AI-Driven Exploits, CISA Deadlines, and Ransomware Infrastructure Disruption: What State CISOs Must Act On This Week

Public Sector

Published on

May 27, 2026

Table of Contents

Threat Assessment Level: ELEVATED (trending toward HIGH) Three actively exploited vulnerabilities carry federal remediation deadlines this week. A structural shift in AI-powered exploit discovery has permanently compressed the window between vulnerability disclosure and weaponization. Meanwhile, the FBI's takedown of criminal VPN infrastructure used by 25 ransomware groups offers only temporary relief — adversary adaptation is expected within two weeks. State government IT leaders face a convergence of immediate patching obligations, evolving ransomware tradecraft, and a fundamental challenge to existing patch management timelines. This brief provides the intelligence and operational guidance needed to act decisively. <h2> What Changed </h2> <table> <thead> <tr> <th> Development </th> <th> Why It Matters for State Government </th> </tr> </thead> <tbody> <tr> <td> CISA adds CVE-2026-48172 to KEV (LiteSpeed cPanel Plugin, CVSS 9.8) </td> <td> Root-level privilege escalation actively exploited in the wild. Federal remediation deadline: 29 May 2026 . Any state agency using cPanel/LiteSpeed web hosting is exposed. </td> </tr> <tr> <td> Microsoft SharePoint RCE disclosed (CVE-2026-45659, CVSS 8.8) </td> <td> Authenticated users with basic Site Member permissions can execute arbitrary code. SharePoint's history of rapid KEV additions (CVE-2026-32201 added in April) makes exploitation likely. </td> </tr> <tr> <td> 700+ Ghost CMS sites hijacked (CVE-2026-26980, CVSS 9.4) </td> <td> Active SQL injection campaign since 7 May injects malicious JavaScript into legitimate websites, deploying ClickFix social engineering lures that execute PowerShell payloads on visitor machines. </td> </tr> <tr> <td> Drupal CVE-2026-9082 KEV deadline: today (CVSS 9.8) </td> <td> 15,000+ exploitation attempts across 6,000 sites. CISA KEV remediation deadline is 27 May 2026 — any unpatched Drupal instance is overdue. </td> </tr> <tr> <td> FBI disrupts "First VPN Service" </td> <td> Criminal anonymization infrastructure used by ~25 ransomware groups since 2014 — taken down in international operation. Expect 7–14 day adversary migration period before operations resume on new infrastructure. </td> </tr> <tr> <td> Kali365 phishing platform confirmed </td> <td> FBI PSA confirms complete Microsoft 365 MFA bypass via OAuth device code token theft. State M365 tenants are high-value targets. </td> </tr> <tr> <td> AI achieves tier-5 autonomous exploit discovery </td> <td> Full OS vulnerability sweeps now cost <$20,000. China's mandatory 48-hour disclosure pipeline (RMSV 2021) gives state-backed actors structured access to findings before public disclosure. Patching windows measured in weeks are no longer viable. </td> </tr> <tr> <td> Nation-state activity: Nimbus Manticore + Volt/Salt Typhoon </td> <td> Check Point documents Nimbus Manticore (IRGC/UNC1549) conducting AI-assisted campaigns targeting aviation, software, and government under Operation Epic Fury. Volt Typhoon and Salt Typhoon maintain pre-positioned access in U.S. critical infrastructure with no new indicators this cycle — absence is not reassurance. </td> </tr> <tr> <td> 6 ABB ICS advisories published </td> <td> Covering PLCs, SCADA runtime, EV chargers, and building automation — all systems deployed across state critical infrastructure. </td> </tr> </tbody> </table> <h2> Threat Timeline </h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Impact </th> </tr> </thead> <tbody> <tr> <td> 7 May 2026 </td> <td> Ghost CMS exploitation campaign begins (CVE-2026-26980) </td> <td> 700+ websites compromised with ClickFix JavaScript injection </td> </tr> <tr> <td> 20 May 2026 </td> <td> Drupal emergency patch for CVE-2026-9082 (CVSS 9.8) </td> <td> 15,000+ exploitation attempts across 6,000 sites; CISA KEV deadline 27 May </td> </tr> <tr> <td> 21 May 2026 </td> <td> LiteSpeed releases patch for CVE-2026-48172 </td> <td> Zero-day exploitation confirmed prior to patch