A cybersecurity company called Cyware is teaming up with WaterISAC, the group that helps American water utilities warn each other about hackers.
The goal is simple: when one water system spots an attack, the warning should reach the others fast, including thousands of tiny rural systems with little or no security staff.
Why it matters beyond your tap: many of the huge computer buildings that power artificial intelligence rely on the local water supply to stay cool and to fight fires. If the local water plant is hacked, those buildings are exposed too. No price or timeline was announced.
Cyware announced on Sept. 30, 2026, in a release distributed via PR Newswire, a partnership with WaterISAC, the information-sharing organization for the US water sector. Under the arrangement, WaterISAC will use Cyware’s threat intelligence platform to collect, enrich and distribute cyber threat data and vulnerability alerts to water and wastewater utilities.
WaterISAC said its existing partnership with the National Rural Water Association already lets it serve more than 20,000 of the sector’s smallest utilities, and that Cyware was selected after an evaluation of available platforms. No financial terms, contract length or rollout schedule were disclosed.
Executive Summary
WaterISAC, the hub through which US water utilities, security experts and government partners share threat warnings, is moving its intelligence work onto Cyware’s platform. The stated aim is to replace manual processes for gathering and enriching threat data with automation, so that alerts reach members faster and larger utilities can receive intelligence directly.
The deal matters because the US water sector is extraordinarily fragmented. The release counts more than 50,000 utilities, many of them small, and argues that each one is a potential point of failure. Collective defense, the idea that a threat seen by one member protects all of them, only works if warnings reach the weakest participants in a form they can act on.
For data center operators, the announcement is a reminder that a facility’s physical resilience depends on infrastructure it does not control. Cooling systems that draw on municipal water, and fire-suppression systems fed by the local supply, inherit the cyber posture of whichever utility serves the site.
Why a Water-Sector Deal Belongs on a Data Center Risk Register
Data center resilience planning usually focuses on what sits inside the fence: backup generators, redundant cooling loops, dual fiber paths. Water is often treated as a commodity input. But many facilities, especially those using evaporative or other water-based cooling, draw on the local municipal supply, and building fire-suppression systems commonly depend on it as well. The Cyware release itself lists fire suppression alongside drinking water and sanitation as a core function of water systems.
That dependency runs through operational technology, or OT: the control systems that run pumps, valves, chemical dosing and treatment at a water plant. Cyware’s release states that adversaries targeting OT now move at machine speed. If a utility’s controls are disrupted, pressure and supply can be affected for every customer on that system, including a data center campus. The operational conclusion is that the relevant cyber defender for a site’s water is not a national agency or a large vendor, but one of more than 50,000 local utilities, each with its own level of security staffing and maturity.
For operators and developers, that makes the local utility’s cyber posture a legitimate site-selection and resilience input, weighed alongside on-site water storage and cooling design. It also means that sector-wide efforts like WaterISAC’s affect data center risk indirectly: a better-informed local utility is a more dependable upstream supplier.
The Small-Utility Problem Is the Real Test
The most revealing detail in the announcement is structural. WaterISAC says its partnership with the National Rural Water Association already lets it serve more than 20,000 of the smallest utilities. WaterISAC Executive Director Tom Dobbins described the Cyware platform as helping WaterISAC’s analysts deliver more real-time insights to members and letting the organization extend intelligence directly to larger utilities.
Read together, those statements suggest a tiered model: analysts work in the platform, larger utilities may connect directly, and smaller utilities receive curated output. That is a reasonable design, since a rural system with no dedicated security staff cannot ingest a raw threat feed. But it also means the speed gains Cyware describes will be felt most by larger members and by WaterISAC’s own analysts. Whether a warning reaches every participant regardless of size, as Cyware’s Tom Stockmeyer framed the goal, depends on how that last step is handled.
What the AI Claims Establish, and What They Do Not
Cyware positions itself around agentic AI, meaning software that automates steps an analyst would otherwise perform, such as collecting, enriching and routing threat data. The release says this will help WaterISAC significantly reduce manual effort and deliver intelligence more efficiently. Those are plausible benefits for an intelligence team, but the release offers no baseline, no target metrics and no description of how automated outputs are validated before distribution.
It is also worth separating intelligence speed from response speed. A warning delivered in seconds helps only if the recipient can act on it. For a small utility, the bottleneck is often people and budget rather than information. The partnership addresses the information side; the response side remains with each utility. Cyware has also said it is supporting NRECA on Department of Energy-funded research into automated collective defense for electric cooperatives, which places the company across both utility inputs that data centers depend on most: power and water.
Background
The US water sector is unusually fragmented: more than 50,000 utilities, ranging from large metropolitan systems to small rural operations with minimal staff. WaterISAC serves as the sector’s information-sharing hub, one of a family of industry-specific ISACs that pool threat warnings so members can learn from one another. Through its partnership with the National Rural Water Association, WaterISAC says it reaches more than 20,000 of the smallest utilities.
Cyware is a threat intelligence software vendor that unifies intelligence management, sharing and collaboration, and orchestration and automation. It markets itself around agentic AI and collective defense, and counts enterprises, government agencies and ISACs among its customers. The WaterISAC deal extends that ISAC-focused strategy into a sector whose resilience underpins other infrastructure, including data centers that rely on local water for cooling and fire protection.
Anthropic, an American artificial intelligence company, says people in the part of Yemen controlled by the Houthi armed movement tried to use its chatbot for help developing advanced weapons.
Why an ordinary person should care: the same software that drafts emails and writes computer code can be asked for dangerous things too, and for now the company selling it is also the one policing it.
Anthropic says it caught the activity. It has not said how many people were involved, what they got out of it, or when any of it happened.
The Associated Press reported that Anthropic said users in Houthi-held Yemen attempted to use its artificial intelligence models to help develop advanced weapons. The activity originated from territory controlled by the Houthi movement, which governs much of northern Yemen including the capital, Sanaa, and which has been the subject of United States terrorism designations in recent years.
Anthropic’s account, as reported, describes attempts rather than outcomes. The company has not publicly quantified the activity, named the weapons categories involved, or detailed how accounts in a conflict zone reached a commercial model that its own usage policy bars from weapons work.
Executive Summary
Frontier artificial intelligence providers have spent two years arguing that their models could, in principle, lower the skill barrier for building dangerous things. This disclosure describes an attempt to do exactly that, from a specific place, by users a model provider says it identified. That is a meaningful shift in register: from risk modelling to an incident.
For the infrastructure industry, the significance is not the headline about Yemen. It is that a software vendor with no physical presence in the country became, by default, the enforcement point for a national-security question. Model providers now perform a function that looks less like content moderation and more like sanctions screening, with the detection happening inside the inference layer rather than at a border or a bank.
That responsibility does not stay with the model provider. The same user journey touches cloud hosting, payment processing, identity verification, content delivery and transit networks, each operated by a different company with its own compliance obligations and its own log data. Anthropic’s disclosure is a useful prompt for every one of those operators to ask what it would have seen, and whether it would have recognised what it was looking at.
Misuse Stops Being a Thought Experiment
Until recently, the debate over catastrophic artificial intelligence risk ran almost entirely on hypotheticals and red-team exercises, where a lab hires experts to attack its own system. Critics reasonably noted that no one had produced a concrete case of a hostile actor using a commercial model for weapons work. A disclosure of attempted weapons development by users in a conflict zone changes the shape of that argument, even without a single confirmed capability gained.
The honest reading is narrow. Attempted misuse is evidence that the intent exists and that commercial models are considered worth trying, which was always the more likely of the two uncertainties. It is not evidence that the models delivered anything a determined group could not have found in technical literature. Those are separate claims, and conflating them is how both the alarmed and the dismissive camps get this wrong.
What is newly hard to dispute is the operational point. Access controls on frontier models are now load-bearing parts of a counter-proliferation regime, and they are maintained by private companies on commercial timelines. Any security professional who has watched a fraud team tune detection thresholds knows what that means in practice: the line moves, it is probabilistic, and it is only as good as the signals feeding it.
Who Owns the Control Point?
A request that reaches a model from a sanctioned or conflict-affected region passes through a long chain. Someone sold the connectivity. Someone hosted the inference, possibly a hyperscale cloud provider reselling model access, meaning a large cloud platform offering a third party’s model through its own interface. Someone processed the payment, or accepted a prepaid alternative. Someone provided the intermediary address that made the traffic look ordinary, whether a commercial virtual private network or a low-cost server in a neutral jurisdiction.
