Cisco SD-WAN Under Active Attack, FortiSandbox Exploits Go AI-Assisted, and Dual-RMM Phishing Targets Government: What State CISOs Must Do This Week

Public Sector

Published on

June 16, 2026

Table of Contents

Threat Assessment Level: ELEVATED Elevated from GUARDED in the prior cycle due to confirmed mass exploitation of state government enterprise systems and active weaponization of perimeter VPN and SD-WAN infrastructure by both criminal and nation-state actors. This level is maintained based on three new actively exploited vulnerabilities added to CISA's Known Exploited Vulnerabilities (KEV) catalog within 72 hours, continued ransomware operator infrastructure refresh targeting government, and fresh APT29 malware samples targeting government networks. <h2> Introduction </h2> State government IT leaders face a convergence of threats this week that demands immediate executive attention. In the span of 72 hours, CISA has confirmed active exploitation of Cisco SD-WAN infrastructure — the backbone of many state wide-area networks — while three critical Fortinet FortiSandbox vulnerabilities are being exploited in the wild, one using a confirmed AI-developed exploit. Simultaneously, a sophisticated phishing campaign is delivering dual remote management tools to government targets, and Russia's APT29 has deployed fresh credential-harvesting malware aimed at government and telecommunications sectors. This is not a theoretical risk briefing. These are confirmed, active campaigns with direct relevance to state government technology stacks. The window to act is measured in hours, not weeks. <h2> What Changed </h2> <table> <thead> <tr> <th> Development </th> <th> Why It Matters for State Government </th> </tr> </thead> <tbody> <tr> <td> CVE-2026-20262 added to CISA KEV (June 15) — Cisco Catalyst SD-WAN Manager arbitrary file write </td> <td> Second Cisco SD-WAN KEV in two weeks. Many states rely on Cisco Catalyst for WAN connectivity. Authenticated attackers can escalate to root. </td> </tr> <tr> <td> CVE-2026-54420 / CVE-2026-48172 added to CISA KEV — LiteSpeed cPanel privilege escalation </td> <td> Actively exploited. New CISA BOD 26-04 mandates 3-day remediation for internet-facing exploitable vulnerabilities. Affects shared hosting used by smaller state agencies. </td> </tr> <tr> <td> FortiSandbox triple exploitation (CVE-2026-39813, CVE-2026-39808, CVE-2026-25089) </td> <td> All CVSS 9.1. Unauthenticated RCE. One exploit confirmed to use AI-assisted development — a first for network security appliances. </td> </tr> <tr> <td> Adobe-spoofing dual-RMM phishing campaign targeting government </td> <td> Delivers both ConnectWise ScreenConnect and MSP360 RMM via a single phishing lure. Legitimate tools abused for persistent access. </td> </tr> <tr> <td> APT29 fresh government-targeting malware (June 15) </td> <td> New Windows executable with credential theft, security tool disabling, and sandbox evasion capabilities. Targets government and telecom. </td> </tr> <tr> <td> CISA BOD 26-04 replaces BOD 22-01 (June 11) </td> <td> New risk-tiered patching framework: 3 days for KEV + internet-facing + automatable. Will cascade to states via federal funding conditions. </td> </tr> <tr> <td> ShinyHunters/UNC6040 mass exploitation of Oracle PeopleSoft (CVE-2026-35273, June 12) </td> <td> Approximately 100 organizations compromised; state financial ERP systems running PeopleSoft are directly in scope. CISA KEV addition confirmed. </td> </tr> <tr> <td> Ransomware operators explicitly add government targeting (June 14–16) </td> <td> REVENANT SPIDER/Qilin, KRYBIT, and AuditTeam all expanded target lists to include government-public-services; infrastructure refresh and pre-ransomware activity detected. </td> </tr> </tbody> </table> <h2> Threat Timeline </h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Actors / CVEs </th> <th> Impact </th> </tr> </thead> <tbody> <tr> <td> June 1, 2026 </td> <td> LiteSpeed confirms active exploitation of cPanel plugin </td> <td> Unknown criminal actors / CVE-2026-54420 </td> <td> Root escalation on shared hosting servers </td> </tr> <tr> <td> June 11, 2026 </td> <td> CISA issues BOD 26-04, revoking BODs 19-02 and 22-01 </td> <td> CISA (policy) </td> <td> New 3-day/14-day/30-day risk-tiered patching mandate </td> </tr> <tr> <td> June 12, 2026 </td> <td> ShinyHunters (UNC6040) begins mass exploitation of Oracle PeopleSoft </td> <td> ShinyHunters / CVE-2026-35273 </td> <td> ~100 organizations compromised; CISA KEV addition </td> </tr> <tr> <td> June 12, 2026 </td> <td> Handala/VOID MANTICORE breaches California water utilities </td> <td> IRGC-affiliated / Handala </td> <td> Critical infrastructure ICS/OT compromise </td> </tr> <tr> <td> June 14, 2026 </td> <td> REVENANT SPIDER confirms ransomware deployment via Check Point VPN </td> <td> Qilin affiliate / CVE-2026-50751 </td> <td> Government-public-services added as explicit target </td> </tr> <tr> <td> June 14, 2026 </td> <td> KRYBIT/AuditTeam add government targeting </td> <td> KRYBIT, AuditTeam </td> <td> Expanded ransomware threat to public sector </td> </tr> <tr> <td> June 15, 2026 </td> <td> ShinyHunters posts Council of Europe breach (297 GB) </td> <td> ShinyHunters / UNC6040 </td> <td> 429,000 files including payroll and medical records </td> </tr> <tr> <td> June 15, 2026 </td> <td> CISA adds CVE-2026-20262 to KEV (Cisco SD-WAN) </td> <td> Unknown / CVE-2026-20262 </td> <td> Active exploitation of state WAN infrastructure </td> </tr> <tr> <td> June 15, 2026 </td> <td> CISA adds CVE-2026-54420 to KEV (LiteSpeed cPanel) </td> <td> Unknown / CVE-2026-54420 </td> <td> Root escalation on shared hosting </td> </tr> <tr> <td> June 15, 2026 </td> <td> APT29 deploys new government-targeting credential harvester </td> <td> APT29 (Russia SVR) </td> <td> Fresh IOC targeting government/telecom </td> </tr> <tr> <td> June 16, 2026 </td> <td> FortiSandbox triple exploitation observed in wild </td> <td> Unknown; AI-assisted exploit development confirmed / CVE-2026-39813, CVE-2026-39808, CVE-2026-25089 </td> <td> Unauthenticated RCE on network security appliances </td> </tr> <tr> <td> June 16, 2026 </td> <td> Adobe-spoof dual-RMM phishing campaign active </td> <td> Unattributed criminal </td> <td> ConnectWise + MSP360 delivery to government targets </td> </tr> </tbody> </table> <h2> Key Threat Analysis </h2> <h3> 1. Cisco SD-WAN Manager: Your WAN Backbone Is Under Attack </h3> CVE-2026-20262 allows an authenticated remote attacker to write arbitrary files to the Cisco Catalyst SD-WAN Manager (formerly vManage) filesystem, enabling privilege escalation to root. This is the second Cisco SD-WAN vulnerability added to CISA's KEV catalog in two weeks. Why this matters for state government: Cisco Catalyst SD-WAN is the primary WAN fabric for many state networks connecting agency offices, data centers, and field sites. Compromise of the management plane gives an attacker control over routing, traffic inspection, and network segmentation — effectively owning the network. Compounding risk: The HOOK SPIDER access broker (Russia-nexus) was observed refreshing U.S. government credential targeting as recently as June 15. Stolen credentials combined with this authenticated file-write vulnerability create a direct path to root on SD-WAN infrastructure. <h3> 2. FortiSandbox Triple Exploitation — With AI-Assisted Exploit Development </h3> Three FortiSandbox vulnerabilities (CVE-2026-39813, CVE-2026-39808, CVE-2026-25089) are under active exploitation. All carry CVSS 9.1 scores. Two were patched in April 2026; one was patched last week. Critically, the CVE-2026-25089 exploit shows confirmed markers of AI-model-assisted development — a first for network security appliance exploitation. The AI dimension: While this particular exploit is currently faulty, it validates what threat intelligence has been tracking: AI-augmented exploit development is no longer theoretical. Expect exploit development timelines to compress by 40–60% for well-documented vulnerability class types. Your patch windows are shrinking in real time. <h3> 3. Dual-RMM Phishing: Legitimate Tools as Weapons </h3> A campaign using "Signed Non-Disclosure Agreement" themed emails