Converging Threats to State Government: Ransomware Playbooks, Vendor Breaches, and Critical Infrastructure Vulnerabilities

Public Sector

Published on

June 5, 2026

Table of Contents

Threat Assessment Level: ELEVATED The threat environment for state government IT organizations remains at ELEVATED, driven by a confirmed third-party data breach affecting millions of Medicaid beneficiaries, a newly detailed ransomware kill chain targeting the exact technology stack most state agencies operate, and a sustained wave of critical infrastructure vulnerability disclosures. While no direct compromise of state systems has been confirmed, the convergence of these threats demands immediate defensive action. <h2> Introduction </h2> State government CIOs and CISOs face a uniquely challenging moment. In the past 72 hours, CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities catalog, a major dental benefits administrator serving state Medicaid programs has been breached with 2.6 million records leaked, and security researchers have published a complete ransomware playbook that maps almost perfectly to common state IT infrastructure — SonicWall VPNs, Veeam backup systems, and VMware ESXi hosts. This is not a theoretical exercise. The tools, techniques, and targets described below are active, documented, and in many cases already being exploited in the wild. This brief provides the intelligence and actionable guidance your teams need to respond. <h2> What Changed </h2> <table> <thead> <tr> <th> Development </th> <th> Date </th> <th> Why It Matters </th> </tr> </thead> <tbody> <tr> <td> ShinyHunters leaks 2.6M DentaQuest records </td> <td> 5 Jun 2026 </td> <td> DentaQuest administers Medicaid dental benefits for multiple states — citizen PII (SSNs, health records) potentially exposed </td> </tr> <tr> <td> Abyss Locker full kill chain published </td> <td> 5 Jun 2026 </td> <td> Sygnia researchers document a SonicWall VPN → Veeam → ESXi → NAS ransomware playbook matching state IT stacks </td> </tr> <tr> <td> CVE-2026-45247 added to CISA KEV </td> <td> 3 Jun 2026 </td> <td> Critical Magento RCE (CVSS 9.8) — affects vendor procurement portals in state supply chains </td> </tr> <tr> <td> CVE-2022-0492 re-added to CISA KEV </td> <td> 2 Jun 2026 </td> <td> Linux container escape via cgroups v1 — signals renewed exploitation of containerized environments </td> </tr> <tr> <td> CISA ATG hardening advisory </td> <td> 2 Jun 2026 </td> <td> Joint advisory urging hardening of Automatic Tank Gauge systems at fuel and water treatment facilities </td> </tr> <tr> <td> Five ICS advisories (Hitachi Energy, NAVTOR, B&R) </td> <td> 4 Jun 2026 </td> <td> Buffer overflow and code execution flaws in power grid substation equipment (RTU500, ITT600) </td> </tr> <tr> <td> Microsoft Cloud privilege escalation vulnerabilities </td> <td> 5 Jun 2026 </td> <td> Azure, Exchange Online, and M365 Copilot flaws enabling privilege escalation </td> </tr> <tr> <td> GOOTLOADER and ClickFix campaigns active against government </td> <td> Ongoing </td> <td> SEO poisoning and fake browser update lures confirmed targeting government entities for initial access </td> </tr> </tbody> </table> Continuity from prior cycle: The ELEVATED threat level is unchanged. Previous cycle findings remain active — CVE-2026-41089 (Netlogon RCE, CVSS 9.8), CVE-2026-35616 (FortiClient EMS exploitation delivering infostealers), APT28 refreshed C2 infrastructure, Gamaredon's updated GammaLoad malware, and CHATTY SPIDER physical help desk pretexting all remain unresolved threats requiring sustained defensive attention. <h2> Threat Timeline </h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Threat Category </th> </tr> </thead> <tbody> <tr> <td> 1 Jun 2026 </td> <td> CVE-2024-21182 added to CISA KEV </td> <td> Vulnerability exploitation </td> </tr> <tr> <td> 2 Jun 2026 </td> <td> CVE-2022-0492 (Linux container escape) re-added to KEV </td> <td> Vulnerability exploitation </td> </tr> <tr> <td> 2 Jun 2026 </td> <td> CISA + partners issue ATG hardening advisory </td> <td> Critical infrastructure </td> </tr> <tr> <td> 3 Jun 2026 </td> <td> CVE-2026-45247 (Magento RCE, CVSS 9.8) added to KEV </td> <td> Supply chain / vendor risk </td> </tr> <tr> <td> 4 Jun 2026 </td> <td> Five ICS advisories: Hitachi Energy RTU500, ITT600, HiDraw; NAVTOR; B&R </td> <td> Critical infrastructure </td> </tr> <tr> <td> 5 Jun 2026 </td> <td> ShinyHunters leaks 234 GB from DentaQuest (2.6M individuals) </td> <td> Third-party breach / extortion </td> </tr> <tr> <td> 5 Jun 2026 </td> <td> Abyss Locker detailed kill chain published by Sygnia </td> <td> Ransomware </td> </tr> <tr> <td> 5 Jun 2026 </td> <td> Microsoft Cloud privilege escalation advisory (BSI WID-SEC-2026-1792) </td> <td> Cloud security </td> </tr> </tbody> </table> <h2> Key Threat Analysis </h2> <h3> 1. Abyss Locker: A Ransomware Playbook Built for State Government Infrastructure </h3> Security firm Sygnia has published a detailed technical analysis of the Abyss Locker ransomware group's operational playbook. What makes this report uniquely concerning for state agencies is the near-perfect alignment between the attacker's preferred targets and common state IT infrastructure: Kill Chain: <ol> <li> Initial Access: Exploitation of unpatched SonicWall VPN appliances (CVE-2021-20038) </li> <li> Credential Harvesting: Modified Veeam-Get-Creds.ps1 scripts targeting Veeam Backup & Replication consoles </li> <li> Command & Control: SSH tunneling over port 443 through ESXi hosts and NAS devices — designed to blend with legitimate HTTPS traffic </li> <li> Defense Evasion: Bring Your Own Vulnerable Driver (BYOVD) using UpdateDrv.sys (Zemana) and ped.sys (Process Explorer) to terminate EDR agents; deployment of fake Sophos executables (SophosAV.exe, auSophos.exe) </li> <li> Exfiltration: Rclone to AWS and BackBlaze cloud storage </li> <li> Encryption: Files encrypted with .Abyss and .crypt extensions </li> </ol> Why this matters: State/local government remains the #1 ransomware-targeted sector. This playbook exploits SonicWall VPNs (widely deployed in state agencies), Veeam backup infrastructure (the most common enterprise backup solution in government), and VMware ESXi (the dominant virtualization platform). The SSH-over-443 tunneling technique is specifically designed to evade network monitoring that allows outbound HTTPS. <h3> 2. ShinyHunters / DentaQuest: A Direct Threat to Citizen Data </h3> The ShinyHunters extortion group (also tracked as UNC6040 / Bling Libra) has leaked approximately 234 GB of data from DentaQuest, a dental benefits administrator serving Medicaid programs across multiple states. An estimated 2.6 million individuals are affected. The state government connection: DentaQuest administers dental benefits for state Medicaid programs. If your state contracts with DentaQuest, citizen PII — including Social Security numbers, health records, and addresses — may be in the leaked dataset. This is not a hypothetical supply chain risk; it is a confirmed breach of a government benefits vendor. ShinyHunters has demonstrated an accelerating pattern: the Canvas LMS education data breach was followed weeks later by DentaQuest. Healthcare and benefits administrators appear to be the group's current focus — organizations that hold large volumes of government-adjacent personal data. <h3> 3. Critical Infrastructure: Sustained ICS/OT Vulnerability Disclosures </h3> Five ICS advisories were published on a single day, including three affecting Hitachi Energy products deployed in power grid substations: <ul> <li> RTU500 — Remote Terminal Units used in substation automation </li> <li> ITT600 Explorer — Engineering tool for substation configuration </li> <li> MACH HiDraw — Engineering drawing tool for substation design </li> </ul> Additionally, CISA issued a joint advisory urging immediate hardening of Automatic Tank Gauge (ATG) systems — devices that monitor fuel levels at gas stations, chemical tanks at water treatment facilities, and industrial storage. Evidence of active scanning against internet-exposed ATG interfaces prompted the advisory. For state agencies: Even if your state does not directly operate these systems, state public utility commissions have regulatory oversight responsibility. Utility operators within your state should be notified and compliance verified. <h3> 4. Linux Container Escape: CVE-2022-0492 Returns </h3> CISA's re-addition of