Each link in that chain has compliance duties that were written for a different kind of transaction. Export-control rules and sanctions screening evolved around shipped goods, wire transfers and named entities. They map awkwardly onto a metered conversation with a model, where the controlled item is not the software but the knowledge it assembles on request, and where attribution to a place depends on signals that are trivially easy to disguise.
The practical consequence for operators is that geographic risk is becoming a question about traffic and identity, not just about where racks sit. Providers that already run robust know-your-customer processes, reseller governance and abuse telemetry are better positioned than those that treat artificial intelligence workloads as ordinary compute. Expect enterprise buyers, particularly in regulated sectors, to start asking their cloud and model vendors how misuse detection works, how often accounts are actioned, and what gets escalated to governments.
The Uplift Question Decides the Policy
Everything downstream of this story depends on a single unresolved empirical question: does a frontier model materially help someone build a weapon they could not otherwise build? That is the uplift question, and it is the axis on which regulation, liability and procurement will turn. If uplift is marginal, access controls are a reputational and legal necessity but not a strategic one. If uplift is real for some categories, then model access belongs in the same policy family as controlled precursors and specialised machine tools.
Neither the companies nor the public evidence base has settled this, and it would be misleading to pretend an attempted-misuse disclosure settles it. Classified assessments likely exist; published ones are thin. Buyers should therefore treat vendor safety claims as statements about process rather than outcomes, and read them the way they read a penetration-test summary: useful, bounded, and not a guarantee.
There is a defensive corollary worth naming for critical-infrastructure operators. The same capabilities being tested for weapons work apply to the dull, effective attacks that actually take down plants, grids and pipelines: reconnaissance, industrial-protocol familiarisation, convincing phishing in a target’s own language. Adversary capability should now be modelled as artificial-intelligence-assisted by default, independent of how the weapons debate resolves.
A Region That Already Matters to the Network
Yemen sits beside one of the most consequential stretches of digital infrastructure on the planet. The Red Sea and the Bab al-Mandab strait carry subsea cable systems linking Europe, the Gulf, East Africa and Asia, and cable damage in those waters has previously degraded intercontinental capacity and forced traffic onto longer, costlier paths. Connectivity planners have treated the corridor as a concentration risk for years, which is why new routes around it keep getting announced.
That context makes this story less abstract for infrastructure readers than a story about chatbot prompts might sound. The same geography shows up in two different risk registers at once: physical exposure of cables and shipping lanes, and now conduct-based exposure at the application layer. Operators with assets, landing stations or partners in the region will find both on the same page of their next board report.
None of this argues for treating a country as uniformly hostile. Yemen is also a place where millions of civilians rely on the same internet access and the same commercial tools as everyone else, and blunt geographic blocking imposes real costs on them while barely inconveniencing a well-resourced actor with an intermediary server. The uncomfortable conclusion is that effective controls have to be behavioural and account-level, which is harder, slower and far less satisfying to announce.
Background
Anthropic is an American artificial intelligence company and the developer of the Claude family of large language models, systems trained on vast text corpora to generate text and code on request. It sells access directly and through major cloud platforms, and has positioned safety research and published usage restrictions as central to its commercial identity. Alongside its peers, it has increasingly published accounts of detected misuse of its models, a practice that borders on the threat-intelligence reporting long familiar from cybersecurity vendors.
Yemen has been divided by civil war for over a decade, with the Houthi movement controlling the north and a recognised government and allied forces holding parts of the south. The conflict has drawn in regional and international actors and made the surrounding waters a security concern for commercial shipping and the subsea cable systems that share those routes. For technology companies, the country sits in the category of jurisdictions where sanctions exposure, limited verification infrastructure and genuine civilian need for digital services all overlap.
Artificial intelligence programs are starting to touch the systems that actually run a country: power grids, water utilities, defence networks, government records. Those systems are deliberately kept off the internet so nothing outside can reach them.
Wand AI and Zeroport say they have a way to let automated software workers operate them anyway. The software gets no connection at all. It sends keystrokes down a wire built so that data physically cannot travel back, and receives only a moving picture of the screen, like looking through a window.
A separate computer watches every frame and can cut the session off mid-task.
Wand AI said in a September 9 announcement distributed over PR Newswire that it has added Zeroport to its Sovereign AI offering, incorporating Zeroport’s Fantom hardware boundary and its Moativ enforcement layer into Wand’s agent platform. The stated goal is to let government programs point autonomous AI agents at segmented and air-gapped estates, including grid, water, SCADA, defence, banking and registry systems, without creating a network route into them.
Under the joint reference architecture, Wand’s runtime dispatches an agent session to a dedicated Fantom Core rather than to an endpoint inside the protected network. Only keystroke and mouse input travels inward across a one-way hardware break, and only a display-only pixel stream travels outward. Moativ, an on-device model running on NVIDIA Jetson Thor accelerators inside the same appliance, inspects every input and every frame and can alert, block or physically sever the session. The companies say the architecture is available to sovereign programs and enterprises now, and that adopting Zeroport is elective rather than required.
Executive Summary
The announcement addresses a real and specific bottleneck. National AI programs are moving past document summarisation toward operating systems of record and systems of control, and those are precisely the estates that security teams spent a decade making unreachable. Connecting an agent to them the conventional way means provisioning an interface, a credential and a network path, which recreates the exposure the segmentation was designed to eliminate. Zeroport’s argument is that the route itself should be removed rather than narrowed.
The technical claim has two halves, and they deserve separate treatment. The first is that the access path is physical: a partition built from the chip up that carries no IP packet and terminates no network session, so an agent reaches the protected system the way a cleared human operator does, keystrokes in and pixels out. The second is that the policy governing the agent lives out of band, on hardware the governed session has no address for, which answers a genuine weakness in software guardrails that run on the same computational plane as the model they police.
What the companies have described is an architecture and a reference design, not a deployment record. No sovereign customer, contract value, pilot result or third-party certification accompanies the announcement, and the performance figures are stated as targets and capacities rather than measured production results. The architectural idea is coherent and the problem is well framed; the evidence that it works at national scale is still forthcoming.
The Last Mile of Sovereign AI Is an Access Problem, Not a Model Problem
Sovereign AI has largely been discussed as a question of ownership: whose chips, whose weights, whose data centre, whose law. That framing gets a country to a capable model sitting on domestic compute. It does not get the model anywhere near the substation control interface, the water treatment historian, or the case management system where the work actually is. Air-gapping means a network is physically or logically isolated with no routable connection to the outside, and organisations do it precisely because a path into those estates is a national risk before it is an IT risk.
Wand’s positioning treats that last mile as the binding constraint on the value of AI labour, and the logic holds. An agent restricted to systems already reachable through ordinary enterprise controls is confined to the least consequential half of a ministry’s estate. The alternatives on offer today all involve a trade the release characterises fairly: virtual private networks, zero-trust network access and privileged access management gateways narrow and log the route but preserve it, so it remains enumerable and exploitable; guardrail software asserts policy on the same plane as the model, where a sufficiently capable model can be argued out of it; and leaving the estate offline removes the route by removing the workload.
Zeroport cites roughly two-thirds of cyber-attacks as exploiting remote access tooling and 80 percent of breaches as involving stolen or compromised credentials. Neither figure is sourced in the announcement, and both are the kind of round number that circulates widely in vendor material, so they should be read as framing rather than evidence. The underlying point survives the caveat regardless: remote access is the dominant vector in most credible threat models, and an agentic layer multiplies the number of sessions requesting it.
Physics Governs the Route; Software Still Governs the Judgment
The strongest part of this architecture is also the most conventional. A one-way hardware break that admits only human-interface signals and emits only pixels is a descendant of the unidirectional gateway and data diode designs that have protected operational technology perimeters for years, combined with the display-only principle behind remote desktop and browser isolation. Applying that lineage to agent sessions is a sensible extension rather than an invention, and it inherits the property that matters: there is no packet to smuggle a payload inside, and nothing for a compromised or drifting agent to pivot into. Revoking an agent removes the path outright rather than closing a session on a path that persists.
The second claim needs more care. Moativ enforces policy from silicon the governed session cannot address, which genuinely defeats the prompt-injection and goal-drift failure modes where an agent talks its way past a rule that lives in its own context. But Moativ is itself a model making content-level judgments about what is on screen and what was typed. Physics secures the channel; a classifier decides intent. That classifier can produce false negatives, in which a harmful action reads as sanctioned, and false positives, in which legitimate work is severed. On a control system, a wrongly terminated session mid-action is not a neutral outcome.
