The Department of Homeland Security on Thursday warned of a “hijacking and tampering” campaign affecting a “number of agencies,” without specifying who is behind the attacks or what agencies have been targeted, CNN reports.
The DHS Cybersecurity and Infrastructure Security Agency, or CISA, “is tracking a series of incidents involving Domain Name System (DNS) infrastructure tampering. CISA is aware of multiple executive branch agency domains that were impacted by the tampering campaign and has notified the agencies that maintain them," according to an emergency directive released on Tuesday.
Due to the ongoing partial government shutdown, about 13 percent of the DHS workforce has been furloughed. Although the department reports that it remains capable of assisting in protecting national security, some significant federal cybersecurity measures have been affected by the shutdown.
According to DHS, attackers interfered with Domain Name System records, which allowed them to redirect and intercept “web and mail traffic.”
The department instructed federal agencies to “audit public DNS records” to make sure “they resolve to the intended location,” and report them to CISA if not, as well as updating passwords, adding multi-factor authentication, and begin monitoring certificate transparency logs.
FireEye senior manager of cyber espionage analysis Benjamin Read told CNN that “we continue to see evidence suggesting that operators are operating out of Iran, and going after targets that would be of interest to a government,” specifically suggesting “in support of the Iranian government,” and that the attacks have affected a minimum of 12 countries.
© 2026 Newsmax. All rights reserved.