Active Exploitation of State Government Systems: Drupal Under Attack, M365 Credentials at Risk, and VPN Infrastructure Compromised

Public Sector

Published on

May 26, 2026

Table of Contents

Threat Assessment Level: ELEVATED (unchanged from prior cycle, trending toward HIGH) Previous assessment: ELEVATED. Maintained based on convergence of three actively exploited vectors targeting state government infrastructure with a federal remediation deadline of May 27. <h2> Executive Summary </h2> State government IT leaders face a convergence of three actively exploited threats that demand immediate action this week. A critical Drupal vulnerability is being mass-exploited across thousands of sites, including government portals. The FBI has confirmed that a new phishing-as-a-service platform bypasses Microsoft 365 multi-factor authentication entirely. And end-of-life SonicWall VPN appliances are being exploited to achieve full domain compromise in under 40 minutes. These are not theoretical risks. They are happening now, against systems that state agencies operate today. <h2> What Changed (Past 72 Hours) </h2> <table> <thead> <tr> <th> Date </th> <th> Development </th> <th> Impact </th> </tr> </thead> <tbody> <tr> <td> Apr 16 </td> <td> SonicWall Gen6 SSL-VPN reaches end-of-life </td> <td> No further security patches will be issued; CVE-2024-12802 exploitation remains unmitigated for unpatched appliances </td> </tr> <tr> <td> May 20 </td> <td> Drupal releases emergency patch for CVE-2026-9082 (CVSS 9.8) </td> <td> Critical SQL injection in Drupal Core affecting PostgreSQL backends </td> </tr> <tr> <td> May 21 </td> <td> CISA publishes 5 ICS advisories (ABB, Hitachi Energy, Siemens) </td> <td> Water/wastewater SCADA and building automation systems affected </td> </tr> <tr> <td> May 22 </td> <td> CISA adds CVE-2026-9082 to Known Exploited Vulnerabilities catalog </td> <td> Federal remediation deadline set for May 27 </td> </tr> <tr> <td> May 22–25 </td> <td> TrapDoor supply chain campaign expands to 34+ packages, 380+ versions </td> <td> npm, PyPI, and Crates.io ecosystems compromised; AI coding tools poisoned </td> </tr> <tr> <td> May 25 </td> <td> FBI issues PSA on Kali365 phishing-as-a-service platform </td> <td> Confirms device code authentication abuse bypasses MFA on M365 tenants </td> </tr> <tr> <td> May 25 </td> <td> Check Point publishes Nimbus Manticore (IRGC) campaign analysis </td> <td> AI-assisted malware, SEO poisoning via fake software download sites </td> </tr> <tr> <td> May 26 </td> <td> Microsoft dismantles Fox Tempest code-signing-as-a-service operation </td> <td> Temporary disruption to Rhysida ransomware and Lumma Stealer delivery </td> </tr> </tbody> </table> <h2> Threat Timeline </h2> <table> <thead> <tr> <th> Timeframe </th> <th> Actor/Campaign </th> <th> Technique </th> <th> Target </th> </tr> </thead> <tbody> <tr> <td> Feb–Apr 2026 </td> <td> Nimbus Manticore (IRGC) </td> <td> AppDomain hijacking, trojanized Zoom, SEO poisoning </td> <td> Aviation, software, government (indiscriminate via SEO) </td> </tr> <tr> <td> Feb–Mar 2026 </td> <td> Unknown IABs </td> <td> SonicWall Gen6 MFA bypass (CVE-2024-12802) </td> <td> Organizations running EOL VPN appliances </td> </tr> <tr> <td> Apr 2026 </td> <td> Kali365 / ShinyHunters </td> <td> Device code phishing, OAuth token theft </td> <td> Microsoft 365 environments including GCC tenants </td> </tr> <tr> <td> May 20–present </td> <td> Unknown (mass exploitation) </td> <td> SQL injection (CVE-2026-9082) </td> <td> Drupal sites on PostgreSQL — 15,000+ attacks across 6,000 sites </td> </tr> <tr> <td> May 22–25 </td> <td> TrapDoor campaign </td> <td> Malicious packages, AI assistant poisoning </td> <td> Developer environments, cloud credentials </td> </tr> <tr> <td> Ongoing </td> <td> Play, SafePay, LockBit5, VICE SPIDER </td> <td> Ransomware, initial access brokering </td> <td> Government, public services, critical infrastructure </td> </tr> <tr> <td> Ongoing </td> <td> Volt Typhoon / Salt Typhoon (China) </td> <td> Pre-positioning in critical