CVE-2022-0492 to the Known Exploited Vulnerabilities catalog signals renewed active exploitation of this Linux kernel cgroups v1 privilege escalation. The vulnerability enables container escape — an attacker who compromises a containerized application can break out to the underlying host. State government exposure: Agencies running Docker or Kubernetes workloads — whether in Azure, on-premises CI/CD pipelines, or containerized web applications — are directly at risk if running unpatched kernels with cgroups v1. <h3> 5. Microsoft Cloud: Privilege Escalation Vulnerabilities (BSI WID-SEC-2026-1792) </h3> A cluster of privilege escalation vulnerabilities affecting Microsoft Azure, Exchange Online, and M365 Copilot was disclosed on 5 Jun 2026 (BSI advisory WID-SEC-2026-1792). These flaws allow authenticated users or compromised accounts to escalate privileges within cloud tenants, potentially enabling lateral movement across Microsoft 365 services. State government exposure: The majority of state executive branch agencies operate on Microsoft 365 tenants. Privilege escalation in Exchange Online or Azure Active Directory could allow an attacker with a single compromised credential to pivot to administrative access across the entire tenant. State agencies should review Microsoft's published mitigations and apply any available patches or configuration hardening immediately. <h3> 6. Nation-State Activity: Quiet but Not Gone </h3> A notable absence this cycle: Volt Typhoon , Salt Typhoon (China), and APT28 (Russia) produced no new indicators despite recently updated threat profiles. This silence should not be interpreted as safety. These actors specialize in living-off-the-land techniques (T1078 — Valid Accounts, T1218 — System Binary Proxy Execution) that generate minimal observable indicators. Volt Typhoon in particular is known for pre-positioning in critical infrastructure networks for months before activation. Active campaigns confirmed in Anomali ThreatStream Next-Gen data include GOOTLOADER and ClickFix — both targeting government entities for initial access through SEO poisoning and fake browser update prompts. <h2> Predictive Analysis </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> Additional CISA KEV additions within 7 days </td> <td> 70% </td> <td> Four CVEs added in 5 days indicates an active exploitation wave </td> </tr> <tr> <td> ShinyHunters leaks additional healthcare/benefits data </td> <td> 50% </td> <td> Group is on an active extortion campaign (Canvas LMS → DentaQuest pattern) </td> </tr> <tr> <td> Abyss Locker claims a state/local government victim </td> <td> 30% </td> <td> Published Sygnia report may accelerate copycat adoption before defenders patch </td> </tr> <tr> <td> Volt Typhoon/Salt Typhoon activity surfaces targeting state networks </td> <td> 25% </td> <td> Profile updates without new IOCs may indicate operational preparation </td> </tr> <tr> <td> GOOTLOADER or ClickFix campaign delivers ransomware payload to a state agency </td> <td> 35% </td> <td> Both campaigns confirmed active against government targets </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Detection Priorities </h3> <table> <thead> <tr> <th> Priority </th> <th> What to Hunt </th> <th> ATT&CK Technique </th> <th> Detection Logic </th> </tr> </thead> <tbody> <tr> <td> CRITICAL </td> <td> SSH connections on port 443 from ESXi management interfaces </td> <td> T1572 (Protocol Tunneling) </td> <td> Alert on any SSH handshake (banner string) over TCP/443 from ESXi hosts </td> </tr> <tr> <td> CRITICAL </td> <td> Service creation: "WMI Helper Agent" </td> <td> T1543.003 (Create or Modify System Process: Windows Service) </td> <td> Monitor for wmihelper.exe or service name containing "WMI Helper" </td> </tr> <tr> <td> HIGH </td> <td> PowerShell scripts matching Veeam credential harvesting </td> <td> T1003 (OS Credential Dumping) </td> <td> Hunt for Veeam-Get-Creds string patterns in PowerShell logs (Event ID 4104) </td> </tr> <tr> <td> HIGH </td> <td> BYOVD driver loading: UpdateDrv.sys, ped.sys, 3ware.sys </td> <td> T1068 (Exploitation for Privilege Escalation) </td> <td> Monitor driver load events for known vulnerable driver hashes </td> </tr> <tr> <td> HIGH </td> <td> Fake