availability </td> </tr> <tr> <td> 22 May 2026 </td> <td> CISA adds Drupal CVE-2026-9082 to KEV </td> <td> Federal agencies mandated to remediate by 27 May </td> </tr> <tr> <td> 25 May 2026 </td> <td> FBI PSA on Kali365 phishing platform </td> <td> Confirms complete Microsoft 365 MFA bypass via OAuth device code token theft </td> </tr> <tr> <td> 25 May 2026 </td> <td> Check Point publishes Nimbus Manticore (IRGC/UNC1549) analysis </td> <td> AI-assisted malware and SEO poisoning targeting aviation, software, government </td> </tr> <tr> <td> 26 May 2026 </td> <td> CISA adds CVE-2026-48172 (LiteSpeed) to KEV </td> <td> Federal remediation deadline: 29 May 2026 </td> </tr> <tr> <td> 26 May 2026 </td> <td> Microsoft discloses CVE-2026-45659 (SharePoint RCE) </td> <td> Authenticated RCE with low-privilege account; patch available </td> </tr> <tr> <td> 26 May 2026 </td> <td> FBI announces "First VPN Service" takedown </td> <td> 32 exit nodes across 27 countries seized; 25 ransomware groups affected </td> </tr> <tr> <td> 26 May 2026 </td> <td> Cato CTRL publishes AI zero-day economics brief </td> <td> Documents <$20K full-OS exploit discovery; China's structured pipeline advantage </td> </tr> <tr> <td> 26 May 2026 </td> <td> CISA publishes 6 ABB ICS advisories </td> <td> PLCs, SCADA, EV chargers, building automation affected </td> </tr> </tbody> </table> <h2> Key Threat Analysis </h2> <h3> 1. LiteSpeed cPanel Root Escalation (CVE-2026-48172) — IMMEDIATE ACTION REQUIRED </h3> A privilege escalation vulnerability in the LiteSpeed User-End cPanel Plugin (versions 2.3–2.4.4) allows arbitrary script execution with root privileges on hosting servers. CISA confirmed active exploitation as a zero-day prior to the 21 May patch. The vulnerability is tagged with espionage motivation targeting U.S. government infrastructure. What to look for: Any state agency web hosting environment running cPanel with LiteSpeed. Run this detection command across hosting infrastructure: grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null Fix: Upgrade to WHM Plugin 5.3.1.0 (bundles user-end plugin 2.4.7+). CISA deadline: 29 May 2026 . <h3> 2. Microsoft SharePoint Server RCE (CVE-2026-45659) </h3> A deserialization vulnerability allows any authenticated user with Site Member permissions to execute arbitrary code on SharePoint Server. While Microsoft currently assesses exploitation as "less likely," SharePoint has a documented pattern of rapid escalation — CVE-2026-32201 was added to the KEV catalog in April 2026. Post-exploitation typically involves web shell deployment for persistent access. Affected systems: SharePoint Server Subscription Edition, SharePoint Server 2019, SharePoint Enterprise Server 2016 — all common in state government hybrid environments connected to Microsoft 365. Risk assessment: The low privilege requirement (Site Member, not Site Owner or Admin) dramatically expands the attack surface. Any compromised standard user account becomes a path to server-level code execution. <h3> 3. Ghost CMS Mass Compromise Campaign (CVE-2026-26980) </h3> Since 7 May, attackers have exploited a critical SQL injection (CVSS 9.4) in Ghost CMS to hijack 700+ websites. The attack chain is sophisticated: <ol> <li> Initial access: Unauthenticated SQL injection steals Admin API keys from the database </li> <li> Content injection: Malicious JavaScript injected into published articles </li> <li> Social engineering: Visitors see fake CAPTCHA/Cloudflare "ClickFix" screens </li> <li> Payload delivery: Victims unknowingly execute Base64-encoded PowerShell commands </li> <li> Execution: Payload delivered via rundll32.exe or trojanized Electron application installer </li> </ol> Any state agency running Ghost CMS versions 3.24.0 through 6.19.0 for public-facing websites is vulnerable. The campaign weaponizes trusted .gov content against citizens visiting legitimate state websites. <h3> 4. Ransomware Ecosystem: Disruption and Adaptation </h3> The FBI's takedown of "First VPN Service" — a criminal anonymization network operating since 2014 across 32 exit nodes in 27 countries — temporarily degrades the