infrastructure </td> <td> U.S. government and critical infrastructure (no new indicators — assessed as collection gap) </td> </tr> </tbody> </table> <h2> Key Threat Analysis </h2> <h3> 1. CVE-2026-9082: Drupal Core SQL Injection — Mass Exploitation Underway </h3> This is the most urgent threat facing state agencies this week. CVE-2026-9082 is a critical (CVSS 9.8) unauthenticated SQL injection vulnerability in Drupal Core affecting PostgreSQL-backed installations. Within 48 hours of the patch release on May 20, security firms observed over 15,000 exploitation attempts across 6,000 sites in 65 countries. Why this matters for state government: Many state agencies operate citizen-facing portals (licensing, benefits, tax services) built on Drupal with PostgreSQL backends. Successful exploitation grants attackers unauthenticated access to backend databases containing citizen PII. The federal deadline is May 27 — CISA's Binding Operational Directive 22-01 requires remediation by tomorrow. While BOD 22-01 applies directly to federal agencies, state agencies connected to federal systems or following CISA guidance should treat this as equally binding. ATT&CK Techniques: T1190 (Exploit Public-Facing Application), T1078 (Valid Accounts — post-exploitation) <h3> 2. Kali365: MFA Is No Longer Sufficient for Microsoft 365 </h3> The FBI's May 25 Public Service Announcement confirms what security researchers have been warning about since April: the Kali365 phishing-as-a-service platform exploits the OAuth device code authentication flow to steal M365 session tokens, completely bypassing multi-factor authentication. How it works: Attackers send victims a legitimate Microsoft device code login prompt. When the victim authenticates (including completing MFA), the attacker captures the resulting OAuth token. This grants full mailbox access, SharePoint access, and the ability to register persistent applications — all without triggering traditional MFA failure alerts. Key details: <ul> <li> Distributed via Telegram with subscription pricing </li> <li> Includes AI-generated phishing lures customized per target </li> <li> Real-time victim tracking dashboard </li> <li> "Cookie Link" adversary-in-the-middle mode for additional credential capture </li> <li> ShinyHunters group confirmed as active users </li> <li> Targets include government GCC (Government Community Cloud) tenants </li> </ul> ATT&CK Techniques: T1566.002 (Spearphishing Link), T1528 (Steal Application Access Token), T1539 (Steal Web Session Cookie), T1078.004 (Cloud Accounts) The critical gap: Device code authentication is enabled by default in Microsoft Entra ID (Azure AD). Most organizations have never restricted it because it was designed for IoT and conference room devices. This is not a vulnerability to patch — it is a configuration that must be explicitly restricted via Conditional Access policy. <h3> 3. SonicWall Gen6 VPN: 40 Minutes to Domain Compromise </h3> CVE-2024-12802 allows attackers to bypass MFA on SonicWall Gen6 SSL-VPN appliances. Active exploitation was confirmed in February–March 2026, with attackers achieving full domain compromise within 40 minutes of initial VPN authentication. Critical complication: The firmware patch alone is insufficient. Six manual LDAP reconfiguration steps are required to fully remediate. And SonicWall Gen6 reached end-of-life on April 16, 2026 — no further security updates will be issued. For state agencies: This is no longer a patching decision. It is a procurement and migration decision. Every day a Gen6 appliance remains in production is a day of unmitigated risk with no vendor support path. ATT&CK Techniques: T1133 (External Remote Services), T1556.006 (Modify Authentication Process), T1078 (Valid Accounts) <h3> 4. Nimbus Manticore (IRGC): AI-Assisted Malware and SEO Poisoning </h3> Iran's IRGC-affiliated Nimbus Manticore (also tracked as UNC1549) conducted three campaign waves between February and April 2026 as part of Operation Epic Fury: <ul> <li> Wave 1: Fake career offers delivering the MiniJunk backdoor via