Actively Exploited SharePoint Flaw, Help Desk Vishing Surge, and ICS Advisories Demand Immediate State Government Action

Public Sector

Published on

July 2, 2026

Table of Contents

Threat Assessment Level: ELEVATED (Unchanged from prior cycle. Escalation to HIGH remains possible within 72 hours if SharePoint exploitation expands to government targets or a new state-sector ransomware incident materializes.) <h2> Introduction </h2> State government IT leaders face a convergence of threats this week that demand immediate operational response. A newly exploited Microsoft SharePoint vulnerability is now on CISA's Known Exploited Vulnerabilities catalog, a prolific cybercriminal group is using social engineering tactics perfectly suited to compromise state identity systems, and CISA published seven ICS advisories in a single day — several affecting equipment commonly deployed in state water and facilities infrastructure. This is not a theoretical risk landscape. The SharePoint vulnerability is being exploited today . The vishing playbook targeting help desks mirrors exactly how state agencies manage identity resets. And the ICS vulnerabilities describe remote command execution on PLCs and RTUs that may sit in your water treatment plants. Below is what changed, what it means for your organization, and what to do about it — prioritized by urgency. <h2> What Changed </h2> <table> <thead> <tr> <th> Development </th> <th> Why It Matters for State Government </th> </tr> </thead> <tbody> <tr> <td> CVE-2026-45659 (SharePoint deserialization RCE) added to CISA KEV — actively exploited </td> <td> State agencies run SharePoint extensively (on-prem and hybrid). This is the second SharePoint deserialization KEV in recent weeks, confirming sustained adversary interest. </td> </tr> <tr> <td> SCATTERED SPIDER vishing campaign documented targeting Entra ID/SSO/VDI via help desk manipulation </td> <td> State IT help desks use identical architecture. A single successful vishing call can yield full domain compromise. </td> </tr> <tr> <td> CVE-2026-50242 (JetBrains Hub authentication bypass, CVSS 10.0) disclosed </td> <td> Any state DevOps team running JetBrains Hub faces unauthenticated administrative takeover — with downstream access to CI/CD pipelines. </td> </tr> <tr> <td> 7 ICS/SCADA advisories published simultaneously (Delta Electronics PLC, Schneider Electric RTU, StoneFly, FUXA HMI, others) </td> <td> Delta DVP12SE PLCs and Schneider Saitel DP RTUs are deployed in state water/wastewater and facilities management. Remote command execution is possible. </td> </tr> <tr> <td> Hunters International ransomware group shut down, released decryption keys, rebranded to "World Leaks" (data extortion only) </td> <td> Affiliates will migrate to other ransomware-as-a-service platforms (Akira, DragonForce, Qilin). Expect a short-term spike in recruitment and new campaigns. </td> </tr> <tr> <td> U.S. Treasury sanctioned Aeza Group (Russia-based bulletproof hosting) supporting BianLian, Lumma, Meduza, and RedLine </td> <td> Disrupts infrastructure used by ransomware and infostealer operations targeting U.S. organizations, but displaced actors will seek new hosting. </td> </tr> <tr> <td> APT29/SVR credential harvesting via messaging apps (Signal, WhatsApp, Telegram) remains active per prior CISA/FBI advisory </td> <td> Senior state officials using personal messaging apps for government business remain at risk of credential theft. </td> </tr> </tbody> </table> <h2> Threat Timeline </h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Relevance </th> </tr> </thead> <tbody> <tr> <td> 12 June 2026 </td> <td> California water utility breach attributed to VOID MANTICORE (Iran/IRGC) </td> <td> Demonstrates active nation-state targeting of U.S. state water infrastructure </td> </tr> <tr> <td> 19 June 2026 </td> <td> JetBrains Hub CVE-2026-50242 (CVSS 10.0) published </td> <td> Unauthenticated admin