State Government Cyber Threat Brief: China-Nexus Supply Chain Attacks and PAN-OS Zero-Day Exploitation Demand Immediate Action

Public Sector

Published on

May 7, 2026

Table of Contents

Threat Assessment Level: ELEVATED Unchanged from prior cycle. The convergence of active state-sponsored exploitation of PAN-OS firewalls (CVE-2026-0300), a newly attributed China-nexus supply chain actor (UNC6863) targeting U.S. government networks, and a previously undocumented backdoor distributed via fake AI tools sustains the ELEVATED posture. Escalation to HIGH is warranted if PAN-OS exploitation broadens or ransomware detonations follow the current access broker loading phase. <h2> Introduction </h2> State government IT leaders face a compressed decision window this week. A critical zero-day vulnerability in Palo Alto Networks PAN-OS firewalls — already exploited by state-sponsored actors linked to Volt Typhoon and APT41 tooling — carries a CISA compliance deadline of May 9, but vendor patches won’t arrive until May 13. Simultaneously, a newly attributed China-nexus threat group (UNC6863) has been confirmed targeting U.S. government entities through a compromised software supply chain, and a novel backdoor is being distributed through fake AI productivity tool websites that state employees are likely visiting. The access broker pipeline feeding ransomware operations against government targets is actively being loaded. The window for defensive action is now — before initial access converts to lateral movement and data encryption. <h2> What Changed </h2> <table> <thead> <tr> <th> Development </th> <th> Date </th> <th> Significance </th> </tr> </thead> <tbody> <tr> <td> CVE-2026-0300 attributed to state-sponsored actors — Unit 42 tracks exploitation cluster CL-STA-1132 using Earthworm and ReverseSocks5 tunneling tools previously associated with Volt Typhoon and APT41 </td> <td> 2026-05-07 </td> <td> Confirms nation-state exploitation of PAN-OS firewalls; 5,400+ exposed VM-Series globally </td> </tr> <tr> <td> UNC6863 formally attributed — Google Threat Intelligence profiles new China-nexus actor behind DAEMONTOOLS supply chain compromise targeting U.S. Government </td> <td> 2026-05-06 </td> <td> Validates supply chain compromise active since March 27; government explicitly listed as target </td> </tr> <tr> <td> “Beagle” backdoor discovered — Previously undocumented malware distributed via fake Claude AI website (claude-pro[.]com) using DLL sideloading </td> <td> 2026-05-07 </td> <td> New capability in China-nexus tooling; exploits employee interest in AI tools </td> </tr> <tr> <td> ConnectWise RAT phishing campaign active — Invitation-themed emails deliver weaponized ScreenConnect for remote access </td> <td> 2026-05-07 </td> <td> Access broker pipeline feeding potential ransomware operations against government </td> </tr> <tr> <td> Five ICS advisories issued — ABB B&R, Hitachi Energy PCM600, Johnson Controls CEM AC2000 (privilege escalation in physical access control) </td> <td> 2026-05-05 </td> <td> Direct relevance to state government building security and SCADA systems </td> </tr> <tr> <td> CISA agentic AI guidance released — Joint guidance with international partners on security challenges of autonomous AI systems </td> <td> 2026-05-01 </td> <td> Emerging compliance framework for state AI procurement decisions </td> </tr> </tbody> </table> <h2> Threat Timeline </h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Actor/Source </th> </tr> </thead> <tbody> <tr> <td> 2026-03-27 </td> <td> UNC6863 first activity — DAEMONTOOLS supply chain compromise begins </td> <td> UNC6863 (China-nexus) </td> </tr> <tr> <td> 2026-04-08 </td> <td> Backdoored Daemon Tools binaries distributed (versions 12.5.0.2421–12.5.0.2434) </td> <td> UNC6863 </td> </tr> <tr> <td> 2026-04-09 </td> <td> First unsuccessful PAN-OS CVE-2026-0300 exploitation attempts </td> <td> CL-STA-1132 (state-sponsored) </td> </tr> <tr> <td> 2026-04-14–16 </td> <td> Large-scale AiTM phishing campaign compromises 35,000 users across 13,000 organizations </td> <td> Unattributed </td> </tr> <tr> <td> 2026-04-16 </td> <td> Successful PAN-OS RCE achieved; shellcode injected, Earthworm/ReverseSocks5 deployed </td> <td> CL-STA-1132 </td> </tr> <tr> <td> 2026-05-01 </td> <td> CISA releases agentic AI adoption security guidance </td> <td> CISA/ASD/Partners </td> </tr> <tr> <td> 2026-05-05 </td> <td> Five ICS advisories published (ABB, Hitachi Energy, Johnson Controls) </td> <td> CISA </td> </tr> <tr> <td> 2026-05-05 </td> <td> UNC6863 last confirmed activity </td> <td> UNC6863 </td> </tr> <tr> <td> 2026-05-06 </td> <td> CVE-2026-0300 added to CISA Known Exploited Vulnerabilities catalog </td> <td> CISA </td> </tr> <tr> <td> 2026-05-06 </td> <td> UNC6863 actor profile formally published </td> <td> Google Threat Intelligence </td> </tr> <tr> <td> 2026-05-07 </td> <td> Group-IB publishes PAN-OS exploitation attribution details </td> <td> Group-IB/Unit 42 </td> </tr> <tr> <td> 2026-05-07 </td> <td> Sophos X-Ops publishes Beagle backdoor analysis (claude-pro[.]com) </td> <td> Sophos </td> </tr> <tr> <td> 2026-05-07 </td> <td> ConnectWise RAT phishing campaign reported active </td> <td> Cofense Intelligence </td> </tr> </tbody> </table> <h2> Key Threat Analysis </h2> <h3> 1. PAN-OS Zero-Day (CVE-2026-0300) — State-Sponsored Exploitation with No Patch Available </h3> CVSS 9.3 | Actively Exploited | CISA Deadline: May 9, 2026 This is the most urgent threat facing state agencies running Palo Alto Networks firewalls. The vulnerability — a buffer overflow in the PAN-OS User-ID Authentication Portal (Captive Portal) — enables unauthenticated remote code execution. Unit 42 is tracking the exploitation cluster as CL-STA-1132, and the post-compromise tooling (Earthworm tunneling, ReverseSocks5 proxy chains) has been previously associated with Volt Typhoon and APT41 — both China-nexus groups with documented interest in U.S. government and critical infrastructure networks. The critical problem: CISA’s Binding Operational Directive requires remediation by May 9, but Palo Alto Networks patches are not expected until May 13. This creates a four-day gap where the only viable control is restricting Authentication Portal access to trusted internal IP ranges — a mitigation that may impact remote workforce authentication. Post-compromise indicators include: - Cleared crash kernel messages and nginx crash log entries - Missing core dump files - Unexpected SOCKS proxy processes (Earthworm, ReverseSocks5) - Protocol tunneling over non-standard ports Shadowserver identifies 5,400+ exposed VM-Series firewalls globally , with 1,998 in North America. Any state agency with internet-facing PAN-OS Authentication Portals should assume they are being scanned. <h3> 2. UNC6863 — New China-Nexus Actor Targeting U.S. Government via Software Supply Chain </h3> Google Threat Intelligence has formally attributed the DAEMONTOOLS supply chain compromise to UNC6863 , a newly tracked China-nexus threat group active since March 27, 2026. Confirmed targets include: Government, Education, Technology, Telecommunications, and Legal/Professional Services across the United States, Canada, Ukraine, Poland, Spain, Morocco, and New Zealand. The attack vector — trojanized versions of Daemon Tools (versions 12.5.0.2421 through 12.5.0.2434) — represents a sophisticated supply chain compromise. Government entities were confirmed among approximately 12 high-value secondary targets receiving QUIC RAT payloads after initial compromise. State agency risk: Any agency or employee that installed Daemon Tools during the March–May 2026 window should be treated as potentially compromised. The software is commonly used for disk imaging and virtual drive mounting — functions that IT staff and developers may use without formal procurement approval. <h3> 3. “Beagle” Backdoor — AI-Themed Malvertising Targets Productivity-Seeking Employees </h3> A previously undocumented backdoor dubbed “Beagle” is being distributed through claude-pro[.]com , a malicious website impersonating Anthropic’s Claude AI assistant. The attack chain uses DLL sideloading — a hallmark of the PlugX/ShadowPad ecosystem associated with China-nexus groups Dragon Breath and Gold Blade . The infection chain: 1. Victim downloads Claude-Pro-windows-x64.zip (~505MB) from the fake site 2. MSI installer drops a signed G DATA binary (NOVupdate.exe), a malicious DLL (avk.dll), and an encrypted payload 3. DLL sideloading triggers DonutLoader shellcode execution 4. Final payload: Beagle backdoor — no existing signatures will detect it Why this matters for state government: Employees across agencies are actively exploring AI tools for productivity gains. Without clear guidance and approved procurement channels, staff will