operational capability of approximately 25 ransomware groups. The service was advertised exclusively on underground forums Exploit[.]in and XSS[.]is, using protocols designed to evade detection: <ul> <li> VLESS/Reality — disguises VPN traffic as legitimate HTTPS </li> <li> WireGuard, OpenConnect, Outline — standard encrypted tunneling </li> <li> OpenVPN ECC, L2TP/IPSec — legacy protocol support </li> </ul> Key actors affected: Groups in the Avaddon/NoEscape ransomware lineage. The Abyss Locker ransomware operation — which specifically exploits VPN appliances for initial access before deploying ransomware against virtualized infrastructure — operates within this same ecosystem. Forecast: Expect a 7–14 day operational pause followed by migration to alternative anonymization infrastructure. State government remains a high-value ransomware target due to political visibility, citizen data holdings, and budget-constrained patching timelines. <h3> 5. AI-Accelerated Exploit Discovery: A Structural Shift </h3> The most strategically significant finding this cycle is not a single vulnerability but a permanent change in threat economics: <ul> <li> Anthropic's Claude Mythos Preview achieved autonomous tier-5 control-flow hijack exploits, including a 27-year-old OpenBSD TCP SACK bug and FreeBSD NFS CVE-2026-4747 </li> <li> China's Qihoo 360 claims ~1,000 vulnerabilities discovered via AI-assisted methods </li> <li> Cost: A full operating system vulnerability sweep now costs under $20,000 </li> <li> China's advantage: The Regulations on Management of Security Vulnerabilities (RMSV 2021) mandate 48-hour disclosure to MIIT, which routes findings to MSS — giving state-backed actors (Volt Typhoon, Salt Typhoon) structured access to exploits before vendors or defenders are notified </li> </ul> Implication for state government: The assumption that "no public proof-of-concept equals low risk" is no longer valid. Legacy systems previously considered "too obscure to target" — older FreeBSD deployments, embedded network stacks, niche SCADA firmware — are now economically viable targets for AI-assisted discovery. <h3> 6. Nation-State Pre-Positioning: Quiet but Not Gone </h3> Volt Typhoon (China) and Salt Typhoon (China) — both documented as pre-positioning within U.S. critical infrastructure for potential disruption during geopolitical crisis — have not generated new campaign indicators this cycle. This absence is notable, not reassuring. These actors specialize in living-off-the-land techniques (legitimate tools, valid credentials, no malware signatures) that evade traditional detection. The persistent OSINT collection gap may also be masking reporting on their activity. Nimbus Manticore (IRGC-affiliated, also tracked as UNC1549) was documented on 25 May conducting AI-assisted malware campaigns and SEO poisoning under Operation Epic Fury targeting aviation, software, and government sectors. <h2> Predictive Analysis </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Timeframe </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> Ransomware groups resume operations on new anonymization infrastructure after First VPN takedown </td> <td> HIGH (85%) </td> <td> 7–14 days </td> <td> Historical pattern: criminal infrastructure rebuilds rapidly; 25 groups have strong financial motivation </td> </tr> <tr> <td> CVE-2026-45659 (SharePoint RCE) added to CISA KEV catalog </td> <td> MODERATE-HIGH (65%) </td> <td> 14–30 days </td> <td> SharePoint KEV precedent (CVE-2026-32201 added April 2026); low exploitation barrier; high-value target </td> </tr> <tr> <td> Ghost CMS ClickFix campaign expands to target .gov websites </td> <td> MODERATE (55%) </td> <td> 7–21 days </td> <td> 700+ sites already compromised; campaign is automated and scaling; any unpatched Ghost instance is at risk </td> </tr> <tr> <td> AI-discovered zero-days exploited against state infrastructure without prior public disclosure </td> <td> MODERATE (50%) </td> <td> 30–90 days </td> <td> China's RMSV pipeline provides structural advantage; <$20K discovery cost removes economic barrier </td> </tr> <tr> <td> Volt Typhoon activity