The controls around that risk are described more concretely than most vendors manage. Rules are written in plain language and compiled into staged detectors, dry-run against a program’s own session history before they are armed, with autonomy set per group on a five-step dial running from observe through alert, investigate and terminate to self-tune. Dry-running policy against real historical sessions is the right way to calibrate an enforcement model, and the audit trail attaches screen content, keystrokes and rationale to every autonomous action. What is absent is any published figure for detection accuracy or intervention rate.
Pixels In, Pixels Out: What the Agent Gives Up
Routing an agent through a screen rather than an application programming interface is a security gain purchased with capability. Agents that drive graphical interfaces are measurably less reliable than agents calling structured interfaces, because they must locate controls visually, tolerate rendering variation, and recover from states no schema describes. Every task must be expressible as keystrokes and mouse movement against a live display, and nothing structured comes back, only pixels. For supervisory control work performed by a human operator today, that is a natural fit. For bulk data extraction, batch reconciliation or anything requiring high-volume structured output, it is a poor one, and it is worth noting that the pixel-only return path is exactly what makes exfiltration hard.
The economics scale in a way network overlays do not. Capacity grows in Cores and then in appliances, with hundreds of concurrent sessions per appliance and thousands per rack, and humans and agents riding the same rails with no shared tunnel to bottleneck. That converts a licensing question into a hardware procurement question, which is familiar territory for defence and utility buyers and appears in a capital budget rather than an operating one. The dedicated pathways target sub-50-millisecond latency, stated as a design target, which is the threshold that separates a channel usable for live control from one fit only for after-the-fact review. All inspection happens on-premises and no session content leaves the rack, a claim that matters more to sovereign buyers than almost anything else in the architecture.
An Ecosystem Assembled Layer by Layer
This is the third such addition Wand has announced in the same pattern, following a storage efficiency layer and a model robustness layer, and alongside existing inference privacy and confidential computing capabilities. The construction is deliberate: a sovereign platform assembled from independently adoptable components, none a prerequisite for another, each addressing a distinct objection a national buyer might raise. It is a credible route to breadth for a company founded in 2023, and it lets Wand answer a procurement checklist without building every layer itself.
It also leaves the commercial substance of each addition undefined. The announcement describes a joint reference architecture and mutual technical fit, but not whether Zeroport hardware is resold by Wand, jointly supported, revenue-shared, or merely certified as compatible. Buyers evaluating an integration care about which entity holds the support contract when an appliance severs a session on a live grid system. It is also worth recording plainly that Fusion Fund appears as an investor in both companies, which is unremarkable in a specialised market but relevant context for how ecosystem partnerships form.
For Zeroport, founded in 2024 in Herzliya by security and military-intelligence veterans, the partnership offers distribution into national programs that a two-year-old hardware company would otherwise reach slowly. For Wand, whose offices include Abu Dhabi and whose stated customer base spans banks, asset managers and system integrators, it supplies an answer to the question sovereign buyers ask last and hardest: what happens when the agent has to touch the thing that matters.
Background
Sovereign AI describes a country’s effort to run artificial intelligence on domestic compute, under domestic law, with control over the models, data and policies involved. The first wave of national programs concentrated on procuring accelerators and building data centres. The second, now underway, tries to convert that capacity into operational work inside ministries, utilities and defence estates, which raises a problem the first wave never had to solve: the highest-value systems are the ones deliberately made unreachable.
Wand AI, founded in 2023 and headquartered in Palo Alto with offices in New York and Abu Dhabi, sells an operating system for deploying and governing AI agents alongside humans, with identity, authority, audit and governance built in. It is backed by Shasta Ventures, Fusion Fund, Thiel Capital and Palo Alto Growth Capital, and has been assembling its sovereign offering as a series of independently adoptable layers covering inference privacy, confidential computing, model robustness and storage efficiency. Zeroport, founded in 2024 in Herzliya, Israel, holds multiple patents on its Fantom platform and says it is deployed across critical infrastructure, energy, defence, financial services and government environments, with backing from lool ventures, Clarim Ventures, CyberFuture and Fusion Fund.
Investigators in Germany are looking into whether someone deliberately damaged equipment at two power substations. A substation is the fenced yard of transformers and switches that takes electricity off long-distance lines and turns it into the kind you can use in a building.
Nobody has been blamed yet. It matters because the warehouses that hold our email, banking and streaming data sit directly behind that equipment. If a substation goes down, backup generators buy hours or days — not weeks.
The Associated Press reported that German authorities have opened an investigation into suspected sabotage following disruption at two electricity substations. Substations are the switching and voltage-conversion nodes that connect the high-voltage transmission network to the lower-voltage lines serving homes, industrial sites and data centers.
“Suspected sabotage” is an investigative classification rather than a finding: it describes how prosecutors are treating the damage while they work, not a conclusion about who caused it or why. Attribution, motive and the full operational impact are among the questions the investigation exists to resolve.
Executive Summary
An open sabotage investigation at two substations is, on its own, a small news item. Its significance for digital infrastructure is that it moves grid security out of the tabletop-exercise category and into the physical one. Most of the industry’s security spending and regulatory attention over the past decade has gone to cyber defence — network segmentation, intrusion detection, supply-chain controls. The asset that actually determines whether a data hall keeps running is a fenced compound full of transformers and switchgear, frequently sited on the edge of an industrial park, and usually protected by perimeter fencing, cameras and a locked gate.
The number two is the part worth noticing. European transmission and distribution networks are planned around an N-1 standard, meaning the system is designed to survive the loss of any single element without dropping customer supply. Simultaneous or near-simultaneous disruption at two sites is precisely the scenario that N-1 planning does not cover, which is why investigators treat multi-site events differently from a single equipment failure.
For data center operators, landlords and their enterprise customers, the practical question raised is not whether this particular incident affected any specific facility. It is whether the substations that feed dense clusters of digital infrastructure are secured in proportion to what depends on them — and whether operators actually know which substations those are.
A Substation Is a Concentration of Risk in a Small Fenced Yard
A substation does three jobs: it changes voltage, it switches circuits, and it protects the network by isolating faults. The physical contents are unglamorous — power transformers, circuit breakers, disconnectors, protection relays, control cabinets — and are often visible from a public road. There is no redundancy inside the fence. A transformer is a single object weighing tens of tonnes, filled with oil, and it either works or it does not.
What makes substations a disproportionate target is the repair asymmetry. Damage can be inflicted quickly and cheaply; large power transformers are custom-engineered for a specific network position, built to order, and moved by specialised heavy transport. Replacement is measured in months, not days, unless the operator holds a compatible spare and can physically get it to site. Utilities manage this with spares pools and mutual-assistance arrangements, but those programmes were sized for storms and equipment failure, not for a pattern of deliberate damage at multiple locations.
This is also why an investigation into two sites reads differently from an investigation into one. Coordination, if it is established, changes the planning assumption. It is worth being precise here: coordination has not been established, and treating an open probe as a confirmed campaign would be running ahead of the evidence.
Where Data Centers Actually Sit in the Blast Radius
A well-built colocation facility has layered protection against utility failure. Uninterruptible power supplies — battery or flywheel systems — carry the load for seconds to minutes. Diesel or gas generators then take over and, given fuel and fuel-delivery contracts, can run for days. Higher-resilience designs take two utility feeds, ideally from separate substations on separate network paths, so that one upstream failure is survivable without ever starting an engine.
Two things weaken that picture. First, “two feeds” is often two circuits that converge upstream at a single substation or a single transmission corridor — diversity on the invoice, not in the ground. Second, generators are engineered for outages measured in hours or days. A substation loss with a months-long transformer replacement is a different failure mode: the facility survives it technically, on fuel deliveries, at a cost structure nobody underwrote and with an emissions and permitting profile that many sites are not licensed for over extended periods.
The exposure is also geographically concentrated. Europe’s data center capacity clusters heavily around a handful of metros — Frankfurt above all, alongside London, Amsterdam, Paris and Dublin — precisely because that is where fibre, land and grid connections already exist. Concentration is efficient for interconnection and unhelpful for resilience: the same few substations and corridors serve a large share of a region’s compute.
Critical Infrastructure on Paper, Ordinary Utility Asset in the Field
Europe’s regulatory architecture already treats both energy and digital infrastructure as essential. The NIS2 Directive covers cybersecurity and incident reporting across sectors including energy and data centers, and the Critical Entities Resilience Directive addresses physical resilience — risk assessment, resilience plans, incident notification — for entities providing essential services. On paper, the substation and the data center it feeds are both in scope.