AppDomain hijacking </li> <li> Wave 2: Trojanized Zoom installers delivering the MiniFast RAT </li> <li> Wave 3: SEO poisoning via the domain getsqldeveloper[.]com delivering MiniFast </li> </ul> The SEO poisoning vector is indiscriminate. Any state employee searching for legitimate software downloads (SQL Developer, development tools) could encounter poisoned search results. The AI-assisted development of MiniFast indicates Iranian cyber capabilities are accelerating. ATT&CK Techniques: T1608.006 (SEO Poisoning), T1574.014 (AppDomainManager Injection), T1059.001 (PowerShell), T1071.001 (Web Protocols) <h3> 5. TrapDoor: Supply Chain Compromise Targeting Developer Credentials </h3> The TrapDoor campaign has expanded to 34+ malicious packages across 380+ versions on npm, PyPI, and Crates.io. Beyond traditional credential theft, this campaign introduces a novel technique: poisoning AI coding assistant configuration files (.cursorrules, CLAUDE.md) to influence AI tools into exfiltrating secrets. Persistence mechanisms include: git hooks, systemd services, cron jobs, and SSH authorized key injection. State government relevance: Application modernization projects that consume open-source packages are at risk. Developer workstations with access to state cloud infrastructure (Azure Government, AWS GovCloud) represent high-value targets for credential theft that could cascade into broader compromise. ATT&CK Techniques: T1195.001 (Supply Chain Compromise — Software Dependencies), T1552.001 (Credentials in Files), T1098.004 (SSH Authorized Keys), T1053.003 (Cron) <h3> 6. Ransomware Landscape: Disruption and Adaptation </h3> Positive development: Microsoft's takedown of Fox Tempest disrupts a major malware-signing-as-a-service operation that enabled Rhysida ransomware, Oyster backdoor, Lumma Stealer, and Vidar infostealer distribution. This will temporarily reduce the volume of signed malware evading endpoint detection. However: Expect ransomware operators to migrate to alternative code-signing services within 2–4 weeks. Active ransomware groups targeting government and public services include Play, SafePay, LockBit5, and VICE SPIDER (distributing BubbleLoader and SocksShell). Fresh indicators of compromise for VICE SPIDER were collected this cycle. <h3> 7. ICS/OT Advisories: Water, Building Automation, and Industrial Networks </h3> CISA published five ICS advisories on May 21 affecting systems commonly deployed in state government facilities: <ul> <li> ABB B&R Automation Studio and B&R PCs (building automation) </li> <li> ABB Terra AC Wallbox (EV charging infrastructure) </li> <li> Hitachi Energy GMS600 (CVE-2022-4304 — OpenSSL timing side-channel) </li> <li> Siemens RUGGEDCOM APE1808 (PAN-OS buffer overflow in Captive Portal) </li> </ul> State agencies operating water/wastewater SCADA systems, building automation, or industrial network equipment should review these advisories immediately. <h2> Predictive Analysis </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Timeframe </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> Automated Drupal CVE-2026-9082 exploitation hits state government portals </td> <td> HIGH (85%) </td> <td> 24–72 hours </td> <td> 15,000+ attacks already observed; state Drupal instances are discoverable via Shodan </td> </tr> <tr> <td> Kali365 campaigns specifically target state government M365 tenants </td> <td> HIGH (75%) </td> <td> 1–2 weeks </td> <td> Platform is maturing rapidly; government email addresses are high-value targets for espionage and BEC </td> </tr> <tr> <td> Ransomware actors migrate to new signing services post-Fox Tempest takedown </td> <td> HIGH (80%) </td> <td> 2–4 weeks </td> <td> Historical pattern: infrastructure disruption causes temporary pause, not permanent cessation </td> </tr> <tr> <td> Volt Typhoon/Salt Typhoon activity resurfaces with new indicators </td> <td> HIGH (70%) </td> <td> 1–4 weeks </td> <td> Current absence likely reflects collection gap, not reduced operations </td> </tr> <tr> <td> Ransomware group exploits SonicWall Gen6 MFA bypass