detected in state/local government networks </td> <td> MODERATE (45%) </td> <td> 30–60 days </td> <td> 22+ days without new indicators despite known pre-positioning; detection may lag due to LOTL techniques </td> </tr> <tr> <td> Kali365 phishing platform used against state M365 tenants </td> <td> MODERATE (50%) </td> <td> 7–30 days </td> <td> FBI PSA confirmed complete MFA bypass; state government M365 deployments are high-value targets </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Detection Priorities </h3> <table> <thead> <tr> <th> ATT&CK Technique </th> <th> What to Hunt </th> <th> Detection Approach </th> </tr> </thead> <tbody> <tr> <td> T1068 — Exploitation for Privilege Escalation </td> <td> LiteSpeed cPanel exploitation artifacts </td> <td> Search cPanel logs for cpanel_jsonapi_func=redisAble; monitor for unexpected root-level process creation on web hosting servers </td> </tr> <tr> <td> T1190 — Exploit Public-Facing Application </td> <td> SharePoint deserialization, Ghost CMS SQL injection, LiteSpeed exploitation </td> <td> WAF alerts on serialized object payloads to SharePoint endpoints; SQL injection signatures against Ghost Content API (/ghost/api/content/) </td> </tr> <tr> <td> T1059.001 — PowerShell </td> <td> ClickFix payload execution from Ghost CMS campaign </td> <td> Alert on powershell.exe spawned by browser processes; Base64-encoded command lines >500 characters; PowerShell downloading and executing DLLs </td> </tr> <tr> <td> T1218.011 — Rundll32 </td> <td> ClickFix second-stage payload </td> <td> rundll32.exe executing DLLs from user temp directories or download folders; unsigned DLLs loaded by rundll32 </td> </tr> <tr> <td> T1090 — Proxy / T1133 — External Remote Services </td> <td> Ransomware groups using anonymization protocols </td> <td> VLESS/Reality protocol on port 443 (mimics HTTPS but detectable via TLS fingerprinting); unauthorized WireGuard/OpenConnect sessions </td> </tr> <tr> <td> T1505.003 — Web Shell </td> <td> SharePoint post-exploitation persistence </td> <td> New .aspx files in SharePoint web directories; unexpected IIS worker process spawning cmd.exe or PowerShell </td> </tr> <tr> <td> T1078 — Valid Accounts </td> <td> Credential abuse via stolen tokens (Kali365, First VPN) </td> <td> Impossible travel alerts; authentication from known VPN/proxy ASNs; OAuth device code flow from unexpected locations </td> </tr> <tr> <td> T0831 — Manipulation of Control </td> <td> ABB ICS exploitation </td> <td> Anomalous commands to ABB AC500 V2 PLCs; unexpected firmware update attempts on ABB Terra AC chargers; Zenon runtime crashes </td> </tr> </tbody> </table> <h3> Hunting Hypotheses </h3> <ol> <li> Hypothesis: State web hosting infrastructure running cPanel/LiteSpeed has been compromised via CVE-2026-48172 prior to patch availability. </li> <ul> <li> Hunt: Audit all cPanel access logs for the period 1–21 May 2026 (pre-patch window). Look for privilege escalation indicators, new cron jobs running as root, unauthorized SSH keys added. </li> </ul> <li> Hypothesis: A compromised Site Member account is being used to stage SharePoint exploitation. </li> <ul> <li> Hunt: Review SharePoint ULS logs for deserialization errors or unusual API calls from accounts that recently had password resets or MFA challenges. Check for new .aspx files in SharePoint hives. </li> </ul> <li> Hypothesis: State agency Ghost CMS instances have been injected with malicious JavaScript. </li> <ul> <li> Hunt: Crawl all state .gov Ghost CMS sites for injected <script> tags not present in source templates. Check for unauthorized Admin API key generation in Ghost logs. </li> </ul> <li> Hypothesis: Ransomware operators are probing state VPN appliances for initial access following First VPN Service disruption. </li> <ul> <li> Hunt: Correlate VPN authentication failures with known ransomware TTP patterns — brute force attempts (T1110) followed by successful authentication from new source IPs, especially from residential proxy ranges. </li> </ul> </ol> <h3> Blocking Guidance </h3> <ul> <li> Block VLESS/Reality protocol traffic at perimeter (detectable via