On January 22, 2019, CISA issued its first-ever Emergency Directive (Mitigate DNS Infrastructure Tampering; 19-01)[8] warning that "an active attacker is targeting government organizations" using DNS spoofing techniques to perform man-in-the-middle attacks.[9] Research group FireEye stated that "initial research suggests the actor or actors responsible have a nexus to Iran."[10]