as initial access to state network </td> <td> MODERATE-HIGH (65%) </td> <td> 2–4 weeks </td> <td> IAB activity confirmed; ransomware groups routinely purchase VPN access from brokers </td> </tr> <tr> <td> TrapDoor-compromised developer credentials used to access state cloud infrastructure </td> <td> MODERATE (50%) </td> <td> 2–6 weeks </td> <td> Depends on whether state dev teams consumed affected packages </td> </tr> <tr> <td> Nimbus Manticore SEO poisoning delivers malware to state employee workstation </td> <td> MODERATE (45%) </td> <td> Ongoing </td> <td> Indiscriminate vector; probability increases with time exposed </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Detection Priorities </h3> <table> <thead> <tr> <th> Priority </th> <th> What to Monitor </th> <th> ATT&CK ID </th> <th> Detection Logic </th> </tr> </thead> <tbody> <tr> <td> P1 </td> <td> Device code authentication attempts in Entra ID sign-in logs </td> <td> T1528 </td> <td> Alert on authenticationProtocol == "deviceCode" for any user not on an approved IoT/conference device list </td> </tr> <tr> <td> P1 </td> <td> Drupal web application logs for SQL injection patterns </td> <td> T1190 </td> <td> WAF rules for UNION-based and blind SQLi against Drupal endpoints; monitor for unexpected database queries </td> </tr> <tr> <td> P1 </td> <td> SonicWall VPN authentication anomalies </td> <td> T1133 , T1556.006 </td> <td> Alert on successful VPN auth from Gen6 appliances followed by rapid lateral movement (< 60 min to DC) </td> </tr> <tr> <td> P2 </td> <td> AppDomainManager injection (.NET config hijacking) </td> <td> T1574.014 </td> <td> Monitor for unexpected modifications to web.config or application .config files loading unsigned assemblies </td> </tr> <tr> <td> P2 </td> <td> SEO poisoning delivery — getsqldeveloper[.]com </td> <td> T1608.006 </td> <td> DNS/proxy block; alert on any resolution attempt; hunt for recent downloads of SQL Developer from non-Oracle sources </td> </tr> <tr> <td> P2 </td> <td> Supply chain indicators — unexpected files in dev environments </td> <td> T1195.001 </td> <td> Scan for .cursorrules and CLAUDE.md files in repositories; audit npm/pip install logs for packages added May 22–25 </td> </tr> <tr> <td> P3 </td> <td> PowerShell execution with encoded commands post-initial access </td> <td> T1059.001 </td> <td> Behavioral detection for encoded PowerShell spawned by w3wp.exe or after VPN authentication </td> </tr> <tr> <td> P3 </td> <td> Scheduled task/cron creation for persistence </td> <td> T1053.003 </td> <td> Alert on new cron jobs or systemd services created by non-administrative processes </td> </tr> </tbody> </table> <h3> Hunting Hypotheses </h3> <ul> <li> "Has device code phishing already succeeded?" — Query Entra ID sign-in logs for the past 30 days for authenticationProtocol == "deviceCode" events. Correlate with user reports of unexpected MFA prompts. Any successful device code auth from a non-approved device is a potential compromise. </li> </ul> <ul> <li> "Are our Drupal instances already compromised?" — Review web server access logs for POST requests to Drupal form endpoints with SQL metacharacters. Check for new database users or unexpected privilege escalations in PostgreSQL audit logs. </li> </ul> <ul> <li> "Did any developer install a TrapDoor package?" — Search package manager lock files (package-lock.json, Pipfile.lock, Cargo.lock) for packages updated between May 22–25. Search file systems for trap-core.js, unexpected .cursorrules, or CLAUDE.md files outside of known AI tool configurations. </li> </ul> <ul> <li> "Is a SonicWall Gen6 appliance being used as an entry point?" — Correlate VPN authentication logs from Gen6 devices with subsequent Active Directory authentication events. A pattern of VPN login → multiple LDAP queries → service account usage within 60 minutes indicates active exploitation. </li> </ul> <h3> IOC Blocking Guidance </h3> <table> <thead> <tr> <th> Type </th> <th> Value </th> <th> Context </th> </tr> </thead> <tbody> <tr> <td> Domain </td> <td> getsqldeveloper[.]com </td> <td> Nimbus Manticore SEO poisoning — MiniFast RAT delivery </td> </tr> <tr> <td> Domain </td> <td> calendly[.]live </td> <td> Suspicious infrastructure (typosquat) </td> </tr> <tr> <td> Domain </td> <td> picktime[.]live </td> <td> Suspicious infrastructure (typosquat) </td> </tr> <tr> <td> Domain </td> <td> aes-secure[.]net </td> <td> Suspicious infrastructure </td> </tr> <tr> <td> Domain </td> <td> azureglobalaccelerator[.]com </td> <td> Suspicious infrastructure (typosquat of Azure service) </td> </tr> <tr> <td> SHA-256 </td> <td> dd70e40a0525db5c516d77a381e10280a9a9eb8b8028a57282e4525c3bf9d407 </td> <td> Malware sample </td> </tr> <tr> <td> SHA-256 </td> <td> aa2badddd074bbdcd5ebcd301da2a7927b4dc20095cd8049a0778f263b0abae5 </td> <td> Malware sample </td> </tr> <tr> <td> SHA-256 </td> <td> 4d4bdb02b1e1d98fdd6cacecf91392be589e3792d0b64251351591dc0b578736 </td> <td> Malware sample </td> </tr> <tr> <td> SHA-256 </td> <td> d1595f3761fb61ba20d8c5af0557239e9ce6eaab214c044c39af1de44c50dc42 </td> <td> Malware sample </td> </tr> <tr> <td> SHA-256 </td> <td> 3c4c099745bf77a57446e3b4da24d971ceac98176d3105021ef08a8dd475471f </td> <td> Malware sample </td> </tr> <tr> <td> SHA-256 </td> <td> 086030087bd7298ad29bd0bb90ffecbafa142ba50b130692866f07611480d8eb </td> <td> Malware sample </td> </tr> <tr> <td> SHA-256 </td> <td> eb1405dcd5f4c194781e0757918985f42644afecfaeceb3470b81b43bcc52b78 </td> <td> Malware sample </td> </tr> <tr> <td> SHA-256 </td> <td> 0e7f7dd1f1d9e6cc26a759f339d226f9fd637d03f4077d767b35605bc9ef14a0 </td> <td> Malware sample </td> </tr> <tr> <td> SHA-256 </td> <td> 0a76a0e53e8a07d857210a26f6b4de3e169aaf68e7a45409eec436fcd25ade0e </td> <td> Malware sample </td> </tr> <tr> <td> SHA-256 </td> <td> cc78dc022a4d994f5afbdf9a08411ff88a67a8618d36dc02fdc00b151ec2c46d </td> <td> Malware sample </td> </tr> <tr> <td> SHA-256 </td> <td> b913d78eb460f17ba53f49c892bd763abb1a95cdfe32e5f5567650f45bf2ff18 </td> <td> Malware sample </td> </tr> <tr> <td> SHA-256 </td> <td> 0e3a876a0d48006516e546a25044a44f22707b686a5374bc8e6906b1fb3ba2ec </td> <td> Malware sample </td> </tr> <tr> <td> SHA-256 </td> <td> bddca906b83ce0aa8838466e44450d3aa8f91774fc9982cc20cc922ea64fb7ea </td> <td> Malware sample </td> </tr> <tr> <td> SHA-256 </td> <td> 094a5b7d261eea0c7f0a6e23f67cf24e51cc5bc4d8e1654f76a0423769654d6f </td> <td> Malware sample </td> </tr> <tr> <td> MD5 </td> <td> 5ebf47b4320129a0a1653e73ace57f6d </td> <td> VICE SPIDER / BubbleLoader indicator </td> </tr> <tr> <td> MD5 </td> <td> a7022795ecb72c7516e3ae9bd75cd837 </td> <td> VICE SPIDER / SocksShell indicator </td> </tr> <tr> <td> SHA-1 </td> <td> 3b2fe4e535f5e2380b1c2101ee3146b804e5790b </td> <td> Malware sample </td> </tr> </tbody> </table> Additional IOCs available via Anomali ThreatStream Next-Gen. <h2> Sector-Specific Defensive Priorities </h2> <h3> Financial Services (State Treasury, Revenue, Benefits Systems) </h3> <ul> <li> Primary threat: CVE-2026-9082 exploitation of Drupal-based tax and benefits portals containing citizen financial data </li> <li> Secondary threat: Kali365 credential theft targeting finance staff with access to payment systems </li> <li> Action: Immediately verify Drupal patch status on all revenue-facing applications. Implement transaction monitoring for anomalous database queries. Enforce Conditional Access restrictions on finance department M365 accounts as priority cohort. </li> </ul> <h3> Energy (State-Regulated Utilities, Grid Operations) </h3> <ul> <li> Primary threat: ICS advisories affecting ABB B&R (building automation, substation control) and Siemens RUGGEDCOM (utility network switches) </li> <li> Secondary threat: Volt Typhoon pre-positioning — absence of new indicators does NOT indicate reduced risk </li> <li> Action: Conduct asset inventory of ABB and Siemens equipment in state-regulated facilities. Verify network segmentation between IT and OT environments. Ensure ICS advisory patches (icsa-26-141-01 through -05) are evaluated for applicability within 7 days. </li> </ul> <h3> Healthcare (State Health Agencies, Medicaid