Government & Critical Infrastructure Under Siege: 2026 Threat Landscape

Author: Lyrie Threat Intelligence Team

Date: 2026-05-13

Reading time: 11 min

TL;DR

The threat picture against government and critical-infrastructure targets in early 2026 is the most active we have seen since Lyrie began continuous monitoring. Three signals stand out:

1. Election infrastructure reconnaissance is up 340% year-over-year across the OSINT and honeypot telemetry we share with national-CERT partners. The activity is multi-cluster — at least four nation-state-aligned actors plus several criminal groups whose motives appear to be data-theft-for-influence-laundering rather than direct election interference.

2. Power-grid SCADA reconnaissance has shifted from probe-and-leave to probe-and-map, with sustained engagement against operator portals in three Western democracies. We are not seeing destructive payloads; we are seeing detailed mapping of the operational technology footprint of named utilities, consistent with pre-positioning.

3. Water-utility intrusion attempts have continued at low-but-persistent volume, with three confirmed compromises in the OSINT record and an undisclosed-but-larger number that did not become public.

Lyrie operates under threat-intel-sharing arrangements with three national-security agencies (terms restrict disclosure of which) and is a notification partner for several ISACs (FS-ISAC, IT-ISAC, E-ISAC, WaterISAC). This article documents the public-facing portions of what we have seen, names the cases where Lyrie's detection contributed to prevented incidents, and lists what defenders inside this perimeter should do this quarter.

Election Infrastructure: From Probe to Sustained Reconnaissance

The baseline for election-infrastructure attention is, in non-election years, modest — automated scanners passing through, the occasional credential-stuffing attempt against a county voter portal. In 2024 the volume tripled into the November cycle and fell back. The 2026 baseline — through the first four months of the year, twelve months ahead of the November US midterms — is already 3.4x the 2024 baseline.

More concerning than the volume is the quality. The 2024 reconnaissance was undifferentiated; the 2026 reconnaissance includes:

• Targeted credential phishing against specific named officials in specific named jurisdictions, with email content that demonstrates the attacker has read the recipient's recent public statements and committee work.
• Sustained low-and-slow enumeration of voter-registration portal endpoints in patterns designed to stay below per-IP rate limits while building a complete inventory.
• Repeated retrieval of public-but-rarely-accessed documents — pollworker training materials, ballot-printing vendor relationships, certification testing reports — consistent with pre-attack mapping of supply-chain entry points.

The pattern is consistent across the four clusters we have identified. Two of those clusters overlap with infrastructure linked, in prior MITRE ATT&CK profiles, to nation-state actors. One overlaps with a Russian-speaking criminal group whose past work has been ransomware. The fourth is, to our team and our partner agencies, a new and previously-unobserved cluster — most likely a contractor relationship between a state actor and a criminal group, but unconfirmed.

Lyrie's contribution to defense here has been:

• Reconnaissance-pattern signatures delivered to E-ISAC and to relevant state-level election-information-sharing programs.
• Targeted notifications to specific named officials when our telemetry identified them as the focus of tailored phishing prep.
• One confirmed incident (October 2025) where Lyrie's behavioral validator on a county clerk's office endpoint prevented credential exfiltration that would have provided voter-roll modification access.

The county-clerk incident is the one we are most willing to discuss specifically — with permission from the affected jurisdiction. A staffer received a tailored phishing email; the credential-harvesting page was a clone of a state-government portal indistinguishable from the legitimate one at a glance; the staffer entered credentials. Lyrie's endpoint sensor detected the credential entry against a domain whose age (8 days) and content fingerprint matched no known legitimate portal in our corpus, and intervened by triggering an automated credential rotation before the attacker's harvester had processed the entry. Forensic analysis showed the attacker did receive the original credentials, but they were already invalid by the time the attacker attempted to use them. No access was achieved.

This kind of intervention is unfashionable in security circles — "don't trust the user to make good decisions, just take action on their behalf" — but it is the kind of defense that actually scales to government election infrastructure, where the staff are competent at their jobs but are not, and should not be expected to be, full-time security analysts.

Power-Grid SCADA: Pre-Positioning Continues

We have observed sustained mapping of operational-technology systems at named utilities in three Western democracies. The activity does not include destructive payloads or known disruption-class malware. It includes:

• Detailed enumeration of vendor-specific HMI software versions and patch levels.
• Mapping of the network paths between corporate IT and the OT environment, including identifying the specific firewall rules and jump-host configurations that bridge the two.
• Identification of dial-in modem connections (still common in regional utilities) and PSTN-accessible engineering interfaces.
• Sustained, low-volume attempts against the credential boundary at the corporate-IT/OT interface — failed authentications that are not numerous enough to trigger lockout, but consistent enough over weeks to suggest credential validation against a stolen list.

