Tag: cyber

These updates are shared to help raise the situational awareness of Faith-Based organizations to best defend against and mitigate the impacts from all-hazards threats including physical security, cybersecurity, and natural disasters. 

ASIS SERIES 

School safety and security efforts are as multifaceted and complex as the students, staff, and families that make up a school and its community. ASIS offers a series on safety and the blocks of a supportive school communities.  

• Q&A: Building Safety into the Schoolhouse Walls 
• Q&A: School Safety Directors Offer Perspective and Scope 
• Q&A: Why School Nurses Should Get a Seat at the School Safety Table 
• Fast Facts: 4 Building Blocks of Supportive School Communities 

Audit of Antisemitic Incidents 2023 

The Anti-Defamation League’s (ADL) 2023 Audit of Antisemitic Incidents reveals a significant surge in antisemitic acts across the United States, marking the highest annual total since the ADL began tracking in 1979. In 2023, the ADL recorded 8,873 incidents of assault, vandalism, and harassment against Jews, representing a 140% increase from the 3,698 incidents documented in 2022. 

Key findings from the report include: 

• Assaults: A 45% rise, totaling 161 incidents 
• Vandalism: A 69% increase, with 2,177 incidents reported 
• Harassment: A 184% surge, accounting for 6,535 incidents 

A substantial portion of this escalation occurred after the October 7 terrorist attacks in Israel. Between October 7 and the end of 2023, the ADL documented 5,204 incidents—more than the total for all of 2022. Notably, 52% of these post-October 7 incidents (2,718) referenced Israel, Zionism, or Palestine. 

The report also highlights significant increases in antisemitic incidents across various locations: Post and Courier 

• K-12 Schools: A 135% rise to 1,162 incidents 
• Jewish Institutions: A 237% increase, totaling 1,987 incidents, largely due to waves of hoax threats targeting synagogues and other institutions.  
• College and University Campuses: A 321% spike, with 922 incidents, most occurring after October 7. 

Related articles: 

• Antisemitic incidents in the US reached record high last year, up 140% from 2022, ADL says 
• Audit of Antisemitic Incidents 2023 
• ADL Antisemitism Audit shows spike in incidents in SC, nationwide 

Analyst Comments: This alarming spike reflects a broader climate of intolerance and geopolitical spillover, especially following the October 7 Hamas attacks in Israel. While the ADL report focuses on Jewish institutions, the spillover effects of this wave often affected interfaith community centers, churches hosting interfaith events, and inter-religious partnerships. Broader research indicates an uptick in targeting of synagogues, mosques, and multifaith prayer spaces, especially during tense geopolitical moments. Preparing for and protecting against rising antisemitic incidents especially in light of the ADL’s 2023 findings involves a combination of community resilience, institutional preparedness, advocacy, and individual vigilance. The FB-ISAO tracks incidents across all communities of faith, and you can read our report on Attacks Against Houses of Worship 2023 here.   

Judge sides with Trump, permits immigration enforcement in houses of worship 

A federal judge has ruled that the Trump administration can proceed with immigration enforcement operations at houses of worship. U.S. District Judge Dabney Friedrich determined that more than two dozen Christian and Jewish groups lacked legal standing to challenge the policy, as there was insufficient evidence that places of worship were being specifically targeted. The plaintiffs argued that the policy infringed upon their First Amendment rights by deterring congregants from attending services due to fears of immigration enforcement. However, Judge Friedrich found that the decline in attendance was more likely attributed to general immigration enforcement activities rather than specific targeting of religious institutions. This decision follows the Trump administration’s reversal of a 30-year-old policy that had designated certain locations, including houses of worship, as “sensitive locations” where immigration enforcement was limited. While this ruling applies to the plaintiffs in this case, a separate lawsuit in Maryland has resulted in a judge issuing a preliminary order restricting enforcement at certain houses of worship. 

