Iranian Hackers Strike LA Metro Transit System; GlassWorm Botnet Dismantled in Major Supply Chain Takedown

Critical Infrastructure Intelligence Briefing
Thursday, May 28, 2026
Reporting Period: May 21-28, 2026

---

1. EXECUTIVE SUMMARY

This week's intelligence highlights significant developments across multiple critical infrastructure sectors, with particular emphasis on transportation security, software supply chain integrity, and the evolving role of artificial intelligence in both offensive and defensive cyber operations.

• Transportation Sector Attack: Iranian state-sponsored hackers have been linked to a cyberattack on the Los Angeles Metro transit system, initially claimed by a hacktivist group but now attributed to nation-state actors based on infrastructure analysis. This represents a concerning escalation in targeting of U.S. mass transit systems.
• Major Botnet Disruption: A coordinated takedown operation led by CrowdStrike, Google, and the Shadowserver Foundation successfully dismantled all four command-and-control channels of the GlassWorm botnet, which had been targeting software developers in supply chain attacks since early 2025.
• AI Threat Evolution: UK GCHQ Director Anne Keast-Butler characterized AI as an "unstoppable force" with significant implications for cyber operations, while warning of escalating Russian hostile activity in the "gray zone" below the threshold of war. Multiple reports this week highlight AI being weaponized for cryptojacking distribution and credential theft campaigns.
• Critical Vulnerability Alert: CISA has issued an emergency directive requiring federal agencies to patch an actively exploited vulnerability in the LiteSpeed cPanel plugin within four days, indicating active exploitation in the wild.
• Physical-Cyber Convergence: The FBI issued warnings about the Silent Ransom Group conducting in-person data theft attacks against U.S. law firms, representing a notable evolution in extortion tactics that combines social engineering with physical intrusion.

---

2. THREAT LANDSCAPE

Nation-State Threat Actor Activities

Iranian State-Sponsored Activity – Transportation Sector

The cyberattack on the Los Angeles Metro system has been attributed to Iranian government-linked threat actors, despite initial claims by a hacktivist group. Security researchers identified infrastructure overlaps with known Iranian APT operations. This attack underscores the ongoing threat to U.S. transportation infrastructure from nation-state actors and the use of hacktivist personas as cover for state-sponsored operations.

Source: SecurityWeek

Russian Gray Zone Operations

UK GCHQ Director Anne Keast-Butler delivered a significant speech warning that Russia is intensifying hostile activities in a "gray zone" that falls just below the threshold of conventional warfare. The intelligence chief characterized AI as "an unstoppable force" and announced that GCHQ is developing an AI-powered cyber shield in response to adversaries deploying AI in warfare contexts.

Source: SecurityWeek, CyberScoop

Ransomware and Cybercriminal Developments

Silent Ransom Group – In-Person Data Theft Operations

The FBI has issued a warning about the Silent Ransom Group (SRG), which is conducting sophisticated attacks against U.S. law firms using a combination of social engineering and physical intrusion. The group impersonates IT personnel to gain physical access to victim organizations, representing a significant evolution in extortion tactics that infrastructure operators should monitor.

Source: CyberScoop, Bleeping Computer

Banking Trojan Campaigns

Dual banking trojan campaigns targeting Windows and Android users have been identified across Latin America and Europe. The Grandoreiro malware targets Windows systems while BTMOB RAT focuses on Android devices. Financial services sector organizations should ensure endpoint protection is current and user awareness training addresses these threats.

Source: The Hacker News

Supply Chain and Developer-Targeted Threats

GlassWorm Botnet Takedown

A major coordinated operation successfully disrupted the GlassWorm botnet, which had been targeting software developers in supply chain attacks since early 2025. CrowdStrike, working with Google and the Shadowserver Foundation, simultaneously took down all four C2 channels, including infrastructure leveraging Solana blockchain for resilience. This operation represents a significant victory against supply chain attack infrastructure.