Sophos executables </td> <td> T1036.005 (Masquerading: Match Legitimate Name) </td> <td> Alert on SophosAV.exe or auSophos.exe executing from non-standard paths </td> </tr> <tr> <td> MEDIUM </td> <td> Container escape indicators on Linux hosts </td> <td> T1611 (Escape to Host) </td> <td> Monitor for unexpected release_agent writes in cgroups v1 hierarchies </td> </tr> <tr> <td> MEDIUM </td> <td> GOOTLOADER SEO poisoning </td> <td> T1189 (Drive-by Compromise) </td> <td> Alert on .js file downloads from compromised legitimate sites followed by wscript execution </td> </tr> </tbody> </table> <h3> Hunting Hypotheses </h3> <ol> <li> Hypothesis: An attacker has compromised a SonicWall VPN appliance and is using it for initial access. </li> <ul> <li> Hunt: Review VPN authentication logs for anomalous login times, impossible travel, or connections from known-bad IP ranges. Check for CVE-2021-20038 patch status across all appliances. </li> </ul> <li> Hypothesis: Veeam backup credentials have been harvested and lateral movement is occurring via backup infrastructure. </li> <ul> <li> Hunt: Audit Veeam console access logs for non-standard accounts. Search for PowerShell scripts containing "Get-VBRCredentials" or "Veeam-Get-Creds" patterns. </li> </ul> <li> Hypothesis: An ESXi host is being used as a C2 relay via SSH tunneling on port 443. </li> <ul> <li> Hunt: Check ESXi SSH service status — it should be disabled in production. Review netstat/connection logs for outbound connections from ESXi management IPs to external addresses on port 443 that are NOT VMware update servers. </li> </ul> </ol> <h3> IOC Blocking Table </h3> <table> <thead> <tr> <th> Type </th> <th> Value </th> <th> Context </th> </tr> </thead> <tbody> <tr> <td> IPv4 </td> <td> 64.95.12[.]57 </td> <td> Abyss Locker SSH reverse tunnel C2 (port 443) </td> </tr> <tr> <td> IPv4 </td> <td> 64.95.12[.]70 </td> <td> Abyss Locker ESXi SSH tunnel endpoint </td> </tr> <tr> <td> SHA-256 </td> <td> 1edc05d0a6f1eb8d088b4bdfeb1922c97a98c4b4501f6b04b7003ff50737e905 </td> <td> Abyss Locker tooling </td> </tr> <tr> <td> Filename </td> <td> UpdateDrv.sys </td> <td> BYOVD — Zemana vulnerable driver </td> </tr> <tr> <td> Filename </td> <td> ped.sys </td> <td> BYOVD — Process Explorer vulnerable driver </td> </tr> <tr> <td> Filename </td> <td> 3ware.sys </td> <td> BYOVD — vulnerable driver for EDR evasion </td> </tr> <tr> <td> Filename </td> <td> SophosAV.exe / auSophos.exe </td> <td> Masquerading EDR killer </td> </tr> <tr> <td> Filename </td> <td> wmihelper.exe / wmihelper.xml / wmihelper.key </td> <td> Abyss Locker persistence </td> </tr> <tr> <td> Service Name </td> <td> WMI Helper Agent </td> <td> Abyss Locker persistence mechanism </td> </tr> </tbody> </table> Additional IOCs available via ThreatStream Next-Gen and MS-ISAC partner feeds. <h2> Sector-Specific Defensive Priorities </h2> <h3> Financial Services (State Treasury, Revenue, Procurement) </h3> <ul> <li> Priority: Verify that any Magento-based vendor payment portals in the state procurement ecosystem are patched against CVE-2026-45247. Contact third-party portal operators for confirmation. </li> <li> Priority: Ensure Veeam backup systems protecting financial databases have console access restricted to hardened jump servers with MFA. </li> <li> Monitor: ShinyHunters has historically targeted financial data — treasury and revenue systems holding taxpayer PII are high-value targets. </li> </ul> <h3> Energy (Public Utility Commissions, State-Regulated Utilities) </h3> <ul> <li> Priority: Issue advisory to regulated utilities regarding Hitachi Energy RTU500, ITT600, and MACH HiDraw vulnerabilities. Request patch status confirmation. </li> <li> Priority: Verify that ATG systems at state-regulated fuel storage and water treatment facilities are not internet-accessible. Require network segmentation evidence. </li> <li> Monitor: Volt Typhoon's known pre-positioning in energy infrastructure means absence of indicators is not absence of threat. </li> </ul> <h3> Healthcare (Medicaid, State Employee Benefits, HHS) </h3> <ul> <li> IMMEDIATE: Determine whether DentaQuest administers dental benefits for your state's Medicaid program. If yes, initiate breach notification