JA3/JA4 fingerprint mismatch with legitimate HTTPS) </li> <li> Alert on authentication attempts from ASN 399629 (BL Networks, associated with First VPN Service) </li> <li> Block rundll32.exe execution of DLLs from %TEMP%, %USERPROFILE%\Downloads, and browser cache directories </li> <li> Implement Content Security Policy headers on all state Ghost CMS instances to prevent injected JavaScript execution </li> </ul> <h2> Sector-Specific Defensive Priorities </h2> <h3> Financial Services (State Treasury, Revenue, Pension Systems) </h3> <ul> <li> Primary threat: Ransomware groups (25 affected by First VPN takedown) historically target financial data for double extortion </li> <li> Immediate action: Verify Veeam backup infrastructure is isolated from domain credentials — Abyss Locker specifically targets backup deletion before encryption </li> <li> Detection focus: Monitor for OAuth device code phishing (Kali365) against treasury M365 accounts; these hold wire transfer authorization </li> <li> Regulatory note: India's 12-hour patching mandate for exploited vulnerabilities signals global regulatory direction — prepare for similar U.S. state-level requirements </li> </ul> <h3> Energy (State-Operated Utilities, Grid Coordination) </h3> <ul> <li> Primary threat: Volt Typhoon pre-positioning for disruption during geopolitical escalation; ABB ICS vulnerabilities in deployed equipment </li> <li> Immediate action: Inventory ABB AC500 V2 PLCs and Zenon SCADA runtime deployments; cross-reference against ICSA-26-146-01 through -06 </li> <li> Detection focus: Living-off-the-land activity in OT networks — legitimate admin tools (PowerShell, WMI, PsExec) executing from unexpected source hosts </li> <li> Architecture: Ensure OT/IT network segmentation prevents SharePoint or cPanel compromises from pivoting to control system networks </li> </ul> <h3> Healthcare (State Health Agencies, Medicaid Systems) </h3> <ul> <li> Primary threat: Ransomware targeting citizen health records (high extortion value); Ghost CMS ClickFix campaign could compromise public health information portals </li> <li> Immediate action: Audit any Ghost CMS instances hosting public health information; patch to 6.19.1+ and rotate API keys </li> <li> Detection focus: ClickFix lures on state health websites could deliver malware to citizens — monitor for reports of fake CAPTCHA screens on .gov health portals </li> <li> Regulatory note: HIPAA breach notification obligations amplify ransomware impact; ensure incident response plans account for 60-day notification timeline </li> </ul> <h3> Government (Executive Agencies, Legislative, Judicial) </h3> <ul> <li> Primary threat: Nation-state espionage (Volt Typhoon, Salt Typhoon, Nimbus Manticore); credential theft via Kali365 MFA bypass; SharePoint RCE for document exfiltration </li> <li> Immediate action: Patch SharePoint Server across all branches; implement conditional access policies blocking authentication from VPN/proxy ASNs </li> <li> Detection focus: Impossible travel on executive accounts; SharePoint document access anomalies (bulk downloads, access to sensitive libraries by accounts that don't normally touch them) </li> <li> Policy consideration: Dutch government blocked U.S. acquisition of DigiD on digital sovereignty grounds — monitor for similar state-level digital identity policy developments </li> </ul> <h3> Aviation & Logistics (State DOT, Airport Authorities, Port Systems) </h3> <ul> <li> Primary threat: Nimbus Manticore (IRGC/UNC1549) Operation Epic Fury specifically targets aviation; supply chain compromise through logistics software dependencies </li> <li> Immediate action: Review npm/PyPI dependencies in any custom logistics or scheduling applications — Glassworm botnet spread through these ecosystems since September 2025 </li> <li> Detection focus: SEO poisoning redirects from transportation-related searches; unusual DNS queries from logistics management systems </li> <li> Architecture: Ensure air-gapped or segmented networks for traffic management and port control systems; ABB EV charger vulnerabilities (ICSA-26-146-01) affect transportation