Systems) </h3> <ul> <li> Primary threat: Ransomware groups (Play, SafePay, LockBit5) actively targeting public services sector — healthcare data is highest-value extortion target </li> <li> Secondary threat: Drupal exploitation of health portal systems containing PHI </li> <li> Action: Validate offline backup integrity for Medicaid and health information exchange systems. Ensure ransomware playbook includes HIPAA breach notification timelines. Prioritize Drupal patching on any system handling protected health information. </li> </ul> <h3> Government (Executive Branch Agencies, Legislature, Courts) </h3> <ul> <li> Primary threat: Kali365 device code phishing targeting M365 GCC tenants — government email compromise enables espionage and lateral movement </li> <li> Secondary threat: SonicWall Gen6 exploitation providing initial access to agency networks </li> <li> Action: Deploy Conditional Access policy blocking device code auth TODAY. Inventory all SonicWall Gen6 appliances across agencies and establish emergency migration timeline. Brief agency heads on the FBI Kali365 warning with specific guidance on recognizing device code phishing attempts. </li> </ul> <h3> Aviation / Logistics (State DOT, Airport Authorities, Port Operations) </h3> <ul> <li> Primary threat: Nimbus Manticore (IRGC) — Operation Epic Fury specifically targeted aviation sector with fake career offers and trojanized tools </li> <li> Secondary threat: Supply chain compromise via TrapDoor affecting logistics software development </li> <li> Action: Alert aviation and transportation IT staff to the SEO poisoning vector — block getsqldeveloper[.]com and brief staff on verifying software download sources. Review any recent hiring-related file attachments for AppDomain hijacking indicators. Audit development dependencies in transportation management systems. </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Within 24 Hours) </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> IT Operations </td> <td> Patch all Drupal instances for CVE-2026-9082 before the May 27 CISA BOD deadline. Prioritize PostgreSQL-backed citizen portals. Verify patch via version check AND SQLi response testing. </td> </tr> <tr> <td> 2 </td> <td> Identity/IAM Team </td> <td> Block device code authentication in Microsoft Entra ID via Conditional Access policy. Exempt only explicitly approved IoT/conference devices. Monitor Entra sign-in logs for DeviceCodeFlow events. </td> </tr> <tr> <td> 3 </td> <td> Network Operations </td> <td> Identify all SonicWall Gen6 SSL-VPN appliances in production. Verify the 6 LDAP reconfiguration steps are completed (firmware patch alone is insufficient). Initiate emergency change request for migration to supported platforms. </td> </tr> <tr> <td> 4 </td> <td> SOC </td> <td> Block domains getsqldeveloper[.]com, calendly[.]live, picktime[.]live, aes-secure[.]net, azureglobalaccelerator[.]com at DNS and web proxy layers. </td> </tr> </tbody> </table> <h3> 7-DAY Actions </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 5 </td> <td> DevOps / AppDev </td> <td> Audit all npm, PyPI, and Cargo dependencies in state projects for packages added/updated May 22–25. Search for .cursorrules and CLAUDE.md files. Rotate credentials (GitHub tokens, cloud keys, SSH keys) on any affected machine. </td> </tr> <tr> <td> 6 </td> <td> SOC / Threat Hunt </td> <td> Deploy detection for MiniFast/MiniJunk — EDR behavioral rules for AppDomainManager injection, YARA signatures for known samples. Hunt for PowerShell execution spawned by w3wp.exe. </td> </tr> <tr> <td> 7 </td> <td> OT/ICS Team </td> <td> Review ICS asset inventory for ABB B&R, Hitachi Energy GMS600, and Siemens RUGGEDCOM deployments. Evaluate CISA ICS advisories for applicability and schedule maintenance windows. </td> </tr> <tr> <td> 8 </td> <td> SOC </td> <td> Retroactive hunt for device code phishing — query 30 days of Entra sign-in logs for device code authentication events. Investigate any from non-approved devices. </td> </tr> </tbody> </table> <h3> 30-DAY Actions </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 9 </td> <td> CISO </td> <td> Develop AI coding assistant security policy — TrapDoor's poisoning of .cursorrules/CLAUDE.md files demonstrates that AI tool configurations are now an attack surface. Require integrity monitoring and approval workflows for AI tool config changes. </td> </tr> <tr> <td> 10 </td> <td> CISO / Procurement </td> <td> Resolve intelligence collection gap — issue RFP for replacement open-source intelligence feed. 100 days of single-source dependency on commercial feeds creates a corroboration blind spot that degrades threat assessment confidence. </td> </tr> <tr> <td> 11 </td> <td> IT Operations </td> <td> Complete SonicWall Gen6 migration — these devices are end-of-life with no future patches. Every day in production is unmitigated risk. Budget and procure Gen7/Gen8 or alternative VPN solution. </td> </tr> <tr> <td> 12 </td> <td> CISO / IR Team </td> <td> Update incident response playbooks to address device code phishing (token revocation procedures), supply chain compromise (dependency audit runbooks), and Drupal exploitation (database forensics for PostgreSQL). </td> </tr> <tr> <td> 13 </td> <td> Executive Leadership </td> <td> Brief agency CIOs on the convergence of identity infrastructure attacks (Kali365 + SonicWall + supply chain credentials). Request emergency budget authority for VPN migration and enhanced identity monitoring tooling. </td> </tr> </tbody> </table> <h2> Continuity Note: Persistent Threats </h2> The following threats from prior cycles remain active and should not be deprioritized despite no new indicators this cycle: <ul> <li> Volt Typhoon / Salt Typhoon (China-nexus): Silent pre-positioning in U.S. critical infrastructure continues. Absence of new indicators is assessed as a collection gap, not reduced threat. </li> <li> APT28 (GRU Unit 26165): WhatsApp phishing of government officials remains active. </li> <li> APT29 / Midnight Blizzard (SVR): Potential linkage to Lithuania breach (600,000+ records); investigation ongoing. </li> <li> Ransomware ecosystem: Fox Tempest takedown provides temporary relief but expect actor migration to new signing infrastructure within 2–4 weeks. </li> </ul> <h2> Bottom Line </h2> The threat environment facing state government IT systems is defined by a single theme this week: the erosion of trust boundaries. Your Drupal portals are being probed by automated scanners right now. Your MFA protections can be bypassed by a $200/month Telegram subscription. Your VPN appliances — the very devices meant to secure remote access — are being used as entry points for domain compromise. The federal remediation deadline for CVE-2026-9082 is tomorrow, May 27. If your agencies run Drupal on PostgreSQL and have not yet patched, the window for proactive defense is measured in hours, not days. Three decisions require senior leadership action today: <ul> <li> Confirm Drupal patch status across all agencies before the May 27 deadline. </li> </ul> <ul> <li> Approve the Conditional Access policy change to block device code authentication in M365. </li> </ul> <ul> <li> Authorize emergency SonicWall Gen6 migration — these devices cannot be secured. </li> </ul> The positive news: Microsoft's disruption of Fox Tempest removes a key enabler from the ransomware supply chain. But this is a temporary reprieve. Use it to harden your defenses before the ecosystem adapts. Published 2026-05-26 by Anomali CTI Desk For questions or additional IOC feeds, contact your Anomali representative or access indicators directly via Anomali ThreatStream Next-Gen.

FEATURED RESOURCES

May 26, 2026

Anomali Cyber Watch

Iranian Cyber Operations Enter Most Dangerous Phase: Physical Destruction Without Malware Under Ceasefire Cover

May 25, 2026

Anomali Cyber Watch

Iran's Cyber War Machine Isn't Stopping for Peace Talks — What CISOs Need to Know Now

May 26, 2026

Anomali Cyber Watch

Public Sector

Active Exploitation of State Government Systems: Drupal Under Attack, M365 Credentials at Risk, and VPN Infrastructure Compromised

Explore All