Analyst Comments: While narrow in scope, this ruling opens the door for more aggressive immigration enforcement in religious spaces. It raises important questions about the balance between law enforcement, religious liberty, and humanitarian norms and signals a legal environment where faith-based protections are increasingly conditional rather than presumed. Religious institutions, particularly those serving immigrant populations, function as community anchors providing food, shelter, legal aid, and spiritual support. Even perceived threats of enforcement on sacred ground can: 

• Deter congregants from attending worship 
• Disrupt outreach programs 
• Undermine the trust between vulnerable populations and spiritual leaders 

ASIS has previously published guidance on handling ICE enforcement actions which can be viewed here. 

American missionary pastor abducted at gunpoint during church meeting in South Africa 

On April 10, 2025, Pastor Josh Sullivan, a 45-year-old missionary from Tennessee, was abducted during a church service at Fellowship Baptist Church in Motherwell Township, Eastern Cape, South Africa. Four masked men entered the church, robbed two congregants of their cellphones, and forcibly took Pastor Sullivan in his silver Toyota Fortuner, which was later found abandoned nearby. Pastor Sullivan moved to South Africa in 2018 with his wife, Maegan, and their six children to lead the Motherwell church branch. The South African Police Service’s Anti-Gang Unit is investigating the incident as both an abduction and armed robbery. No ransom demands have been reported, and authorities have not confirmed Sullivan’s identity or commented on potential motives. The U.S. embassy in South Africa is involved in efforts to locate Pastor Sullivan. Supporters and family members have taken to social media to express concern and request prayers for his safe return.   

Related articles: An American pastor was abducted at gunpoint in South Africa while preaching a sermon 

Analyst Comments: The recent abduction of Pastor Josh Sullivan highlights a growing security risk for missionary and faith-based organizations, especially in regions with high crime rates like parts of South Africa. The fact that he was abducted during a church service at gunpoint underscores the vulnerability of religious institutions, where congregants are focused on worship and less likely to anticipate violent threats. Faith leaders and religious organizations in foreign regions should be aware of potential targeting whether it may be for financial reasons, political leverage, or a means to disrupt religious communities. As always, the FB-ISAO resources has resources on securing facilities securities and people.  

These updates are shared to help raise the situational awareness of Faith-Based organizations to best defend against and mitigate the impacts from all-hazards threats including physical security, cybersecurity, and natural disasters.    

FB-ISAO Releases April Newsletter

The latest edition of the FB-ISAO Newsletter has been published. ICYMI, the newsletter features the most recent threat level statement that was released on 31 March. Both the physical threat level and the cyber threat level remain “Elevated”. There is also a section focused on the importance of monitoring your organization’s online presence, which was a focus of the Weekly Advisory from 19 March. The newsletter also features upcoming

ISIS in 2025: The Resurging Threat 

The threat posed by the Islamic State of Iraq and Syria (ISIS) continues to grow as the Global Terrorism Index (GTI) 2025 has reported that the terror conglomerate has expanded its operations now to 22 countries, causing 1,805 deaths in 2024, with Syria and the Democratic Republic of Congo accounting for 71 per cent of its attacks last year. A 2024 UN report estimated that ISIS, despite recent setbacks, still commanded up to 6,000 fighters in Afghanistan, about 3,000 fighters in Syria and Iraq, and 2,000 to 3,000 fighters in the West African states of Mali, Burkina Faso and the Niger.

Analyst Comments: US experts have previously warned that ISIS has the ability to re-emerge as a potent terrorist threat within a year or two without US presence in Syria. The ISIS threat may have been depleted in recent years, but the threat of the transnational Salafi jihadist group remains a dangerously persistent and evolving security challenge. While lone actors inspired by ISIS ideology have demonstrated an ability to carry out attacks, the group’s influence and ability to plan coordinated attacks will only grow as formal structures reemerge.

These updates are shared to help raise the situational awareness of Faith-Based organizations to best defend against and mitigate the impacts from all-hazards threats including physical security, cybersecurity, and natural disasters.    

