Abyss Locker Ransomware Maps Directly to State Government Infrastructure: What CISOs Must Do This Week

Public Sector

Published on

May 28, 2026

Table of Contents

Threat Assessment Level: ELEVATED (trending toward HIGH) The threat level remains ELEVATED, consistent with the prior assessment period. Escalation toward HIGH is driven by newly published attack chain analysis confirming that the Abyss Locker ransomware group is actively exploiting technology stacks identical to those deployed across state government agencies — SonicWall VPN appliances, Veeam Backup & Replication, and VMware ESXi hypervisors. Simultaneously, Russian and Iranian nation-state actors have refreshed their government-targeting toolkits this week. <h2> Introduction </h2> State government IT leaders face a convergence of threats this week that demands immediate attention. A detailed technical teardown of the Abyss Locker ransomware operation reveals an attack chain that reads like a blueprint against standard state agency infrastructure. At the same time, COZY BEAR (APT29/Midnight Blizzard) — Russia's SVR-affiliated cyber espionage group — has refreshed indicators targeting government entities, and a newly surfaced Iranian actor, WARLORD KITTEN , is deploying implants against government and telecom targets. State and local government remains the #1 ransomware target sector in the United States. The intelligence in this brief is not theoretical — it describes active campaigns exploiting the exact systems your agencies operate today. <h2> What Changed This Week </h2> <table> <thead> <tr> <th> Development </th> <th> Why It Matters to State Government </th> </tr> </thead> <tbody> <tr> <td> Abyss Locker full kill chain published (Sygnia, 28 May) </td> <td> Confirms active exploitation of SonicWall CVE-2021-20038, Veeam credential theft, and ESXi encryption — all standard state gov components </td> </tr> <tr> <td> COZY BEAR IOCs refreshed (28 May) </td> <td> Russia's premier government-targeting espionage group has re-validated active infrastructure; government remains primary target </td> </tr> <tr> <td> WARLORD KITTEN enters collection (28 May) </td> <td> New Iranian threat actor deploying OtakuKit malware against government and telecom — first appearance in state-relevant feeds </td> </tr> <tr> <td> CISA adds 3 new KEVs (27 May) </td> <td> New actively exploited vulnerabilities with mandatory federal patch deadlines; state agencies on shared infrastructure face same exposure </td> </tr> <tr> <td> OAuth device code phishing documented (28 May) </td> <td> Technique bypasses MFA entirely against Microsoft 365/Azure AD — the identity platform most state agencies depend on </td> </tr> <tr> <td> 6 ABB ICS advisories issued (27 May) </td> <td> Vulnerabilities in industrial control systems (AC500 V2, Terra AC, Zenon) relevant to state-operated water, facilities, and transportation </td> </tr> <tr> <td> FBI seizes "First VPN Service" infrastructure (26 May) </td> <td> Temporary disruption to ~25 ransomware groups; adversary migration to new infrastructure expected within 7–14 days </td> </tr> <tr> <td> Nimbus Manticore (IRGC-affiliated) AI-assisted malware campaigns documented (26 May) </td> <td> Iranian government-targeting operations confirmed active using AI-assisted tooling </td> </tr> </tbody> </table> <h2> Threat Timeline </h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Relevance </th> </tr> </thead> <tbody> <tr> <td> 7 May 2026 </td> <td> Ghost CMS SQL injection campaign (CVE-2026-26980) begins compromising 700+ sites with ClickFix lures </td> <td> State agency websites running CMS platforms at risk of watering-hole compromise </td> </tr> <tr> <td> 26 May 2026 </td> <td> FBI seizes "First VPN Service" infrastructure used by ~25 ransomware groups </td> <td> Temporary disruption; adversary migration to new