The gap is between designation and hardening. Obligations of this kind produce risk assessments, plans and reporting duties; they do not automatically produce ballistic barriers, intrusion detection at the fence line, hardened transformer walls or on-site response at every distribution node. The United States offers a useful comparator: after the 2013 Metcalf substation shooting in California, regulators adopted a dedicated physical security standard, NERC CIP-014, which requires targeted risk assessment and protection — but only for a defined set of transmission stations whose loss would cause instability or cascading outages. Most substations, in most countries, fall outside such tiers by design, because hardening every one of them is not economically serious.
That triage logic was built around outage consequence for the electricity system. It was not built around the question of which substations feed several hundred megawatts of concentrated digital load underpinning payments, logistics and public services. Whether those two rankings produce the same priority list is an open and answerable question, and one that data center operators are better placed to raise with their network operators than to wait to be told.
What Operators Can Reasonably Do Before the Regulation Catches Up
Nothing in an ongoing investigation obliges a data center operator to act. But the incident points at a diligence exercise that is cheap relative to its value: knowing, specifically, which substations and which transmission paths a site depends on, and whether the redundancy purchased is real upstream diversity or a paper duplicate. Many operators can answer this for their own switchgear and cannot answer it two nodes out.
The second exercise is duration. Contingency plans and service-level agreements are usually written against outages of hours. Modelling a multi-week loss of a primary feed changes the questions: fuel logistics and contracted supply priority, permit ceilings on generator run-hours, staffing rotations, and whether workload can be shifted to another region and at what latency and cost. Customers negotiating colocation or wholesale capacity are within their rights to ask for these answers in writing.
None of this argues for alarm. Grid operators handle equipment failure and weather damage continuously and restore service well; the system is more robust than a single investigation makes it look. The measured conclusion is narrower: physical security of the electricity assets serving digital infrastructure deserves the same explicit, documented attention that cyber risk has received, and right now, in most contracts, it does not get it.
Background
Electricity reaches a data center through a chain: generation, high-voltage transmission, one or more substations that step the voltage down, and finally the distribution circuits into the site’s own switchgear. Substations are the hinge points, and because they concentrate transformers and switching equipment in one compound they are also the points where a single physical failure has the widest effect. Grid planners compensate with the N-1 principle — designing the network so any one element can fail without cutting supply — and with spares pools and mutual-assistance agreements between utilities.
Digital infrastructure has been formally recognised as essential in European law: data centers sit within the digital infrastructure sector under NIS2, alongside energy in the same regime, and the Critical Entities Resilience Directive extends resilience duties beyond cyber to physical threats. The practical hardening picture is uneven, however, because protection regimes worldwide triage substations by their consequence for the electricity system rather than by the digital load they carry. That distinction is what an investigation into physical damage at grid assets brings into focus for the data center industry.
An AI-assisted cybersecurity tool has been credited with helping secure a satellite communication system in the aftermath of the 2022 Russian hacking campaign, according to a report from the Associated Press. The 2022 incident — the most consequential known cyberattack on commercial satellite communications to date — struck at the opening of Russia’s full-scale invasion of Ukraine and disrupted connectivity for users across Europe.
The report positions the tool as a working example of artificial intelligence applied to defending space-based connectivity infrastructure, an area regulators and militaries have flagged as critically exposed since that attack.
Executive Summary
The announcement, carried by AP, describes an AI-assisted tool that helped secure a satellite communication system following the 2022 Russian hack — widely understood to reference the attack on Viasat’s KA-SAT network on the day Russia invaded Ukraine. That attack used wiper malware to disable tens of thousands of satellite modems, cutting off Ukrainian users and collateral customers across Europe, including remote monitoring for thousands of German wind turbines.
Why it matters: satellite links carry traffic that terrestrial fiber cannot reach — rural broadband, maritime and aviation connectivity, military communications, and backup paths for critical infrastructure. The 2022 attack proved a nation-state could take a commercial satellite network’s user base offline in hours. Evidence that AI-assisted tooling has since been used to harden such a system marks a shift in defensive AI from lab pilots and vendor demos to operational deployment on infrastructure that has already been targeted in wartime.
For infrastructure operators, the signal is that AI-augmented defense is becoming table stakes for any network — space-based or terrestrial — that adversaries consider a strategic target.
From Pilot to Proven: Defensive AI Grows Up
For years, ‘AI in cybersecurity’ mostly meant anomaly-detection features bolted onto marketing decks. What makes this report notable is the context: the tool is credited with helping secure a system that suffered one of the most damaging real-world attacks on record, not a simulated range exercise. Securing a post-breach environment is the hardest test in the discipline — the adversary has demonstrated capability and intent, and defenders must assume they will return.
AI’s genuine advantage in this setting is scale and speed of pattern analysis. Satellite ground networks generate enormous telemetry streams from modems, gateways, and management servers. Human analysts cannot review that volume; machine-learning systems can flag deviations — an unusual firmware push, an unexpected management-plane login path — fast enough to matter. That is precisely the vector the 2022 attackers exploited, reaching modems through a compromised management network.
The Ground Segment Is the Soft Underbelly of Space
A persistent misconception is that hacking a satellite network means attacking the spacecraft. The 2022 incident showed otherwise: the attackers never touched the satellite. They compromised the terrestrial management infrastructure — the ‘ground segment’ — and used it to push destructive commands to customer modems. Wiper malware, which destroys a device’s software rather than stealing data, rendered the modems inoperable.
That architecture lesson generalizes across all infrastructure: the management plane is the crown jewel. Data centers, carrier networks, and cloud platforms share the same exposure — whoever controls the orchestration layer controls everything downstream. AI-assisted monitoring of that layer, rather than only the customer-facing edge, is where defensive investment is now flowing.
Market Stakes: Space Cybersecurity Becomes a Line Item
The commercial satellite connectivity market has expanded rapidly since 2022, driven by low-Earth-orbit constellations, in-flight and maritime connectivity, and government demand for resilient communications. Every new terminal is an endpoint an adversary can target. Insurers, defense customers, and regulators have all raised security expectations for satellite operators since the 2022 attack, and demonstrated AI-assisted hardening gives operators something concrete to point to in procurement and compliance conversations.
Winners in this shift are operators who can prove security posture, and vendors selling AI-driven monitoring for operational-technology environments. Under pressure are smaller operators and legacy VSAT (very-small-aperture terminal) networks running aging ground infrastructure that predates modern security assumptions — retrofitting is expensive, and the talent to do it is scarce.
The Limits: AI Defends, But Humans Still Own the Outcome
Caution is warranted. AI-assisted defense narrows the detection gap but does not eliminate the fundamentals: patching, segmentation of management networks, and credential hygiene — the exact weaknesses exploited in 2022. AI models also introduce their own attack surface, from data-poisoning risks to false-positive floods that exhaust analysts. And adversaries use AI too, accelerating vulnerability discovery and phishing at the same pace defenders accelerate detection.
The realistic read is that AI has become a force multiplier for well-run security programs, not a substitute for them. The systems most likely to benefit are those where operators pair AI tooling with disciplined architecture — which, based on this report, appears to be the path taken here.
Background
Commercial satellite communications became a wartime target on the first day of Russia’s 2022 invasion of Ukraine, when the KA-SAT broadband network operated by Viasat was hit with wiper malware delivered through its ground-based management systems. The attack disabled tens of thousands of modems, disrupted Ukrainian communications at a critical moment, and caused collateral outages across Europe. Western governments formally attributed it to Russia, and the incident became the canonical case study in space-infrastructure cybersecurity.
Since then, satellite connectivity has grown strategically and commercially — low-Earth-orbit constellations, aviation and maritime services, and military resilience programs have multiplied the number of networked terminals in orbit and on the ground. That growth has drawn sustained investment into securing the ground segment, where artificial intelligence is increasingly applied to detect intrusions and harden systems at a scale human teams cannot match.
Two senators, one from each party, have proposed a law to prepare the power grid for quantum computers. These are a new kind of machine that could one day crack the digital locks protecting the grid’s control systems.
The bill gives the Energy Department one year to study the danger and set up a test lab where power companies can try stronger locks.
Why it matters: the huge computer warehouses that run artificial intelligence depend on the grid. If the grid’s security slips, their electricity is at risk too.