spoofing Adobe is delivering both ConnectWise ScreenConnect and MSP360 RMM to targets. This dual-RMM approach provides attackers with redundant persistent access using tools that may already be authorized in your environment. This follows a pattern: adversaries are systematically rotating through legitimate remote management tools — NetSupport, MeshCentral, ConnectWise, MSP360 — to evade signature-based detection. The only scalable defense is a positive-security model: if an RMM tool isn't on your authorized list, its installation is an incident. <h3> 4. APT29: Fresh Government-Targeting Malware </h3> A new APT29-attributed Windows executable (SHA256: e5a6ca0d2a2a8727a7b05fc9ca77f41db7d9b704f499e3c9cebb13f25af385f3) was ingested on June 15 with government and telecommunications targeting tags. The sample demonstrates extensive capabilities including PowerShell execution, process injection, token impersonation, security tool disabling, browser credential theft, and sandbox evasion. Current assessment: Primary targeting appears focused on European and APAC government entities (Belgium, France, India, Ukraine). However, APT29 has historically pivoted to U.S. state government targets, and the credential-harvesting TTPs align with techniques used against federated identity systems common in state IT environments. <h3> 5. Ransomware Operators Refreshing Government Targeting </h3> REVENANT SPIDER (Qilin affiliate) confirmed direct ransomware deployment via CVE-2026-50751 (Check Point VPN bypass) on June 14, with government-public-services explicitly added as a targeting category. KRYBIT and AuditTeam ransomware groups have similarly expanded their target lists to include government. A "Pre-Ransomware Activity" campaign targeting government was detected in threat intelligence feeds on June 16. No new state/local government ransomware victim was confirmed in the past 24 hours — but this absence should not be mistaken for safety. Infrastructure refresh and explicit targeting declarations typically precede operational deployment by 7–14 days. <h3> 6. CISA BOD 26-04: The New Patching Paradigm </h3> CISA's Binding Operational Directive 26-04 (issued June 11) replaces the familiar BOD 22-01 with a risk-tiered framework: <ul> <li> 3 days for KEV + internet-facing + automatable vulnerabilities </li> <li> 14 days for KEV + internet-facing </li> <li> 30 days for all other KEV entries </li> </ul> While directly binding only on federal agencies, this directive will cascade to state governments through federal grant conditions, audit frameworks, and CISA partnership agreements. Most state patching SLAs (typically 14–30 days for critical vulnerabilities) are now misaligned with federal expectations. <h2> Predictive Analysis </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Timeframe </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> Additional exploitation of Cisco SD-WAN infrastructure at state agencies </td> <td> 75% (HIGH) </td> <td> 7 days </td> <td> Public PoC availability, KEV listing, state reliance on Cisco SD-WAN, access broker credential activity </td> </tr> <tr> <td> AI-assisted FortiSandbox exploit refined to working state and redistributed </td> <td> 50% (MODERATE) </td> <td> 14 days </td> <td> Confirmed AI development markers; current version faulty but iterative improvement expected </td> </tr> <tr> <td> REVENANT SPIDER / Qilin claims new state or local government ransomware victim </td> <td> 45% (MODERATE) </td> <td> 14 days </td> <td> Infrastructure refresh June 14–16, explicit government targeting added, pre-ransomware campaign detected </td> </tr> <tr> <td> Dual-RMM phishing campaign (CLU-219 pattern) hits state agency employees </td> <td> 60% (MODERATE-HIGH) </td> <td> 7 days </td> <td> Government targeting confirmed; Adobe/NDA lure is sector-agnostic; IOCs are fresh </td> </tr> <tr> <td> APT29 pivots credential harvester to U.S. state government targets </td> <td> 25% (LOW) </td> <td> 30 days </td> <td> Current targeting EU/APAC; historical precedent for U.S. pivot exists but no direct evidence </td> </tr> <tr> <td> State agencies