Threat Intelligence

Army CID issued an RFI for commercial, cloud-hosted software to identify and investigate threats across darknet sites, encrypted messaging services, and alternative social platforms. The market research highlights demand for AI-enabled analysis, cross-platform identity correlation, evidence preservation, and protected undercover workspaces; it is not a solicitation or award, and responses are due December 9, 2026.

The Department of War, through JIATF-401, awarded DroneSec work to track and analyze adversary unmanned systems; the contract value and number were not disclosed. The award adds an intelligence-analysis component to a broader counter-drone portfolio that includes 10 September IDIQ awards with a combined ceiling of up to $4.15 billion.

CISA circulated an internal framework on November 5 to help leaders assess cyber and infrastructure risks, identify decision-critical information, and coordinate preparedness and response. Divisional implementation guidance is expected in the coming months, but no solicitation or contract opportunity has been announced.

CISA’s enhanced web-based incident form collects more detailed information, including expanded incident classifications and MITRE ATT&CK-aligned activity questions. Federal civilian agencies must report incidents, while submissions from other organizations remain voluntary; contractors supporting federal cyber operations may need to align response workflows with the updated form.

CrowdStrike reports that China-backed Vapor Panda used the ARTEX agentic AI framework with DeepSeek to target more than 200 organizations in at least 14 countries, compromising about 140 sensitive targets in 11 days. For government contractors, the campaign underscores demand for effective endpoint, identity, and cross-domain detection and response, but identifies no specific solicitation, award, or funding.

Google Cloud and Mandiant warn that patched PHP packages may leave systems exposed unless services are restarted and runtime versions verified. Government contractors hosting PHP applications must audit running processes and review logs back to October 17 for exploitation attempts.

Semperis reports that the Iran-linked Prince of Persia (Infy) threat group resumed data theft in 2026 after a confirmed three-month pause and used a U.S.-hosted command-and-control server for the first time since 2016. While the report identifies no procurement opportunity, it gives agencies and contractors a reason to review indicators of compromise and account for threats operating through shared commercial infrastructure.

Researchers mapped 66 operations tied to an exposed, unauthenticated AI-enabled intrusion platform, including activity against government bodies in Vietnam, Taiwan, Indonesia, and India. The findings do not identify a contract or solicitation, but highlight cyber-risk considerations for agencies and contractors securing externally accessible services, credentials, and government-connected systems.

Google Threat Intelligence Group and Mandiant reported repeated tampering with AOMEI update configuration files from April through July 2026, with some malicious configurations active for only five to ten minutes. Government buyers and contractors using AOMEI products should review update integrity and investigate potentially affected endpoints, even if the update servers have since been corrected.

The DOJ and FBI have seized seven domains linked to cyber activities of China's Integrity Technology Group. This action underscores ongoing national security risks for critical infrastructure, prompting contractors to reassess cybersecurity measures and capabilities.

A notable trend is emerging among cybersecurity professionals seeking to transition from Security Operations Centers (SOC) to Threat Intelligence roles. This shift underscores the need for government agencies and contractors to adapt their training and recruitment strategies to meet evolving cybersecurity demands.

The emergence of the self-destructing Mistic backdoor emphasizes the need for stronger cybersecurity measures in government procurement. As threat actors evolve their methods, agencies must invest in advanced solutions to protect networks against sophisticated intrusion tactics.