— State and local governments are finally getting $1 billion to secure their computer systems. But it means nothing if they don’t start prioritizing cyber funding themselves, one expert warns.

— Cyber regulators’ worst nightmare just came true: Suspected Chinese hackers compromised nine companies almost immediately after CISA shared details publicly about the vulnerability they used, a new report shows.

— Cleaning out the queue: Now that the bipartisan infrastructure package is on Biden’s desk, the Senate is able to return its focus to the cyber-heavy defense budget authorization.

HAPPY MONDAY, and welcome back to Morning Cybersecurity! I’m your host, Sam Sabin, and I, too, am confused about what time it is right now. 6 a.m.? 10 a.m.? Midnight? Who knows!

Have tips and secrets to share with MC? Or thoughts on what we should track down next? Send what you’ve got to [email protected]. Stay up to date by following @POLITICOPro and @MorningCybersec. (Full team contact info below.) Let’s get to it:

PLANNING AHEAD — Inside the $550 billion infrastructure bill that President Joe Biden is expected to sign into law this week is a four-year, $1 billion grant fund that state and local governments have been waiting for to help tackle their growing cybersecurity to-do list. But the fund could be all for nought if states don’t start changing their own spending habits, one expert told MC.

“There’s no guarantee after the first four years of this grant program” that it will stick around, said Matt Pincus, director of government affairs at National Association of State Chief Information Officers. “If Congress says, ‘Alright, that’s it,’ what are you going to do?”

But that thought experiment is tough for most state cyber officials given that only 35 percent of states currently have a line item for cybersecurity in their budgets, Pincus said, underscoring the potential that this funding could have on helping states, cities and towns that have been bombarded with ransomware attacks and data breaches.

— Congress tried to account for this issue. In order to receive a portion of the millions of dollars in grant funding each year, states have to match a specified percentage of the federal dollars. The percentage starts at 10 percent and grows to 40 percent over the next four years. The idea is that states will get used to accounting for cyber funding in their budgets, as a result.

“I frequently hear from state CIOs and state CISOs that their legislature doesn’t understand that cyber can’t be resolved with a one-time injection of money,” Pincus said. The forthcoming grant program “is sort of like the ‘teach a man to fish’ adage, and that’s really important.”

Not only will most state governments have to learn to budget for cyber consistently, but they’ll also have to get creative. While $1 billion sounds like a lofty sum, it will only go so far to help each municipality that needs it. “If you crunch the numbers and just do bar napkin math, you’re really looking at a few million dollars per state per year,” Pincus said.

— One way around it: Partnerships between neighboring municipalities for vendor contracts and other collaborative projects like that could go a long way in cities that just need funds for more IT and cybersecurity employees to help update their systems.

— Devil in the details: But the real answer to what can and can’t be done to help stretch the funds sits with CISA, which is helping the FEMA craft rules for the grant program.

“There’s a lot of things that really need to happen, and it’s not going to happen overnight,” Pincus said. “But from the state and local perspective, you need to be ready with a plan for how you would implement this and what you would spend it on.”

Want to receive this newsletter every weekday? Subscribe to POLITICO Pro. You’ll also receive daily policy news and other intelligence you need to act on the day’s biggest stories.

HACKER SEE, HACKER DO — A report from Palo Alto Networks released Sunday evening highlights a long-held fear about publicly releasing details about critical vulnerabilities: hackers using those warnings as inspiration for future attacks.

That’s seemingly what happened after CISA, the FBI and the U.S. Coast Guard Cyber Command warned on Sept. 16 about a critical vulnerability in password management firm ManageEngine ADSelfService Plus’s tools. According to researchers in Palo Alto Networks’ Unit 42 division, the next day a group of suspected Chinese-speaking hackers scanned “leased infrastructure in the United States” belonging to hundreds of organizations.

— They saw success. Between Sept. 22 and early October, the Chinese group compromised nine companies around the world in the technology, defense, healthcare, energy and education industries. The group also targeted at least 370 servers in the United States.

While Palo Alto Networks couldn’t definitively attribute which group was behind the attack, researchers said the hackers used tactics to gain entry into a network that emulates those that advanced threat group Emissary Panda uses in their attacks.

The report underscores a growing problem for federal cybersecurity regulators: How do you get more organizations to quickly patch their systems after such notices? This is far from the first time hackers, whether criminal or state-linked, have taken advantage of publicly released security vulnerabilities, with reports about Exchange Server exploits continuing to surface.