Legis1 reported that Sens. Chris Coons (D-DE) and Mike Rounds (R-SD) introduced the Quantum Grid Utility Assurance and Resilient Defense Act, or Quantum-GUARD Act, on August 14, 2026. The bill targets a future threat: quantum computers powerful enough to break the encryption that protects the electric grid’s IT and control systems.
The bill would require the Federal Energy Regulatory Commission (FERC) to weigh quantum risks when it reviews grid reliability standards. It would give the Department of Energy one year to stand up a post-quantum cryptography testing sandbox with utilities, grid operators and vendors, and one year to report to Congress on quantum risks to the bulk-power system. IonQ, American Binary, the Quantum Industry Coalition, the Quantum Economic Development Consortium and the Cyber Threat Alliance endorsed it.
Executive Summary
The Quantum-GUARD Act is the first bill aimed specifically at moving the electric grid onto post-quantum cryptography. These are encryption methods designed to withstand attacks from quantum computers. The bill does not order utilities to replace anything. It directs regulators to study the problem, build a joint testing environment and factor quantum risk into the rules that govern grid reliability. Sen. Rounds described it as codifying parts of President Trump’s June executive order on advanced cryptographic attacks, which set a federal policy of moving government systems to NIST-approved post-quantum standards and helping critical infrastructure owners do the same.
For the data center industry, the significance lies in the dependency, not the quantum computers themselves. AI campuses are among the largest new customers of the grid, and their uptime rests on utility control systems they neither own nor secure. Encryption upgrades to those systems are slow to plan and deploy. A bill that starts one-year federal clocks on assessment and testing marks the point at which grid cryptography becomes something power-hungry operators should track alongside capacity, interconnection and price.
Why Grid Encryption Belongs on the AI Power Risk List
A data center’s power is only as dependable as the systems that run the grid behind it. Those systems include substation controls, generator dispatch and the communications between control rooms and field equipment, which engineers call operational technology, or OT. Much of that traffic is protected by public-key cryptography, the same family of math that quantum computers are expected to threaten. The Quantum-GUARD Act names this directly: it would require FERC to consider post-quantum cryptography in both IT and OT systems, and it tasks the Energy Department with identifying obstacles to moving ‘high-value systems’ to new standards.
The one-year deadlines explain why operators should track this now rather than later. Under the bill, DOE’s Office of Cybersecurity, Energy Security, and Emergency Response would have twelve months to launch a testing sandbox and twelve months to deliver findings to the Senate Energy and Natural Resources and House Energy and Commerce committees. Those are the first steps of a migration, not the end of one. Grid control equipment often stays in service far longer than office IT, so any cryptographic change moves through procurement, testing and field replacement over years. For a company planning an AI campus that depends on a particular utility for a decade or more, how that utility handles the transition is a real long-term risk, even though the bill never mentions data centers.
In practice, this is a due-diligence item rather than an alarm. Large-load customers already question utilities about capacity, redundancy and restoration times. The bill’s framework makes it reasonable to add a question about cryptographic readiness, and to expect that the answer will be shaped by whatever the DOE study and sandbox produce.
What the Bill Does, and What It Leaves Open
The bill’s verbs matter. FERC would have to ‘consider’ quantum risk when reviewing proposed reliability standards. That makes quantum risk a factor in rulemaking but sets no deadline for migration. DOE would ‘study’ and ‘establish’ a sandbox, with no requirement that utilities adopt what it finds. This is a framework bill. It builds the evidence base that later mandates, if any, would rest on.
That restraint has advantages. Utilities run a very wide mix of legacy and modern equipment, and a mandate issued before anyone has tested post-quantum algorithms on real grid hardware could cause more reliability problems than it solves. The sandbox exists to test that, bringing utilities, vendors, federal agencies and state and local organizations into one environment to find where new cryptography breaks old equipment. The cost is time. By design, the bill’s first concrete output is a report, and the harder questions of who pays, on what schedule and under what enforcement come after it.
Why Now: The Standards Exist, the Threat Does Not Yet
The timing follows the standards. NIST finalized its first three post-quantum cryptography standards in August 2024 and has encouraged organizations to begin transitioning, which means there is now a defined target to migrate toward. Before that, a grid-specific migration bill would have had nothing concrete to point at.
The threat, by contrast, is still prospective. The bill is framed around protecting the grid ‘before sufficiently powerful quantum computers can undermine existing encryption,’ and it does not say when that might happen. That is the right way to frame it. The argument for starting early rests on how slowly large infrastructure changes its cryptography, not on any fixed date for when quantum machines will arrive. Readers should treat claims of an imminent quantum break, from any side, with the same caution the bill’s own wording shows.
A Quantum Industry Coalition Behind a Grid Bill
The endorsements come mainly from the quantum and cybersecurity sectors: IonQ, a quantum technology company; American Binary; the Quantum Industry Coalition; the Quantum Economic Development Consortium; and the Cyber Threat Alliance. Support from companies that build quantum and security technology is expected and does not weaken the bill’s reasoning, which rests on NIST’s published standards and an existing executive order. It does mean that the people who would carry out the migration, meaning utilities, grid operators and state regulators whose ratepayers ultimately fund utility upgrades, will shape how practical the plan turns out to be, and their public positions on the bill are worth watching.
Background
The US electric grid runs under mandatory reliability standards, including cybersecurity rules. These are largely developed by the North American Electric Reliability Corporation and approved by FERC. The Department of Energy’s Office of Cybersecurity, Energy Security, and Emergency Response (CESER) leads the department’s work on energy-sector security. Grid cybersecurity has historically focused on present-day threats such as intrusions and ransomware. Quantum computing adds a longer-horizon concern: that a sufficiently powerful machine could defeat the public-key encryption that protects much of the grid’s communications.
NIST’s finalization of its first three post-quantum cryptography standards in August 2024 gave organizations a concrete target for migration. Federal policy has since moved toward requiring that transition for government systems and supporting it for critical infrastructure. Meanwhile, rapid data center construction, driven largely by AI, has made grid reliability a central concern for the digital infrastructure industry.
Security researchers at Symantec say a small hacking crew based in China spent months reading the email of government officials across Asia and the Middle East. It also ran a cryptocurrency scam business from the same control screen.
Its most effective move: instead of breaking into government ministries one at a time, it broke into the single company that hosted all of their email. One planted piece of code reached more than 15 government email systems at once.
The takeaway is simple. When many organizations rely on one shared provider, one break-in can expose all of them.
Industrial Cyber reported on August 14 that Symantec’s Threat Hunter Team, working with Carbon Black researchers, has exposed Jewelbug, which Symantec describes as a China-based hackers-for-hire group. According to Symantec, the group ran espionage campaigns against governments, militaries and state telecom operators across the Middle East, Southeast Asia and South Asia. It also ran a cryptocurrency fraud operation aimed at Chinese-speaking victims, and both activities were managed from a single browser-based control panel called XG-Web.
In under three months, Symantec found, the group logged more than one million implant check-ins and stole over 580,000 browser cookies, thousands of credentials and more than 2,300 email bodies. An implant is a piece of malware that reports back to its operators. Its largest operation compromised a shared web-hosting platform run by a Middle Eastern state telecom provider, which placed malicious code in front of more than 15 government webmail tenants at once.
Executive Summary
Symantec’s research is unusually detailed. It is built on visibility into the group’s own control panel and victim database, so it describes more than a list of intended targets. It documents actual compromises: harvested mailboxes of senior officials, intercepted internal network traffic, and implants running on Windows machines, Linux servers and network devices. Jewelbug is also tracked under other names, including Earth Alux, REF7707 and CL-STA-0049.
For infrastructure operators, the most important finding is architectural rather than about any single piece of malware. Jewelbug did not breach each ministry one by one. It gained write access to a centrally hosted webmail system run by a state telecom and planted one script, and that script fired for every ministry employee who logged in. A second finding points in the same direction. The group’s Linux and router implant, ClientKing, is built to reach servers and network equipment, the layer that carries everyone else’s traffic.
Symantec also reported that some ClientKing builds were configured to route traffic through the internal corporate proxy of a major U.S. aerospace and industrial manufacturer. That extends the group’s footprint beyond Asia and the Middle East into industrial infrastructure.
One Write Permission, Fifteen Ministries
The shared-hosting compromise is the clearest demonstration in Symantec’s report of how multi-tenancy changes the economics of an attack. Multi-tenancy means many customers running on one platform. The Middle Eastern government’s ministries did not each run their own mail servers. They were tenants on a web-hosting platform operated by the state telecommunications provider. Once Jewelbug had write access to the central webmail system, it needed only one malicious script. That script ran each time any ministry staff member logged in or checked their email, across more than 15 government tenants.
