NSA Cybersecurity Advisories & Guidance


NSA leverages its elite technical capability to develop advisories and mitigations on evolving cybersecurity threats.

Browse or search our repository of advisories, info sheets, tech reports, and operational risk notices listed below. Some resources have access requirements.

For a subset of cybersecurity products focused on telework and general network security for end users, view our Telework and Mobile Security Guidance page.

To read our complete series on protecting DoW microelectronics from adversary influence, view our DoW Microelectronics Guidance page.

ImageTitlePublication Date
CSA: Exploitation of SD-WAN AppliancesCSA: Exploitation of SD-WAN Appliances2/25/2026
CSA: Defending Against an Active Threat to Siemens S7 Series PLCsCSA: Defending Against an Active Threat to Siemens S7 Series PLCs8/19/2026
CSA: Countering China State Actors Compromise of NetworksCSA: Countering China State Actors Compromise of Networks8/27/2025
CSA: Control System Defense: Know the OpponentCSA: Control System Defense: Know the Opponent9/22/2022
CSA: Conti Ransomware (March 2022 Update)CSA: Conti Ransomware (March 2022 Update)3/9/2022
CSA: Chinese State Sponsored Cyber TTPsCSA: Chinese State Sponsored Cyber TTPs7/19/2021
CSA: Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive DataCSA: Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data10/8/2026
CSA: China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI CompaniesCSA: China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies9/8/2026
CSA: BlackMatter RansomwareCSA: BlackMatter Ransomware10/18/2021
CSA: BADBAZAAR and MOONSHINE: Technical analysis and mitigationsCSA: BADBAZAAR and MOONSHINE: Technical analysis and mitigations4/9/2025
CSA: BADBAZAAR and MOONSHINE: Spyware targeting Uyghur, Taiwanese and Tibetan groups and civil society actorsCSA: BADBAZAAR and MOONSHINE: Spyware targeting Uyghur, Taiwanese and Tibetan groups and civil society actors4/9/2025
CSA: APT5: Citrix ADC Threat Hunting GuidanceCSA: APT5: Citrix ADC Threat Hunting Guidance12/13/2022
CSA: APT28 Exploits Known Vulnerability to Carry Out Reconnaissance and Deploy Malware on Cisco RoutersCSA: APT28 Exploits Known Vulnerability to Carry Out Reconnaissance and Deploy Malware on Cisco Routers4/18/2023
CSA: APT Cyber Tools Targeting ICS/SCADA DevicesCSA: APT Cyber Tools Targeting ICS/SCADA Devices4/13/2022
CSA: 2023 Top Routinely Exploited VulnerabilitiesCSA: 2023 Top Routinely Exploited Vulnerabilities11/12/2024
Page 17 of 19

Additional Documents

Some guidance is protected and requires use of a DoW Common Access Card (CAC) to access. Visit https://cyber.mil/nsa/cybersecurity-advisories-and-technical-guidance/ to access the following and other protected documents:

  • Avoid Dangers of Wildcard TLS Certificates and the ALPACA Technique (FOUO version)
  • Protecting VSAT Communications
  • Quantum Security of Symmetric Cryptography and Hash Functions: A Review
  • Securing AWS S3
  • Security Considerations for Office 365 Government Customers