Threat Intelligence

Semperis reports that the Iran-linked Prince of Persia (Infy) threat group resumed data theft in 2026 after a confirmed three-month pause and used a U.S.-hosted command-and-control server for the first time since 2016. While the report identifies no procurement opportunity, it gives agencies and contractors a reason to review indicators of compromise and account for threats operating through shared commercial infrastructure.

Researchers mapped 66 operations tied to an exposed, unauthenticated AI-enabled intrusion platform, including activity against government bodies in Vietnam, Taiwan, Indonesia, and India. The findings do not identify a contract or solicitation, but highlight cyber-risk considerations for agencies and contractors securing externally accessible services, credentials, and government-connected systems.

Google Threat Intelligence Group and Mandiant reported repeated tampering with AOMEI update configuration files from April through July 2026, with some malicious configurations active for only five to ten minutes. Government buyers and contractors using AOMEI products should review update integrity and investigate potentially affected endpoints, even if the update servers have since been corrected.

The DOJ and FBI have seized seven domains linked to cyber activities of China's Integrity Technology Group. This action underscores ongoing national security risks for critical infrastructure, prompting contractors to reassess cybersecurity measures and capabilities.

A notable trend is emerging among cybersecurity professionals seeking to transition from Security Operations Centers (SOC) to Threat Intelligence roles. This shift underscores the need for government agencies and contractors to adapt their training and recruitment strategies to meet evolving cybersecurity demands.

The emergence of the self-destructing Mistic backdoor emphasizes the need for stronger cybersecurity measures in government procurement. As threat actors evolve their methods, agencies must invest in advanced solutions to protect networks against sophisticated intrusion tactics.