The attack chain that followed was conventional, and that is part of the lesson. The injected code captured session cookies and email addresses. Session cookies are the small tokens that keep a user logged in, and stealing one can let an attacker impersonate that user without a password. Windows users were then shown a fake Adobe Flash update prompt, which installed Antino, the group’s backdoor. Antino added a malicious browser extension that gave operators control of the browser and a route into internal government networks. None of these steps required a novel exploit against each ministry, because the shared platform had already delivered every tenant to the attacker.
Symantec’s own summary makes the point directly: compromising a shared hosting provider and placing a watering hole on every government tenant turned a single intrusion into access across an entire national webmail estate. A watering hole is a trusted site rigged to infect the people who visit it. The implication for telecoms, hosting providers and data center operators that serve government or regulated customers is that the provider’s control plane is part of every tenant’s attack surface. The control plane is the administrative layer with write access to shared code. Tenant isolation at the data layer does little if one set of credentials can change the code all tenants run.
The Network Layer Is in Scope
Most espionage reporting centres on endpoints: laptops, email and browsers. Jewelbug’s toolkit goes further. According to Symantec, ClientKing is a Linux and router implant that can reach servers and network devices, and all of the group’s implants feed one victim database. Routers and Linux servers sit below the level where most endpoint detection tools operate. They often run for years between refreshes, and they see traffic from many downstream users at once.
That matters for the telecom operators Symantec says were targeted. A foothold on network infrastructure can outlast a cleaned-up laptop and can observe traffic rather than just one user’s files. Symantec noted that the group intercepted internal network traffic, and that the common thread across its espionage targets was government communications and the providers that host them. The researchers said that combination would give an intelligence customer broad, durable access to official correspondence.
The detail about the U.S. aerospace and industrial manufacturer needs careful reading. Symantec said a couple of ClientKing builds were configured to beacon through that company’s internal corporate proxy. That shows the group’s tooling was set up to operate inside or through that environment. The report as described does not establish the extent of any compromise there.
A Hack-for-Hire Business Model, Visible From the Inside
Symantec’s central attribution finding is that foreign-government espionage and commodity cryptocurrency fraud ran on the same infrastructure, by the same small team, from one control panel. The researchers call that pairing the signature of a hack-for-hire entity running for-profit crime on the side. They tied the fraud and search-engine-optimisation arm, with high confidence, to the sole legal representative of an SEO company in Changsha, Hunan Province. That attribution rests on identity documents, a business license and a stamped authorization letter. Symantec was explicit that the link between this individual and the espionage operators is not fully established. Its assessment is that the SEO business most likely supplied access, infrastructure and delivery.
The operational discipline is notable for defenders. The group has built five generations of command-and-control code, the servers and software attackers use to direct their malware. A scheduled job checked its own domains against VirusTotal every 12 hours so operators could rotate away from anything flagged. VirusTotal is a widely used public malware-scanning service. Antino disguised its communications as ordinary Microsoft cloud traffic. Taken together, these choices suggest that blocklists and domain reputation alone will lag this kind of operator. Behavioural monitoring and integrity checks on shared code are better placed to catch it.
For hosting and telecom operators, the practical questions are about blast radius. Who holds write access to code that every tenant executes? Is that code monitored for unauthorized changes? Are session tokens bound tightly enough that a stolen cookie is of limited use? None of these are exotic controls. The Jewelbug case shows what happens when one of them fails on a platform many customers share.
Background
Symantec is one of the longest-established names in enterprise security. Its enterprise business has been part of Broadcom since 2019, and its Threat Hunter Team publishes research on state-linked and criminal hacking groups alongside Carbon Black, another Broadcom-owned security brand. Different vendors often track the same group under different names, which is why Jewelbug also appears in industry reporting as Earth Alux, REF7707 and CL-STA-0049.
Telecom operators and hosting providers have long been attractive espionage targets because they sit upstream of many customers at once. Governments in many regions consolidate ministry email and web services onto shared platforms, often run by a state telecom, to cut cost and complexity. The Jewelbug case shows the other side of that trade-off: consolidation also concentrates risk. Earlier in 2026, Symantec reported on Seedworm, an Iran-linked group whose campaigns spanned government, airport, manufacturing and financial targets.
Two of the undersea internet cables that link Australia to the rest of the world stopped working off Perth on the same weekend. Only 16 such cables connect the entire country.
At the same time, a tanker ship managed from the United Arab Emirates was tracked sailing back and forth in loops over the protected strip of seabed where the cables lie. The cable company says this could be coincidence and has asked federal police to investigate.
The bigger problem is that the cables had no built-in fault sensors. Nobody can say what broke them until a repair crew physically inspects them.
The Maritime Executive reported on August 13, 2026, that fiber operator Subco lost two subsea cables back-to-back over the preceding weekend. Both breaks occurred inside a government-designated cable protection zone off Perth, Western Australia. At about the same time, a UAE-managed product tanker (a ship that carries refined fuels) sailed an unusual racetrack pattern over the charted cable area and crossed it several times. Security consultancy Windward independently validated the vessel’s presence and identity.
Subco founder and CEO Bevan Slattery said the ship’s activity may be a coincidence. He nonetheless urged the Australian Federal Police to investigate urgently and said this could be the second such incident in a federally declared cable protection zone. The cables had no automatic diagnostic systems, so Subco will not know the root cause, including whether an anchor was dragged across the seabed, until it arranges a physical inspection.
Executive Summary
Australia’s international connectivity runs through 16 subsea cables, and two of them went down together off Perth. The breaks happened in a zone where anchoring and certain fishing are restricted precisely to protect cables. A tanker was moving back and forth overhead at the time, and surface conditions were benign. That combination made the operator raise the possibility of a security incident rather than treat the outage as routine maintenance.
The more consequential detail is operational. Because the cables lacked automatic diagnostics, Subco cannot yet tell an accidental anchor drag from deliberate interference. Anchor drag alone causes about a third of cable breaks worldwide, according to the International Cable Protection Committee. Until a repair ship reaches the fault, investigators, insurers, customers and policymakers have to act without knowing which kind of event this was.
For anyone running data centers or cloud services that depend on international routes, the difference matters. An accident is a random event that route diversity absorbs. A deliberate act can recur and can target several cables at once, and that changes how much redundancy is enough.
Two Out of Sixteen Is Not a Rounding Error
Subsea cables carry the overwhelming majority of intercontinental data traffic. That includes the traffic that lets Australian businesses reach cloud regions and AI services hosted overseas, and lets local data centers serve customers across the Indian Ocean and Asia. With just 16 cables linking Australia to the world, losing two at once removes a significant share of the country’s international paths. The Maritime Executive described that as a substantial security event.
Geography sharpens the problem. Perth is Australia’s western gateway, and cables landing there take routes toward Asia and the Middle East that east-coast systems do not. When two breaks cluster in the same protected corridor, traffic has to shift onto fewer routes. That can mean longer paths, higher latency (the delay data experiences in transit) and less spare capacity if anything else fails before repairs are complete.
The Real Gap: Nobody Can Yet Say What Happened
The detail that should concern infrastructure operators most is that Subco’s cables had no automatic diagnostic systems. Without them, the operator knows the cables stopped carrying light but not why. It has to send a vessel to locate the fault, lift the cable and examine the damage before it can distinguish an anchor strike from a snag, a fishing gear incident or deliberate cutting. Until then, the circumstantial evidence is all anyone has: back-to-back breaks, a ship making multiple crossings in a racetrack pattern, and calm surface conditions that remove bad weather as an easy explanation.
This attribution delay has direct consequences for data center and cloud operators. Resilience planning for subsea routes has traditionally assumed faults are independent accidents. Under that assumption, buying capacity on two or three diverse cables makes a simultaneous outage very unlikely. That math weakens if breaks can be deliberate and coordinated, because a single actor can hit several cables in one corridor, as two breaks in one protection zone illustrates. An operator that cannot tell which kind of event it is facing cannot tell whether its redundancy is adequate. It also cannot tell whether the same corridor is safe to rely on while repairs proceed.
The same gap slows everyone downstream. Police cannot easily build a case, insurers cannot assign a cause, and governments cannot calibrate a response. Slattery asked the Australian Federal Police to move urgently, and the physical evidence on the seabed is what any investigation will ultimately depend on.