Two arrested in Paris over suspected terror plot, explosives found

French authorities have thwarted a suspected terror plot following a series of arrests and explosive discoveries in Paris. Police in Paris arrested two men on Sunday on suspicion of criminal conspiracy linked to a terrorist plot, as well as possession of explosives, according to France’s national anti-terrorist prosecutor’s office.

French media outlets reported that the main suspect, a 19-year-old from northern France, is believed to have connections with the “Islamic State militant group” – claims his lawyer has firmly denied. Le Parisien newspaper reported that one suspect had written a pledge of allegiance to Islamic State and was allegedly planning to carry out an attack in a public space.

Analyst Comments: In a recent Global Forecast, OSAC assessed that ISIS continues to inspire attacks in 2025 and we continue to see online propaganda encouraging attacks. The EU’s most recent Annual Terrorism Report stated that “Young people were involved in planning attacks, creating propaganda and inciting violence. Radicalization often occurs online through virtual communities that reinforce extremist views and target younger audiences with visually appealing content.” That report can be found here. OSAC recommends the following resources:

• Terrorism Alerts and the Private Sector
• U.S. Violent Extremist Mobilization Indicators 2021 

CISA braces for deep staffing cuts

A new round of personnel cuts at CISA could see as many as 1/3 of the agency depart which are expected to impact “every single part of the agency.” A new “Fork in the Road” email is expected soon, with additional layoffs anticipated depending on how many people accept the administration’s offer. Cuts reportedly include 75 contract personnel who work on CISA’s threat hunting operations.

Analyst Comments: The agency has cut funding to several election security efforts, spurring concerns among state and local election officials who relied on the agency for threat intelligence about adversaries targeting their elections. CISA said last month that it was terminating contracts “where the agency has been able to find efficiencies and eliminate duplication of effort,” including in its red team operations.

As we have previously stated, shifts in administration priorities is bound to disrupt normal operations, and any impact to threat intelligence sharing between agencies like CISA and the private sector will only enhance the importance of non-government led information sharing initiatives like the Faith-Based ISAO. We are resharing a LinkedIn post from FB-ISAO Founder and Board President Andy Jabbour that addresses some recent messaging around CISA downsizing and the importance of ISACs/ISAOs.

From Colorado storage unit, Arizona man practiced placing bombs in churches

A Phoenix man who traveled across the western U.S. to sneak backpacks into Christian churches in three states was simultaneously assembling bomb-making materials in Colorado, according to a federal investigation. He was convicted Friday of a federal hate crime. Between September and November of 2023, Zimnako Salah traveled to four Christian churches in Arizona, California, and Colorado while wearing black backpacks. At two of those churches, Salah planted the backpacks, “placing congregants in fear that they contained bombs,” the U.S. Department of Justice stated in a press release. 

Analyst Comments: This case brings up several considerations for Houses of Worship. The first is that Salah’s actions of visiting multiple houses of worship with backpacks could be considered reconnaissance for future attacks, considering the rudimentary explosive device found at his storage unit. Multiple individuals reported Salah’s suspicious activity, demonstrating the important part members of congregations can have in preventing attacks. We encourage community members to familiarize themselves with the Hostile Event Attack Cycle (HEAC) to better understand the various steps many attackers go through.

The case also demonstrates access control concerns that many houses of worship have. As organizations consider steps to further enhance their security measures, we recommend they review The Physical Security Performance Goals for Faith-Based Communities, which are a set of physical security practices that houses of worship and related facilities can use to reduce security risks to their congregations.

These updates are shared to help raise the situational awareness of Faith-Based organizations to best defend against and mitigate the impacts from all-hazards threats including physical security, cybersecurity, and natural disasters.    

Religious leaders protest ICE policies in Center City Philadelphia 

On April 3, 2025, religious leaders from various faiths gathered in Center City Philadelphia to protest against ICE policies, particularly targeting immigrant sanctuaries. The rally took place outside the ICE office in Chinatown, with attendees expressing concerns over the fear caused by recent policy changes. In January, the Trump administration revoked a directive that protected sensitive spaces like churches and schools from immigration raids. Leaders called for these places to be off-limits to ICE. The demonstration included symbolic actions like building an altar to emphasize the sanctity of worship spaces. Religious leaders are advocating for lawmakers to restore protections for these locations. 