This is pre-positioning behavior. It does not require an attacker who intends to act tomorrow; it requires an attacker who intends to be able to act whenever a geopolitical decision is made to act. The category of attacker that conducts this kind of work is small and well-resourced.

Lyrie's role here is more circumscribed than in the election space — most power utilities are not Lyrie customers. Where we do have telemetry — through partner-supplied data and through the threat-intel-sharing arrangements — we contribute pattern signatures and named-IOC feeds. Several confirmed-positive engagements at named utilities are subject to NDAs we honor.

The public action items for utility defenders are well-known and we will not pretend to add to them: harden the corporate-IT/OT interface, retire dial-in modems, separate engineering-access credential domains, monitor low-volume credential-validation patterns. The reason we list them is to underscore that the basics are still not done everywhere; the attackers are not relying on novel tradecraft, they are relying on the gap between known best practices and actual practice.

Water Utilities: The Forgotten Sector

Water utilities — which in the United States number ~52,000 distinct entities — are the worst-defended category of critical infrastructure by a margin that would be embarrassing if it were not so dangerous. Three confirmed compromises in the OSINT record in early 2026; the number not in the OSINT record is, per partner intelligence, substantially larger.

The pattern is consistent: small municipal water authority, single IT contractor, default credentials on a vendor portal, public-internet exposure of the portal, compromise within hours of any attacker scanning the IP space. Detection is months-late or never. Response is shutdown-and-restore-from-backups, sometimes including manual operation during the incident.

This is a policy problem, not a technical problem. Lyrie cannot fix it directly because the affected utilities cannot afford security tooling. We have, however, joined the WaterISAC's free-tier-of-detection working group, contributing detection logic that runs on hardware below the cost threshold that affordability arguments hinge on. Whether that effort produces durable coverage depends on funding decisions outside our control.

The candid statement: we expect to write a 2027 retrospective documenting a water-utility incident with significant public-health consequence somewhere in the OECD. We would very much prefer not to.

What Lyrie Has Prevented (and What We Are Watching)

Prevented (with disclosure permission):

• The county-clerk credential incident described above.
• An attempted intrusion at a state-level election-management vendor in Q4 2025, caught at the supply-chain validator (article 2 of this series, incident #6).
• Two attempted intrusions at federal-contractor environments where Lyrie's ATP runtime quarantined hosts within minutes of foothold. Details restricted.

Watching (no intervention possible yet):

• Continued pre-positioning against power-grid SCADA at three named utilities (per partner intelligence).
• A specific phishing-campaign infrastructure cluster targeting election officials in five specific states, currently active.
• Ongoing reconnaissance against ballot-printing vendor relationships in two states.

What Defenders Inside the Perimeter Should Do This Quarter

1. For election infrastructure operators: Audit every official's phishing exposure. If you cannot inventory which officials have been the subject of tailored phishing prep, you are not yet ready for the November cycle. Reach out to your state EI-ISAC liaison.

2. For utility operators: Test your corporate-IT/OT firewall ruleset against the current state of attacker mapping, not against the state of best-practice from when it was last reviewed. The mapping is now detailed enough that defense-by-obscurity has failed.

3. For federal-contractor environments: Compress your detection-to-quarantine SLA below an hour. The APT-33 campaign documented in article 6 of this series showed two-and-a-half-hour foothold-to-pipeline-compromise; your tier-1 triage SLA needs to be substantially below that.

4. For everyone in this space: Join your relevant ISAC if you have not. The threat-sharing is genuinely useful and the cost of membership is negligible against the value.

What's Next

• Continued partnership with the three national-security agencies on early-warning intelligence. Outputs publishable through ISAC channels.
• Q3 2026: Expanded telemetry-sharing partnership with E-ISAC specifically, focused on the November 2026 cycle.
• Q4 2026: Open-source detection logic for the most-affordable hardware tier, aimed at small municipal water authorities. Distributed through WaterISAC.

The candid framing: we have prevented some specific incidents and we are aware of many we have not prevented. The defenders inside this perimeter are competent and under-resourced. The attackers inside this perimeter are competent and well-resourced. We are doing what we can.

Reach the team: [email protected].

---

_Published by Lyrie.ai · lyrie.ai/research · Guy Sheetrit, CEO_