Critical Cisco SD-WAN Zero-Day and Government Cloud Credential Harvesting Demand Immediate State Agency Response

Public Sector

Published on

May 15, 2026

Table of Contents

Threat Assessment Level: ELEVATED (trending toward HIGH) Changed from: Maintained at ELEVATED from prior cycle (2026-05-14). Escalation to HIGH pending confirmation of direct exploitation against U.S. state government networks. The addition of a new CVSS 10.0 vulnerability in state WAN backbone infrastructure and confirmed government cloud credential targeting by supply chain malware increases pressure toward escalation. <h2> Executive Summary </h2> State government IT leaders face a convergence of threats this week that demand immediate attention. A new critical authentication bypass in Cisco Catalyst SD-WAN — the backbone of many state wide-area networks — has been added to CISA's Known Exploited Vulnerabilities catalog. Simultaneously, a sophisticated supply chain worm is actively harvesting AWS GovCloud credentials from compromised developer environments, with OpenAI confirmed as a victim. Five nation-state adversary groups remain active against government targets, and a wave of industrial control system advisories affects equipment deployed in state water and building automation environments. This is not a theoretical risk briefing. These are active campaigns with confirmed victims and government-specific targeting. <h2> What Changed This Cycle </h2> <table> <thead> <tr> <th> Development </th> <th> Why It Matters to State Government </th> </tr> </thead> <tbody> <tr> <td> CVE-2026-20182 — Cisco SD-WAN CVSS 10.0 auth bypass disclosed (May 14) </td> <td> Many states use Cisco Catalyst SD-WAN as their inter-agency network fabric. Complete administrative takeover possible without credentials. </td> </tr> <tr> <td> TeamPCP/Shai-Hulud worm confirmed targeting AWS GovCloud zones (May 15) </td> <td> The worm explicitly enumerates us-gov-east-1 and us-gov-west-1 — zones restricted to government agencies. This is purpose-built government targeting. </td> </tr> <tr> <td> Siemens ICS advisory batch — 8 advisories including SIMATIC CN 4100 and Ruggedcom ROX (May 14) </td> <td> Affects communication nodes and ruggedized switches deployed in state water treatment, transportation, and building automation. </td> </tr> <tr> <td> China-nexus SLICKDEMON malware via DAEMON Tools supply chain (updated May 14) </td> <td> Government explicitly listed as a target sector. New supply chain vector using legitimate disk imaging software. </td> </tr> <tr> <td> ClickFix + NETSUPPORT RAT campaigns targeting government (updated May 14) </td> <td> Social engineering technique tricks state employees into running malicious PowerShell — deploys remote access trojan. </td> </tr> <tr> <td> MuddyWater (Iran/MOIS) deploys Chaos ransomware as false-flag covering espionage (May 11) </td> <td> Destructive ransomware payload masks underlying intelligence-collection mission; state agencies may misclassify incident as financially motivated. </td> </tr> <tr> <td> Akira (PUNK SPIDER) and Qilin (REVENANT SPIDER) ransomware groups update operations (May 15) </td> <td> Both groups remain operationally active with state and local government among preferred target sectors. </td> </tr> <tr> <td> Cloud phishing infrastructure abusing Google App Engine and Azure App Service (ongoing) </td> <td> Over 100 unique appspot.com subdomains identified hosting Microsoft 365 credential harvesting pages; hosted on legitimate cloud platforms to bypass domain reputation filters. </td> </tr> </tbody> </table> <h2> Threat Timeline </h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Severity </th> </tr> </thead> <tbody> <tr> <td> 2026-05-08 </td> <td> CISA adds CVE-2026-6973 (Ivanti EPMM zero-day) to KEV catalog </td> <td> CRITICAL </td> </tr> <tr> <td> 2026-05-11 </td> <td> MuddyWater (Iran/MOIS) deploys Chaos ransomware as false-flag covering espionage </td> <td> HIGH </td> </tr> <tr> <td> 2026-05-11 </td> <td> TeamPCP compromises 170+ npm/PyPI packages via TanStack supply chain attack </td> <td> CRITICAL </td> </tr> <tr> <td> 2026-05-12 </td> <td> MISTBRICK malware deployed via Ivanti CVE-2026-1281/CVE-2026-1340 against government targets </td> <td> HIGH </td> </tr> <tr> <td> 2026-05-12 </td> <td> CISA publishes 7 ICS advisories (ABB AC500 V3, Fuji Electric Tellus HMI) </td> <td> ELEVATED </td> </tr> <tr> <td> 2026-05-14 </td> <td> CVE-2026-20182 disclosed — Cisco SD-WAN CVSS 10.0 authentication bypass </td> <td> CRITICAL </td> </tr> <tr> <td> 2026-05-14 </td> <td> Siemens ICS advisory batch: SIMATIC CN 4100, Ruggedcom ROX ×4, Simcenter, Teamcenter </td> <td> ELEVATED </td> </tr> <tr> <td> 2026-05-14 </td> <td> China-nexus SLICKDEMON campaign updated — government targeting confirmed </td> <td> HIGH </td> </tr> <tr> <td> 2026-05-15 </td> <td> OpenAI confirms employee compromise via Shai-Hulud; AWS GovCloud credential targeting revealed </td> <td> CRITICAL </td> </tr> <tr> <td> 2026-05-15 </td> <td> Akira (PUNK SPIDER) and Qilin (REVENANT SPIDER) ransomware groups update operations </td> <td> ELEVATED </td> </tr> </tbody> </table> <h2> Key Threat Analysis </h2> <h3> 1. Cisco SD-WAN: Your State Network Backbone Is at Risk </h3> CVE-2026-20182 is a peering authentication bypass in Cisco Catalyst SD-WAN Controller/Manager that allows unauthenticated remote attackers to gain full administrative NETCONF access. An attacker exploiting this vulnerability can manipulate the entire SD-WAN fabric configuration — effectively controlling routing, segmentation, and traffic flow across all connected state agency sites. This is the second CVSS 10.0 in this product family in three months (following CVE-2026-20127 from February 2026). The February vulnerabilities are already being actively exploited in the wild. The new vulnerability introduces an additional attack vector in the control connection handshake. Bottom line: If your state uses Cisco Catalyst SD-WAN for inter-agency connectivity, a successful exploitation could segment or surveil the entire state network. <h3> 2. Supply Chain Worm Targeting Government Cloud Credentials </h3> The TeamPCP threat group has executed one of the most significant supply chain attacks of 2026. Their Shai-Hulud worm compromised 170+ packages across npm and PyPI ecosystems, including widely-used TanStack libraries. The worm: <ul> <li> Explicitly targets AWS GovCloud — enumerating all 19 AWS availability zones including the government-restricted us-gov-east-1 and us-gov-west-1 </li> <li> Exfiltrates credentials from source code repositories, CI/CD pipelines, and environment variables </li> <li> Uses a novel fallback C2 mechanism (FIRESCALE) that scans ALL public GitHub commit messages for RSA-4096 signed alternative server URLs — making takedown extremely difficult </li> <li> Activates destructive payloads (file deletion) on machines geolocated to Israel or Iran, while exiting on Russian-locale systems </li> </ul> Confirmed victims include OpenAI (two employee devices compromised), with TanStack, UiPath, Mistral AI, OpenSearch, and Guardrails AI also affected. Any state agency developer environment using these packages is at risk. Primary C2: 83.142.209[.]194 <h3> 3. Nation-State Actor Landscape </h3> Five nation-state adversary groups remain active against government targets: <table> <thead> <tr> <th> Actor </th> <th> Origin </th> <th> Current Activity </th> <th> Primary Concern </th> </tr> </thead> <tbody> <tr> <td> Volt Typhoon / Salt Typhoon </td> <td> China (PLA/MSS) </td> <td> Silent pre-positioning in critical infrastructure </td> <td> Highest-consequence scenario — living-off-the-land makes detection extremely difficult </td> </tr> <tr> <td> Kimsuky / APT43 </td> <td> North Korea (RGB) </td> <td> LLM-assisted spear-phishing, VSCode tunnel C2 </td> <td> Credential theft targeting government employees </td> </tr> <tr> <td> MuddyWater </td> <td> Iran (MOIS) </td> <td> Chaos ransomware as false-flag for espionage </td> <td> Destructive capability masked as financially motivated </td> </tr> <tr> <td> VENOMOUS BEAR / Turla </td> <td> Russia (FSB) </td> <td> Refreshed Kazuar RAT variants </td> <td> Long-term persistent access to government networks </td> </tr> <tr> <td> China-nexus (unattributed) </td> <td> China </td> <td> SLICKDEMON via DAEMON Tools supply chain </td> <td> Government, education, telecom targeting across 7 countries </td> </tr> </tbody> </table> Critical absence to note: No Volt Typhoon activity was detected this cycle. For a living-off-the-land actor that has already achieved persistence in critical infrastructure, silence is not reassurance — it likely indicates successful persistence without triggering detections. <h3> 4. Industrial Control Systems Under Pressure </h3> Fourteen ICS advisories have been published in the past week affecting systems deployed in state-coordinated OT environments: <ul> <li> Siemens SIMATIC CN 4100 — communication nodes in industrial automation </li> <li> Siemens Ruggedcom ROX (4 advisories) — ruggedized switches in utility and transportation networks </li> <li> ABB AC500 V3 PLCs — programmable logic controllers in water treatment </li> <li> Fuji Electric Tellus HMI (CVE-2026-8108) — human-machine interfaces in building automation </li> <li> Universal Robots — authentication bypass in robotic systems </li> </ul> These systems are often managed by separate OT teams with different patching cadences than enterprise IT. Coordination is essential. <h3> 5. Social Engineering Evolution: ClickFix Campaigns </h3> A growing wave of ClickFix campaigns is specifically targeting government sector employees. The technique presents fake browser update or error messages that instruct users to copy and paste PowerShell commands — effectively tricking them into executing malware. The current campaign deploys NETSUPPORT RAT for persistent remote access. This technique bypasses traditional email security because the initial lure often comes through compromised legitimate websites or search engine results rather than email. <h2> Predictive Analysis </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Timeframe </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> Additional TeamPCP supply chain victims disclosed (state agencies potentially among them) </td> <td> 75% </td> <td> Next 72 hours </td> <td> 170+ packages compromised; only a handful of victims publicly confirmed so far </td> </tr> <tr> <td> Exploitation attempts against CVE-2026-20182 increase significantly </td> <td> 50% </td> <td> Next 7 days </td> <td> February CVEs already exploited; new advisory details lower the exploitation bar </td> </tr> <tr> <td> Ransomware incident against a U.S. state/local government entity </td> <td> 60% </td> <td> Next 14 days </td> <td> Akira and Qilin both operationally active; state/local gov remains a preferred target </td> </tr> <tr> <td> Volt Typhoon activity surfaces in state critical infrastructure </td> <td> 30% </td> <td> Next 30 days </td> <td> Continued silence from a confirmed pre-positioned actor increases probability of eventual detection or activation </td> </tr> <tr> <td> Copycat supply chain attacks inspired by TeamPCP's "$1,000 Monero contest" </td> <td> 25% </td> <td> Next 30 days </td> <td> Public gamification of supply chain attacks may attract additional actors </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Detection Priorities </h3> <table> <thead> <tr> <th> Priority </th> <th> What to Detect </th> <th> ATT&CK Technique </th> <th> Detection Logic </th> </tr> </thead> <tbody> <tr> <td> P1 </td> <td> Cisco SD-WAN unauthorized NETCONF access </td> <td> T1190 , T1078 </td> <td> Alert on NETCONF sessions from non-management IPs; monitor for configuration changes outside change windows </td> </tr> <tr> <td> P1 </td> <td> Shai-Hulud