Source: The Hacker News, SecurityWeek, CyberScoop

SymJack Attack on AI Coding Agents

Security researchers have disclosed a new attack technique dubbed "SymJack" that weaponizes AI coding agents as supply chain attack delivery systems. Malicious repositories using disguised symlinks can trick AI coding assistants into installing attacker-controlled MCP servers capable of stealing secrets and compromising CI/CD pipelines. Organizations using AI coding tools should implement additional controls around repository access.

Source: SecurityWeek

Malicious npm Package Targeting Claude AI Users

A malicious package named "mouse5212-super-" was discovered on the npm registry with information-stealing capabilities specifically targeting Claude AI user directories. This highlights the growing trend of threat actors targeting AI tool users and their associated data.

Source: The Hacker News

AI-Enabled Threats

Cryptojacking via AI Chatbot Manipulation

Microsoft has warned of an active cryptojacking campaign that manipulates AI chatbot interactions to surface malicious download sites. The campaign uses coordinated SEO poisoning to ensure AI systems recommend compromised resources, targeting users with high-performance computing systems.

Source: The Hacker News, Bleeping Computer

AI Model Vulnerability to Iterative Attacks

Research published this week demonstrates that AI models are more vulnerable than previously claimed when subjected to iterative attack techniques. This has implications for organizations relying on AI-based security tools and those deploying AI in operational technology environments.

Source: CSO Online

---

3. SECTOR-SPECIFIC ANALYSIS

Transportation Systems

ELEVATED THREAT LEVEL

The Iranian state-sponsored attack on LA Metro represents a significant escalation in targeting of U.S. mass transit infrastructure. Key considerations for transportation sector operators:

• The attack was initially masked as hacktivist activity, suggesting nation-state actors are increasingly using false flag operations
• Transit systems should review network segmentation between IT and operational technology systems
• Incident response plans should account for potential nation-state attribution complexity
• Information sharing with sector ISACs and federal partners is critical for identifying related campaigns

Recommended Actions:

• Review and validate network segmentation controls
• Ensure logging and monitoring capabilities can support attribution analysis
• Coordinate with TSA and sector partners on threat intelligence sharing
• Conduct tabletop exercises focused on nation-state intrusion scenarios

Communications & Information Technology

Supply Chain Security Focus

The GlassWorm botnet takedown and multiple developer-targeted attacks this week highlight ongoing threats to software supply chains:

• GlassWorm Impact: The botnet infected hundreds of pieces of software through compromised developer environments. Organizations should audit software dependencies for potential compromise.
• AI Development Tools: The SymJack attack and Claude AI-targeting malware demonstrate that AI development environments require enhanced security controls.
• Gitea Vulnerability: A disclosed flaw in the Gitea platform allows unauthenticated attackers to pull private container images, potentially exposing proprietary code and credentials.

Source: The Hacker News

Authentication Framework Vulnerability

A critical authentication bypass vulnerability has been identified in the Starlette framework, which underpins many FastAPI-based AI tools. Organizations deploying AI services built on these frameworks should prioritize patching.

Source: CSO Online

Financial Services

Banking Trojan Activity

The Grandoreiro and BTMOB RAT campaigns targeting Windows and Android users respectively pose risks to financial services customers and potentially to institution-facing systems. Financial sector organizations should:

• Update endpoint detection signatures for these malware families
• Enhance customer-facing security awareness communications
• Monitor for indicators of compromise in mobile banking channels

FIFA World Cup Phishing Campaign

Group-IB has identified over 4,300 fake FIFA World Cup domains in a campaign dubbed "Ghost Stadium" targeting fans. While primarily consumer-focused, financial institutions should be aware of potential credential harvesting that could impact customer accounts.

Source: Infosecurity Magazine

Healthcare & Public Health

HIPAA Security Developments

HHS Office for Civil Rights and NIST are preparing for the "Safeguarding Health Information: Building Assurance through HIPAA Security 2026" event scheduled for September. Healthcare organizations should monitor for updated guidance that may emerge from this initiative.