But there’s not really a great solution. CISA, in particular, already works with researchers and major vendors to identify and fix vulnerabilities before informing the public. That strategy is a solid compromise between vendors who are worried about immediate detrimental hacks once a vulnerability goes public and the agency’s desire to share the threat information with as many organizations as possible.

— In the meantime, Palo Alto Networks said in a statement that it hopes the new report is “a call to action” for organizations to scan and patch their systems for the ADSelfService Plus vulnerabilities.

TURNING BACK TO NDAA — With the bipartisan infrastructure package out of the way, cyber-minded lawmakers are starting to turn their attention back to the National Defense Authorization Act (to the delight of several Republican senators).

Traction is already picking up. Late last week, a group of bipartisan lawmakers released what were arguably the most anticipated cyber-focused NDAA amendments: one tackling mandatory cybersecurity incident reporting and another updating the Federal Information Security Management Act, which defines federal agencies’ cybersecurity practices.

The Senate’s incident reporting amendment is the long-awaited compromise between the Homeland Security and Intelligence committees, as Eric reported for Pros. That’s good news for the future NDAA conference committee: A group of lawmakers, led by Rep. Yvette Clarke (D-N.Y.), also successfully got a mandatory incident reporting amendment onto the House’s NDAA.

— What else is already in the Senate’s NDAA: Senators are proposing a $268.4 million budget increase for the Pentagon’s cybersecurity efforts, as well as a private-public partnership at Cyber Command to help tackle foreign cyber threats.

The lingering questions: We’re still awaiting possible new amendments to the NDAA, similar to the more than 800 amendments proposed in the House shortly before the chamber passed its version of the NDAA. Also, lawmakers still have another major package they’re trying to pass before the NDAA: the $1.75 trillion social spending package.

REGULATING SPYWARE — Following the Biden administration’s addition of several cyber surveillance firms to a trade blacklist, a group of Democratic lawmakers called on the State Department on Friday to also sanction NSO Group and similar services under the Global Magnitsky Act, which would cut the companies off from the U.S. financial system and its investors. The letter — penned by Reps. Tom Malinowski (N.J.), Katie Porter (Calif.), Joaquin Castro (Texas) and Anna Eshoo (Calif.) — follows a similar call from Sen. Ron Wyden (D-Ore.) last week.

CRACKING DOWN — The streak of ransomware operator arrests continued Friday when Interpol said it had arrested six people suspected of being in the Clop ransomware gang and issued two requests to member countries to track and arrest other suspects. The arrests follow the arrest of six members of a “notorious ransomware family” in Ukraine in September, which Interpol was also involved in.

— The arrests are the latest example of how private-public partnerships are helping law enforcement crackdown on international ransomware gangs. Interpol said it worked with Trend Micro, CDI, Kaspersky Lab, Palo Alto Networks, Fortinet and Group-IB on the operation.

BREACHING DEFENSE — Electronic Warfare Associates, a U.S. defense contractor, disclosed in a recent filing with Montana’s attorney general that hackers penetrated its systems and downloaded files containing the names, Social Security numbers and driver’s license numbers of employees. Bleeping Computer first reported the filing Friday. EWA, which works with various branches of the military as well as the Homeland Security Department, said hackers gained access to a company email account on Aug. 2, and the company first spotted the malicious activity when hackers attempted wire fraud.

A Daylight Saving Time joke for the Dads in the room from Reuters cybersecurity reporter Joseph Menn: “The more clocks you have to reset by hand, the smaller your attack surface.”

— Agencies are expected to miss today’s deadline for rolling out encryption and multifactor authentication as laid out in the May cybersecurity executive order (CyberScoop)

— An amendment to the Build Back Better package would give the Technology Modernization Fund an additional $250 million. (FedScoop)

— SolarWinds’ investors alleged in a recent lawsuit that the company knew about and failed to monitor its cybersecurity failings ahead of the SolarWinds hack. (Reuters)

— FBI issued a private industry notification warning that ransomware gangs have targeted several tribal-owned casinos in recent months. (Bleeping Computer)

— Researchers at BlackBerry discovered a new broker system that’s helping ransomware gangs, phishing criminals and even hacking groups targeting nation states.

Chat soon.

Stay in touch with the whole team: Eric Geller ([email protected]); Bob King ([email protected]); Sam Sabin ([email protected]); and Heidi Vogt ([email protected]).