C2 communication </td> <td> T1071.001 , T1567 </td> <td> Block/alert on traffic to 83.142.209[.]194; monitor for unexpected outbound connections from CI/CD build servers </td> </tr> <tr> <td> P1 </td> <td> ClickFix PowerShell execution </td> <td> T1204.001 , T1059.001 </td> <td> Alert on PowerShell spawned as child process of any browser (chrome.exe, msedge.exe, firefox.exe) with -enc or -encodedcommand flags </td> </tr> <tr> <td> P2 </td> <td> FIRESCALE GitHub C2 fallback </td> <td> T1102 </td> <td> Monitor for GitHub API calls (api.github.com/search/commits) from non-developer endpoints or build servers </td> </tr> <tr> <td> P2 </td> <td> AWS GovCloud credential exfiltration </td> <td> T1552.001 , T1134 </td> <td> Alert on AWS API calls from unexpected source IPs; monitor for enumeration of us-gov-* regions from developer workstations </td> </tr> <tr> <td> P2 </td> <td> NETSUPPORT RAT persistence </td> <td> T1219 , T1547.001 </td> <td> Detect NETSUPPORT Manager installation artifacts; monitor registry Run keys for unexpected remote access tools </td> </tr> <tr> <td> P3 </td> <td> Volt Typhoon living-off-the-land </td> <td> T1078 , T1072 </td> <td> Hunt for legitimate admin tool usage (ntdsutil, netsh, wmic) from unexpected user accounts or at unusual times </td> </tr> </tbody> </table> <h3> Hunting Hypotheses </h3> <ul> <li> Hypothesis: TeamPCP supply chain compromise has already affected state developer environments. </li> </ul> <ul> <li> Hunt: Query package manager logs for any TanStack, UiPath, Mistral AI, OpenSearch, or Guardrails AI npm/PyPI packages installed after May 11. Check CI/CD pipeline execution logs for unexpected network connections to 83.142.209[.]194. </li> </ul> <ul> <li> Hypothesis: Cisco SD-WAN controllers have been probed or exploited via CVE-2026-20182 or predecessor CVEs. </li> </ul> <ul> <li> Hunt: Review SD-WAN controller authentication logs for failed/anomalous peering attempts. Check NETCONF session logs for configuration reads or changes from unrecognized sources. </li> </ul> <ul> <li> Hypothesis: ClickFix has already delivered NETSUPPORT to state employee endpoints. </li> </ul> <ul> <li> Hunt: Search EDR telemetry for PowerShell execution with encoded commands spawned by browser processes in the past 14 days. Look for NETSUPPORT Manager client installations not deployed by IT. </li> </ul> <ul> <li> Hypothesis: Volt Typhoon maintains persistence in state network infrastructure. </li> </ul> <ul> <li> Hunt: Audit all administrative account usage on network devices (routers, switches, firewalls) for the past 90 days. Flag any use of built-in admin tools (ntdsutil, netsh, wmic) from service accounts or at off-hours. </li> </ul> <h3> IOC Blocking Actions </h3> <table> <thead> <tr> <th> Type </th> <th> Indicator </th> <th> Context </th> </tr> </thead> <tbody> <tr> <td> IPv4 </td> <td> 83.142.209[.]194 </td> <td> TeamPCP/Shai-Hulud primary C2 server </td> </tr> </tbody> </table> Note: Additional IOCs for all campaigns discussed in this report — including file hashes, additional network indicators, and phishing infrastructure — are available through Anomali ThreatStream Next-Gen and partner feeds. Contact your Anomali representative for access. <h2> Sector-Specific Defensive Priorities </h2> <h3> Financial Services (State Treasury, Revenue, Comptroller) </h3> Primary threat: TeamPCP credential harvesting targeting financial system API keys and AWS credentials used for tax processing and payment systems Action: Audit all npm/PyPI dependencies in citizen-facing financial applications (tax portals, payment gateways). Rotate all AWS IAM keys accessible from development environments. Enable MFA on all service accounts with access to financial data stores. Monitor: Unusual AWS API calls to S3 buckets containing tax records or payment data, especially from new source IPs or GovCloud region enumeration. <h3> Energy & Utilities (State-Coordinated