face compliance pressure from BOD 26-04 alignment requirements </td> <td> 70% (HIGH) </td> <td> 90 days </td> <td> Federal funding conditions historically cascade; CISA partnership frameworks will reference new directive </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Immediate Detection Priorities </h3> <ol> <li> Cisco SD-WAN Manager File Write Detection </li> </ol> <ul> <li> ATT&CK: T1190 (Exploit Public-Facing Application), T1068 (Exploitation for Privilege Escalation), T1105 (Ingress Tool Transfer) </li> <li> Hunt hypothesis: Authenticated sessions to vManage API writing files outside expected directories, particularly to /etc/, /opt/cisco/, or cron directories </li> <li> Detection: Monitor vManage audit logs for file write operations by non-service accounts; alert on any new files in system directories created via HTTP API calls; baseline normal file write patterns and alert on deviation </li> <li> Defensive guidance: Restrict vManage management plane access to dedicated jump hosts only; enforce MFA on all SD-WAN administrative accounts; segment management network from data plane </li> </ul> <ol start="2"> <li> Dual-RMM Installation Detection </li> </ol> <ul> <li> ATT&CK: T1219 (Remote Access Software), T1566.002 (Spearphishing Link), T1204.001 (User Execution — Malicious Link) </li> <li> Hunt hypothesis: Two or more RMM tools installed on the same endpoint within a 24-hour window, where at least one is not on the agency's authorized RMM list </li> <li> Detection: Alert on ScreenConnect.ClientSetup.msi or MSP360 RMM agent installation on non-IT-admin workstations; monitor for outbound connections to *.screenconnect.com:443 and *.mspbackups.com from endpoints without authorized RMM; correlate with email gateway logs for "Signed Non-Disclosure Agreement" subject lines with external links </li> <li> Defensive guidance: Maintain an authorized RMM tool registry per agency; any unauthorized RMM installation = HIGH priority alert; block known C2 domains at web proxy </li> </ul> <ol start="3"> <li> APT29 Credential Harvesting TTPs </li> </ol> <ul> <li> ATT&CK: T1059.001 (PowerShell), T1055 (Process Injection), T1134.001 (Token Impersonation), T1562.001 (Disable Security Tools), T1555.003 (Credentials from Web Browsers), T1497 (Virtualization/Sandbox Evasion) </li> <li> Hunt hypothesis: PowerShell processes spawning with token manipulation followed by browser credential store access, particularly on systems where security tools have been stopped or modified </li> <li> Detection: Deploy hash-based detection for e5a6ca0d2a2a8727a7b05fc9ca77f41db7d9b704f499e3c9cebb13f25af385f3; hunt for PowerShell with -TokenImpersonation or AdjustTokenPrivileges calls; alert on security service stop/disable events (T1562.001) followed by credential file access within 60 minutes </li> <li> Defensive guidance: Enable credential guard on Windows endpoints; restrict PowerShell to constrained language mode on non-admin workstations; monitor for browser credential store access by non-browser processes </li> </ul> <ol start="4"> <li> LiteSpeed cPanel Exploitation </li> </ol> <ul> <li> ATT&CK: T1505.003 (Web Shell), T1068 (Exploitation for Privilege Escalation), T1548.001 (Setuid/Setgid Abuse) </li> <li> Hunt hypothesis: Symlink creation in web-accessible directories pointing to system files, followed by privilege escalation to root </li> <li> Detection: Run detection command on all cPanel servers: grep -rE 'cpanel_jsonapi_func=(generateEcCert|packageUserSize)|cert_action_entry .