infrastructure expected within 7–14 days </td> </tr> <tr> <td> 26 May 2026 </td> <td> Nimbus Manticore (IRGC-affiliated) documented conducting AI-assisted malware campaigns targeting government </td> <td> Iranian government-targeting operations confirmed active </td> </tr> <tr> <td> 27 May 2026 </td> <td> CISA adds 3 new actively exploited vulnerabilities to KEV catalog </td> <td> Patch deadlines apply to federal and state .gov systems </td> </tr> <tr> <td> 28 May 2026 </td> <td> Sygnia publishes Abyss Locker VPN-to-ransomware technical deep dive </td> <td> Attack chain maps precisely to state government technology stack </td> </tr> <tr> <td> 28 May 2026 </td> <td> COZY BEAR (APT29) IOCs refreshed with high-confidence government targeting </td> <td> Active Russian espionage threat to state government </td> </tr> <tr> <td> 28 May 2026 </td> <td> WARLORD KITTEN (Iranian) surfaces with OtakuKit implant targeting government/telecom </td> <td> New actor in state government threat aperture </td> </tr> </tbody> </table> <h2> Key Threat Analysis </h2> <h3> 1. Abyss Locker: A Ransomware Playbook Written Against Your Infrastructure </h3> The Abyss Locker group's documented attack chain is alarming in its specificity to state government environments: Kill Chain: <ol> <li> Initial Access: Exploit unpatched SonicWall VPN (CVE-2021-20038) </li> <li> Credential Theft: Harvest Veeam Backup & Replication service account credentials using custom PowerShell scripts </li> <li> Persistence: Deploy SSH reverse tunnels masquerading as Windows services (WMI Helper Agent, UpdateSVC) </li> <li> Defense Evasion: Bring-Your-Own-Vulnerable-Driver (BYOVD) to kill EDR — using signed Zemana and Process Explorer drivers </li> <li> Lateral Movement: PsExec and Impacket across the domain </li> <li> Exfiltration: Rclone to cloud storage (AWS S3, BackBlaze) </li> <li> Impact: Encrypt ESXi hypervisors hosting all agency virtual machines </li> </ol> Why this matters: Most state agencies run SonicWall VPN for remote access, Veeam for backup, and ESXi for virtualization. This is not a hypothetical — it is a documented, active campaign exploiting the exact stack you operate. Key ATT&CK Techniques: T1190, T1003.002, T1562.001, T1572, T1570, T1567, T1486 <h3> 2. COZY BEAR (APT29) — Persistent Government Espionage </h3> Russia's SVR-affiliated group refreshed active indicators on 28 May targeting government, defense, NGOs, and universities. The ATI-Agent malware family uses web protocol C2, obfuscated payloads, and stolen credentials for persistence. State government agencies — particularly those handling policy, elections, or federal coordination — remain squarely in COZY BEAR's targeting aperture. Key ATT&CK Techniques: T1071.001, T1027, T1078, T1566.001 <h3> 3. WARLORD KITTEN — New Iranian Actor Targeting Government </h3> A previously uncollected Iranian-nexus actor has surfaced deploying OtakuKit malware against government and telecom targets. Iranian actors have historically targeted state government for strategic intelligence — voter registration data, policy documents, and inter-agency communications. OtakuKit operates as an installation-phase implant suggesting long-dwell espionage operations rather than smash-and-grab. Key ATT&CK Techniques: T1059, T1105, T1547, T1036 <h3> 4. OAuth Device Code Phishing — MFA Is Not Enough </h3> Attackers are exploiting legitimate Microsoft OAuth authorization flows to steal access tokens that bypass MFA entirely. No fake infrastructure is required — attackers reuse legitimate Microsoft client IDs, and stolen tokens refresh indefinitely. This technique targets the Microsoft 365 and Azure AD environments that virtually all state agencies depend on for email, collaboration, and identity. Key ATT&CK Techniques: T1528, T1550.001, T1539, T1078.004 <h3> 5. ICS/SCADA Exposure — ABB Advisories </h3> Six new CISA ICS advisories cover ABB products (AC500 V2, Terra AC wallbox, Zenon, Camera Connect, B&R Runtime, LVS MConfig). State agencies operating water treatment, building automation, transportation management, or EV charging infrastructure using ABB components must assess exposure immediately. <h2> Predictive Analysis </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Timeframe </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> Abyss Locker (or copycat) compromises a state/local government entity via unpatched SonicWall VPN </td> <td> HIGH (75%) </td> <td> 30 days </td> <td> Published playbook + confirmed active exploitation + state gov is #1 target sector </td> </tr> <tr> <td> Ransomware groups migrate to new VPN infrastructure following FBI seizure of First VPN Service </td> <td> HIGH (80%) </td> <td> 7–14 days </td> <td> Historical pattern: infrastructure seizures cause 1–2 week disruption, then full resumption </td> </tr> <tr> <td> OAuth/device-code phishing campaign targets state M365 tenants </td> <td> MODERATE-HIGH (65%) </td> <td> 30 days </td> <td> Technique publicly documented; state gov M365 tenants are high-value targets with large user populations </td> </tr> <tr> <td> COZY BEAR spearphishing campaign targets state agencies involved in federal coordination </td> <td> MODERATE (50%) </td> <td> 60 days </td> <td> Refreshed IOCs + historical targeting pattern + geopolitical tensions </td> </tr> <tr> <td> WARLORD KITTEN conducts espionage against state government systems </td> <td> LOW-MODERATE (30%) </td> <td> 90 days </td> <td> Single-source intelligence; Iranian actors historically prefer federal targets but state gov is opportunistic target </td> </tr> <tr> <td> Exploitation of ABB ICS vulnerabilities in state-operated facilities </td> <td> LOW (20%) </td> <td> 60 days </td> <td> Advisories published but ICS exploitation requires specialized access and motivation </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Immediate Detection Priorities </h3> Hunt Hypothesis 1: Abyss Locker VPN-to-Ransomware Chain <ul> <li> Monitor: Outbound SSH connections on port 443 from Windows hosts (T1572). Legitimate HTTPS does not use SSH protocol — any SSH handshake on 443 is anomalous. </li> <li> Detect: Process execution of wmihelper.exe, deploy443.ps1, or veeam11.ps1 on any endpoint (T1059). Service creation named WMI Helper Agent or UpdateSVC (T1547). </li> <li> Investigate: Any loading of UpdateDrv.sys, ped.sys, or 3ware.sys drivers — these are BYOVD payloads used to kill EDR (T1562.001). </li> <li> Block: C2 IPs 64.95.12[.]57 and 64.95.12[.]70 at perimeter firewall. </li> </ul> Hunt Hypothesis 2: COZY BEAR Spearphishing <ul> <li> Monitor: Email attachments delivering obfuscated payloads to government-facing mailboxes (T1566.001). </li> <li> Detect: Execution of binaries matching SHA256 12e1139ef422c2c0884fb5b1786a8489c1769a96880a30406e4a28b76ea4a73a (T1027). </li> <li> Investigate: Any use of valid accounts from unusual locations or devices following phishing delivery (T1078). </li> </ul> Hunt Hypothesis 3: OAuth Token Theft <ul> <li> Monitor: Azure AD sign-in logs for device code flow authentications (grant_type=urn:ietf:params:oauth:grant-type:device_code) from unmanaged devices (T1528). </li> <li> Detect: OAuth consent grants to applications with unusual scopes (Mail.Read, Files.ReadWrite.All) from unrecognized client IDs (T1550.001). </li> <li> Investigate: Refresh token usage patterns — tokens refreshing from IP addresses that differ from the original authentication (T1539). </li> </ul> Hunt Hypothesis 4: WARLORD KITTEN Implant <ul> <li> Monitor: Execution of unknown binaries that establish persistence via autostart registry keys or scheduled tasks (T1547). </li> <li> Detect: SHA256 054736b827e07d5e461b0a900ad54b0bcb58bdc23a5c607697a1e6c452b3570d in