Water, Power, Transportation) </h3> Primary threat: Siemens SIMATIC CN 4100 and Ruggedcom ROX vulnerabilities in water treatment and transportation SCADA networks; Volt Typhoon pre-positioning Action: Coordinate with OT teams to inventory Siemens SIMATIC CN 4100 and Ruggedcom ROX deployments. Apply patches per ICSA-26-134-10/11/12/16. Verify network segmentation between IT and OT environments. Conduct 90-day audit of administrative access to OT network devices. Monitor: Any IT-to-OT lateral movement attempts; unusual NETCONF or SNMP traffic to industrial switches; administrative tool usage on OT-adjacent systems outside maintenance windows. <h3> Healthcare (State Health Agencies, Medicaid Systems) </h3> Primary threat: Ransomware (Akira/Qilin) targeting healthcare data; ClickFix social engineering against health agency staff; supply chain compromise of health IT applications Action: Verify offline backup integrity for Medicaid enrollment and claims systems. Brief health agency staff on ClickFix lure techniques (fake browser updates). Audit third-party health IT vendor access for supply chain exposure. Monitor: PowerShell execution from browser processes on health agency endpoints; unusual data exfiltration volumes from health record databases; ransomware precursor activity (Cobalt Strike beacons, credential dumping). <h3> Government (Executive Branch Agencies, Legislative Support) </h3> Primary threat: Nation-state espionage (Kimsuky credential theft, MuddyWater false-flag ransomware); Cisco SD-WAN exploitation disrupting inter-agency communications Action: Confirm Cisco SD-WAN patch status across all agency sites. Enable advanced audit logging on Microsoft 365 (EWS API, Azure AD sign-ins). Brief executives on callback phishing and ClickFix techniques. Review VSCode Remote Tunnel policies — disable if not operationally required. Monitor: Anomalous Azure AD sign-ins (impossible travel, new device registrations); SD-WAN configuration changes outside change windows; VSCode tunnel connections from non-developer endpoints. <h3> Aviation & Logistics (State DOT, Airport Authorities, Port Systems) </h3> Primary threat: ICS/SCADA vulnerabilities in traffic management and port automation systems; China-nexus supply chain targeting transportation sector Action: Inventory Universal Robots and Siemens deployments in port/airport automation. Review DAEMON Tools usage on engineering workstations (SLICKDEMON vector). Verify air-gapping of traffic management systems from enterprise networks. Monitor: Authentication anomalies on robotic/automation systems; unexpected software installations on engineering workstations; network connections from OT segments to internet-facing infrastructure. <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Within 24 Hours) </h3> <table> <thead> <tr> <th> Action </th> <th> Owner </th> <th> Rationale </th> </tr> </thead> <tbody> <tr> <td> Verify Cisco Catalyst SD-WAN Manager/Controller is patched to version 20.18+ or apply cisco-sa-sdwan-rpa2-v69WY2SW mitigation </td> <td> Network Operations </td> <td> CVE-2026-20182 is CVSS 10.0, KEV-listed, and predecessor CVEs are actively exploited. This is your WAN backbone. </td> </tr> <tr> <td> Block 83.142.209[.]194 at perimeter firewalls and DNS sinkholes </td> <td> SOC / Network Security </td> <td> Primary C2 for Shai-Hulud supply chain worm actively targeting government cloud credentials </td> </tr> <tr> <td> Audit npm/PyPI dependencies across all state development environments for TanStack and related compromised packages (installed after May 11) </td> <td> DevOps / Application Teams </td> <td> 170+ packages compromised; worm specifically targets AWS GovCloud credentials </td> </tr> <tr> <td> Deploy EDR detection rule: alert on PowerShell spawned by browser processes with encoded commands </td> <td> SOC / Endpoint Security </td> <td> ClickFix campaigns actively targeting government employees </td> </tr> <tr> <td> Rotate