*geneccert' /usr/local/cpanel/logs/ /var/cpanel/logs/ 2>/dev/null </li> <li> Defensive guidance: Update LiteSpeed cPanel plugin to ≥2.4.8 immediately; audit for existing web shells; restrict FTP access to known administrative IPs </li> </ul> <ol start="5"> <li> FortiSandbox Unauthenticated Access </li> </ol> <ul> <li> ATT&CK: T1190 (Exploit Public-Facing Application), T1059 (Command and Scripting Interpreter) </li> <li> Hunt hypothesis: Unauthenticated HTTP requests to FortiSandbox management interfaces resulting in command execution </li> <li> Detection: Monitor FortiSandbox logs for authentication bypass indicators; alert on any command execution from unauthenticated sessions; inspect HTTP access logs for exploit patterns against management endpoints </li> <li> Defensive guidance: If FortiSandbox is internet-facing, restrict access immediately via ACL while patching; verify patches for CVE-2026-39813, CVE-2026-39808, and CVE-2026-25089 are applied </li> </ul> <h2> IOC Blocking Table </h2> The following indicators are confirmed from intelligence collection and should be blocked or alerted upon immediately: <table> <thead> <tr> <th> Type </th> <th> Value </th> <th> Context </th> </tr> </thead> <tbody> <tr> <td> Domain </td> <td> file-readers[.]gomera[.]com </td> <td> Phishing delivery — Adobe-spoof dual-RMM campaign </td> </tr> <tr> <td> Domain </td> <td> instance-ndmshy-relay[.]screenconnect[.]com </td> <td> ConnectWise ScreenConnect RAT C2 </td> </tr> <tr> <td> Domain </td> <td> client[.]rmm[.]mspbackups[.]com </td> <td> MSP360 RMM C2 </td> </tr> <tr> <td> Domain </td> <td> rm[.]mspbackups[.]com </td> <td> MSP360 RMM WebSocket C2 </td> </tr> <tr> <td> MD5 </td> <td> b480e6c4983d108513dcc09d021e49de </td> <td> ScreenConnect.ClientSetup.msi </td> </tr> <tr> <td> MD5 </td> <td> 386529af136fe96a23da6aaa39711e2b </td> <td> MSP360 RMM installer </td> </tr> <tr> <td> SHA-256 </td> <td> e5a6ca0d2a2a8727a7b05fc9ca77f41db7d9b704f499e3c9cebb13f25af385f3 </td> <td> APT29 government-targeting credential harvester </td> </tr> <tr> <td> SHA-256 </td> <td> bb128eb2f2277fc59cc9f7dcf4ca628a293a800afb7709b8cdb4505d249abb02 </td> <td> Associated malware sample </td> </tr> </tbody> </table> Additional IOCs for the campaigns discussed in this report are available through Anomali ThreatStream Next-Gen and partner feeds. <h2> Sector-Specific Defensive Priorities </h2> <h3> Financial Services (State Treasury, Revenue, Comptroller) </h3> <ul> <li> Primary threat: ShinyHunters/UNC6040 mass exploitation of Oracle PeopleSoft (CVE-2026-35273) — state financial ERP systems running PeopleSoft are directly in the crosshairs </li> <li> Action: Verify PeopleSoft patches applied; audit for unauthorized database access since June 12; review PeopleSoft web server logs for exploitation indicators </li> <li> Secondary threat: Credential harvesting campaigns (APT29, phishing) targeting financial system administrators </li> <li> Action: Enforce phishing-resistant MFA (FIDO2) on all financial system admin accounts; review privileged access logs for anomalous authentication patterns </li> </ul> <h3> Energy (State-Regulated Utilities, Public Power) </h3> <ul> <li> Primary threat: IRGC-affiliated Handala/VOID MANTICORE confirmed breach of California water utilities (June 12) — demonstrates active Iranian targeting of U.S. water/energy infrastructure </li> <li> Action: Verify OT/ICS network segmentation from IT networks; audit remote access to SCADA systems; confirm no shared credentials between IT and OT environments </li> <li> Secondary threat: FortiSandbox exploitation (CVE-2026-39813/39808/25089) — Fortinet appliances are common in utility network architectures </li> <li> Action: Inventory all Fortinet appliances in OT-adjacent networks; prioritize patching of internet-facing instances; implement network-level access restrictions to management interfaces </li> </ul> <h3> Healthcare (State Health Agencies, Medicaid Systems) </h3> <ul> <li> Primary threat: Ransomware operators (REVENANT SPIDER/Qilin, KRYBIT) explicitly adding government-public-services targeting — health agencies hold high-value PII and face extreme pressure to restore services </li> <li> Action: Verify offline backup integrity for Medicaid and health records systems; test incident response playbooks for ransomware scenarios; confirm network segmentation between clinical/claims systems and general IT </li> <li> Secondary threat: Dual-RMM phishing campaign — healthcare administrative staff are high-value phishing targets </li> <li> Action: Deploy email gateway rules for "Signed Non-Disclosure Agreement" lures; brief staff on Adobe-spoofing tactics; block unauthorized RMM tools at endpoint level </li> </ul> <h3> Government (Executive Branch Agencies, Legislature, Courts) </h3> <ul> <li> Primary threat: Cisco SD-WAN Manager exploitation (CVE-2026-20262) — state WAN infrastructure compromise enables lateral movement across all connected agencies </li> <li> Action: Emergency patching of vManage; restrict management plane access; audit for unauthorized file writes on SD-WAN infrastructure </li> <li> Secondary threat: APT29 credential harvesting and HOOK SPIDER access broker activity targeting government credentials </li> <li> Action: Hunt for PowerShell-based credential theft TTPs; review dark web monitoring for state government credential listings; rotate credentials for any accounts with suspected exposure </li> <li> Tertiary threat: Pre-ransomware activity campaign detected targeting government — REVENANT SPIDER infrastructure refreshed June 14–16 </li> <li> Action: Elevate monitoring for lateral movement indicators (PsExec, WMI, RDP from unusual sources); verify EDR coverage on all domain controllers and file servers </li> </ul> <h3> Aviation / Logistics (State DOT, Airports, Port Authorities) </h3> <ul> <li> Primary threat: Supply chain compromise via legitimate vendor tools — ConnectWise ScreenConnect and MSP360 are commonly used by MSPs serving transportation agencies </li> <li> Action: Audit all third-party remote access tools in use by contractors and MSPs; verify each against authorized RMM registry; require MFA on all vendor remote access sessions </li> <li> Secondary threat: Nation-state targeting of transportation infrastructure — APT29 has historical interest in government-adjacent transportation networks </li> <li> Action: Review network segmentation between operational technology (traffic management, port systems) and administrative IT; ensure ICS/SCADA systems are not accessible via compromised IT credentials </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> 🔴 IMMEDIATE (Within 24 Hours) </h3> <table> <thead> <tr> <th> Action </th> <th> Owner </th> <th> Rationale </th> </tr> </thead> <tbody> <tr> <td> Patch Cisco Catalyst SD-WAN Manager to address CVE-2026-20262. Verify no unauthorized file writes on vManage filesystem. </td> <td> IT Operations </td> <td> Active exploitation confirmed by CISA KEV. State WAN infrastructure at direct risk. </td> </tr> <tr> <td> Run LiteSpeed detection command on all cPanel shared hosting servers. Update plugin to ≥2.4.8. </td> <td> IT Operations </td> <td> BOD 26-04 mandates 3-day remediation. Active exploitation confirmed. </td> </tr> <tr> <td> Block phishing campaign IOCs at email gateway and web proxy: file-readers[.]gomera[.]com, instance-ndmshy-relay[.]screenconnect[.]com, client[.]rmm[.]mspbackups[.]com, rm[.]mspbackups[.]com. Block MD5 hashes at endpoint. </td> <td> SOC </td> <td> Active campaign targeting government with dual-RMM delivery. </td> </tr> <tr> <td> Alert on email subject line "Signed Non-Disclosure Agreement" with external links from non-Adobe domains. </td> <td> SOC / Email Security </td> <td> Direct detection of phishing lure in active campaign. </td> </tr> <tr> <td> Restrict Cisco vManage management plane access to dedicated jump hosts; enforce MFA on all SD-WAN admin accounts. </td> <td> Network Operations </td> <td> Reduces exploitation surface for authenticated file-write vulnerability. </td> </tr> </tbody> </table> <h3> 🟠 7-DAY </h3> <table> <thead> <tr> <th> Action </th> <th> Owner </th> <th> Rationale </th> </tr> </thead> <tbody> <tr> <td> Verify FortiSandbox appliances patched for CVE-2026-39813, CVE-2026-39808, CVE-2026-25089. If internet-facing, treat as IMMEDIATE. </td> <td> IT Operations </td> <td> Triple CVSS 9.1 exploitation in wild; AI-assisted exploit development accelerates risk. </td> </tr> <tr> <td> Deploy EDR detection for APT29 SHA256 hash. Hunt for PowerShell token impersonation (T1134.001), security tool disabling (T1562.001), and browser credential theft (T1555.003). </td> <td> SOC </td> <td> Fresh nation-state malware targeting government sector. </td> </tr> <tr> <td> Establish authorized RMM tool registry per agency. Configure