Analyst comments: The protest in Philadelphia, involving religious leaders rallying against ICE policies, deeply intersects with the principles of faith and justice. This protest’s demands to shield sensitive spaces like churches, schools, and community centers from immigration enforcement reflecting a broader faith-based commitment. Despite a judge’s ruling last month for ICE not to conduct immigration enforcement actions “in or near any place of worship” associated with the case brought by Quakers, Baptists and Sikhs, many faith-based leaders remain concerned about ICE actions. Several organizations, such as World Relief have published best practices for responding if ICE shows up at your house of worship. While these resources can provide general guidance, they should not be considered legal advice, and faith-based leaders are encouraged to consult with specialized legal counsel if they have specific concerns for their congregation.  

Nevada man accused of threatening to kill Jewish people 

A man from Henderson, Nevada, is facing federal charges after allegedly leaving threatening voicemails targeting Jewish individuals. Between October 11 and October 19, 2023, 43-year-old John Anthony Miller purportedly sent multiple messages to the office of U.S. Senator Jacky Rosen, a Democrat from Nevada. The voicemails contained explicit threats to assault, kidnap, or murder Senator Rosen, who is Jewish. In one message, Miller used profane language to express his intentions. Additionally, on October 19, he left further voicemails questioning the senator’s family ties to Israeli settlers and making additional threats. Miller was arrested on October 26 and is charged with threatening a federal official. He is scheduled to appear before U.S. Magistrate Judge Elayna J. Youchah on November 13, 2023. 

Related articles: Nevada man federally charged after allegedly threatening to kidnap, assault or murder Jewish US senator 

Analyst comments: This incident underscores a troubling intersection of hate speech, religious intolerance, and public safety. For faith-based organizations, this case highlights the ongoing need for vigilance, unity, and advocacy in combating religious hatred and promoting understanding. Individuals who are targeted with potential hate crimes are encouraged to report the incidents to their local police department, as well as submitting a report to the FBI. 

Threat actors leverage tax season to deploy tax-themed phishing campaigns 

As Tax Day approaches, Microsoft has detected phishing campaigns targeting individuals with tax-themed social engineering tactics. These campaigns typically involve malicious attachments or links, such as URL shorteners and QR codes, which lead victims to fake tax-related websites designed to steal sensitive credentials or deploy malware. The attackers exploit the busy tax season, hoping that people will be less cautious when dealing with seemingly legitimate communications. These tactics highlight the importance of vigilance during tax season to avoid falling victim to phishing scams. 

Analyst comments: The rise in tax-themed phishing campaigns presents a significant concern, especially as the tax season typically involves a surge in online transactions and interactions with financial institutions. Tax season is a peak period for sensitive financial activities, with many individuals filing returns and interacting with tax-related entities. Attackers leverage this by timing their phishing campaigns to coincide with heightened user activity, making their attempts more likely to succeed. This manipulation of the calendar underscores the importance of cybersecurity awareness during periods of high public engagement with financial matters. 

The use of QR codes and URL shorteners in these phishing campaigns indicates an evolving sophistication in attack strategies. These methods can bypass traditional security checks and make it harder for users to discern malicious content. The fact that attackers are refining their approaches means that cybersecurity professionals must continually update their methods for identifying and blocking these threats, and users must stay informed about emerging tactics. It calls for a dual approach: strengthening technical defenses while also educating users to be more aware and cautious, particularly during vulnerable periods like tax season. 

These updates are shared to help raise the situational awareness of Faith-Based organizations to best defend against and mitigate the impacts from all-hazards threats including physical security, cybersecurity, and natural disasters.    

