Real-time global intelligence

© 2026 OpenWatch. All rights reserved.

For informational and entertainment purposes only. Not investment advice.

Platform

Brief
Signals
Countries
Companies
Industries
Themes
Scenarios
Rankings

Tools

Globe
Analytics
Crises
Clusters
Supply Chain
Alliances
Screener
Watchlist
Portfolio

Developer

API Reference
Developer Keys
Webhooks
Status

Sources

View all sources →

1,000+ tracked sources

Signals updated every 15 minutes

Not investment advice. OpenWatch is provided for informational and entertainment purposes only. While we strive for accuracy, precision, and source attribution in all intelligence assessments, geopolitical analysis involves inherent uncertainty and our conclusions may be incomplete, delayed, or incorrect. Nothing on this platform constitutes financial, investment, legal, or professional advice of any kind. Forward-looking scenarios and probability estimates are analytical hypotheses — not independently validated forecasts. Any actions taken based on information found here are solely your responsibility. Always consult a qualified financial advisor before making investment decisions. Past signal patterns do not guarantee future outcomes.

Methodology
Privacy Policy
Terms of Use

openwatch.io

v·a7bd076

Signal Search

Search across all ingested intelligence signals. Supports websearch syntax: AND OR "exact phrase" -exclude

Keywords

Threat Layer

Military Cyber Economic Disaster Political Criminal Health Supply Chain

Signal Type

Any Crisis Update Resolution

Region

Country

Min. Severity

Any ≥ 3 ≥ 5 ≥ 7 ≥ 9

Date Range

Clear all filters

Sort by

Severity Newest

↓Export CSV (requires API key)

Themes:🧠AI Chip Bottleneck 🛡US Defense Surge 🔌Taiwan Semiconductor Risk 🏦EM CB Pivot

83 results for Cyber+Criminal · United States · Crisis

Page 1 of 4

CyberCrisis🇺🇸United States 🇮🇪Ireland 🇮🇷Iran63d ago

A hacktivist group tied to Iranian intelligence has claimed responsibility for a destructive data-wiping cyberattack on Stryker, the Michigan-based global medical technology giant. More than 5,000 employees were sent home from the company's largest hub in Ireland, while a recorded message at Stryker's U.S. headquarters warned of an ongoing building emergency.

6.8/10·Krebs on Security·Kalamazoo, Michigan

Source ↗Details →

CyberCrisis🇺🇸United States5d ago

A major edtech company is locked in an ongoing struggle to reclaim control of its systems from hackers, with the personal data of hundreds of millions of users potentially exposed or at risk of exfiltration.

6.5/10·Dark Reading

Source ↗Details →

CyberCrisis🇺🇸United States6d ago

A cybercrime group defaced the login page of the Canvas education platform with a ransom demand, disrupting classes at school districts and universities across the United States and threatening to leak data from an estimated 275 million students and faculty at nearly 9,000 institutions.

6.5/10·Krebs on Security

Source ↗Details →

CyberCrisis🇷🇺Russia 🇺🇸United States7d ago

A secret department at the military training center of Bauman Moscow State Technical University is training hackers and saboteurs for the GRU, a joint investigation by The Insider, The Guardian, Le Monde, Der Spiegel, Frontstory, and VSquare has found. The journalists reviewed more than two thousand internal documents from the department, including curricula, contracts, promotional materials, and lists of students, graduates, and faculty. The investigation describes how promising students are groomed for careers in the GRU — an organization known for hacking Western government systems, poisoning opposition figures abroad, and interfering in elections across Europe and the United States. Meduza summarizes the key findings.

6.5/10·Meduza (English)·Moscow, Moscow

Source ↗Details →

CyberCrisis🇺🇸United States8d ago

Palo Alto Networks has warned that a critical remote code execution flaw in its PAN-OS firewall software — tracked as CVE-2026-0300 with a CVSS score of 9.3 — is being actively exploited by attackers, requiring no authentication to trigger against internet-facing management portals.

6.5/10·The Hacker News

Source ↗Details →

CyberCrisis🇺🇸United States9d ago

Microsoft has uncovered a large-scale phishing campaign that ran from April 14–16, 2026, using fake code-of-conduct emails and legitimate email platforms to redirect tens of thousands of users to attacker-controlled sites and steal their authentication tokens, hitting more than 35,000 victims across 13,000 organizations in 26 countries.

6.5/10·The Hacker News

Source ↗Details →

CyberCrisis🇵🇭Philippines 🇱🇦Laos 🇨🇦Canada+210d ago

An unidentified hacking group is exploiting a newly disclosed cPanel vulnerability to breach government and military networks across Southeast Asia, while also hitting managed service providers and hosting companies in the Philippines, Laos, Canada, South Africa, and the United States.

6.5/10·The Hacker News

Source ↗Details →

CyberCrisis🇰🇵North Korea 🇺🇸United States12d ago

North Korean hackers have been stealing cryptocurrency at a historic and accelerating rate, with some heists occurring as frequently as weekly, and AI tools may now be amplifying their capabilities.

6.5/10·Dark Reading

Source ↗Details →

CyberCrisis🇺🇸United States 🇲🇱Mali24d ago

CISA has issued an alert after attackers compromised two versions of the widely-used Axios npm package on March 31, 2026, injecting a malicious dependency that downloads a remote access trojan — urging developers and organizations to downgrade, rotate credentials, and audit any pipelines that ran the affected versions.

6.5/10·CISA Current Activity·Mali

Source ↗Details →

CriminalCrisis🇬🇹Guatemala 🇺🇸United States5d ago

An investigation has exposed the operational structure of a fentanyl manufacturing ring operating in Guatemala, revealing how chemical precursors were smuggled into the country and processed into finished product for distribution.