search for and download tools from unofficial sources. This campaign directly exploits that behavior. <h3> 4. ConnectWise RAT Campaign — Access Broker Pipeline Loading </h3> An active phishing campaign uses invitation-themed lures (“join me for a joyful gathering on the 9th of May 2026”) to deliver ConnectWise ScreenConnect — a legitimate remote management tool weaponized as a RAT. The campaign also deploys credential phishing pages and uses Telegram bot APIs for command and control. This pattern is consistent with initial access broker operations — threat actors who establish persistent remote access to government networks, then sell that access to ransomware operators. The current absence of ransomware detonations against state/local government, combined with active access broker loading, suggests a 2–4 week window before potential ransomware deployment. <h3> 5. ICS/OT Vulnerabilities — Physical Access Control at Risk </h3> Five ICS advisories from CISA affect systems commonly deployed in state government facilities: - Johnson Controls CEM AC2000 — Privilege escalation allowing standard users to gain elevated access on the host machine. CEM AC2000 is a physical access control system managing building entry in government facilities. - ABB B&R Automation Runtime/Studio/PVI — Three vulnerabilities in industrial automation platforms used in water/wastewater and transportation systems. - Hitachi Energy PCM600 — Vulnerability in protection and control IED management used in energy infrastructure. <h2> Predictive Analysis </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Timeframe </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> PAN-OS exploitation attempts increase as CVE-2026-0300 details proliferate </td> <td> 80% </td> <td> Next 72 hours </td> <td> Public attribution + no patch until May 13 creates maximum exploitation window </td> </tr> <tr> <td> ConnectWise RAT campaign expands targeting; May 9 date in lure suggests imminent wave </td> <td> 60% </td> <td> Next 7 days </td> <td> Lure content references specific near-term date; campaign infrastructure active </td> </tr> <tr> <td> Ransomware deployment against state/local government following access broker loading phase </td> <td> 50% </td> <td> 2–4 weeks </td> <td> Active access broker pipeline (CLU-103) + historical pattern of 2–4 week dwell time </td> </tr> <tr> <td> Additional UNC6863 victims identified among state agencies using Daemon Tools </td> <td> 50% </td> <td> Next 14 days </td> <td> Compromise window (March 27–May 5) is broad; not all victims yet identified </td> </tr> <tr> <td> Beagle backdoor variants appear with additional AI-themed lures (ChatGPT, Copilot, Gemini) </td> <td> 45% </td> <td> Next 30 days </td> <td> Successful tradecraft tends to be replicated across multiple lure themes </td> </tr> <tr> <td> Volt Typhoon pre-positioning in state critical infrastructure via PAN-OS access </td> <td> 40% </td> <td> Ongoing </td> <td> Consistent with Volt Typhoon’s documented strategy of persistent infrastructure access </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Detection Priorities </h3> <table> <thead> <tr> <th> Priority </th> <th> What to Monitor </th> <th> ATT&CK Technique </th> <th> Detection Logic </th> </tr> </thead> <tbody> <tr> <td> CRITICAL </td> <td> PAN-OS Authentication Portal exploitation </td> <td> T1190 (Exploit Public-Facing Application) </td> <td> Alert on any external access to User-ID Authentication Portal; audit crash logs for gaps; hunt for Earthworm/ReverseSocks5 processes </td> </tr> <tr> <td> CRITICAL </td> <td> Unauthorized AI tool downloads </td> <td> T1204.002 (Malicious File) </td> <td> Web proxy alerts for downloads matching *claude*, *chatgpt*, *copilot*, *gemini* from non-official vendor domains </td> </tr> <tr> <td> HIGH </td> <td> DLL sideloading via G DATA binaries </td> <td> T1574.002 (DLL Side-Loading) </td> <td> Monitor for NOVupdate.exe loading avk.dll from non-standard paths; alert on any G DATA signed binary in user-writable directories </td> </tr> <tr> <td> HIGH </td> <td> Unauthorized ScreenConnect installations </td> <td> T1219 (Remote Access Software) </td> <td> Alert on ScreenConnect MSI installations not originating from approved IT deployment channels; monitor for relay domain connections </td> </tr> <tr> <td> MEDIUM </td> <td> Protocol tunneling from firewalls </td> <td> T1572 (Protocol