cyber.hendryadrian.com
Security Report · trendmicro.com

Q1 2026 Threat Review Details Risks Facing U.S. Public Sector

· Original article ↗

Summary

Trend Micro’s Q1 2026 review covers alleged nation-state activity, public-sector breaches, ransomware trends, and actively exploited vulnerabilities, with recommended steps for government and education security teams.

Key points

  • The review says Salt Typhoon targeted U.S. House committee staff emails and describes the group’s operations as ongoing.
  • It reports 251 ransomware attacks on educational institutions globally in 2025 and 3.9 million exposed records, up 27% from the prior year.
  • The article describes Illinois and Minnesota DHS data exposures involving misconfiguration and excessive access permissions.
  • An attack on a third-party provider disrupted Anchorage Police Department systems, which were taken offline.
  • The review says attackers actively exploited vulnerabilities affecting Fortinet, Cisco, VMware, and Microsoft products.
  • It describes AI-assisted reconnaissance and credential theft as emerging ransomware-related risks, including the appearance of Tsundere Bot.
  • Recommended priorities include patching exposed infrastructure, enforcing MFA, assessing third parties, improving behavioral detection, and maintaining asset visibility.

Article Details

Publisher
Trend Micro
Report Period
Q1 2026; includes historical 2025 statistics and events
Scope
Cyber threats affecting U.S. government agencies and educational institutions, including nation-state activity, ransomware, data exposure, supply-chain incidents, and exploited vulnerabilities.
Key Statistics
  • 251 ransomware attacks hit educational institutions globally in 2025.
  • The U.S. had 130 education-sector ransomware incidents in 2025, the highest number of any country.
  • Education ransomware attacks exposed 3.9 million records in 2025, up 27% from 3.1 million the prior year.
  • The average education-sector breach cost was $3.80 million per incident in 2025.
  • The article reports that 59% of higher-education institutions reporting ransomware attacks experienced full data exfiltration before encryption.
Recommendations
  • Audit and patch internet-facing Fortinet, Cisco, and VMware infrastructure, particularly systems affected by CVE-2020-12812 and CVE-2026-20274; use IPS virtual patching where applicable.
  • Enforce MFA for state and federal employee and contractor access.
  • Conduct security assessments of third parties and contractors.
  • Deploy behavioral detection and AI anomaly analysis.
  • Implement full asset visibility and continuous Cyber Risk Exposure Management scanning.

CVE

CVE-2020-12812CVE-2020-12812CVE-2025-12825CVE-2025-12825CVE-2025-38067CVE-2025-38067CVE-2026-20045CVE-2026-20045CVE-2026-20274Audit and patch (or virtually patch via IPS) all internet-facing Fortinet, Cisco, and VMware infrastructure — particularly CVE-2020-12812 and CVE-2026-20274CVE-2026-20860CVE-2026-20860

Threat Actors

Salt TyphoonIdentified as a PRC-linked threat actor that targeted U.S. House Committee staff emails and whose operations were reported as ongoing.UAT-7290China-linked threat group reported to target U.S. and allied telecommunications providers by exploiting edge network device vulnerabilities.

Vendors

AT&TIn February, a U.S. Senator revealed that AT&T and Verizon had actively blocked the release of Salt Typhoon security assessment reports — raising serious concerns about transparency and regulatory oversightCiscoCisco Unified Communications ManagerFortinetFortinet FirewallsMicrosoftMicrosoft OfficeTrend MicroSources: Trend Micro Security Predictions 2026 — The AI-fication of Cyberthreats | SentinelOne — Cybersecurity Statistics 2026 | VikingCloud — Ransomware StatisticsVerizonIn February, a U.S. Senator revealed that AT&T and Verizon had actively blocked the release of Salt Typhoon security assessment reports — raising serious concerns about transparency and regulatory oversightVMwareVMware Aria Suite

Products

Cisco Unified Communications ManagerCisco Unified Communications ManagerFortinet FirewallsFortinet FirewallsFortinet FortiGate Fortinet FortiGateMicrosoft OfficeMicrosoft OfficeTrendAI Vision OneTrendAI Vision One™ enables this transformation across four critical capabilities:VMware Aria SuiteVMware Aria Suite

Tools

Tsundere BotA new initial access tool, Tsundere Bot, emerged in January 2026 specifically designed to automate credential theft and persistence in ransomware precursor operations

Countries

Chinaeducational institutions are operating in the most hostile cyber threat environment ever recorded. From China-aligned nation-state actors persistently targeting congressional communications to ransomware gangsUnited States

Industries

EducationEducation Sector: Record Data Exposure Despite Stabilizing Attack CountsGovernmentThe first quarter of 2026 has reinforced a hard truth: U.S. government agencies and educational institutions are operating in the most hostile cyber threat environment ever recorded. From China-aligned nation-stateLaw enforcementLaw Enforcement Hit via Third-Party Attack: Anchorage PoliceTelecommunicationsOn January 9, 2026, SC Media and the NJCCIC confirmed that Salt Typhoon, the PRC-linked threat actor that previously breached major U.S. telecommunications carriers, successfully targeted U.S.

Related Articles