Weighing the Evidence on Both Sides
The case for concern is real but circumstantial. The vessel’s track and timing match the breaks, Windward validated its identity and presence, and Slattery noted this could be the second incident in a federally declared zone. Researchers are also warning about the broader pattern. ASPI’s David Brewster told ABC that many recent cable cuts in Europe and around Taiwan were, in his view, fairly obviously the work of Russia and China. A new review from the Australian National University’s National Security College concludes that state actors appear to be probing cable infrastructure in peacetime so they could degrade connectivity quickly at the start of a conflict.
The case for caution is equally worth stating. Slattery himself twice said the ship’s behavior may be a coincidence. Anchor drag is a common, ordinary cause of cable damage. Brewster’s remarks concerned incidents elsewhere, not this one, and he acknowledged it is difficult to be certain in some cases. A tanker managed from the UAE is not evidence of any state’s involvement. Unusual vessel movements can have commercial or navigational explanations that have not yet been aired. The fair reading is that the incident warrants investigation, not that its cause is known.
What Operators and Buyers Should Take From It
For cable owners, the lesson is that monitoring is now part of the security posture, not just a maintenance convenience. Fault-location and fiber-sensing systems that can flag disturbances as they happen would shorten the window in which an event goes unexplained. Tracking vessel behavior over protection zones as it happens would help too. Protection zones deter accidental damage by lawful mariners, but they do not stop a ship that ignores them. Enforcement depends on noticing quickly.
For data center and enterprise buyers of international capacity, the practical questions are about correlation, not just redundancy. Are the backup routes physically separate from the primary ones, or do they share the same seabed corridor or landing point? How quickly can capacity be restored, and how many repair vessels are available in the region? Those answers now matter as much as headline bandwidth.
Background
Subsea cables are bundles of optical fiber laid along the seabed that carry most of the world’s intercontinental internet and data traffic. They are built to last decades but are physically exposed. Ship anchors and fishing gear are the most common causes of damage, and repairs require specialized vessels that are in limited supply. Australia’s geographic isolation makes it unusually dependent on a small number of these systems, and the government declares cable protection zones off major landing points to restrict risky activity near them.
Subco is an Australian subsea cable operator founded by Bevan Slattery, a long-time builder of Australian digital infrastructure. Concern about deliberate cable damage has grown since a series of incidents in the Baltic Sea and around Taiwan over the past several years. Security researchers there have pointed to state actors seeking disruption while keeping deniability, and that context is why every unexplained break now draws closer scrutiny.
Government agencies in the United States and South Korea have jointly warned about a criminal hacking group called Gunra. It breaks into organizations, copies their private files, locks everything up, then demands payment, threatening to publish or sell the stolen files if victims refuse.
Its main way in is the security equipment that lets employees log in to work networks from home. Once inside, it erases its tracks and works overnight, between 10 at night and 6 in the morning.
Hospitals, banks, utilities and universities are among its targets. One bright spot: a flaw in one version lets some victims unlock files without paying.
Industrial Cyber reported that the FBI, the Cybersecurity and Infrastructure Security Agency (CISA), the Department of Defense Cyber Crime Center (DC3), the National Security Agency (NSA), the US Secret Service and South Korea’s National Police Agency (KNPA) released a joint advisory Monday on Gunra, a ransomware operation derived from leaked Conti source code. Gunra steals data, encrypts systems and threatens to publish or sell the stolen data on its leak site, with victims listed across the Americas, Europe, the Middle East, Africa and the Asia-Pacific region.
The advisory says Gunra gets in mainly by exploiting known flaws in internet-facing firewall and VPN appliances, including two authentication-bypass vulnerabilities in specific FortiOS and FortiProxy versions (CVE-2024-55591 and CVE-2025-24472), deletes logs to hide, and works primarily between 10 p.m. and 6 a.m.
Executive Summary
Six US and South Korean agencies have published a detailed account of how Gunra ransomware operates, from initial access to extortion. Gunra emerged in April 2025, added a Linux variant by mid-2025, and by early 2026 had become a ransomware-as-a-service operation that recruits affiliates on dark web forums. Its leak site lists victims in more than ten sectors, including healthcare, finance, utilities, transportation and government.
For infrastructure operators, the advisory’s significance is where the attack begins and how it hides. Entry runs through the edge: firewall and VPN appliances with known vulnerabilities, default credentials or weak access controls. Once inside, the actors delete system and network access logs, clear command history, work overnight and run an encryptor that produces no observable network indicators. That combination leaves appliance logs held somewhere the attacker cannot reach, and watched after hours, among the most useful signals a defender has.
The advisory also contains a rare point in defenders’ favor: as of March 2026, Gunra’s Linux variants use weak, time-seeded randomness that lets encryption keys be reconstructed and files recovered without payment, though that does nothing about data already stolen.
The Front Door Is the Security Appliance Itself
The most consequential detail for infrastructure operators is how Gunra gets in. The FBI observed the group obtaining initial access primarily by exploiting known vulnerabilities in internet-facing devices, including firewall and VPN appliances, and named two authentication-bypass flaws in specific FortiOS and FortiProxy versions: CVE-2024-55591 and CVE-2025-24472. An authentication bypass lets an attacker reach functions that should require a login without valid credentials. South Korea’s National Police Agency separately observed Gunra exploiting credential exposure and Secure Shell (SSH) access-control weaknesses on internet-facing VPN gateways.
The intrusion the agencies describe shows how modest the first step can be: default credentials on an SSL-VPN appliance, the encrypted gateway remote staff use to reach internal systems, with no account lockout to stop repeated guessing. After compromising an administrator workstation, the actors reached the appliance’s administrative console, found an unused account with access to both external and internal networks, and modified it to skip a mandatory password change, creating a persistent backdoor that looks like an ordinary account.
For data center, colocation and network operators, firewalls and VPN concentrators sit at the boundary of nearly everything they run, including remote administration paths into their own environments. Because both named CVEs are known vulnerabilities, the defense here is patch cadence and asset inventory rather than anything exotic. The practical test is whether an operator can list every internet-facing appliance it owns, its firmware version and every account configured on it, including dormant ones.
Why Edge Appliance Logs Belong Off the Box
Gunra is built to leave few traces where defenders usually look. According to the advisory, the actors delete system and network access logs and clear command history while active, conduct reconnaissance and encryption primarily between 10 p.m. and 6 a.m., and run the encryptor as a self-contained binary that produces no observable network indicators. Data is exfiltrated before encryption, so by the time files lock, the extortion leverage has already left the network.
Taken together, those facts narrow the useful evidence to a short list, and the advisory’s own incident-response guidance points at it: review network appliance logs for anomalous privileged activity and audit file creation to detect exfiltration. Logs that exist only on the compromised appliance or host are exactly what the actors delete. Logs forwarded in near real time to a separate, access-controlled collector survive that deletion, and they only help if someone, or an automated rule, is watching during the overnight window the group favors.
This falls hardest on organizations that run round-the-clock infrastructure with thin overnight staffing, and on managed service providers that administer appliances for many customers. An after-hours login to a VPN administrative console, a dormant account suddenly modified, or a change to appliance traffic controls are low-volume events that are straightforward to alert on, provided the record sits where the attacker cannot erase it. None of this is new practice, but Gunra’s combination of edge entry, log wiping and night-time activity turns off-device logging from a best-practice line item into the difference between catching the intrusion before encryption and discovering it from a ransom note.
MFA and Credentials Fail at the Seams
The advisory is a reminder that multi-factor authentication (MFA) protects a login step, not the systems behind it. Against one victim, Gunra modified files on the virtual desktop infrastructure (VDI) authentication portal, the gateway to remotely hosted desktops, so it would accept a designated one-time password. The actors also manipulated SSL-VPN traffic controls to harvest credentials and session cookies, hijacked sessions to impersonate legitimate users, and entered the internal VDI environment with stolen session tokens.
Inside, the playbook targets the identity core. Using Impacket libraries over SMB, the Windows file-sharing protocol, the actors moved laterally to the VDI authentication server, the Active Directory server that governs who can access what, and IT staff desktops. They ran secretsdump.py against the NTDS database where domain controllers store password hashes, enabling pass-the-hash and pass-the-ticket attacks that reuse stolen credentials without cracking them. At one victim they reached a Hiware system access control server over SSH and stole the symmetric key needed to decrypt enterprise server credentials stored in its database.
