Hello. The Securities and Exchange Commission dropped its case against SolarWinds and CISO Tim Brown but that doesn’t mean the government is backing off on cybersecurity enforcement. 

The complexity of cyber disclosure rules is increasing, while states are also taking up the baton with their own cyber-reporting regimens. Elsewhere at the federal level, regulators and prosecutors are intensifying oversight of cyber practices down the supply chain.

All of which means heavy scrutiny of what companies and their CISOs say and do before, during and after a hack. Read our full story. 

More news below.

China's Brickstorm campaign: Suspected Chinese hackers are using malware that allows them to lay low in a network and disguise their communications and movements, U.S. and Canadian cyber officials said Thursday. The so-called Brickstorm malware has been seen in eight incidents targeting government agencies and tech providers, said Nick Andersen, executive assistant director for cybersecurity at CISA. 

• Goals of the campaigns appear to be long-term access, disruption and sabotage of critical infrastructure, Andersen said. "All organizations should take this seriously," he said. 
• Read CISA's analysis, including indicators of compromise.

• The Cybersecurity and Infrastructure Security Agency has been without a permanent leader since Jen Easterly left in January as President Trump took office. (CyberScoop)

The WSJ Pro Cybersecurity team is Deputy Bureau Chief Kim S. Nash and reporters Angus Loten and James Rundle. Follow us on X @WSJCyber. Reach the team by replying to any newsletter you receive or by emailing Kim at kim.nash@wsj.com.