CISA Denies Reports of Shift in Posture Amid Russian Threats

The US Cybersecurity and Infrastructure Security Agency (CISA) has reaffirmed that it will pursue its mission to defend against all cyber threats to US critical infrastructure, including those from Russia, under the Trump administration.

Reports have recently emerged of an internal memo sent to CISA staff members introducing new priorities for the agency. According to The Guardian, this directive included China but did not mention Russia.

Additionally, an anonymous source told The Guardian that CISA analysts have been verbally informed that they were not to follow or report on Russian threats.

Speaking to Infosecurity, Department of Homeland Security (DHS) spokesperson Tricia McLaughlin denied that the directive mentioned by the UK newspaper came from the Trump administration. “The memo referenced in The Guardian’s ‘reporting’ is not from the Trump Administration, which is quite inconvenient to The Guardian’s preferred narrative,” she added.

“CISA remains committed to addressing all cyber threats to US critical infrastructure, including from Russia. There has been no change in our posture or priority on this front,” McLaughlin also said.

This latter statement resonates with a CISA social media post on March 3, in which the US agency said, “There has been no change in our posture. Any reporting to the contrary is fake and undermines our national security.”

Read more: CISA’s 2024 Review Highlights Major Efforts in Cybersecurity Industry Collaboration

Cyber Pros Emphasize Russian Threats

Scott Small, Director of Cyber Threat Intelligence at Tidal Cyber, commented: “For the past decade-plus, government advisories and vendor intelligence reports have highlighted the threat posed by Russia state-sponsored cyber actors to not only government-related targets but also organizations in a wide range of private sectors. Recent reporting on Seashell Blizzard, an exceptionally persistent and flexible group targeting government entities and enterprises around the world, is just the latest example.”

“Organizations of all stripes must remain aware of Russian adversaries’ extremely diverse targeting patterns as they are re-evaluating their security posture in the near term,” he added.

Speaking to Infosecurity, Rasheen Whidbee, creator of the LinkedIn newsletter Tech Tales, warned that, if confirmed, halting cyber advisories of Russian-based cyber threats could be detrimental to US cyber defenses.

“From a cybersecurity standpoint, the absence of location-based tracking makes it significantly harder to verify intelligence. If an advanced persistent threat (APT) group identifies a known blind spot, they will inevitably exploit it as an attack vector or disguise their activities to blend in with it. This lack of visibility creates a critical vulnerability, raising serious concerns about the integrity and effectiveness of threat detection on a global scale,” he said. 

US Cyber Command to Stop Offensive Action Against Russia

Meanwhile, several news outlets reported that US Defense Secretary Pete Hegseth allegedly directed US Cyber Command to cease all preparations and operations targeting Russia, effectively halting potential digital countermeasures against the country.

According to The Record, Hegseth’s instruction was conveyed to Gen. Timothy Haugh, the head of Cyber Command, who in turn notified Marine Corps Maj. Gen. Ryan Heritage, the outgoing director of operations, about the new directive.

The impact of Hegseth’s guidance on Cyber Command’s personnel is uncertain, but it could affect hundreds to thousands of people, depending on its scope. If limited to digital warriors focused on Russia, it may impact hundreds, but if it extends to areas like intelligence and capabilities development, the number could grow to 2,000-3,000 employees.

Some experts expect the move to have a significant impact on Ukraine, where US Cyber Command had been actively supporting the country’s cyber defense efforts against Russian cyber-attacks and espionage, particularly through its hunt-forward missions deployed since the invasion.