takeover; weaponization window open </td> </tr> <tr> <td> 26 June 2026 </td> <td> CISA/FBI updated advisory: APT29/SVR credential harvesting via messaging apps </td> <td> Direct threat to senior state officials </td> </tr> <tr> <td> 29 June 2026 </td> <td> CVE-2026-48558 (SimpleHelp, CVSS 10.0) added to CISA KEV </td> <td> Unauthenticated system compromise via forged OIDC tokens; MSP-dependent environments at risk </td> </tr> <tr> <td> 30 June 2026 </td> <td> CISA publishes 7 ICS advisories + 1 medical device advisory in single batch </td> <td> Delta PLC, Schneider RTU, StoneFly, FUXA HMI — state OT infrastructure affected </td> </tr> <tr> <td> 1 July 2026 </td> <td> CVE-2026-45659 (SharePoint RCE) added to CISA KEV — active exploitation confirmed </td> <td> State SharePoint farms are confirmed attack surface </td> </tr> <tr> <td> 2 July 2026 </td> <td> SCATTERED SPIDER vishing campaign advisory published (Singapore CSA/CrowdStrike) </td> <td> Identical TTPs to state help desk identity reset procedures </td> </tr> </tbody> </table> <h2> Key Threat Analysis </h2> <h3> 1. SharePoint Under Sustained Attack — CVE-2026-45659 </h3> What it is: A deserialization-of-untrusted-data vulnerability in Microsoft SharePoint that allows an authenticated attacker to execute arbitrary code remotely. CVSS 8.8. Why it matters now: CISA confirmed active exploitation and added it to the KEV catalog on 1 July 2026. This is the second SharePoint deserialization vulnerability to hit the KEV in recent cycles, establishing a clear pattern: adversaries are systematically targeting SharePoint as an initial access vector into organizations that rely on it for document management and collaboration. State government agencies typically run SharePoint in hybrid configurations with significant on-premises footprints — often with patching cycles measured in weeks rather than days. Every day unpatched is a day exposed. ATT&CK techniques: T1190 (Exploit Public-Facing Application), T1059.001 (PowerShell execution post-compromise), T1078.004 (Cloud Accounts persistence) <h3> 2. SCATTERED SPIDER Vishing — Your Help Desk Is the Front Door </h3> What it is: SCATTERED SPIDER (also tracked as UNC3944) is conducting active campaigns using voice phishing (vishing) to manipulate IT help desk staff into resetting MFA and passwords on Entra ID, SSO, and VDI accounts. Once inside, they use legitimate tools for reconnaissance (ADExplorer, ADRecon.ps1), extract credential databases (ntds.dit), establish tunneled command-and-control (Chisel via trycloudflare[.]com, ngrok), suppress email notifications via PowerShell transport rules, and exfiltrate data to cloud storage (S3 Browser). Why it matters for state government: This group's playbook is a near-perfect match for how state IT service desks operate. If your help desk will reset an Entra ID password based on a phone call — even with basic identity verification — you are vulnerable. Notably, a separate group (CHATTY SPIDER) uses the same vishing-to-identity-reset technique, meaning state help desks face compound risk from multiple independent threat actors exploiting the same procedural weakness. ATT&CK techniques: T1566.004 (Spearphishing Voice), T1078.004 (Cloud Accounts), T1087.002 (Domain Account Discovery), T1003.003 (NTDS credential dumping), T1572 (Protocol Tunneling), T1564.008 (Email Hiding Rules), T1537 (Transfer Data to Cloud Account) <h3> 3. JetBrains Hub CVE-2026-50242 — CVSS 10.0 Supply Chain Risk </h3> What it is: A critical authentication bypass in JetBrains Hub that allows unauthenticated attackers to gain full administrative access via direct database manipulation. JetBrains Hub manages identity and access for all connected JetBrains services — including TeamCity (CI/CD), YouTrack, and Space. Why it matters: Any state development team using JetBrains tools with an exposed Hub instance faces complete supply chain compromise. An attacker with