AI Governance Considerations

Reports this week on AI-enabled sanction evasion and the broader challenges of AI governance have implications for healthcare organizations deploying AI in clinical and administrative contexts. Robust AI governance frameworks are increasingly essential.

Source: CSO Online

Energy Sector

While no sector-specific incidents were reported this week, energy sector operators should note:

• The UK GCHQ warning about Russian gray zone activities has particular relevance given historical Russian targeting of energy infrastructure
• Supply chain compromises like GlassWorm could impact industrial control system software
• The CISA emergency directive on LiteSpeed vulnerabilities may affect web-facing energy sector systems

Water & Wastewater Systems

No sector-specific incidents were reported this week. Water utilities should maintain awareness of:

• Nation-state targeting patterns that may shift to water infrastructure
• Supply chain security for SCADA and control system software
• The ongoing need for network segmentation between IT and OT environments

---

4. VULNERABILITY & MITIGATION UPDATES

Critical Vulnerabilities Requiring Immediate Attention

🔴 CRITICAL: LiteSpeed cPanel Plugin – Active Exploitation

CISA has added a critical vulnerability in the LiteSpeed cPanel user-end plugin to its Known Exploited Vulnerabilities catalog and issued an emergency directive requiring federal agencies to patch within four days. This compressed timeline indicates active exploitation with significant impact potential.

Affected Systems: Web hosting environments using cPanel with LiteSpeed
Action Required: Immediate patching; if patching is not possible, implement compensating controls or take affected systems offline
Federal Deadline: Four days from May 27, 2026

Source: Bleeping Computer

🟠 HIGH: Starlette Framework Authentication Bypass

FastAPI-based AI tools are exposed to authentication bypass due to a flaw in the underlying Starlette framework. Organizations deploying AI services should audit their technology stacks for affected components.

Affected Systems: FastAPI applications, AI tools built on Starlette
Action Required: Update Starlette framework; review authentication controls on affected applications

Source: CSO Online

🟠 HIGH: Gitea Private Container Image Exposure

Unauthenticated attackers can pull private container images from Gitea instances due to a security flaw. This could expose proprietary code, credentials, and sensitive configuration data.

Affected Systems: Self-hosted Gitea instances with container registry functionality
Action Required: Apply patches when available; audit container registries for sensitive content; implement network-level access controls

Source: The Hacker News

🟡 MEDIUM: Pretalx Conference Software Account Takeover

Researchers discovered an account takeover vulnerability in Pretalx, an open-source call-for-papers management tool. While not directly critical infrastructure, organizations using this software for security conferences should update immediately.

Source: SecurityWeek

Defensive Tool Updates

Microsoft Defender for Endpoint – Automatic Device Isolation

Microsoft has previewed automatic device isolation capabilities in Defender for Endpoint. This feature can automatically quarantine compromised devices, reducing attacker dwell time. Organizations should evaluate this capability for deployment in their environments.

Source: CSO Online

Windows 11 KB5089573 Update

Microsoft released the KB5089573 preview cumulative update for Windows 11 versions 25H2 and 24H2, including 30 changes focused on performance and reliability improvements. Organizations should test and deploy according to standard patch management procedures.

Source: Bleeping Computer

Recommended Defensive Measures

• Credential Protection: Given the ongoing credential crisis highlighted in industry reporting, organizations should implement phishing-resistant MFA, monitor for session hijacking, and deploy credential breach detection services.
• AI Tool Governance: Establish policies for sanctioned AI tools, implement monitoring for shadow AI usage, and ensure AI development environments have appropriate security controls.
• Supply Chain Verification: In light of the GlassWorm takedown, audit software dependencies and implement software bill of materials (SBOM) practices.