EDR telemetry (T1036). </li> <li> Investigate: Ingress tool transfer from external infrastructure to internal hosts (T1105). </li> </ul> <h3> SIEM Correlation Rules to Create </h3> <ol> <li> SSH-over-443: Outbound connection on TCP/443 where process name contains "ssh", "chisel", "wmihelper", or "putty" → HIGH alert </li> <li> BYOVD Driver Load: Any loading of known vulnerable drivers (UpdateDrv.sys, ped.sys, 3ware.sys) → CRITICAL alert </li> <li> Veeam Credential Access: PowerShell accessing Veeam credential stores or executing scripts with "veeam" in filename → HIGH alert </li> <li> Device Code Flow Anomaly: Azure AD device code authentication from non-compliant device → MEDIUM alert, auto-escalate if followed by data access </li> </ol> <h2> Sector-Specific Defensive Priorities </h2> <h3> Financial Services (State Treasury, Revenue, Benefits) </h3> <ul> <li> Priority: Protect citizen financial data (tax records, benefits payments, banking information) </li> <li> Action: Ensure Veeam backup service accounts for financial databases use dedicated PAM-managed credentials with no domain admin privileges. Monitor for Rclone or similar exfiltration tools targeting financial data stores. </li> <li> Rationale: Abyss Locker specifically targets backup credentials to prevent recovery; financial data exfiltration maximizes extortion leverage. </li> </ul> <h3> Energy (State-Operated Utilities, Building Automation) </h3> <ul> <li> Priority: Assess ABB ICS device exposure across state facilities </li> <li> Action: Inventory all ABB AC500 V2, Terra AC, Zenon, and B&R Runtime deployments. Segment ICS networks from IT networks. Apply patches per CISA advisories where operationally feasible. For devices that cannot be patched immediately, implement compensating network monitoring. </li> <li> Rationale: Six simultaneous ABB advisories indicate systemic vendor vulnerability; state-operated water treatment and building automation systems are exposed. </li> </ul> <h3> Healthcare (State Health & Human Services, Medicaid Systems) </h3> <ul> <li> Priority: Protect PHI/PII and ensure system availability for benefits processing </li> <li> Action: Prioritize OAuth device code flow restrictions for health agency M365 tenants — these agencies handle the most sensitive citizen data and are prime targets for credential theft. Implement data loss prevention (DLP) policies on health data repositories. </li> <li> Rationale: Healthcare data commands premium prices on criminal markets; OAuth token theft provides persistent, MFA-resistant access to email and file shares containing PHI. </li> </ul> <h3> Government (All Executive Branch Agencies) </h3> <ul> <li> Priority: Defend against nation-state espionage (COZY BEAR, WARLORD KITTEN) and ransomware (Abyss Locker) </li> <li> Action: Immediately verify SonicWall VPN patch status across all agencies. Deploy COZY BEAR and WARLORD KITTEN IOCs to all EDR/SIEM instances. Brief agency IT directors on the Abyss Locker kill chain with specific indicators to watch for. </li> <li> Rationale: State government is simultaneously targeted by espionage actors (for policy intelligence) and ransomware actors (for extortion leverage from public pressure). </li> </ul> <h3> Aviation/Logistics (State DOT, Airport Authorities, Port Systems) </h3> <ul> <li> Priority: Protect operational technology and logistics coordination systems </li> <li> Action: Review VPN access to transportation management systems — Abyss Locker's SonicWall exploitation could provide access to DOT operational networks. Ensure ICS/SCADA systems for traffic management and port operations are segmented from compromised IT networks. </li> <li> Rationale: Nimbus Manticore (IRGC-affiliated) has specifically targeted aviation; transportation systems use the same VPN and virtualization infrastructure vulnerable to Abyss