Hub admin access can inject malicious code into CI/CD pipelines, compromise build artifacts, and pivot into production environments. Historical precedent: CVE-2024-27198 (TeamCity) was weaponized within 48 hours of disclosure. Current status: No confirmed in-the-wild exploitation yet — but the CVSS 10.0 score and full admin takeover capability mean the weaponization window is narrow. <h3> 4. ICS/SCADA Advisory Surge — State Water and Facilities at Risk </h3> Seven ICS advisories published on 30 June 2026 affect equipment commonly deployed in state government operational technology environments: <table> <thead> <tr> <th> Advisory </th> <th> Product </th> <th> Risk </th> </tr> </thead> <tbody> <tr> <td> ICSA-26-181-07 </td> <td> Delta Electronics DVP12SE PLC </td> <td> Remote command execution, operational value modification </td> </tr> <tr> <td> ICSA-26-181-04 </td> <td> Schneider Electric EasyLogic T150 / Saitel DP RTU </td> <td> Unauthorized access, sensitive information exposure </td> </tr> <tr> <td> ICSA-26-181-06 </td> <td> StoneFly Storage Concentrator </td> <td> Arbitrary command execution </td> </tr> <tr> <td> ICSA-26-181-05 </td> <td> B&R Products (XZ Utils) </td> <td> Supply chain backdoor via compromised library </td> </tr> <tr> <td> ICSA-26-181-03 </td> <td> Schneider Electric EcoStruxure IT Data Center Expert </td> <td> DCIM platform vulnerability </td> </tr> <tr> <td> ICSA-26-181-02 </td> <td> Frangoteam FUXA SCADA/HMI </td> <td> Unauthenticated user enumeration </td> </tr> <tr> <td> ICSA-26-181-01 </td> <td> Mitsubishi Electric MELSOFT Update Manager </td> <td> Local data tampering/destruction </td> </tr> </tbody> </table> The Delta DVP12SE PLC and Schneider Saitel DP RTU advisories are particularly concerning: they describe remote command execution capabilities that align with documented pre-positioning tactics used by Volt Typhoon (Chinese state-sponsored) in U.S. water/wastewater infrastructure. The absence of new Volt Typhoon reporting this cycle does not indicate absence of activity — it may indicate successful concealment. <h3> 5. Ransomware Ecosystem Reshuffling </h3> Hunters International has shut down ransomware operations and released decryption keys, rebranding as "World Leaks" (data extortion only). This is operationally significant because their affiliates — experienced operators with established access to victim networks — will migrate to other ransomware-as-a-service platforms. Meanwhile, the U.S. Treasury sanctioned Aeza Group , a Russia-based bulletproof hosting provider that supported BianLian ransomware, Lumma infostealer, Meduza infostealer, and RedLine infostealer operations. While sanctions disrupt infrastructure, displaced actors historically reconstitute within weeks. Active ransomware groups updated in the last 48 hours with government targeting: Krybit, Stormous, ShinyHunters, Gunra, NightSpire. No specific state/local government victim was reported this cycle, but reporting lag is common. <h2> Predictive Analysis </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Timeframe </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> CVE-2026-45659 exploitation expands; scanning activity against state SharePoint instances </td> <td> HIGH (70%) </td> <td> 72 hours </td> <td> Active exploitation confirmed; state SharePoint widely deployed and often slow to patch </td> </tr> <tr> <td> SCATTERED SPIDER expands targeting to government sector </td> <td> MODERATE (50%) </td> <td> 2–4 weeks </td> <td> Entra ID ubiquity in government; group historically expands to adjacent sectors </td> </tr> <tr> <td> Hunters International affiliates surface under new RaaS banners (Qilin, DragonForce, Akira) </td> <td> MODERATE (40%) </td> <td> 2 weeks </td> <td> Standard affiliate migration pattern after RaaS shutdown </td> </tr> <tr> <td> JetBrains Hub CVE-2026-50242 weaponized </td> <td> LOW-MODERATE (20%) </td> <td> 7 days </td> <td> CVSS 