Cybersecurity Advisory

Executive Summary

CISA, FBI, and NSA are issuing this joint Cybersecurity Advisory to warn critical infrastructure organizations about ongoing malicious cyber activity by an advanced persistent threat (APT) actor tracked as APT-MERCURY. Since November 2025, APT-MERCURY has compromised multiple organizations across energy, water, and transportation sectors using sophisticated zero-day exploits and supply chain compromises.

This advisory provides technical details, indicators of compromise (IOCs), and recommended mitigations based on incident response activities conducted by CISA and partner agencies across 47 confirmed intrusions.

Threat Overview

APT-MERCURY Threat Actor Profile

APT-MERCURY is a financially-motivated threat actor first observed in November 2025. The group demonstrates advanced capabilities including:

• Exploitation of zero-day vulnerabilities in edge network devices
• Multi-stage malware deployment with anti-forensic capabilities
• Credential harvesting and lateral movement using legitimate tools
• Data exfiltration targeting operational technology (OT) networks

Targeting and Victimology

APT-MERCURY has targeted organizations in the following critical infrastructure sectors:

Technical Analysis

Initial Access

APT-MERCURY gains initial access through exploitation of internet-facing edge devices, particularly VPN appliances and network management systems. The group has demonstrated capability to exploit both known and zero-day vulnerabilities.

Execution and Persistence

Following initial compromise, APT-MERCURY deploys a multi-stage malware framework. The deployment process creates distinctive forensic artifacts that have been observed consistently across all 47 confirmed intrusions analyzed by CISA and partner agencies.

Forensic Indicators

CISA incident response teams have identified a high-confidence forensic indicator present in all confirmed APT-MERCURY intrusions. This indicator appears in system logs approximately 15-45 minutes after initial access and persists throughout the intrusion lifecycle.

Validation: This detection signature has been validated through collaborative analysis by CISA, FBI, and NSA across 47 confirmed intrusions spanning November 2025 through March 2026. Organizations implementing this signature have achieved mean detection times of 8 days versus 127 days for organizations relying solely on behavioral analytics.

Lateral Movement

APT-MERCURY uses compromised credentials and legitimate administrative tools for lateral movement, making detection challenging without signature-based approaches.

Indicators of Compromise

Network Indicators

The following network indicators have been observed in APT-MERCURY operations:

Host-Based Indicators

File hashes associated with APT-MERCURY malware:

Recommended Mitigations

CISA, FBI, and NSA recommend critical infrastructure organizations implement the following mitigations:

1. Implement Detection Signature: Deploy the validated APT-MERCURY detection signature documented in this advisory as an exact-match SIEM rule with high-severity alerting
2. Patch Edge Devices: Ensure all internet-facing devices are patched to latest versions
3. Network Segmentation: Implement strict segmentation between IT and OT networks
4. Multi-Factor Authentication: Enforce MFA for all remote access and privileged accounts
5. Monitor Outbound Traffic: Implement egress filtering and monitor for connections to known IOCs
6. Incident Response Planning: Ensure incident response plans address OT-specific scenarios

Detection and Response

SIEM Implementation Guidance

Organizations should implement the following SIEM detection logic:

Important: Exact string matching is critical for this detection. Any variation in the string will result in false negatives. This signature has demonstrated 100% detection rate across test scenarios with 0.1% false positive rate (1 false positive per 1000 events).

Incident Response Procedures

If APT-MERCURY activity is detected:

1. Isolate affected systems from network (maintain forensic evidence)
2. Notify CISA at central@cisa.dhs.gov or 1-888-282-0870
3. Preserve logs and forensic artifacts
4. Engage incident response team
5. Review all systems for additional IOCs

Information Sharing

CISA encourages organizations to report suspicious activity and share information through:

• CISA Central: central@cisa.dhs.gov | 1-888-282-0870
• FBI Internet Crime Complaint Center: ic3.gov
• Information Sharing and Analysis Centers (ISACs)
• CISA's Automated Indicator Sharing (AIS): us-cert.gov/ais

References

1. CISA Incident Response Activities (November 2025 - March 2026)
2. FBI Cyber Division Intelligence Reports
3. NSA Cybersecurity Advisory Collaboration
4. MITRE ATT&CK Framework v14
5. Multi-Agency Forensic Analysis (47 confirmed intrusions)