Locker. </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Within 24 Hours) </h3> <table> <thead> <tr> <th> Priority </th> <th> Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> IMMEDIATE </td> <td> IT Ops </td> <td> Verify all SonicWall VPN appliances are patched against CVE-2021-20038. Abyss Locker is actively exploiting unpatched instances. Confirm firmware version across all agencies. Any unpatched device is an open door. </td> </tr> <tr> <td> IMMEDIATE </td> <td> SOC </td> <td> Block Abyss Locker C2 infrastructure: IPs 64.95.12[.]57 and 64.95.12[.]70 at perimeter firewalls. Create SIEM alert for any historical connections to these IPs. </td> </tr> <tr> <td> IMMEDIATE </td> <td> SOC </td> <td> Deploy nation-state IOCs to EDR/SIEM: COZY BEAR SHA256 12e1139ef422c2c0884fb5b1786a8489c1769a96880a30406e4a28b76ea4a73a; WARLORD KITTEN SHA256 054736b827e07d5e461b0a900ad54b0bcb58bdc23a5c607697a1e6c452b3570d </td> </tr> <tr> <td> IMMEDIATE </td> <td> SOC </td> <td> Create detection rule for SSH tunneling on port 443 from Windows endpoints — any SSH protocol handshake on 443 is malicious in a state government environment </td> </tr> </tbody> </table> <h3> 7-DAY Actions </h3> <table> <thead> <tr> <th> Priority </th> <th> Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 7-DAY </td> <td> IT Ops </td> <td> Audit Veeam Backup & Replication service accounts. Restrict to least-privilege. Remove domain admin rights. Implement PAM for Veeam credentials. Create PowerShell execution alerts for scripts accessing Veeam credential stores. </td> </tr> <tr> <td> 7-DAY </td> <td> Identity/IAM </td> <td> Restrict OAuth device code flow in Azure AD Conditional Access. Limit device code authentication to managed/compliant devices only. Alert on device code grant requests from unrecognized client IDs. </td> </tr> <tr> <td> 7-DAY </td> <td> IT Ops </td> <td> Inventory ABB ICS devices across all state facilities (water, buildings, transportation). Cross-reference against 6 new CISA advisories. Prioritize patching for any internet-accessible or DMZ-adjacent devices. </td> </tr> <tr> <td> 7-DAY </td> <td> SOC </td> <td> Deploy BYOVD detection: Alert on loading of UpdateDrv.sys, ped.sys, or 3ware.sys drivers. These are signed but vulnerable drivers abused to kill endpoint protection. </td> </tr> </tbody> </table> <h3> 30-DAY Actions </h3> <table> <thead> <tr> <th> Priority </th> <th> Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 30-DAY </td> <td> CISO </td> <td> Evaluate ZTNA alternatives to VPN. SonicWall VPN is a recurring single point of failure across multiple threat clusters (Abyss Locker, Gen6 MFA bypass, nation-state exploitation). Zero-trust network access reduces the attack surface permanently. </td> </tr> <tr> <td> 30-DAY </td> <td> CISO </td> <td> Mandate FIDO2/passkey authentication for privileged accounts. OAuth token theft and device code phishing bypass all traditional MFA. Hardware-bound credentials are the only durable mitigation. </td> </tr> <tr> <td> 30-DAY </td> <td> CISO </td> <td> Publish employee advisory on AI tool downloads. Fake ChatGPT campaigns (delivering credential stealers via domains like openew[.]app) target employees searching for AI tools. Whitelist official download URLs in web proxy. </td> </tr> <tr> <td> 30-DAY </td> <td> Executive </td> <td> Fund replacement for degraded OSINT collection capability. 