Real-time global intelligence

© 2026 OpenWatch. All rights reserved.

For informational and entertainment purposes only. Not investment advice.

Platform

Brief
Signals
Countries
Companies
Industries
Themes
Scenarios
Rankings

Tools

Globe
Analytics
Crises
Clusters
Supply Chain
Alliances
Screener
Watchlist
Portfolio

Developer

API Reference
Developer Keys
Webhooks
Status

Sources

View all sources →

1,000+ tracked sources

Signals updated every 15 minutes

Not investment advice. OpenWatch is provided for informational and entertainment purposes only. While we strive for accuracy, precision, and source attribution in all intelligence assessments, geopolitical analysis involves inherent uncertainty and our conclusions may be incomplete, delayed, or incorrect. Nothing on this platform constitutes financial, investment, legal, or professional advice of any kind. Forward-looking scenarios and probability estimates are analytical hypotheses — not independently validated forecasts. Any actions taken based on information found here are solely your responsibility. Always consult a qualified financial advisor before making investment decisions. Past signal patterns do not guarantee future outcomes.

Methodology
Privacy Policy
Terms of Use

openwatch.io

v·a6e49d1

Signal Search

Search across all ingested intelligence signals. Supports websearch syntax: AND OR "exact phrase" -exclude

Keywords

Threat Layer

Military Cyber Economic Disaster Political Criminal Health Supply Chain

Signal Type

Any Crisis Update Resolution

Region

Country

Min. Severity

Any ≥ 3 ≥ 5 ≥ 7 ≥ 9

Date Range

Clear all filters

Sort by

Severity Newest

↓Export CSV (requires API key)

Themes:🧠AI Chip Bottleneck 🛡US Defense Surge 🔌Taiwan Semiconductor Risk 🏦EM CB Pivot

116 results for Cyber+Criminal · United States · Crisis

Page 1 of 5

CyberCrisis🇺🇸United States 🇮🇪Ireland 🇮🇷Iran65d ago

A hacktivist group tied to Iranian intelligence has claimed responsibility for a destructive data-wiping cyberattack on Stryker, the Michigan-based global medical technology giant. More than 5,000 employees were sent home from the company's largest hub in Ireland, while a recorded message at Stryker's U.S. headquarters warned of an ongoing building emergency.

6.8/10·Krebs on Security·Kalamazoo, Michigan

Primary Source ↗Details →

CriminalCrisis🇺🇸United States23h ago

US forces have killed close to 200 people aboard boats suspected of drug smuggling, but Latin American investigative journalists who identified 13 of the victims say most had no links to drug trafficking, raising major questions about the legality and oversight of these operations.

6.5/10·Dagens Nyheter (Sweden)

Primary Source ↗Details →

CyberCrisis🇺🇸United States7d ago

A major edtech company is locked in an ongoing struggle to reclaim control of its systems from hackers, with the personal data of hundreds of millions of users potentially exposed or at risk of exfiltration.

6.5/10·Dark Reading

Primary Source ↗Details →

CyberCrisis🇺🇸United States8d ago

A cybercrime group defaced the login page of the Canvas education platform with a ransom demand, disrupting classes at school districts and universities across the United States and threatening to leak data from an estimated 275 million students and faculty at nearly 9,000 institutions.

6.5/10·Krebs on Security

Primary Source ↗Details →

CyberCrisis🇷🇺Russia 🇺🇸United States8d ago

A secret department at the military training center of Bauman Moscow State Technical University is training hackers and saboteurs for the GRU, a joint investigation by The Insider, The Guardian, Le Monde, Der Spiegel, Frontstory, and VSquare has found. The journalists reviewed more than two thousand internal documents from the department, including curricula, contracts, promotional materials, and lists of students, graduates, and faculty. The investigation describes how promising students are groomed for careers in the GRU — an organization known for hacking Western government systems, poisoning opposition figures abroad, and interfering in elections across Europe and the United States. Meduza summarizes the key findings.

6.5/10·Meduza (English)·Moscow, Moscow

Primary Source ↗Details →

CyberCrisis🇺🇸United States10d ago

Palo Alto Networks has warned that a critical remote code execution flaw in its PAN-OS firewall software — tracked as CVE-2026-0300 with a CVSS score of 9.3 — is being actively exploited by attackers, requiring no authentication to trigger against internet-facing management portals.