6.2/10·La Prensa Libre (Guatemala — Spanish, expanded)·Guatemala City, Guatemala

Source ↗Details →

CyberCrisis🇺🇸United States5d ago

A newly disclosed Linux vulnerability called Dirty Frag allows attackers with unprivileged access to escalate privileges to root by exploiting kernel networking and memory-fragmentation handling. Microsoft Defender has detected limited active exploitation in the wild, and the flaw can be leveraged after initial compromise through SSH, web shells, containers, or low-privileged accounts.

6.2/10·Microsoft Security Blog

Source ↗Details →

CyberCrisis🇺🇸United States6d ago

Security researchers have identified PCPJack, a credential theft framework that targets exposed cloud infrastructure and removes competing malware. The toolset harvests credentials from cloud services, containerized environments, developer platforms, productivity tools, and financial services before exfiltrating the data through attacker-controlled systems.

6.2/10·The Hacker News

Source ↗Details →

CyberCrisis🇺🇸United States8d ago

Attackers are deploying CloudZ RAT alongside a new plugin called Pheno in targeted campaigns designed to compromise Windows software that bridges PCs and smartphones, with tactics specifically engineered to evade detection.

6.2/10·Dark Reading

Source ↗Details →

CyberCrisis🇺🇸United States15d ago

Ransomware attackers are now targeting victims of the TeamPCP supply chain compromise, layering extortion demands on top of an already serious breach — though security researchers are cautioning victims not to pay, as the decryptor may not work.

6.2/10·Dark Reading

Source ↗Details →

CriminalCrisis🇸🇻El Salvador 🇺🇸United States20d ago

"Socalj" for Borderland Beat “This morning, we executed operation “Gangsters Paradise. We’ve indicted forty members and associates of the Mexican Mafia, who is the most powerful, prolific gang that operates out of state prisons,” said L.A.’s top federal prosecutor, Bill Essayli. “They control and operate all the Hispanic street gangs out in the neighborhoods,” he added.

6.1/10·Borderland Beat·Santa Ana

Source ↗Details →

CyberCrisis🇺🇸United States5d ago

The hacking group ShinyHunters stole roughly 6.65 terabytes of data from the educational platform Canvas, affecting nearly 9,000 schools and millions of students worldwide, and has been extorting individual institutions to prevent their data from being publicly released. The FBI has acknowledged the breach, and while Canvas has been restored online, stolen data remains at risk of exposure as some schools enter negotiations with the hackers.

6.0/10·Dawn

Source ↗Details →

CyberCrisis🇺🇸United States9d ago

Multiple proof-of-concept exploits emerged quickly after an authentication-bypass flaw was made public, and at least one researcher says the vulnerability had already been exploited in the wild for a month before disclosure — suggesting attackers had a significant head start.

6.0/10·Dark Reading

Source ↗Details →

CyberCrisis🇺🇸United States21d ago

A threat actor tracked as UAT-4356 is actively exploiting two known vulnerabilities in Cisco Firepower network security devices, gaining unauthorized access to unpatched systems — a campaign flagged by Cisco's Talos intelligence team.

6.0/10·Cisco Talos Intelligence

Source ↗Details →

CyberCrisis🇺🇸United States23d ago

Cybercriminals in 2025 are increasingly targeting vulnerabilities in multi-factor authentication systems and weaponizing legitimate, stolen credentials to launch convincing phishing attacks from trusted business accounts. The shift signals a coordinated focus on exploiting organizational trust—a fundamental weakness in everyday business security workflows.

6.0/10·Cisco Talos Intelligence

Source ↗Details →

CyberCrisis🇺🇸United States 🇲🇱Mali57d ago

CISA issued an alert following a March 11, 2026 cyberattack on medical technology giant Stryker Corporation that compromised its Microsoft environment, warning that threat actors are broadly targeting endpoint management systems and urging organizations to harden Microsoft Intune configurations using least-privilege, phishing-resistant MFA, and multi-admin approval policies.

6.0/10·CISA Current Activity·Mali, Michigan

Source ↗Details →

CriminalCrisis🇺🇸United States5d ago

Federal gun and drug prosecutions have stalled amid a wave of resignations by senior prosecutors. Agents have been reassigned away from drug task forces and gang investigations, and some cases have been transferred to state authorities—an unusual step indicating possible institutional stress or resource constraints in federal law enforcement.

5.5/10·St. Louis Post-Dispatch

Source ↗Details →

CriminalCrisis🇺🇸United States5d ago

Federal prosecutors handling major gun and drug cases have quit in significant numbers, causing new prosecutions to stall. Federal agents are withdrawing from drug task forces and gang investigations, with some cases being transferred to state authorities instead—an unusual procedural shift that suggests operational disruption at the federal level.

5.5/10·Rapid City Journal (South Dakota)

Source ↗Details →

CriminalCrisis🇺🇸United States5d ago

An individual has been charged with abusing at least eight students between 2013 and 2015, according to allegations brought following an FBI tip received in 2024. The charges reflect a multi-year pattern of harm against minors.

5.5/10·St. Louis Post-Dispatch

Source ↗Details →

CyberCrisis🇺🇸United States5d ago

Hackers breached Canvas, a popular educational platform used by universities across the United States, compromising data from nearly 8,000 students across multiple institutions. The breach raises concerns about student data security and potential misuse of personal information.

5.5/10·La Prensa Libre (Guatemala — Spanish, expanded)

Source ↗Details →

CyberCrisis🇺🇸United States6d ago

A newly discovered Linux malware called QLNX is silently infecting developers' machines, harvesting credentials and keystrokes while enabling attackers to tunnel through compromised networks — with researchers warning the implant specifically targets software supply chain personnel.

5.5/10·The Hacker News

Source ↗Details →