Tunneling) </td> <td> Hunt for SOCKS proxy traffic originating from firewall management interfaces; detect Earthworm/ReverseSocks5 signatures </td> </tr> <tr> <td> MEDIUM </td> <td> Log tampering on network devices </td> <td> T1070.004 (File Deletion) </td> <td> Alert on crash log deletions, missing core dumps, or nginx log gaps on PAN-OS devices </td> </tr> </tbody> </table> <h3> Hunting Hypotheses </h3> <ol> <li> Hypothesis: State firewalls may have been compromised via CVE-2026-0300 since April 9. </li> </ol> <ul> <li> Hunt: Review PAN-OS crash logs for gaps between April 9 and present. Search for unexpected processes, SOCKS proxy binaries, or tunneling tools. Check for cleared core dumps. </li> <li> Techniques: T1190, T1059.004, T1572, T1070.004 </li> </ul> <ol> <li> Hypothesis: Employees may have downloaded trojanized Daemon Tools (versions 12.5.0.2421–12.5.0.2434) since March 27. </li> </ol> <ul> <li> Hunt: Query endpoint telemetry for Daemon Tools installations in the affected version range. Check software inventory for unauthorized installations. Search for QUIC protocol anomalies from endpoints. </li> <li> Techniques: T1195.002, T1071 </li> </ul> <ol> <li> Hypothesis: Access brokers have established ScreenConnect persistence in the environment. </li> </ol> <ul> <li> Hunt: Search for ScreenConnect client installations across all endpoints. Identify any relay connections to instance-dqb5m3-relay[.]screenconnect[.]com or instance-k9augs-relay[.]screenconnect[.]com. Check for ScreenConnect MSI files in email quarantine or download logs. </li> <li> Techniques: T1219, T1566.002 </li> </ul> <ol> <li> Hypothesis: Employees have visited claude-pro[.]com or downloaded the fake Claude installer. </li> </ol> <ul> <li> Hunt: Query web proxy logs for connections to claude-pro[.]com and vertextrust-advisors[.]com. Search endpoint telemetry for Claude-Pro-windows-x64.zip, Claude.msi, NOVupdate.exe, or avk.dll. Check startup folders for unexpected persistence. </li> <li> Techniques: T1574.002, T1204.002, T1547.001 </li> </ul> <h2> Sector-Specific Defensive Priorities </h2> <h3> Financial Services (State Treasury, Revenue, Comptroller) </h3> <ul> <li> Primary threat: Credential phishing via ConnectWise RAT campaign targeting financial transaction authorization workflows. Access brokers specifically value financial system credentials for ransomware leverage. </li> <li> Action: Enforce hardware token MFA (not SMS/push) for all financial transaction approvals. Audit ScreenConnect and other RMM tool presence on systems with access to treasury/payment platforms. Review SAP NetWeaver access controls — SAP released multiple security notes this cycle (CVE patches at me.sap.com/notes/3536461 and related). </li> <li> Monitor: Unusual after-hours access to financial systems; new RMM tool installations on finance endpoints. </li> </ul> <h3> Energy & Utilities (State-Operated Water/Wastewater, Power) </h3> <ul> <li> Primary threat: ICS vulnerabilities in ABB B&R and Hitachi Energy systems; Volt Typhoon pre-positioning strategy targeting critical infrastructure for disruption during geopolitical crisis. </li> <li> Action: Apply patches per ICSA-26-125-01 through ICSA-26-125-05. Segment OT networks from IT networks with unidirectional gateways where possible. Audit remote access to SCADA systems — ensure no internet-facing PAN-OS Authentication Portals provide access to OT zones. </li> <li> Monitor: Anomalous protocol tunneling from network perimeter devices into OT segments; unexpected firmware updates or parameter changes on ABB controllers. </li> </ul> <h3> Healthcare (State Health Agencies, Medicaid Systems) </h3> <ul> <li> Primary threat: Ransomware via access broker pipeline. Healthcare data commands premium prices, and state Medicaid systems contain PII on millions of residents. ConnectWise RAT campaign provides initial access that ransomware operators purchase. </li> <li> Action: Verify all RMM tools in the environment are authorized and inventoried. Implement application allowlisting on systems processing PHI/PII. Ensure offline backups of Medicaid enrollment and claims databases are current and tested. </li> <li> Monitor: ScreenConnect installations on healthcare endpoints; lateral movement from compromised workstations toward database servers; data staging in unusual directories. </li> </ul> <h3> Government (Executive Agencies, Law