A New Agenda for School Safety Research 

“A New Agenda for School Safety Research” by RAND explores challenges and priorities in ensuring safety within U.S. K–12 schools. It discusses the complex, evolving nature of school safety concerns, from serious incidents like school shootings to less visible threats such as cyberbullying and low-level violence. A roundtable hosted by RAND in September 2024 brought together educators, law enforcement, mental health professionals, and researchers to identify research priorities for improving school safety. The paper provides actionable recommendations for policymakers and stakeholders, emphasizing the need for a multifaceted approach to address both traditional and emerging safety issues. 

Related articles: 

• Highlights from the 2024 Eastern West Virginia Safety Summit 
• Rethinking School Safety 

Analyst Comments: It is important to forward-think using this approach to school safety, recognizes both the need for immediate measures and the importance of long-term strategies to prevent incidents and foster a safer, healthier school culture. Best practices include not just creating safety measures but regularly reviewing and updating them. As threats to school safety evolve, so too must the strategies. Schools should consistently evaluate the effectiveness of their safety protocols and be flexible enough to adapt to new challenges. 

National Weather Service: Significant and High Impact Severe Weather Event is Underway 

A powerful spring storm continues across the country with multiple high impacts in the forecast. Life-threatening, catastrophic, and potentially historic flash flood event continues across the Lower Ohio Valley and Mid-South. A couple rounds of significant severe weather expected from the Mid-South through the Ozarks and ArkaLaTex with very large hail and strong tornadoes possible. 

• Related articles: Violent storms, including tornadoes, wallop Midwest and South 
• Deadly Tornado Outbreak, Flooding Leave Path of Destruction From South to Great Lakes 
• Live: At least 4 deaths reported as deadly overnight tornadoes ripped across several states 
• Live updates: Violent storms cut through the South and Midwest, spawning tornadoes and killing 3 

Analyst Comments: Given the severity of the forecast, it is important to stress the importance of early warning systems and public safety messaging. Authorities should issue clear, concise evacuation and safety instructions, especially in areas most at risk for flash flooding and tornadoes. Preparing shelters, coordinating emergency response teams, and ensuring communities have access to reliable communication channels would be key points of focus. This storm system represents a high-risk event with the potential for widespread and catastrophic damage.The combination of flash flooding, severe storms, and tornadoes necessitates comprehensive, multi-agency collaboration to mitigate impact and facilitate recovery. 

As CISA Downsizes, Where Can Enterprises Get Support? 

The downsizing of the CISA and its potential impact on organizations seeking cybersecurity support is due to cost-cutting measures under the Trump administration, CISA has reduced its personnel, which may affect the range of services it offers, such as threat intelligence and incident response. Experts suggest that private sector companies, academic institutions, and state governments could help fill the gaps left by CISA’s downsizing. While the private sector has the expertise to assist in cybersecurity, smaller organizations may struggle to afford these services. Enterprises are advised to strengthen relationships with security vendors and professionals to mitigate risks. 

Analyst Comments: We want to share a LinkedIn post from FB-ISAO Founder and Board President Andy Jabbour related to this article. Andy notes that sometimes reports can shar incorrect information, and nots that “”ISACs are suffering because many smaller members relied on DHS grants to fund their ISAC dues.” Jake, while that applies to state and local entities and the efforts of MS-ISAC to support government entities, that is ***very not correct*** for the *vast majority* of ISACs and their members, where nearly all members *do not* leverage grants for membership. Most ISACs have scaling costs to allow smaller members to join at affordable levels. As Cybersecurity and Infrastructure Security Agency may back off some levels of support, now – more than ever – ISACs and orgs like FB-ISAO: The Faith-Based Information Sharing & Analysis Organization are critical communities and resources for their sectors.”  

Singapore foils teen’s plot to kill 100 in Christchurch-inspired mosque attacks 

A 17-year-old in Singapore was detained under the Internal Security Act (ISA) for planning a mass shooting at five mosques. The teen, inspired by the 2019 Christchurch mosque attacks, intended to kill at least 100 Muslims during Friday prayers before taking his own life. He had identified specific mosques in areas such as Jurong West, Clementi, and Admiralty Road as targets. Authorities thwarted the attack, preventing a potential tragedy. The teenager’s actions highlight the ongoing threat of terrorism, even from local extremists. 

