and charts were limited to verifiable information from the period.

Charts