Enforcement, Elections) </h3> <ul> <li> Primary threat: Nation-state espionage via PAN-OS exploitation (Volt Typhoon/APT41) and supply chain compromise (UNC6863). State government networks contain law enforcement sensitive data, voter registration databases, and inter-agency communications that are high-value intelligence targets. </li> <li> Action: Restrict PAN-OS Authentication Portal access immediately. Audit Daemon Tools installations across all agency endpoints — any version 12.5.0.2421–12.5.0.2434 installed since March 27 should trigger incident response. Issue directive prohibiting unauthorized AI tool downloads. </li> <li> Monitor: Outbound QUIC protocol connections from endpoints (UNC6863 indicator); SOCKS proxy traffic from firewall management planes; access to voter registration or law enforcement databases from unusual source IPs. </li> </ul> <h3> Aviation & Logistics (State DOT, Airports, Port Authorities) </h3> <ul> <li> Primary threat: Critical infrastructure pre-positioning by Volt Typhoon; Johnson Controls CEM AC2000 privilege escalation affecting physical access control at transportation facilities. </li> <li> Action: Patch Johnson Controls CEM AC2000 per ICSA-26-125-05 — privilege escalation on physical access control hosts could allow unauthorized building/facility access. Review network segmentation between transportation management systems and general IT networks. </li> <li> Monitor: Privilege escalation attempts on access control system hosts; unauthorized badge system modifications; anomalous traffic from transportation management systems to external IPs. </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Within 24–48 Hours) </h3> <table> <thead> <tr> <th> # </th> <th> Action </th> <th> Responsible Team </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> Restrict PAN-OS User-ID Authentication Portal to trusted internal IP ranges only. If remote access depends on this portal, implement compensating controls (VPN-first architecture). CISA compliance deadline is May 9. </td> <td> Network Security / IT Ops </td> </tr> <tr> <td> 2 </td> <td> Hunt for ScreenConnect installations not deployed by IT. Query endpoint management for ScreenConnect.ClientSetup.msi or ScreenConnect client processes. Quarantine and investigate any unauthorized instances. </td> <td> SOC / Endpoint Team </td> </tr> <tr> <td> 3 </td> <td> Audit PAN-OS firewall logs for evidence of compromise since April 9: missing crash logs, cleared core dumps, unexpected processes, SOCKS proxy activity. </td> <td> SOC / Network Security </td> </tr> </tbody> </table> <h3> 7-DAY </h3> <table> <thead> <tr> <th> # </th> <th> Action </th> <th> Responsible Team </th> </tr> </thead> <tbody> <tr> <td> 5 </td> <td> Audit Daemon Tools installations across all endpoints. Any version 12.5.0.2421–12.5.0.2434 installed since March 27 triggers incident response investigation for UNC6863 compromise. </td> <td> Endpoint Team / IR </td> </tr> <tr> <td> 6 </td> <td> Patch Johnson Controls CEM AC2000 physical access control systems per ICSA-26-125-05. Verify standard users cannot escalate privileges on host machines. </td> <td> Facilities / OT Security </td> </tr> <tr> <td> 7 </td> <td> Issue employee advisory prohibiting download of AI tools from unofficial sources. Direct staff to approved procurement channels. Provide list of official vendor URLs for Claude, ChatGPT, Copilot, and Gemini. </td> <td> CISO Office / Communications </td> </tr> <tr> <td> 8 </td> <td> Implement web proxy detection rules for AI-themed downloads from non-official domains (pattern matching on *claude*, *chatgpt*, *copilot*, *gemini* from unauthorized sources). </td> <td> SOC / Web Security </td> </tr> <tr> <td> 9 </td> <td> Apply PAN-OS patches when released (expected May 13). Plan emergency change window. Validate patches on non-production firewalls first. </td> <td> Network Security / Change Management </td> </tr> </tbody> </table> <h3> 30-DAY </h3> <table> <thead> <tr> <th> # </th> <th> Action </th> <th> Responsible Team </th> </tr> </thead> <tbody> <tr> <td> 10 </td> <td> Develop formal agentic AI adoption policy aligned with CISA/ASD guidance (published May 1, 2026). Include security requirements for any AI system with autonomous action capabilities. </td> <td> CISO Office / Policy </td> </tr> <tr> <td> 11 </td> <td> Implement DLL sideloading detection — monitor for signed binaries