Analyst Comments: Individuals, like the Singaporean teen, often act in isolation, planning attacks without direct support from organized terrorist groups. This makes such threats harder to detect and prevent, as these individuals are not necessarily involved in traditional extremist networks. Faith-based groups, especially those with visible places of worship, are seen as symbols of vulnerability by extremists seeking to create fear and division. The threat is further compounded by the ease with which extremists can access radicalizing materials online, which empowers them to act independently, often without a clear understanding of the wider consequences of their actions. We have often seen manifestos where attackers have pointed to previous attacks as inspiration, and will sometimes attempt to schedule attacks around anniversaries, so it is important to maintain situational awareness around some of those significant dates of previous attacks. As always FB-ISAO has resources on securing your facilities in the resource library.  

These updates are shared to help raise the situational awareness of Faith-Based organizations to best defend against and mitigate the impacts from all-hazards threats including physical security, cybersecurity, and natural disasters.    

Weekly Security Sprint EP 105. Hurricane forecast, Vehicle ramming study, and more 

The Gate 15 Security Sprint is a weekly rundown of he week’s notable all-hazards security news, risks and threats and some of the key focus areas for organizations to consider behind the headlines. Gate 15 team members discuss physical security, cybersecurity, natural hazards, health threats and other issues across our environment.    

In this week’s Security Sprint, Dave and Andy covered the following topics:

• Severe weather 
• Vehicle Ramming & Terrorism 
• North Korean Worker Threats 

Information on other Gate 15 podcasts can be found here. 

Forecasters warn of an impending outbreak of long-lasting, strong tornadoes and once-in-a-lifetime flooding | CNN  

Severe weather is expected to impact parts of the central and eastern United States on Wednesday, April 2, 2025, as a powerful spring storm system brings a high risk of long-last tornadoes and significant flooding.  

• Tornado Outbreak: A widespread tornado outbreak is expected, with over 20 million people at risk from Louisiana to Ohio. Strong tornadoes, including EF2 and potentially EF3+ storms, are likely. The tornado threat will increase in the afternoon and continue into the evening. 
• Severe Thunderstorms: Severe thunderstorms have already begun in the Plains, with storms tracking eastward into the Mississippi Valley. These storms will produce damaging winds, hail, and strong, long-lived tornadoes. 
• Generational Flooding: A stalled weather front will lead to heavy, continuous rainfall, setting the stage for a “once-in-a-lifetime” flooding event. Parts of Arkansas, Missouri, Tennessee, and Mississippi are expected to receive up to 15 inches of rain by Saturday, potentially causing life-threatening flooding. Flood watches are in effect across multiple states, with a rare “high risk” warning for extreme flooding, particularly in Arkansas, Kentucky, and Missouri. 

Forecasters are urging residents in affected areas to take immediate precautions as these dangerous weather events unfold. 

Analyst Comments: The severe tornado and flooding risks should not be underestimated, authorities are right to issue urgent warning, and residents in affected areas should be proactive in seeking shelter and evacuating if needed. The storm’s unpredictability and strength underscore the need for immediate attention to this life-threatening weather event. The U.S. in entering a period where multiple types of natural disasters and severe weather will be a concern. Emergency communications play a pivotal role in disaster response, coordination, and recovery. April is Emergency Communications Month is a reminder of the critical need to ensure that these systems are not only functional but resilient during emergencies.  

The Weaponization of PDFs : 68% of Cyberattacks begin in your inbox, with 22% of these hiding in PDFs – Check Point Blog 

According to Check Point, 68% of cyberattacks begin via email, with 22% of these hiding malicious content in PDFs. These attacks exploit vulnerabilities in PDFs, which often contain hidden scripts or malicious links. Attackers use this method to deliver ransomware, steal credentials, or install malware. Despite PDFs being a commonly used format, their potential as a weapon in cyberattacks remains underestimated. The article emphasizes the need for robust security measures, such as email filtering and regular updates to PDF readers, to mitigate the risks of such attacks. 