infrastructure </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Within 48 Hours) </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> IT Operations </td> <td> Audit and patch all cPanel/LiteSpeed installations for CVE-2026-48172. Upgrade to WHM Plugin 5.3.1.0+. CISA KEV deadline: 29 May. Run detection: grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ </td> </tr> <tr> <td> 2 </td> <td> IT Operations </td> <td> Apply May 2026 SharePoint security updates (CVE-2026-45659) to all SharePoint Server instances. Prioritize internet-facing and hybrid-connected farms. Authorize emergency change window if needed. </td> </tr> <tr> <td> 3 </td> <td> IT Operations </td> <td> Patch or isolate all Ghost CMS instances below version 6.19.1. Rotate all Admin API keys. Audit published content for injected JavaScript (<script> tags not in original templates). </td> </tr> <tr> <td> 4 </td> <td> SOC </td> <td> Verify Drupal CVE-2026-9082 remediation is complete — today (27 May) is the CISA KEV deadline for this vulnerability. Confirm no state Drupal instances remain unpatched. </td> </tr> <tr> <td> 5 </td> <td> SOC </td> <td> Deploy detection rules for ClickFix indicators: PowerShell spawned by browsers, Base64 commands >500 chars, rundll32.exe loading DLLs from temp directories. </td> </tr> </tbody> </table> <h3> 7-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 6 </td> <td> Network Security </td> <td> Block or alert on VLESS/Reality protocol traffic on HTTPS ports. Implement JA3/JA4 fingerprint-based detection for VPN-over-HTTPS tunneling. </td> </tr> <tr> <td> 7 </td> <td> SOC </td> <td> Implement conditional access policies blocking M365 and VPN authentication from known proxy/anonymizer ASNs. Cross-reference ASN 399629 (BL Networks) against historical auth logs. </td> </tr> <tr> <td> 8 </td> <td> Identity Team </td> <td> Audit OAuth device code flow configurations in Azure AD. Restrict device code authentication to managed devices only. This blocks the Kali365 MFA bypass technique. </td> </tr> <tr> <td> 9 </td> <td> IT Operations </td> <td> Inventory all ABB ICS deployments (AC500 V2 PLCs, Zenon SCADA, Terra AC chargers, B&R Automation Runtime). Cross-reference against CISA advisories ICSA-26-146-01 through -06. Schedule vendor-recommended updates. </td> </tr> <tr> <td> 10 </td> <td> Development/DevOps </td> <td> Audit npm and PyPI dependencies in all state-developed applications for Glassworm botnet indicators. Pin dependencies to verified commit SHAs. Review VS Code extensions installed on developer workstations. </td> </tr> </tbody> </table> <h3> 30-DAY (Strategic) </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 11 </td> <td> CISO </td> <td> Reassess patch management SLAs in light of AI-accelerated exploit discovery. Current 30-day windows for critical vulnerabilities are inadequate. Recommend: 72-hour SLA for internet-facing systems with active exploitation, 7-day for critical CVSS without exploitation evidence. </td> </tr> <tr> <td> 12 </td> <td> CISO </td> <td> Commission red team assessment of SharePoint hybrid environments, focusing on privilege escalation paths from Site Member to server-level code execution. </td> </tr> <tr> <td> 13 </td> <td> CISO/Legal </td> <td> Review incident response plans for ransomware scenarios accounting for the post-takedown period. Groups migrating infrastructure often test new capabilities against targets of opportunity. Ensure backup isolation, communication plans, and legal/regulatory notification timelines are current. </td> </tr> <tr> <td> 14 </td> <td> IT Operations </td> <td> Implement network segmentation review ensuring OT/ICS networks (building automation, water/wastewater SCADA, traffic management) cannot be reached from compromised IT systems (SharePoint, cPanel, Ghost CMS). </td> </tr> <tr> <td> 15 </td> <td> CISO </td> <td> Evaluate OSINT and threat intelligence feed coverage — persistent gaps in open-source intelligence collection may be masking nation-state activity reporting. Ensure at least two independent intelligence sources cover each critical threat vector. </td> </tr> </tbody> </table> <h2> IOC