---

5. RESILIENCE & CONTINUITY PLANNING

Lessons from Recent Incidents

GlassWorm Takedown – Coordinated Response Model

The successful disruption of the GlassWorm botnet demonstrates the effectiveness of coordinated public-private action. Key lessons:

• Simultaneous takedown of all C2 channels prevented operator pivot to backup infrastructure
• Collaboration between CrowdStrike, Google, and Shadowserver Foundation enabled comprehensive disruption
• Blockchain-based C2 infrastructure (Solana) required specialized takedown approaches
• Organizations should participate in threat intelligence sharing to enable similar coordinated responses

LA Metro Attack – Attribution Complexity

The Iranian attack initially claimed by hacktivists highlights the importance of:

• Not accepting initial attribution claims at face value
• Maintaining forensic capabilities to support deeper analysis
• Coordinating with federal partners for attribution support
• Developing incident response plans that account for nation-state scenarios

Supply Chain Security Developments

AI Tool Supply Chain Risks

This week's reporting on SymJack attacks and malicious npm packages targeting AI users underscores emerging supply chain risks:

• AI coding assistants can be weaponized to introduce malicious dependencies
• AI tool user directories contain sensitive data attractive to threat actors
• Organizations should implement controls around AI tool deployment and data access

Binary Analysis Capabilities

RevEng.AI's $15 million funding round for AI-powered binary analysis tools (BinNet) highlights growing investment in detecting vulnerabilities and backdoors in released software. Organizations should consider incorporating binary analysis into their software acceptance processes.

Source: SecurityWeek

Cross-Sector Dependencies

The LA Metro attack demonstrates potential cascading impacts:

• Transportation disruptions affect workforce mobility across all sectors
• Transit system compromises could impact emergency response capabilities
• Shared IT infrastructure between transit and other municipal services creates lateral movement risks

Public-Private Coordination

OpenAI Election Security Initiative

OpenAI announced cybersecurity and election interference safeguard plans for the 2026 midterm elections, building on 2024 efforts to combat AI-infused election manipulation. Critical infrastructure operators should monitor for sector-specific guidance that may emerge from these initiatives.

Source: CyberScoop

---

6. REGULATORY & POLICY DEVELOPMENTS

Federal Guidelines and Initiatives

NSA AI Cyber Doctrine – "Mythos" Program

Reporting this week provides insight into the NSA's emerging AI cyber doctrine, including a program referred to as "Mythos." While details remain limited, this signals increasing integration of AI into national cyber defense strategies. Critical infrastructure operators should anticipate future guidance aligned with these developments.

Source: CSO Online

CISA Emergency Directive – LiteSpeed Vulnerability

The four-day patching deadline for the LiteSpeed cPanel vulnerability represents one of the most compressed timelines in recent CISA directives, indicating the severity of active exploitation. While binding only on federal agencies, critical infrastructure operators should treat this as a priority.

International Policy Developments

UK AI Cyber Shield Development

GCHQ Director Keast-Butler's announcement of an AI-powered cyber shield development program signals UK investment in AI-enabled defense capabilities. This may influence allied nations' approaches and create opportunities for international cooperation on AI security.

Compliance Considerations

AI Governance and Sanctions Compliance

Reporting on AI-enabled sanctions evasion highlights emerging compliance risks for organizations deploying AI systems. Governance frameworks should address:

• AI system audit trails and explainability
• Sanctions screening integration with AI-driven processes
• Third-party AI tool compliance verification

UK Cyber Spending Trends

A survey indicates 68% of UK firms plan to increase cybersecurity spending as AI adoption raises security concerns. This trend may influence regulatory expectations and industry standards globally.

Source: Infosecurity Magazine

---

7. TRAINING & RESOURCE SPOTLIGHT

Tools and Frameworks

Data Security Posture Management (DSPM) Buyer's Guide

CSO Online published a comprehensive buyer's guide covering the top 10 DSPM tools. Organizations seeking to improve visibility into data security across cloud and on-premises environments should review this resource.

Source: CSO Online

Quantum-Resilient Identity Solutions

Lastwall's $11.5 million funding round for quantum-resilient identity platforms highlights growing investment in post-quantum cryptography. Organizations should begin assessing their cryptographic dependencies and planning for quantum-resistant transitions.