Analyst Comments: The fact that 22% of cyberattacks now involve PDFs underscores a growing trend where attackers are leveraging commonly trusted document formats for malicious purposes. This highlights a shift in tactics, with cybercriminals increasingly targeting less obvious vulnerabilities. PDFs, once seen as a safe format, are now being weaponized as a vector for malware delivery, which demands heightened attention from both individuals and organizations. While PDFs are a staple in daily digital communication, their increasing use in cyberattacks demands greater vigilance and stronger defenses. Organizations must adapt quickly to combat this evolving threat and safeguard their data and systems. Considering that email is widely used by all members of the organization, it is critical that all users are provided training to raise awareness to threats, and adhere to proper cyber hygiene practices. 

Hamas Likely to Escalate Attacks on Israelis Abroad, National Security Council Warns 

Israel’s National Security Council (NSC) has issued a warning regarding an expected escalation in attacks targeting Israelis and Jews abroad, particularly as tensions in Gaza continue to rise. The council highlighted that Hamas, under mounting pressure, is likely to increase efforts to carry out attacks against Israeli citizens and institutions overseas. This follows a series of foiled plots in Europe, including arrests in Denmark, Germany, and the Netherlands. The NSC also pointed to Iran as a major sponsor of terrorism targeting Israeli and Jewish interests globally. In addition, the rise in lone-wolf-style attacks and actions by global jihadist groups like ISIS is increasing the overall threat environment. Israeli citizens are advised to exercise heightened vigilance and avoid high-risk areas such as the Sinai Peninsula. 

Analyst Comments: The warning from Israel’s National Security Council highlights a significant and expanding threat to Israeli citizens and Jewish institutions abroad. The likelihood of Hamas increasing its attacks overseas indicates a shift from a primarily regional conflict to a broader, global security concern. This escalation could be influenced by Hamas’s desire to amplify its impact and exert pressure beyond Israel’s borders, especially as it faces military challenges within Gaza. The National Security Council’s warning reflects an increasingly volatile situation where Israeli citizens and Jewish targets abroad are facing a greater risk from Hamas and other extremist organizations. It calls for a more proactive and coordinated international response to ensure the safety of these communities and prevent future attacks. Members are reminded that attacks do not need to be carried out by foreign terrorist organizations (FTOs) to be effective, and we continue to see lone actors inspired by global calls to action as well. 

These updates are shared to help raise the situational awareness of Faith-Based organizations to best defend against and mitigate the impacts from all-hazards threats including physical security, cybersecurity, and natural disasters.    

Upcoming FB-ISAO Event: Standing Up Teams 

• Date: 02 April 2025 
• Time: 12pm ET 
• Register Here. 
• Non-members register Here. 

For various reasons, many houses of worship are devoid of a formal security team. Though that is a difficult reality, there are things that can be done to help enhance your organization’s security posture, even with limited resources. This session will explore ideas around a bottom-up approach to protecting the house of worship and its members, investing in skills to beef up the sole practitioner’s knowledge and skills, and considering ways to leverage community-based resources. Most importantly, this session will help members with attaining the  perspective and support needed to not burn out! For more information on Standing Up Teams visit FB-ISAO Standing up Teams. 

FB-ISAO: Threat Levels Remain Elevated 

The FB-ISAO Cyber Threat Intelligence and Operational Resilience (together, the Threat and Incident Response) working groups actively monitor and share information, reports, and perspective regarding our threat environment. In addition to our continued observance of abroad array of general threats and hostility to people and places of faith, we have reviewed the ongoing events and threats relating to the ongoing conflict in Israel and Gaza and the related activities internationally and domestically. Based on that assessment, we have determined to maintain both the Physical and Cyber Threat Levels at “ELEVATED.”  

We continue to have concerns over the widespread acts of hostility and open threats to faith-basedorganizations based on their religious identity and political beliefs – (including antisemitism, islamophobia, anti-Christian, anti-Hindu and anti-Sikh sentiment, etc.), which can be heightened in this period of major holidays for many religions around the world. 