assessment and citizen impact analysis. </li> <li> Priority: Inventory all third-party benefits administrators and their data handling practices. The ShinyHunters pattern suggests additional healthcare data brokers may be targeted. </li> <li> Monitor: HIPAA breach notification timelines may apply — coordinate with legal counsel. </li> </ul> <h3> Government (All Executive Branch Agencies) </h3> <ul> <li> Priority: Patch all SonicWall VPN appliances against CVE-2021-20038 immediately — this is the confirmed initial access vector for Abyss Locker targeting government. </li> <li> Priority: Audit Linux container environments for CVE-2022-0492 exposure, particularly CI/CD pipelines and web application hosting. </li> <li> Priority: Review Microsoft 365 tenant configurations and apply mitigations for BSI WID-SEC-2026-1792 privilege escalation vulnerabilities. </li> <li> Monitor: GOOTLOADER and ClickFix campaigns are actively targeting government employees via SEO poisoning and fake browser updates. Reinforce user awareness. </li> </ul> <h3> Aviation / Logistics (State DOT, Airport Authorities, Port Operations) </h3> <ul> <li> Priority: Review NAVTOR NavBox ICS advisory — affects maritime navigation systems relevant to port authorities. </li> <li> Priority: Ensure transportation management systems (traffic control, fleet management) are segmented from enterprise IT networks. </li> <li> Monitor: Supply chain compromise via logistics software remains a viable attack vector for nation-state actors seeking pre-positioning. </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Within 24 Hours) </h3> <table> <thead> <tr> <th> Action </th> <th> Responsible Team </th> </tr> </thead> <tbody> <tr> <td> Block C2 IPs 64.95.12[.]57 and 64.95.12[.]70 at perimeter firewall; add to EDR watchlist for SSH connections on port 443 </td> <td> SOC / Network Security </td> </tr> <tr> <td> Verify ALL SonicWall VPN appliances are patched against CVE-2021-20038 — confirm no unpatched instances remain in inventory </td> <td> IT Operations </td> </tr> <tr> <td> Determine whether DentaQuest administers state Medicaid dental benefits; if yes, initiate breach impact assessment and citizen notification planning </td> <td> HHS Liaison / Legal / CISO </td> </tr> <tr> <td> Deploy detection rules for "WMI Helper Agent" service creation and wmihelper.exe in system paths </td> <td> SOC / Detection Engineering </td> </tr> <tr> <td> Verify ESXi SSH service is disabled on all production hypervisors; alert on any SSH activity from ESXi management interfaces </td> <td> Virtualization Team / SOC </td> </tr> </tbody> </table> <h3> 7-DAY </h3> <table> <thead> <tr> <th> Action </th> <th> Responsible Team </th> </tr> </thead> <tbody> <tr> <td> Audit all Linux container hosts for CVE-2022-0492 patch status; prioritize hosts running cgroups v1 </td> <td> IT Operations / DevOps </td> </tr> <tr> <td> Restrict Veeam Backup & Replication console access to jump-server-only with MFA; hunt for Veeam-Get-Creds.ps1 variants </td> <td> IT Operations / SOC </td> </tr> <tr> <td> Coordinate with OT/SCADA teams to verify ATG systems are not internet-accessible; implement network segmentation per CISA advisory </td> <td> OT Security / IT Operations </td> </tr> <tr> <td> Issue advisory to state-regulated utilities regarding Hitachi Energy RTU500/ITT600/HiDraw vulnerabilities </td> <td> Public Utility Commission / CISO </td> </tr> <tr> <td> Update Chrome fleet to version 149 across all managed endpoints (429 vulnerabilities patched) </td> <td> Endpoint Management </td> </tr> <tr> <td> Brief HR/recruiting teams on DPRK IT worker fraud indicators (UNC5267) — verify applicant identity procedures </td> <td> HR / Security Awareness </td> </tr> <tr> <td> Apply Microsoft mitigations for BSI WID-SEC-2026-1792; review Azure AD and Exchange Online privilege assignments for anomalous escalation </td> <td> M365 / Cloud Security Team </td> </tr> </tbody> </table> <h3> 30-DAY </h3> <table> <thead> <tr> <th> Action </th> <th> Responsible Team </th> </tr> </thead> <tbody> <tr> <td> Conduct comprehensive third-party benefits administrator inventory — identify all vendors holding citizen PII and assess breach notification obligations </td> <td> Procurement / Legal / CISO </td> </tr> <tr> <td> Evaluate post-quantum certificate readiness; begin inventory of certificate infrastructure for PQC migration planning </td> <td> IT Architecture / CISO </td> </tr> <tr> <td> Commission tabletop exercise simulating Abyss Locker scenario: VPN compromise → Veeam credential theft → ESXi encryption </td> <td> CISO / IR Team </td> </tr> <tr> <td> Assess OSINT collection capability — six consecutive days of degraded intelligence collection represents a structural blind spot requiring platform-level remediation </td> <td> CTI Team / CIO </td> </tr> <tr> <td> Review and update incident response playbooks for ransomware scenarios involving backup infrastructure compromise </td> <td> IR Team / CISO </td> </tr> </tbody> </table> <h3> Executive / IR Preparedness </h3> <ul> <li> Decision Required (CIO/CISO): Confirm DentaQuest vendor relationship and authorize breach impact assessment if applicable. </li> <li> Decision Required (CIO): Approve emergency SonicWall patch verification given confirmed active exploitation by ransomware operators. </li> <li> Preparedness: Ensure ransomware incident response retainer is current and covers scenarios where backup infrastructure is compromised (Veeam-targeted attacks invalidate traditional recovery assumptions). </li> <li> Communication: Prepare holding statement for potential citizen notification if DentaQuest breach affects state residents. </li> </ul> <h2> Bottom Line </h2> Three actions cannot wait. First, verify SonicWall VPN patch status across all appliances — CVE-2021-20038 is the confirmed entry point for the Abyss Locker playbook now in the hands of every ransomware affiliate. Second, determine your state's DentaQuest exposure today — if your Medicaid dental program runs through DentaQuest, 2.6 million citizens' PII may already be in threat actor hands and breach notification obligations may be active. Third, block the Abyss Locker C2 infrastructure at the perimeter and deploy the WMI Helper Agent detection rule before end of business. The broader picture is one of compressing timelines: four CVEs added to the CISA KEV catalog in five days, a ransomware group publishing a step-by-step guide targeting government infrastructure, and a benefits vendor breach that converts a supply chain risk into a confirmed citizen data exposure. Nation-state actors remain quiet — but Volt Typhoon's doctrine of silent pre-positioning means the absence of indicators is not the absence of threat. The question is not whether these techniques will be used against state government — it is whether your defenses will be in place when they are. <h2> Closing </h2> The intelligence picture is clear: ransomware operators are publishing and refining playbooks specifically designed for the technology stacks that state government agencies rely on. Third-party vendors holding citizen data are being breached at accelerating rates. Critical infrastructure systems are under sustained vulnerability disclosure pressure. The window between vulnerability disclosure and active exploitation continues to shrink — CISA added four CVEs to the KEV catalog in five days this cycle. The Abyss Locker playbook published this week gives every ransomware affiliate a step-by-step guide to compromising SonicWall VPNs, stealing Veeam credentials, and encrypting ESXi environments. Verify your SonicWall patches today. Confirm your DentaQuest exposure today. Block the C2 infrastructure today. Everything else can follow the 7-day and 30-day timelines — but these three actions cannot wait. Prepared by the Anomali CTI Desk | 2026-06-05 For questions or additional indicators, contact your Anomali representative or access enriched IOCs via Anomali ThreatStream Next-Gen.

FEATURED RESOURCES

June 5, 2026

Anomali Cyber Watch

Iran's Cyber Offensive Enters a Dangerous New Phase: What CISOs Must Know on Day 98

June 5, 2026

Anomali Cyber Watch

Public Sector

Converging Threats to State Government: Ransomware Playbooks, Vendor Breaches, and Critical Infrastructure Vulnerabilities

June 4, 2026

Anomali Cyber Watch

Iran's Cyber War Machine Evolves: Physical Attacks, Ransomware Convergence, and a Closing Window for Defenders

Explore All