6.5/10·The Hacker News

Primary Source ↗Details →

CyberCrisis🇺🇸United States11d ago

Microsoft has uncovered a large-scale phishing campaign that ran from April 14–16, 2026, using fake code-of-conduct emails and legitimate email platforms to redirect tens of thousands of users to attacker-controlled sites and steal their authentication tokens, hitting more than 35,000 victims across 13,000 organizations in 26 countries.

6.5/10·The Hacker News

Primary Source ↗Details →

CyberCrisis🇵🇭Philippines 🇱🇦Laos 🇨🇦Canada+212d ago

An unidentified hacking group is exploiting a newly disclosed cPanel vulnerability to breach government and military networks across Southeast Asia, while also hitting managed service providers and hosting companies in the Philippines, Laos, Canada, South Africa, and the United States.

6.5/10·The Hacker News

Primary Source ↗Details →

CyberCrisis🇰🇵North Korea 🇺🇸United States14d ago

North Korean hackers have been stealing cryptocurrency at a historic and accelerating rate, with some heists occurring as frequently as weekly, and AI tools may now be amplifying their capabilities.

6.5/10·Dark Reading

Primary Source ↗Details →

CyberCrisis🇺🇸United States 🇲🇱Mali26d ago

CISA has issued an alert after attackers compromised two versions of the widely-used Axios npm package on March 31, 2026, injecting a malicious dependency that downloads a remote access trojan — urging developers and organizations to downgrade, rotate credentials, and audit any pipelines that ran the affected versions.

6.5/10·CISA Current Activity·Mali

Primary Source ↗Details →

CriminalCrisis🇬🇹Guatemala 🇺🇸United States7d ago

An investigation has exposed the operational structure of a fentanyl manufacturing ring operating in Guatemala, revealing how chemical precursors were smuggled into the country and processed into finished product for distribution.

6.2/10·La Prensa Libre (Guatemala — Spanish, expanded)·Guatemala City, Guatemala

Primary Source ↗Details →

CyberCrisis🇺🇸United States7d ago

A newly disclosed Linux vulnerability called Dirty Frag allows attackers with unprivileged access to escalate privileges to root by exploiting kernel networking and memory-fragmentation handling. Microsoft Defender has detected limited active exploitation in the wild, and the flaw can be leveraged after initial compromise through SSH, web shells, containers, or low-privileged accounts.

6.2/10·Microsoft Security Blog

Primary Source ↗Details →

CyberCrisis🇺🇸United States8d ago

Security researchers have identified PCPJack, a credential theft framework that targets exposed cloud infrastructure and removes competing malware. The toolset harvests credentials from cloud services, containerized environments, developer platforms, productivity tools, and financial services before exfiltrating the data through attacker-controlled systems.

6.2/10·The Hacker News

Primary Source ↗Details →

CyberCrisis🇺🇸United States10d ago

Attackers are deploying CloudZ RAT alongside a new plugin called Pheno in targeted campaigns designed to compromise Windows software that bridges PCs and smartphones, with tactics specifically engineered to evade detection.

6.2/10·Dark Reading

Primary Source ↗Details →

CyberCrisis🇺🇸United States17d ago

Ransomware attackers are now targeting victims of the TeamPCP supply chain compromise, layering extortion demands on top of an already serious breach — though security researchers are cautioning victims not to pay, as the decryptor may not work.

6.2/10·Dark Reading

Primary Source ↗Details →

CriminalCrisis🇺🇸United States 🇨🇺Cuba 🇬🇪Georgiayesterday

<h3>Good morning, Chicago. ✶</h3><p>🔎 <b>Below</b>:&nbsp;A state review board has sent to Gov. JB Pritzker its confidential recommendations about whether former Gangster Disciples leader Larry Hoover should be freed.</p><p>🗞️ <b>Plus</b>: The politicians getting ex-Ald.

6.1/10·Chicago Sun-Times·Chicago, Illinois

Primary Source ↗Details →

CriminalCrisis🇺🇸United States 🇴🇲Omanyesterday

<p>A jury of seven men and five women found Tony Robinson guilty late Thursday in the murder of graduate student Anat Kimchi, who was fatally stabbed in an unprovoked attack Downtown.</p><p>Robinson, 45, was charged with killing Kimchi by sneaking up on her and stabbing her three times in the neck and back. Jurors deliberated five hours before reaching their verdict.</p><p>In the gallery, Kimchi’s mother broke down in tears while relatives and friends comforted her. Both of Kimchi’s parents said they were too emotional in the moment to speak.</p><p>Robinson did not visibly react when the verdict was read aloud in court.