10.0 attracts attention; less internet-exposed than TeamCity but high value </td> </tr> <tr> <td> Nation-state exploitation of Delta/Schneider ICS vulnerabilities against state water systems </td> <td> LOW (15%) </td> <td> 30 days </td> <td> Volt Typhoon has demonstrated interest; advisories provide roadmap </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Detection Priorities </h3> <table> <thead> <tr> <th> Priority </th> <th> What to Monitor </th> <th> ATT&CK ID </th> <th> Detection Logic </th> </tr> </thead> <tbody> <tr> <td> CRITICAL </td> <td> SharePoint deserialization exploitation attempts </td> <td> T1190 </td> <td> WAF alerts for serialized object payloads in SharePoint requests; IIS logs showing unusual POST requests to /_layouts/ or /_vti_bin/ endpoints </td> </tr> <tr> <td> HIGH </td> <td> Help desk credential reset anomalies </td> <td> T1566.004 </td> <td> Track all Entra ID password/MFA resets initiated via phone — correlate with subsequent impossible-travel or new device enrollments within 1 hour </td> </tr> <tr> <td> HIGH </td> <td> Tunneling tool usage </td> <td> T1572 </td> <td> DNS queries to trycloudflare[.]com, ngrok[.]io, pinggy[.]io; process creation for chisel.exe, ngrok.exe; outbound connections on non-standard ports </td> </tr> <tr> <td> HIGH </td> <td> Email transport rule modifications </td> <td> T1564.008 </td> <td> M365 Unified Audit Log: Set-TransportRule, New-TransportRule, New-InboxRule with redirect/delete actions — especially from recently-reset accounts </td> </tr> <tr> <td> MEDIUM </td> <td> NTDS.dit access </td> <td> T1003.003 </td> <td> Volume Shadow Copy creation (vssadmin/wmic), ntdsutil.exe execution, large file transfers from domain controllers </td> </tr> <tr> <td> MEDIUM </td> <td> AD reconnaissance tooling </td> <td> T1087.002 </td> <td> Process creation for ADExplorer.exe, ADRecon.ps1, Get-ADUser with -Filter * parameters </td> </tr> <tr> <td> MEDIUM </td> <td> Adaptix C2 beaconing </td> <td> T1071.001 </td> <td> Outbound connections to 45.32.64[.]12 on port 4321 (Vultr ASN 20473) — persistent IOC from prior cycles </td> </tr> </tbody> </table> <h3> Hunting Hypotheses </h3> <ol> <li> "Did anyone vish our help desk this week?" — Review all password/MFA reset tickets opened via phone in the last 14 days. Cross-reference the reset accounts with: new device enrollments, impossible-travel alerts, mail forwarding rule changes, or SharePoint/OneDrive bulk downloads within 24 hours of reset. </li> <li> "Is anyone tunneling out?" — Hunt for DNS resolution of trycloudflare[.]com, ngrok[.]io, or pinggy[.]io across all endpoints. Check for Chisel, Rsocx, or Teleport binaries. Look for sustained outbound connections on ports 443/8443 to cloud tunnel providers. </li> <li> "Has our SharePoint been probed?" — Review SharePoint/IIS access logs for unusual POST requests containing serialized .NET objects, base64-encoded payloads, or requests to rarely-accessed administrative endpoints. Correlate with any new CISA KEV scanning signatures. </li> <li> "Is Adaptix C2 active in our environment?" — Search network flow data for any communication with 45.32.64[.]12 or 107.191.61[.]105 (107.191.61.105.vultr.com). Check for beaconing patterns on port 4321. </li> </ol> <h3> IOC Blocking Guidance </h3> The following indicators should be added to blocking/alerting rules: <table> <thead> <tr> <th> Type </th> <th> Value </th> <th> Context </th> </tr> </thead> <tbody> <tr> <td> IPv4 </td> <td> 45.205.1[.]20 </td> <td> APT29-associated infrastructure </td> </tr> <tr> <td> IPv4 </td> <td> 124.198.131[.]185 </td> <td> APT-associated infrastructure </td> </tr> <tr> <td> IPv4 </td> <td> 45.32.64[.]12 </td> <td> Adaptix C2 node (Vultr, ASN 20473) </td> </tr> <tr> <td> IPv4 </td> <td> 107.191.61[.]105 </td> <td> Adaptix C2 infrastructure (Vultr) </td> </tr> <tr> <td> IPv4 </td> <td> 45.32.137[.]94 </td> <td> APT-associated infrastructure </td> </tr> <tr> <td> Domain </td> <td> trycloudflare[.]com </td> <td> Abused for SCATTERED SPIDER tunneling (alert, not block — legitimate service) </td> </tr> <tr> <td> Domain </td> <td> Vpsvault[.]host </td> <td> Malicious hosting infrastructure </td> </tr> <tr> <td> Domain </td> <td> 107.191.61.105.vultr[.]com </td> <td> Adaptix C2 reverse DNS </td> </tr> <tr> <td> SHA-256 </td> <td> 9e0c2a9f281d7e54a542f59a6255016a0079cb24afcc6feead968ced3042a6d4 </td> <td> Malware sample — APT-associated </td> </tr> <tr> <td> SHA-256 </td> <td> 703ad46a35788b02709709f2687530d3adf8d9098f4599f86932b7f861f667ef </td> <td> Malware sample — APT-associated </td> </tr> <tr> <td> SHA-256 </td> <td> f939005f6f4ffd8db22fda5da78d0d6d54a35e41d9c63ed0088c98c453d9c002 </td> <td> Malware sample — APT-associated </td> </tr> <tr> <td> SHA-256 </td> <td> 38c2a69ff2cec4892feab5f4c936f9b37d345edf66a8da2647ac2b0a0fb91508 </td> <td> Malware sample </td> </tr> <tr> <td> SHA-256 </td> <td> 34decefae1a43abb9194993eafbbe8a53aec75a64d1b7c5ec968a977b8e9cbe8 </td> <td> Malware sample </td> </tr> <tr> <td> SHA-256 </td> <td> 3df168d6c5732e448edb4b4bd120bf2573e67fcbcf3618792a90d20f9a4460b0 </td> <td> Malware sample </td> </tr> <tr> <td> SHA-256 </td> <td> e1c7c16eaccd612a8b4c93b7d07907ec7ef8b4fef4034deb2e444fe0a05932e7 </td> <td> Malware sample </td> </tr> </tbody> </table> Additional IOCs available via Anomali ThreatStream Next-Gen. Note on trycloudflare[.]com: This is a legitimate Cloudflare service abused by SCATTERED SPIDER for tunneling. Blocking it outright may cause operational disruption. Recommended approach: alert on DNS resolution, investigate any endpoint resolving it, and block only if your organization has no legitimate use case. <h2> Sector-Specific Defensive Priorities </h2> <h3> Financial Services (State Treasury, Revenue, Benefits Systems) </h3> <ul> <li> Primary threat: Infostealer campaigns (Lumma, Meduza, RedLine) targeting credentials for financial platforms; BianLian ransomware targeting data exfiltration from payment systems </li> <li> Action: Audit all service accounts accessing financial databases for credential hygiene. Deploy browser-based credential theft detection. Monitor for bulk PII access patterns that could indicate pre-ransomware staging. </li> <li> Specific concern: Aeza Group sanctions may temporarily disrupt infostealer C2, but operators will migrate infrastructure within days. Do not assume reduced risk. </li> </ul> <h3> Energy (State Facilities, Power Management, Building Automation) </h3> <ul> <li> Primary threat: ICS vulnerabilities in Schneider Electric EcoStruxure (data center management) and B&R products (XZ Utils supply chain backdoor) </li> <li> Action: Inventory all Schneider Electric EcoStruxure IT Data Center Expert deployments. Verify B&R product firmware is not running compromised XZ Utils versions. Ensure building automation systems are network-segmented from IT. </li> <li> Specific concern: The XZ Utils backdoor in B&R products (ICSA-26-181-05) represents a supply chain compromise — verify integrity of all B&R firmware updates applied in the last 12 months. </li> </ul> <h3> Healthcare (State Health & Human Services, Medicaid Systems) </h3> <ul> <li> Primary threat: Ransomware (Krybit, Stormous, NightSpire all active against healthcare); SCATTERED SPIDER lateral movement to SaaS platforms containing PHI </li> <li> Action: Verify backup integrity for Medicaid management systems. Ensure SaaS platforms storing PHI (Salesforce Health Cloud, Epic integrations) have conditional access policies preventing access from unmanaged devices. Brief clinical system administrators on vishing risk. </li> <li> Specific concern: ICSMA-26-181-01 (OFFIS DCMTK medical imaging toolkit) — verify if state health systems use DCMTK for DICOM processing and patch accordingly. </li> </ul> <h3> Government (All Executive Branch Agencies) </h3> <ul> <li> Primary threat: APT29/SVR credential