CRITICALApt
Verified
United States

Volt Typhoon Compromises US Natural Gas Pipeline Operator OT Networks

Saturday, March 28, 2026 at 08:00 AM UTC·Source: CISA / TSA Emergency Directive

Updated: Sunday, March 29, 2026 at 06:00 AM UTC

Executive Summary

Volt Typhoon confirmed inside OT networks of a major US natural gas pipeline operator. Access to safety instrumented systems raises explosion risk concerns.

Analysis

CISA emergency advisory confirms Volt Typhoon has gained access to operational technology networks at a major US natural gas pipeline operator. Investigators found evidence of access to safety instrumented systems (SIS) that control emergency shutdowns. While no manipulation was detected, the access level raises serious concerns about potential kinetic impacts. TSA issued an emergency security directive requiring enhanced monitoring.

Timeline

Discovered
Jan 1, 2024
Exploitation Detected
Jan 1, 2024
Published
Mar 28, 2026
Source Attribution

Originally published by CISA / TSA Emergency Directive on Mar 28, 2026. Verified by: CISA, TSA, DOE, FBI.

Related Threats

LOWApt

Cloudflare’s new CMS is not a WordPress killer, it’s a WordPress alternative

Cloudflare on Wednesday rolled out EmDash, which it described as “the spiritual successor to WordPress.” The security vendor positioned EmDash as a far more secure site building tool that avoids the extensive cybersecurity problems with WordPress plugins . But the Cloudflare claims go far beyond cybersecurity issues. The vendor is arguing that the very nature of websites in 2026 is sharply differe

CSO Online
MEDIUMApt

Apple Rolls Out DarkSword Exploit Protection to More Devices

The DarkSword exploit kit has been used by both state-sponsored hackers and commercial spyware vendors. The post Apple Rolls Out DarkSword Exploit Protection to More Devices appeared first on SecurityWeek .

SecurityWeek
HIGHApt

New Whitepaper: Stealthy BPFDoor Variants are a Needle That Looks Like Hay

Executive Overview Advanced persistent threats (APTs) are constantly and consistently changing tactics as network defenders plug holes in defenses. Static indicators of compromise (IoCs) for the BPFDoor have been widely deployed, forcing threat actors to get creative in their use of this particular strain of malware. What they came up with is ingenious. New research from Rapid7 Labs has uncovered

Rapid7