Religiously targeted acts of violence such as arson, vandalism, and low-level attacks including swatting and bomb threats continue to occur. Globally, there has also been a renewed proliferation of vehicle ramming attacks, several surrounding religious events and celebrations. With the change of the U.S. Presidential Administration, we have seen new authority for ICE agents to enter houses of worship, protestors be detained (sometimes under vague allegations), and a federal government workforce put on edge, which includes a scale back of personnel who were charged with protecting the homeland. In this environment we’ve seen increased threats to prominent figures such as judges and corporate executives, support to those who have conducted attacks, and public rhetoric approving of acts of violence, which all suggest an increasing acceptance across society of violence to solve issues. 

Analyst Comments: To read more about the FB-ISAO current threat level you can find it here. 

National Weather Service: Tracking a Significant Spring Storm Impacting the Central U.S. This Week 

The National Weather Service highlights significant weather events this week like flash flooding, winter storm, fire weather, and the temperature outlook. A major spring storm will move across the central U.S. and into the Great Lakes by Thursday. The northern Plains and Upper Midwest will experience heavy snow and blowing snow, while severe thunderstorms are forecast for the southern Plains and Midwest. Additionally, a multi-day excessive rainfall and flooding event is expected from the Ozarks to the Ohio Valley, lasting from Wednesday through Saturday.   

Analyst Comments: As this significant spring storm tracks across the central U.S. it is crucial to consider not only the immediate impact on individuals but also the safety of important communities spaces. The storm’s severe weather component includes the risk of strong wings, hail, and even tornadoes. It is important to review emergency plans, have designated safe rooms, and secure structures that outdoors. As always the FB-ISAO resource library has resources on protecting from natural hazards. 

Evolution of Sophisticated Phishing Tactics: The QR Code Phenomenon 

The rising threat of QR code phishing, or quishing, which has become a more sophisticated method of phishing attacks has become a challenge. Attackers embed malicious URLs within QR codes that look like legitimate documents from services like DocuSign or Adobe Acrobat Sign. When scanned, these codes lead victims to phishing websites, where they unwittingly expose personal information.  

Key points: 

• QR code phishing: This tactic bypasses traditional security tools by directing victims to phishing sites through QR codes scanned on personal devices, which typically have weaker security. 
• URL redirection: Attackers use URL redirection techniques, often exploiting legitimate websites, to mask malicious links and make them appear trustworthy. 
• The attacks target a variety of sectors, including finance, education, healthcare, and automotive. 

Analyst Comments: The rise of QR phishing marks a significant shift in phishing tactics, as attackers increasingly exploit the convenience and widespread adoption of QR codes to bypass traditional security measures. The growth of QR code phishing underscores the increasingly creativity of cybercriminal, highlighting the need for evolving security measures. Users and organizations must remain vigilant, and security systems need to adapt to detect and mitigate QR code-based attacks. We encourage FB-ISAO members to help raise awareness of trending threats to help ensure the community stays resilient. 

Where Wrongful Detention is on the Rise 

There is increasing case of wrongful detention of U.S. citizens abroad in 2024, 54 Americans were wrongfully detained in 17 countries, with a notable rise in such incidents since 2015. Most detentions are legal, but a small percentage involve hostage-taking or illegitimate reasons. 

The Levinson Act provides a framework for identifying and responding to wrongful detentions, which are defined by several criteria, including if the detainee is held for political reasons or in violation of their rights. Exit bans, where individuals cannot leave a country but are not formally detained, are also counted as wrongful detentions by some organizations. The report calls attention to growing issue of wrongful detentions and the complexities surronding their identification and resolution.  

Analyst Comments: While detentions are a growing concern, they are also a reflection of broader geopolitical dynamics and evolving legal challenges. Addressing this issue requires a multi-faceted approach, including better international legal frameworks, stronger diplomatic ties, and more comprehensive support systems for those detained abroad. To learn more about this threat, please see the FB-ISAO Weekly Report from 19 December, 2024.