harvesting via personal messaging apps (Signal, WhatsApp, Telegram); SCATTERED SPIDER vishing for Entra ID compromise; SharePoint exploitation for initial access </li> <li> Action: Issue directive to all senior officials: do not use personal messaging apps for government business. Implement phishing-resistant MFA (FIDO2/hardware keys) for all executive accounts. Patch SharePoint within 48 hours. </li> <li> Specific concern: The convergence of SCATTERED SPIDER and CHATTY SPIDER using identical vishing playbooks means your help desk faces attacks from multiple independent groups — a single procedural fix (callback verification) defeats both. </li> </ul> <h3> Aviation/Logistics (State DOT, Airport Authorities, Port Systems) </h3> <ul> <li> Primary threat: SCATTERED SPIDER has explicitly expanded to aviation; state transportation systems share infrastructure patterns with commercial aviation targets </li> <li> Action: Review all VDI and remote access systems used by DOT staff for MFA bypass vulnerabilities. Audit VMware vCenter access controls — SCATTERED SPIDER specifically targets vCenter for ntds.dit extraction. Monitor for S3 Browser or unusual cloud storage tool usage. </li> <li> Specific concern: State DOT systems often interconnect with federal FAA and FHWA systems — a compromise could provide lateral access to federal infrastructure, escalating the incident significantly. </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Within 24 Hours) </h3> <table> <thead> <tr> <th> Action </th> <th> Owner </th> <th> Rationale </th> </tr> </thead> <tbody> <tr> <td> Patch Microsoft SharePoint for CVE-2026-45659 </td> <td> IT Operations </td> <td> Actively exploited RCE; CISA BOD 22-01 mandates remediation. State SharePoint farms are confirmed in-scope. </td> </tr> <tr> <td> Brief all IT help desk staff on vishing attacks targeting Entra ID/MFA resets </td> <td> Security Operations / IT Service Management </td> <td> SCATTERED SPIDER uses this exact playbook. Implement mandatory callback verification to a registered manager phone number before any credential reset. </td> </tr> <tr> <td> Confirm SimpleHelp patch status (CVE-2026-48558) across all MSP-managed environments </td> <td> IT Operations / Vendor Management </td> <td> CVSS 10.0, on CISA KEV since 29 June. Any unpatched MSP-managed SimpleHelp instance = full system compromise via forged OIDC tokens. </td> </tr> <tr> <td> Block/alert on IOCs listed above </td> <td> SOC </td> <td> Deploy to firewalls, EDR, DNS filtering, and SIEM correlation rules. </td> </tr> <tr> <td> Issue messaging app directive to senior officials </td> <td> CISO / Executive Communications </td> <td> APT29/SVR actively harvesting credentials via Signal, WhatsApp, Telegram. Prohibit use for government business; recommend Signal only for personal use with disappearing messages enabled. </td> </tr> </tbody> </table> <h3> 7-DAY </h3> <table> <thead> <tr> <th> Action </th> <th> Owner </th> <th> Rationale </th> </tr> </thead> <tbody> <tr> <td> Audit JetBrains Hub version; upgrade to 2026.1.13757+ </td> <td> DevOps / Application Security </td> <td> CVSS 10.0 authentication bypass. Verify no internet-facing instances exist. Historical precedent: TeamCity CVE was weaponized in <48 hours. </td> </tr> <tr> <td> Review ICS advisory applicability (ICSA-26-181-04, -07) for state water/facilities </td> <td> OT/ICS Security Team </td> <td> Delta DVP12SE PLC and Schneider Saitel DP RTU — remote command execution. Apply vendor patches or implement network segmentation. </td> </tr> <tr> <td> Deploy tunneling tool detection </td> <td> SOC / Network Security </td> <td> Alert on DNS queries to trycloudflare[.]com, ngrok[.]io, pinggy[.]io. Hunt for Chisel, Rsocx, Teleport binaries. Monitor PowerShell mail transport rule changes in M365. </td> </tr> <tr> <td> Conduct tabletop exercise: "vishing leads to domain compromise" </td> <td> CISO / IR Team </td> <td> Validate