6.1/10·Chicago Sun-Times·Chicago, Illinois

Primary Source ↗Details →

CyberCrisis🇺🇸United States7d ago

<p>Many Illinois colleges and schools are scrambling after the online learning platform Canvas went offline Thursday following a cyberattack on its parent company.</p><p>The shutdown forced the University of Illinois Urbana-Champaign to postpone all final exams and assignments scheduled for Friday, Saturday and Sunday, <a class="Link" href="https://massmail.illinois.edu/massmail/277104776.html" target="_blank" ><u>leaders told students in a message</u></a> sent Thursday night.</p><p>Thousands of K-12 school districts and colleges use Canvas nationwide, including U. of I. and Northwestern University, to manage classes, post assignments and communicate with students.

6.1/10·Chicago Sun-Times

Primary Source ↗Details →

CriminalCrisis🇲🇽Mexico 🇺🇸United States8d ago

“Sol Prendido” for Borderland Beat  Today, I have the privilege—the honor—of sharing this table with one of the journalists I admire most, and who is, moreover, a true master in many respects. And setting aside that praise—which might sound like flattery, though I say it with all my heart—Jesús Esquivel is perhaps one of the most knowledgeable experts regarding the relationship between Mexico and the United States in matters of security. Furthermore, for undertaking the project he just completed—*Los Cárteles Gringos* (The Gringo Cartels)—is no small feat.

6.1/10·Borderland Beat·Mexico

Primary Source ↗Details →

CriminalCrisis🇸🇻El Salvador 🇺🇸United States22d ago

"Socalj" for Borderland Beat “This morning, we executed operation “Gangsters Paradise. We’ve indicted forty members and associates of the Mexican Mafia, who is the most powerful, prolific gang that operates out of state prisons,” said L.A.’s top federal prosecutor, Bill Essayli. “They control and operate all the Hispanic street gangs out in the neighborhoods,” he added.

6.1/10·Borderland Beat·Santa Ana

Primary Source ↗Details →

CyberCrisis🇲🇱Mali 🇺🇸United States106d ago

Introduction Mandiant has identified an expansion in threat activity that uses tactics, techniques, and procedures (TTPs) consistent with prior ShinyHunters-branded extortion operations. These operations primarily leverage sophisticated voice phishing (vishing) and victim-branded credential harvesting sites to gain initial access to corporate environments by obtaining single sign-on (SSO) credentials and multi-factor authentication (MFA) codes. Once inside, the threat actors target cloud-based software-as-a-service (SaaS) applications to exfiltrate sensitive data and internal communications for use in subsequent extortion demands.

6.1/10·Mandiant Threat Intelligence·Mali

Primary Source ↗Details →

CyberCrisis🇺🇸United States7d ago

The hacking group ShinyHunters stole roughly 6.65 terabytes of data from the educational platform Canvas, affecting nearly 9,000 schools and millions of students worldwide, and has been extorting individual institutions to prevent their data from being publicly released. The FBI has acknowledged the breach, and while Canvas has been restored online, stolen data remains at risk of exposure as some schools enter negotiations with the hackers.

6.0/10·Dawn

Primary Source ↗Details →

CyberCrisis🇺🇸United States11d ago

Multiple proof-of-concept exploits emerged quickly after an authentication-bypass flaw was made public, and at least one researcher says the vulnerability had already been exploited in the wild for a month before disclosure — suggesting attackers had a significant head start.

6.0/10·Dark Reading

Primary Source ↗Details →

CyberCrisis🇺🇸United States23d ago

A threat actor tracked as UAT-4356 is actively exploiting two known vulnerabilities in Cisco Firepower network security devices, gaining unauthorized access to unpatched systems — a campaign flagged by Cisco's Talos intelligence team.

6.0/10·Cisco Talos Intelligence

Primary Source ↗Details →

CyberCrisis🇺🇸United States25d ago

Cybercriminals in 2025 are increasingly targeting vulnerabilities in multi-factor authentication systems and weaponizing legitimate, stolen credentials to launch convincing phishing attacks from trusted business accounts. The shift signals a coordinated focus on exploiting organizational trust—a fundamental weakness in everyday business security workflows.

6.0/10·Cisco Talos Intelligence

Primary Source ↗Details →