loading unexpected DLLs from user-writable directories. Specific pattern: NOVupdate.exe + avk.dll. </td> <td> SOC / Detection Engineering </td> </tr> <tr> <td> 12 </td> <td> Review software procurement controls — the UNC6863 and Beagle campaigns both exploit gaps in software approval processes. Implement application allowlisting or software restriction policies for non-IT-approved installations. </td> <td> IT Governance / Endpoint Team </td> </tr> <tr> <td> 13 </td> <td> Conduct tabletop exercise simulating ransomware deployment following access broker compromise. Scenario: ScreenConnect RAT established → credential harvest → lateral movement → ransomware detonation. Test IR playbooks and backup restoration. </td> <td> CISO Office / IR Team </td> </tr> <tr> <td> 14 </td> <td> Assess BOD 26-02 compliance — review all edge devices (firewalls, VPN concentrators, load balancers) for management interface exposure. CISA’s Binding Operational Directive on edge device security applies to FCEB but sets the standard for state agencies. </td> <td> Network Security / Compliance </td> </tr> </tbody> </table> <h3> Executive / IR Preparedness </h3> <ul> <li> CIO Decision Required: Approve emergency change to restrict PAN-OS Authentication Portal access before May 9. If this impacts remote workforce authentication, a temporary VPN-first architecture may be needed. </li> <li> CISO Decision Required: Approve employee communication regarding unauthorized AI tool downloads. The Beagle backdoor campaign is active now. </li> <li> IR Team: Pre-stage incident response resources for potential ransomware event in 2–4 week window. Verify backup integrity, test restoration procedures, confirm communication plans with agency heads. </li> <li> Legal/Compliance: Review state breach notification obligations in context of potential UNC6863 supply chain compromise affecting resident PII. </li> </ul> <h2> Bottom Line </h2> Three converging threats demand action today. First, the PAN-OS zero-day (CVE-2026-0300) is being actively exploited by China-nexus actors with a CISA compliance deadline of May 9 and no vendor patch until May 13 — restrict Authentication Portal access now. Second, the UNC6863 supply chain compromise and Beagle backdoor campaign demonstrate that China-nexus actors are systematically exploiting gaps between what employees want to use and what IT has approved — software procurement controls and employee communications are not optional. Third, the ConnectWise RAT access broker pipeline is actively loading, and historical patterns suggest ransomware deployment within 2–4 weeks if initial access is not evicted. State agencies that act on the immediate recommendations in this brief can close the most critical exposure windows before they convert to incidents. <h2> Closing </h2> The intelligence picture this week presents a clear pattern: China-nexus actors are investing heavily in supply chain and social engineering vectors to gain persistent access to U.S. government networks, while the ransomware ecosystem’s access broker pipeline continues loading. The PAN-OS zero-day creates an immediate crisis requiring action before May 9, but the broader strategic challenge is the expanding software supply chain attack surface — from Daemon Tools to fake AI websites — that exploits gaps between what employees want to use and what IT has approved. The four-day window between CISA’s compliance deadline (May 9) and patch availability (May 13) is not a reason to delay. It is a reason to implement the mitigation now and plan the patch for the moment it drops. Every day of delay is a day that state-sponsored actors with confirmed exploitation capability have access to your perimeter. Act on the immediate recommendations today. Brief your agency CIOs on the AI tool risk this week. And prepare your incident response team for the ransomware scenario that the current access broker activity is building toward.

FEATURED RESOURCES

May 7, 2026

Anomali Cyber Watch

Iranian Cyber Forces in “Coiled Spring” Posture: What CISOs Must Do Before the Window Closes

May 7, 2026

Anomali Cyber Watch

Public Sector

State Government Cyber Threat Brief: China-Nexus Supply Chain Attacks and PAN-OS Zero-Day Exploitation Demand Immediate Action

May 6, 2026

Anomali Cyber Watch

The Calm Before the Storm: Iran’s Cyber Forces Are Pre-Positioning While Diplomats Talk

Explore All