The operational lesson is that authentication portals, privileged-access systems and key stores are high-value targets in their own right and warrant the same integrity monitoring and segmentation as production systems. The agencies’ recommendations map onto each step: least-privilege administrative rights, audits for unrecognized accounts, MFA on all services with emphasis on VPNs and webmail, network segmentation to restrict lateral movement, and disabling command-line and scripting activity where possible.
A Flaw in the Linux Encryptor, With Limits
One finding cuts in defenders’ favor. As of March 2026, the advisory says, Gunra’s Linux ELF variants use a weak pseudorandom number generator seeded with predictable system time, allowing defenders to mathematically reconstruct keys from file timestamps and recover files without paying. That is relevant to infrastructure operators because Linux underpins much of the server estate, and Gunra introduced its Linux variant in mid-2025 as it moved toward cross-platform targeting.
The limits matter. The weakness is described for the Linux variants as of a specific date, and ransomware-as-a-service operations, which rent their tooling to affiliates, can ship revised builds. Key recovery also does nothing about stolen data: the threat to publish or sell it stands regardless. Offline, immutable backups kept in a physically separate, segmented location, and tested, remain the control that makes recovery independent of both the attacker’s cooperation and the attacker’s mistakes.
Background
Gunra traces its code to Conti, a prolific ransomware operation whose source code leaked in 2022 and has since been reused by several groups. Gunra appeared in April 2025 focused on Windows systems, introduced a Linux variant by mid-2025, and by early 2026 had adopted a ransomware-as-a-service model, in which core developers supply the malware and infrastructure while recruited affiliates carry out intrusions in exchange for a share of ransoms.
Joint advisories from US agencies and foreign partners are a standard way of publishing attacker techniques, indicators and mitigations for a specific ransomware family. They typically align recommendations with CISA and NIST’s cross-sector cybersecurity performance goals, a baseline of practices such as patching internet-facing systems, maintaining offline backups, enforcing multi-factor authentication and segmenting networks.
California’s governor announced a plan on August 10 to use artificial intelligence to find and block hackers targeting the systems behind tap water, electricity and emergency phone lines.
The timing is the story. The federal government has proposed cutting its main cyber defense agency’s budget by about 30 percent, and a monitoring service that small towns used for free for two decades has lost its federal funding and is starting to charge. California is taking on more of that protection itself. It has not yet said how much it will spend.
On August 10, 2026, California Governor Gavin Newsom announced an AI Cyber Defense Program, which his office describes as first-in-the-nation, according to the announcement published on CA.gov. The Governor directed state agencies to set up the program inside the California Cybersecurity Integration Center (Cal-CSIC), using AI for vulnerability detection, network hardening and incident response; to expand AI-enabled cyber defenses to local governments and critical infrastructure partners; and to designate an AI Cybersecurity Officer in every state agency.
The Governor’s office tied the move to AI-enabled attacks and to federal pullbacks: a proposed Fiscal Year 2027 cut of roughly $707 million, about 30%, to the Cybersecurity and Infrastructure Security Agency (CISA), the end of federal funding for the Multi-State Information Sharing and Analysis Center (MS-ISAC) in late 2025, and the winding down of the current funding phase of a $1 billion federal state-and-local cyber grant program.
Executive Summary
California is building a state-run layer of AI-assisted cyber defense for the systems residents depend on most: water, power, transportation and emergency communications. The program sits in Cal-CSIC, the state’s existing hub for threat intelligence and incident coordination, and extends beyond state agencies to local governments and critical infrastructure operators.
The significance is less the technology than the division of labor. For two decades, small water districts, counties and cities leaned on free or grant-funded federal services for round-the-clock monitoring and incident help. With those services shrinking or moving to paid models, California is positioning the state as the provider of last resort for AI-era cyber defense.
What the announcement does not yet include is a budget, a timeline or eligibility rules, so the scale of what the state can actually absorb remains an open question.
Why Utility Cyber Defense Is Becoming a State Job
The most consequential directive is not the AI itself but the second item on the list: expanding access to advanced cybersecurity capabilities, including AI-enabled defenses, for local governments and critical infrastructure partners. That commits the state, through Cal-CSIC, to supplying defensive capacity to organizations it does not run: municipal water systems, county networks, and the operators of the power, transportation and emergency communications services that Cal OES Director Caroline Thomas Jacobs named.
The Governor’s office set this against three federal changes. The proposed FY2027 budget would cut CISA, the federal agency that provides field support, incident response and defensive tools, by roughly $707 million, about 30% below earlier levels. MS-ISAC, which for more than twenty years gave thousands of state, local, Tribal and territorial governments 24/7 monitoring and threat intelligence at no direct cost, lost federal funding in late 2025 and is moving to paid models. And the State and Local Cybersecurity Grant Program, launched with $1 billion under the Bipartisan Infrastructure Law, is nearing the end of its current funding phase. Each of these disproportionately served small jurisdictions, such as a water district with a handful of IT staff that could never run its own round-the-clock security operations center. When that free federal layer thins, those operators can pay, go without, or lean on the state. California is choosing to make the third option real.
Two caveats keep this in proportion. The CISA figure is a budget proposal; Congress sets appropriations, and it has advanced bipartisan legislation to keep the grant program authorized. And the state has attached no dollar figure to its own program, so how much of the federal gap it can fill is unknown. The stakes are illustrated by the case federal officials recently flagged in Minnesota: a suspected Iran-linked operation touching more than 30 municipal water utilities in a single campaign, exactly the kind of many-small-targets pattern where limited local defenses matter most.
What AI-Enabled Defense Means in Practice
The program names three functions. Vulnerability detection means finding weaknesses, such as unpatched software or exposed services, before attackers do. Network hardening means closing unnecessary openings and tightening configurations. Incident response means containing a breach and restoring service. AI’s promise across all three is speed and scale: sorting thousands of alerts, scanning large inventories of systems, and flagging anomalies faster than a small team could.
The Governor’s office grounds the urgency in disclosures by leading AI developers that advanced systems independently carried out sophisticated cyber operations in controlled testing, and in adversaries using AI to attack more cheaply and effectively. The logic follows: if the cost of attacking falls, defenders relying on manual processes fall behind, and automation is the natural counter. The announcement does not, however, name the tools, vendors or performance measures the state will use.
Utilities are also harder to protect than office networks. Water treatment and the power grid run on operational technology, the industrial controllers that open valves, dose chemicals and switch circuits. Much of it is old and cannot be scanned or patched aggressively without risking the very service it runs. Whether the program reaches into those control systems or stays on the business-network side will largely determine how much protection it delivers to the services it names.
Governance First: An AI Cyber Officer in Every Agency
The third directive, an AI Cybersecurity Officer in every state agency, creates a named point of accountability across government. It aligns with Cal-Secure 2.0, the state’s 2026 cybersecurity roadmap, which already prioritizes workforce, coordination and wider use of AI-enabled security tools.
It also completes a two-sided posture. Through Senate Bill 53, signed in 2025, the largest frontier AI developers must publish their safety frameworks and report certain critical safety incidents to the state. With this program, California is both regulating the developers whose models could be misused and deploying AI defensively. The state has not said whether incident reports filed under SB 53 will inform Cal-CSIC’s defensive work, which would be the most direct way to connect the two.
What It Means for Data Center and Utility Operators
Data centers, fiber networks and cloud facilities in California depend on the same grid and water systems the program targets, so a compromise upstream is an outage risk downstream. If private operators qualify as critical infrastructure partners, access to state threat intelligence and AI-enabled tooling could be a meaningful resource, particularly for smaller regional providers without large security teams.
Until eligibility and terms are published, though, prudent planning assumes nothing. Local governments that relied on MS-ISAC’s no-cost services should budget for paid alternatives rather than count on state coverage arriving on a particular date. For security vendors, the program signals state demand for AI-driven detection and response, though procurement details have not been released.
Background
California has built out a state cyber apparatus over several years: Cal-CSIC as its threat intelligence and coordination hub, the Cal-Secure statewide cybersecurity roadmap (updated to Cal-Secure 2.0 in 2026), executive orders on artificial intelligence in 2023 and 2026, and SB 53, the Transparency in Frontier Artificial Intelligence Act, signed in 2025.
Nationally, state and local cyber defense has leaned heavily on federal support: CISA’s field staff, incident response and tools; MS-ISAC’s no-cost monitoring for thousands of governments; and the $1 billion State and Local Cybersecurity Grant Program. All three are now shrinking, changing or facing uncertain funding, which shifts more of the burden to states and the local operators of water, power and communications systems.
