Cyber Operations & Adversary IC — 2026-03-27

CISA Operating at 40% Capacity as Iranian Cyber Operations Intensify Against US Critical Infrastructure

A Foundation for Defense of Democracies analysis published March 27 warns that Iranian cyber operations are exploiting a dangerous vulnerability window: CISA's acting director Nick Andersen testified to Congress that roughly 60% of the agency's workforce is furloughed under the DHS shutdown, pausing "the very activities that reduce systemic risk over time." This coincides with the most sustained Iranian cyber campaign since the war began, including the Handala group's Stryker wiper attack (200,000+ devices across 79 countries), escalating healthcare ransomware, and the 7,381 conflict-themed phishing URLs identified by Unit 42. The Senate's DHS funding deal covers CISA, but House rejection leaves the gap open.

Analysis
The convergence of peak Iranian cyber operations with CISA's lowest operational capacity in its history represents a structural vulnerability, not a coincidence. The DHS shutdown that furloughed 60% of CISA's workforce is the same shutdown covered in this digest's IC Oversight section, meaning the legislative impasse simultaneously degrades both physical security (TSA) and cyber defense (CISA) at the moment both face wartime-elevated threats.

2 sources

Iranian Cyber Operations Take Advantage of Weakened U.S. Defenses - Foundation for Defense of Democracies
CISA Operates Under Partial Shutdown as Iran Cyber Threats Spike - TechBuzz