Source: SecurityWeek

Best Practices

Shadow AI Management

The Hacker News published guidance on managing shadow AI tools without impeding productivity. Key recommendations include:

• Establish clear policies for approved AI tools
• Implement discovery mechanisms for unsanctioned AI usage
• Provide secure alternatives that meet employee needs
• Balance security controls with usability

Source: The Hacker News

SOC Incident Response Optimization

Guidance on three SOC steps that shut down incident risks early emphasizes proactive threat hunting, automated response capabilities, and cross-functional coordination.

Source: The Hacker News

Workforce Development

Cybersecurity Burnout as Organizational Risk

Cybermindz is warning that cybersecurity burnout represents a growing organizational risk, urging adoption of measurable, risk-based approaches to workforce stress management. Security leaders should consider burnout mitigation as part of their resilience planning.

Source: Infosecurity Magazine

Industry Reports

FBI 2025 Internet Crime Report

The FBI's 2025 Internet Crime Report has been released with comprehensive statistics on cybercrime trends. Security professionals should review this data to inform risk assessments and resource allocation.

Source: Schneier on Security

---

8. LOOKING AHEAD: UPCOMING EVENTS

Conferences and Workshops

June 4, 2026 – NCCoE Manufacturing Cybersecurity Incident Response Guidelines
NIST National Cybersecurity Center of Excellence virtual event providing an overview of upcoming guidelines on improving cybersecurity incident response in manufacturing environments.
Time: 1:00 PM – 2:00 PM EDT
Source: NIST

June 9, 2026 – NIST NCCoE Genomic Data PETs Testbed & Dioptra Webinar
Webinar showcasing Privacy-Enhancing Technologies (PETs) Testbed and Dioptra platform for healthcare and research organizations handling sensitive genomic data.
Time: 1:00 PM – 3:30 PM EDT
Source: NIST

June 22, 2026 – NIST Workshop on Hardware CPE and CVSS Updates
One-day workshop on hardware representation in Common Platform Enumeration (CPE) and Common Vulnerability Scoring System (CVSS) applications to hardware. Relevant for organizations managing hardware asset inventories and vulnerability management programs.
Source: NIST

June 25, 2026 – Iris Experts Group Annual Meeting
Forum for discussion of technical questions related to iris recognition for government agencies. Relevant for organizations implementing biometric access controls.
Source: NIST

July 21, 2026 – NIST Time and Frequency Seminar
Annual seminar covering precision clocks, atomic frequency standards, synchronization, and quantum information. Relevant for telecommunications and critical timing infrastructure operators.
Source: NIST

August 11-12, 2026 – SecurityWeek AI Risk Summit
Third annual conference bringing together CISOs, security leaders, AI researchers, developers, policymakers, and enterprise risk professionals at the Ritz-Carlton, Half Moon Bay.
Source: SecurityWeek

September 2, 2026 – Safeguarding Health Information: HIPAA Security 2026
Joint HHS OCR and NIST event on HIPAA security requirements. Essential for healthcare sector organizations and their technology partners.
Source: NIST

Threat Periods Requiring Heightened Awareness

• 2026 FIFA World Cup: The Ghost Stadium phishing campaign with 4,300+ fake domains indicates elevated threat activity around World Cup events. Organizations should warn employees about related phishing risks.
• 2026 Midterm Elections: OpenAI's announcement of election security measures signals anticipated threat activity. Critical infrastructure operators should prepare for potential election-related disruption attempts.

Anticipated Developments

• Additional guidance expected from NIST NCCoE on manufacturing cybersecurity incident response
• Potential follow-on activity from GlassWorm operators attempting to reconstitute infrastructure
• Continued evolution of AI-enabled attack techniques requiring updated defensive measures

---

This intelligence briefing is compiled from open-source reporting and is intended to support critical infrastructure protection efforts. Recipients are encouraged to share relevant information with sector partners and report suspicious activity to appropriate authorities.

Report Prepared: Thursday, May 28, 2026