Blocking Table </h2> The following indicators are derived from intelligence collection for the campaigns discussed in this report. Implement blocking and alerting as appropriate to your environment. Note on file hashes: SHA-256 hashes for malware samples associated with these campaigns are available through Anomali ThreatStream Next-Gen and partner feeds. See the ThreatStream Next-Gen collection for CVE-2026-26980 (Ghost CMS), CVE-2026-48172 (LiteSpeed), and the First VPN Service takedown for current, verified file indicators. <table> <thead> <tr> <th> Type </th> <th> Value </th> <th> Context </th> </tr> </thead> <tbody> <tr> <td> Domain </td> <td> Exploit[.]in </td> <td> Underground forum advertising criminal VPN/ransomware services </td> </tr> <tr> <td> Domain </td> <td> XSS[.]is </td> <td> Underground forum advertising criminal VPN/ransomware services </td> </tr> <tr> <td> Domain </td> <td> discordapp[.]com </td> <td> Abused for C2 and payload delivery in multiple campaigns — alert on unexpected outbound connections from servers and non-user workstations; do not block wholesale in user environments </td> </tr> <tr> <td> Process Name </td> <td> rundll32.exe </td> <td> Abused for DLL side-loading in ClickFix campaign </td> </tr> <tr> <td> Process Name </td> <td> feedbackAPI.exe </td> <td> Suspicious executable associated with tracked malware </td> </tr> <tr> <td> Process Name </td> <td> SophosAV.exe / auSophos.exe </td> <td> Masquerading filenames (not legitimate Sophos binaries) </td> </tr> <tr> <td> Process Name </td> <td> wmihelper.exe </td> <td> Suspicious WMI helper associated with persistence mechanisms </td> </tr> <tr> <td> Driver </td> <td> UpdateDrv.sys / ped.sys / 3ware.sys </td> <td> BYOVD (Bring Your Own Vulnerable Driver) candidates </td> </tr> <tr> <td> IPv4 </td> <td> 64.95.12[.]57 </td> <td> Infrastructure associated with tracked campaigns </td> </tr> <tr> <td> IPv4 </td> <td> 64.95.12[.]70 </td> <td> Infrastructure associated with tracked campaigns </td> </tr> <tr> <td> IPv4 </td> <td> 64.95.12[.]238 </td> <td> Infrastructure associated with tracked campaigns </td> </tr> <tr> <td> IPv4 </td> <td> 64.95.12[.]59 </td> <td> Infrastructure associated with tracked campaigns </td> </tr> <tr> <td> IPv4 </td> <td> 64.95.12[.]114 </td> <td> Infrastructure associated with tracked campaigns </td> </tr> </tbody> </table> Additional IOCs — including verified file hashes — for the campaigns discussed in this report are available through ThreatStream Next-Gen and partner feeds. <h2> The Bottom Line </h2> State government IT leaders face a week where three separate CVSS 9.0+ vulnerabilities demand simultaneous emergency response, the ransomware ecosystem is temporarily disrupted but actively adapting, and the fundamental economics of exploit discovery have permanently shifted against defenders. The 29 May CISA KEV deadline for CVE-2026-48172 is non-negotiable. SharePoint and Ghost CMS patching cannot wait for the next scheduled maintenance window. And the strategic reality — that AI can now discover critical exploits faster and cheaper than organizations can deploy patches — demands a policy-level conversation about whether current patch SLAs are fit for purpose. The FBI's disruption of criminal VPN infrastructure buys time, not safety. Use that window to harden, patch, and hunt. The adversaries will be back online within two weeks with new infrastructure and renewed motivation. Act now. The math has changed. Anomali CTI Desk | 2026-05-27 | TLP:GREEN For questions or additional IOC feeds, contact your Anomali account team or access indicators directly via ThreatStream Next-Gen.

FEATURED RESOURCES

May 27, 2026

Anomali Cyber Watch

Iranian Cyber Operations Expand Multi-Tool Staging Infrastructure as Conflict Enters Fourth Month

May 27, 2026

Anomali Cyber Watch

Public Sector

AI-Driven Exploits, CISA Deadlines, and Ransomware Infrastructure Disruption: What State CISOs Must Act On This Week

May 26, 2026

Anomali Cyber Watch

Iranian Cyber Operations Enter Most Dangerous Phase: Physical Destruction Without Malware Under Ceasefire Cover

Explore All