Wyoming Vendors Targeted in Phishing Attack:

A Wyoming small business owner posted a public warning about an apparent cyberattack targeting local Wyoming vendors. According to the post, at least one Cheyenne business was reportedly compromised after receiving suspicious emails that appeared to come from legitimate contacts or government email addresses. The emails reportedly contain unsolicited links or file-sharing requests with little or no explanation, no greeting, no signature, and no official contact information. The business owner noted that one suspicious message appeared to come from a Wyoming government email account associated with "Devon Finson" and later saw similar messages being sent from another local vendor, suggesting the attack may spread through infected accounts and contact lists. The warning urges people not to click unexpected links or shared files, even if they appear to come from someone they know, as doing so could allow attackers to send more malicious messages from their account. CyberWyoming Note: Unfortunately, cyberattacks like this happen more often than many realize, especially to small businesses. Small businesses make up 99.9% of all businesses in the United States and are frequent targets because they hold valuable information but may have fewer cybersecurity resources than larger organizations. In addition to avoiding unexpected links, be sure to verify unusual emails through a separate communication channel and enable multi-factor authentication (MFA) on all accounts. If you clicked a suspicious link, change your password, check your email settings for unknown forwarding rules or filters, remove anything suspicious, and alert your contacts that your account may have been compromised.

Pentagon Suspends CMMC Phase 2 Requirements:

The Pentagon has paused the next phase of its Cybersecurity Maturity Model Certification (CMMC) program, which was set to require many defense contractors to pass third-party cybersecurity checks starting in 2026. While current self-assessment requirements remain in place, the Defense Department is conducting a 60-day review to decide how the program should change. Officials say the current rules may be too costly and complicated, especially for small businesses, and could prevent new companies from working with the military. The review will look for ways to improve cybersecurity while reducing paperwork, expenses, and barriers for contractors. The Pentagon says the goal is to focus more on practical cybersecurity protections rather than a burdensome certification process.
- Brought to you by Federal News Network & CISA Region 8
federalnewsnetwork.com/cybersecurity/2026/07/pentagon-suspends-cmmc-phase-two-requirements-launches-review-of-program/

Water Systems Targeted for Sabotage:

Nation-state hackers from Iran, Russia, and China are increasingly targeting water systems, but they often rely on basic security weaknesses rather than advanced malware. Iran-linked groups have focused on exposed control systems and psychological disruption, Russia has shown more interest in direct sabotage and infrastructure testing, and China’s Volt Typhoon campaign appears aimed at long-term access for potential future conflicts. Common entry points include weak passwords, exposed industrial control systems, insecure remote access, and poor IT/OT network separation. Experts emphasize that water utilities and other critical infrastructure organizations can reduce risk by strengthening basic cybersecurity practices while also investing in specialized operational technology (OT) monitoring and protection.
– Brought to you by DarkReading & CISA Region 8
www.darkreading.com/ics-ot-security/iran-russia-china-target-water-systems-sabotage

Reporter Impersonation Targeting C-Suite Executives:

Corporate executives are increasingly facing tailored social engineering attacks where malicious actors impersonate reporters or journalists to gain a foothold in an organization. Fueled by advancements in generative AI, deepfakes, and voice-cloning technology, these attacks move away from traditional technical exploits to manipulate human emotions and trust. Hackers target highlevel executives to breach their personal or home networks, which are subsequently used to compromise the broader corporate infrastructure, engage in high-dollar corporate espionage, or carry out extensive extortion schemes.
– Brought to you by GBHackers
gbhackers.com/reporter-impersonation-to-target-c-suite/

Interested in cybersecurity business training?

The Made Safe™ Cybersecurity Training Program is a one-on-one program designed specifically for micro-businesses to reduce cyber risk and relieve anxiety around cybersecurity. Thanks to CyberWyoming’s members and sponsors, scholarships are available for Wyoming companies. Learn more at cyberwyoming.org/cyber-training/ or email info@cyberwyoming.org.

MS-ISAC and CISA Patch Now Alert:

The Multi-State Information Sharing and Analysis Center (MS-ISAC) or the Cybersecurity & Infrastructure Security Agency (CISA) has published a patch now (update your software) alert for WordPress Core. If you use this product, make sure the software (or firmware) is updated.

Data Breaches in the News:

Ernst & Young, Abbot Laboratories, Fairlife Dairy, Hugging Face, and Qantas. Note: If you have an account with these companies, be sure to change your password and consider placing a credit freeze on your accounts through the three credit reporting agencies: TransUnion, Experian, and Equifax.

Please report scams you may experience to phishing@cyberwyoming.org to alert your friends and neighbors.

‍Other ways to report a scam:

• Better Business Bureau Scam Tracker: bbb.org/scamtracker/us/reportscam
• Wyoming Attorney General’s Office, Consumer Protection
  • Email ag.consumer@wyo.gov
  • Complaint form attorneygeneral.wyo.gov/law-office-division/consumer-protection-and-antitrust-unit/consumer-complaints

• File a complaint with the Federal Trade Commission at reportfraud.ftc.gov
• Get steps to help at www.IdentityTheft.gov
• Report your scam to the FBI at www.ic3.gov/complaint
• Reported unwanted calls to the Federal Trade Commission’s Do Not Call Registration. Online at donotcall.gov/report.html or call 1-888-382-1222, option 3
• Office of the Inspector General: oig.ssa.gov
• If you believe someone is using your Social Security number, contact the Social Security Administration’s (SSA) fraud hotline at 1-800-269-0271.
• AARP Fraud Watch Network (any age welcome) Helpline 877-908-3360
• IRS: report email scams impersonating the IRS to phishing@irs.gov
• Call the Wyoming Senior Medicare Patrol (SMP) for assistance with potential Medicare fraud, abuse, or errors at 1 800 856-4398
• Victim Support: The AARP Fraud Watch Network and Volunteers of America (VOA) created a new, free program to provide emotional support for people impacted by a scam or fraud, called ReST. Visit www.aarp.org/fraudsupport to learn more about the free program and register