89 days of degraded open-source intelligence has created a structural blind spot, particularly for cybersecurity legislation monitoring. Request emergency procurement for a commercial threat intelligence supplement. </td> </tr> <tr> <td> 30-DAY </td> <td> IR Team </td> <td> Conduct tabletop exercise using the Abyss Locker kill chain. Scenario: SonicWall VPN compromised → Veeam credentials stolen → ESXi encrypted. Test: Can your team detect at each stage? Can you recover without paying ransom? </td> </tr> </tbody> </table> <h2> IOC Blocking Table </h2> The following IOCs are confirmed from intelligence collection and should be deployed to defensive systems immediately: <table> <thead> <tr> <th> Type </th> <th> Value </th> <th> Context </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> IPv4 </td> <td> 64.95.12[.]57 </td> <td> Abyss Locker C2 (SSH reverse tunnel) </td> <td> Block at firewall; alert on historical connections </td> </tr> <tr> <td> IPv4 </td> <td> 64.95.12[.]70 </td> <td> Abyss Locker C2 (ESXi SSH tunnel) </td> <td> Block at firewall; alert on historical connections </td> </tr> <tr> <td> SHA-256 </td> <td> 12e1139ef422c2c0884fb5b1786a8489c1769a96880a30406e4a28b76ea4a73a </td> <td> COZY BEAR / ATI-Agent </td> <td> Block in EDR; hunt in telemetry </td> </tr> <tr> <td> SHA-1 </td> <td> 6e00b86a2480abc6dbd971c0bf6495d81ed1b629 </td> <td> COZY BEAR / ATI-Agent </td> <td> Block in EDR </td> </tr> <tr> <td> MD5 </td> <td> 556b9eca4a85f52e2f3176c306e18661 </td> <td> COZY BEAR / ATI-Agent </td> <td> Block in EDR </td> </tr> <tr> <td> SHA-256 </td> <td> 054736b827e07d5e461b0a900ad54b0bcb58bdc23a5c607697a1e6c452b3570d </td> <td> WARLORD KITTEN / OtakuKit </td> <td> Block in EDR; hunt in telemetry </td> </tr> <tr> <td> MD5 </td> <td> 33e4aa4f25e2e3991291edc1e1697ab5 </td> <td> WARLORD KITTEN / OtakuKit </td> <td> Block in EDR </td> </tr> <tr> <td> Domain </td> <td> discordapp[.]com </td> <td> Potential C2 exfiltration channel </td> <td> Monitor (do not block without business impact assessment) </td> </tr> <tr> <td> File Name </td> <td> wmihelper.exe </td> <td> Abyss Locker SSH tunnel service </td> <td> Alert on execution </td> </tr> <tr> <td> File Name </td> <td> UpdateDrv.sys </td> <td> Abyss Locker BYOVD (Zemana driver) </td> <td> Alert on driver load </td> </tr> <tr> <td> File Name </td> <td> ped.sys </td> <td> Abyss Locker BYOVD (Process Explorer) </td> <td> Alert on driver load </td> </tr> </tbody> </table> Additional IOCs for the campaigns discussed in this report are available through Anomali ThreatStream Next-Gen and partner feeds. <h2> Bottom Line </h2> The intelligence this week delivers an uncomfortable message: a ransomware group has published — through their operational activity — a step-by-step guide to encrypting state government infrastructure. The Abyss Locker kill chain is not a future threat. It is an active campaign exploiting the exact technology stack that state agencies operate today. The window between vulnerability disclosure and exploitation has collapsed. The window between ransomware infrastructure disruption (the FBI's VPN seizure) and adversary reconstitution is measured in days, not months. And nation-state actors — Russian and Iranian — continue to refresh their government-targeting capabilities on a daily basis. Three decisions require executive action this week: <ol> <li> Confirm SonicWall patch status across every agency. One unpatched appliance is all it takes. </li> <li> Approve OAuth device code flow restrictions in Azure AD. MFA alone does not protect your M365 environment. </li> <li> Fund OSINT collection replacement. You cannot defend against threats you cannot see — and an 89-day intelligence blind spot is unacceptable. </li> </ol> The threat actors are not waiting. Neither should you. Anomali CTI Desk | 2026-05-28 For questions or IOC feeds, contact your Anomali account team.

FEATURED RESOURCES

May 28, 2026

Anomali Cyber Watch

Iran's Cyber War Machine Doesn't Do Ceasefires: What CISOs Need to Know Now

May 28, 2026

Anomali Cyber Watch

Public Sector

Abyss Locker Ransomware Maps Directly to State Government Infrastructure: What CISOs Must Do This Week

May 27, 2026

Anomali Cyber Watch

Iranian Cyber Operations Expand Multi-Tool Staging Infrastructure as Conflict Enters Fourth Month

Explore All