that incident response procedures account for social-engineering-initiated identity compromise. Test: can your SOC detect a vished credential reset before lateral movement begins? </td> </tr> <tr> <td> Review and harden SharePoint WAF rules </td> <td> Network Security / IT Operations </td> <td> Add detection for serialized .NET object payloads. Consider accelerated patching SLA specifically for SharePoint given two KEVs in recent weeks. </td> </tr> </tbody> </table> <h3> 30-DAY </h3> <table> <thead> <tr> <th> Action </th> <th> Owner </th> <th> Rationale </th> </tr> </thead> <tbody> <tr> <td> Resolve OSINT intelligence feed failure </td> <td> CISO / CTO </td> <td> 137 days degraded. Evaluate commercial OSINT API alternatives (Recorded Future, Mandiant Advantage, GreyNoise). This gap is degrading legislative monitoring and nation-state tracking capabilities. Requires executive decision and budget allocation. </td> </tr> <tr> <td> Conduct threat hunt for Adaptix C2 beaconing </td> <td> SOC / Threat Hunting </td> <td> Search for communications to 45.32.64[.]12 on port 4321. This IOC has persisted at high confidence for 7+ days without confirmed absence from the environment. </td> </tr> <tr> <td> Evaluate SharePoint migration to fully-managed SharePoint Online </td> <td> IT Architecture / CTO </td> <td> Structural risk reduction: Microsoft manages patching for SharePoint Online. Two KEV-listed deserialization vulnerabilities in recent weeks demonstrate that on-premises SharePoint is a persistent liability. </td> </tr> <tr> <td> Assess Hunters International affiliate migration risk </td> <td> CTI / SOC </td> <td> Monitor for new ransomware campaigns from Qilin, DragonForce, or Akira that show TTPs consistent with former Hunters International operators. Update detection rules accordingly. </td> </tr> <tr> <td> Implement phishing-resistant MFA (FIDO2) for all privileged accounts </td> <td> IAM / IT Security </td> <td> Defeats both vishing-based credential theft and AiTM phishing. Prioritize: domain admins, help desk staff with reset privileges, executive accounts, and OT/ICS administrators. </td> </tr> </tbody> </table> <h2> Bottom Line </h2> The threat landscape facing state government IT is not abstract. SharePoint is being exploited right now . Threat actors are calling help desks today to steal identities. PLCs in your water treatment plants have published vulnerabilities enabling remote command execution. The good news: the most impactful defensive actions this week are procedural, not budgetary. A callback-verification policy for credential resets costs nothing and defeats two independent threat groups. Patching SharePoint within 48 hours is an operational decision, not a procurement one. Confirming SimpleHelp patch status with your MSPs requires a phone call. The 30-day items — OSINT feed restoration, FIDO2 deployment, SharePoint architecture decisions — require executive sponsorship and budget. But they address structural vulnerabilities that will generate recurring crises until resolved. Act on the immediates today. Brief your leadership on the 7-day items tomorrow. Put the 30-day items on next week's governance agenda. The adversaries are not waiting. Anomali CTI Desk | 2 July 2026 | TLP:GREEN This report is based on intelligence collected through 2 July 2026. IOCs and threat actor attributions are derived from ThreatStream Next-Gen, CISA advisories, and vetted partner feeds. Additional IOCs and context available via ThreatStream Next-Gen.

FEATURED RESOURCES

July 2, 2026

Anomali Cyber Watch

Iran's Cyber War Machine Hits Triple Speed: What CISOs Must Do Now

July 2, 2026

Anomali Cyber Watch

Public Sector

Actively Exploited SharePoint Flaw, Help Desk Vishing Surge, and ICS Advisories Demand Immediate State Government Action

July 1, 2026

Anomali Cyber Watch

Iran's Cyber War Machine Isn't Waiting for a Ceasefire: What CISOs Must Do Now

Explore All