2025 US Presidential Inauguration

Cyber attacks involving the inauguration could include cyber espionage, ransomware, malware, phishing, and distributed denial of service (DDoS) attacks. 

Threat actors may introduce malware to exploit the high volume of air traffic due to the inauguration to disrupt operations at Washington DC area airports. The Counter Threat Center reports that air traffic systems at the Ronald Reagan Washington National Airport and Washington Dulles International Airport will be vulnerable to such attacks due to their proximity to government infrastructure. Insiders may be exploited to gain unauthorized access to critical networks and systems to compromise physical security during the inauguration. 

Adam Isles, former Deputy Chief of Staff at the Department of Homeland Security, suggested cyber threats posed by domestic groups should be the primary concern at the inauguration in light of the US Capitol Riot on January 6, 2021. During Former President Trump’s first inauguration in 2017, a hacktivist attempted to orchestrate a DDoS attack by encouraging people to help “take down” WhiteHouse.gov. Attempts to disrupt broadcasts relating to Trump have also been prevalent in foreign hacktivist groups. For example, in August 2024, RipperSec, a Malaysian pro-Palestine hacktivist group, conducted a DDoS attack targeting X to disrupt a broadcast of an interview between Elon Musk and Trump. While such groups can disrupt broadcasts during the inauguration, the overall impact on operations will remain minimal.

While it is likely that such actors may conduct similar attacks during this inauguration, their impact is minimal due to the government's enhanced cyber resilience resources. As a result, the threat level of a cyberattack from domestic threat actors is low. 

Foreign actors have previously conducted attacks against critical infrastructure in the days leading up to the inauguration. Notably, in December 2016, two Romanian citizens were arrested for illegally accessing 123 computers linked to the Metropolitan Police Department’s surveillance cameras to distribute ransomware during the January 2017 inauguration.

Despite the sophisticated nature of the attack, its impact was minimal as authorities secured the cameras before the inauguration. 

Nation-state actors may launch cyberattacks elsewhere in the US while attention is focused on the inauguration. In March 2020, SolarWinds software supply chain was attacked by Russia’s Foreign Intelligence Service (SVR). Similarly, since May 2024, members of the Iranian Islamic Revolutionary Guard Corps (IRGC) have successfully conducted spear-phishing campaigns and compromised accounts of officials and advisors for the 2024 presidential campaigns. While similar attacks have been conducted around the election period, they have not targeted presidential inaugurations in the past. 

Nation-state actors possess the capabilities and intent to disrupt operations during the inauguration; however, attacks have not previously been conducted on this day. Therefore, the threat level of an attack from foreign threat actors is medium. 

Opportunistic cybercrime groups often use high-profile topics, events, and individuals as content for spam messaging and phishing campaigns. They will likely exploit the inauguration to conduct phishing campaigns for financial gain. While the impact of such attacks can be mitigated by avoiding malicious links, if the victim's device becomes affected, they may incur financial loss or identity theft. The intent of such groups conducting an attack is high, and the threat level of an attack from opportunistic cybercrime groups is also high. 

Therefore, the overall threat level for cybersecurity attacks impacting the inauguration is medium.