alerts for any RMM installation not on the approved list. </td> <td> SOC / Endpoint Team </td> <td> Converts RMM abuse detection gap into positive-security model. </td> </tr> <tr> <td> Review Oracle PeopleSoft patching status for CVE-2026-35273 (CVSS 9.8). Audit database access logs since June 12. </td> <td> ERP / Database Team </td> <td> ShinyHunters mass exploitation of ~100 organizations; state PeopleSoft instances are high-value targets. </td> </tr> </tbody> </table> <h3> 🟡 30-DAY </h3> <table> <thead> <tr> <th> Action </th> <th> Owner </th> <th> Rationale </th> </tr> </thead> <tbody> <tr> <td> Brief executive leadership on CISA BOD 26-04 implications. Assess state patching SLAs against new 3-day/14-day/30-day framework. Determine federal funding compliance requirements. </td> <td> CISO / CIO </td> <td> New federal patching paradigm will cascade to states via grant conditions and audit frameworks. </td> </tr> <tr> <td> Develop behavioral detection for dual-RMM installation patterns (any two RMM tools on same endpoint within 24 hours). </td> <td> SOC / Detection Engineering </td> <td> Adversaries rotating through legitimate RMM tools; signature-based detection is insufficient. </td> </tr> <tr> <td> Evaluate SD-WAN vendor diversification for critical network segments given recurring Cisco SD-WAN vulnerabilities. </td> <td> Network Architecture / CISO </td> <td> Two KEV entries in two weeks indicates systemic vendor risk concentration. </td> </tr> <tr> <td> Conduct tabletop exercise for ransomware scenario targeting state government services, incorporating REVENANT SPIDER/Qilin TTPs and Check Point VPN initial access vector. </td> <td> CISO / IR Team </td> <td> Ransomware operators have explicitly added government targeting; infrastructure refresh indicates imminent operations. </td> </tr> <tr> <td> Assess OT/ICS network segmentation posture for water/wastewater and transportation systems given confirmed Iranian targeting of U.S. water utilities. </td> <td> CISO / OT Security </td> <td> Handala/VOID MANTICORE breach of California water utilities (June 12) demonstrates direct threat to state critical infrastructure. </td> </tr> </tbody> </table> <h2> Bottom Line </h2> The threat environment facing state government IT systems is defined by speed and convergence. Exploit development is accelerating through AI assistance. Patch mandates are compressing from weeks to days. Ransomware operators are explicitly naming government as a target category while refreshing their infrastructure. And nation-state actors continue to harvest credentials from government networks with fresh tooling. The three actions that matter most this week: <ol> <li> Patch your Cisco SD-WAN Manager today. Not this sprint. Not next maintenance window. Today. Active exploitation is confirmed, and your WAN backbone is the keys to every agency on your network. </li> <li> Block the dual-RMM phishing IOCs within hours. This campaign is active, targeting government, and delivers persistent access through tools your security stack may trust by default. </li> <li> Start the BOD 26-04 conversation with your CIO now. The 3-day patching mandate is coming to state government through federal funding conditions. The agencies that prepare now will adapt; those that wait will scramble during their first audit finding. </li> </ol> The adversaries are not waiting. Neither should we. Published June 16, 2026 | Anomali CTI Desk For questions or additional IOC feeds, contact your Anomali representative or access indicators directly via Anomali ThreatStream Next-Gen.

FEATURED RESOURCES

June 16, 2026

Anomali Cyber Watch

Iranian Cyber Operations Intensify: Seven Cisco SD-WAN Exploits, AI-Generated Attack Code, and Fresh C2 Infrastructure Signal Imminent Escalation

June 16, 2026

Anomali Cyber Watch

Public Sector

Cisco SD-WAN Under Active Attack, FortiSandbox Exploits Go AI-Assisted, and Dual-RMM Phishing Targets Government: What State CISOs Must Do This Week

June 15, 2026

Anomali Cyber Watch

Iran's Cyber War Machine Isn't Stopping for Peace Talks: What CISOs Need to Know Now

Explore All