AWS IAM credentials on all developer workstations with GovCloud access </td> <td> Cloud Operations </td> <td> Shai-Hulud explicitly enumerates and exfiltrates GovCloud zone credentials </td> </tr> </tbody> </table> <h3> 7-DAY Actions </h3> <table> <thead> <tr> <th> Action </th> <th> Owner </th> <th> Rationale </th> </tr> </thead> <tbody> <tr> <td> Patch Siemens SIMATIC CN 4100 and Ruggedcom ROX per ICSA-26-134-10/11/12/16 advisories </td> <td> OT / Facilities Teams </td> <td> Exploitation could compromise water treatment and building automation systems </td> </tr> <tr> <td> Implement network detection for GitHub API commit search calls from non-developer endpoints </td> <td> SOC / Network Security </td> <td> FIRESCALE C2 fallback mechanism scans GitHub commits for signed C2 URLs </td> </tr> <tr> <td> Enable CloudTrail alerts for AWS API calls from unexpected geolocations and for us-gov-* region enumeration </td> <td> Cloud Security </td> <td> Early warning of credential abuse from Shai-Hulud compromise </td> </tr> <tr> <td> Conduct targeted threat hunt for Volt Typhoon TTPs across network infrastructure </td> <td> SOC / Threat Hunting </td> <td> Continued silence from a confirmed pre-positioned actor warrants proactive validation </td> </tr> <tr> <td> Brief all agency IT liaisons on ClickFix social engineering technique with visual examples </td> <td> Security Awareness </td> <td> Government-targeted campaigns active; user recognition is the primary defense </td> </tr> </tbody> </table> <h3> 30-DAY Actions </h3> <table> <thead> <tr> <th> Action </th> <th> Owner </th> <th> Rationale </th> </tr> </thead> <tbody> <tr> <td> Commission architecture review of WAN resilience — assess single-vendor concentration risk in Cisco SD-WAN </td> <td> CISO / Enterprise Architecture </td> <td> Two CVSS 10.0 vulnerabilities in 3 months in the same product family indicates systemic risk </td> </tr> <tr> <td> Operationalize Software Bill of Materials (SBOM) for all citizen-facing applications </td> <td> DevOps / Procurement </td> <td> Four active supply chain campaigns in the past week; inventory is prerequisite to defense </td> </tr> <tr> <td> Inventory and evaluate DAEMON Tools usage across state endpoints — remove or replace if non-essential </td> <td> IT Operations / Endpoint Mgmt </td> <td> China-nexus SLICKDEMON campaign uses trojanized versions for government network access </td> </tr> <tr> <td> Establish secondary OSINT intelligence collection capability with automatic failover </td> <td> CISO / CTI Team </td> <td> Single-provider dependency has created a 6-day intelligence gap affecting legislative monitoring and threat corroboration </td> </tr> <tr> <td> Conduct tabletop exercise: "Ransomware + SD-WAN compromise" dual-incident scenario </td> <td> CISO / IR Team </td> <td> Tests response capability for the most probable compound scenario given current threat landscape </td> </tr> </tbody> </table> <h3> Executive / IR Preparedness </h3> <ul> <li> Update incident response playbooks to include supply chain compromise scenarios (npm/PyPI package contamination → credential theft → cloud infrastructure access) </li> <li> Pre-authorize emergency patching for CVSS 10.0 vulnerabilities without standard change advisory board delays </li> <li> Establish communication plan for potential SD-WAN outage affecting inter-agency connectivity </li> <li> Review cyber insurance coverage for supply chain compromise scenarios — confirm coverage extends to third-party package contamination </li> </ul> <h2> Cloud Phishing Infrastructure Alert </h2> Intelligence this cycle identified an extensive phishing infrastructure abusing Google App Engine (*.appspot.com) and Azure App Service (*.azurewebsites.net) to host credential harvesting pages impersonating Microsoft 365 login portals. Over 100 unique appspot.com subdomains were identified hosting phishing content targeting Office 365, SharePoint, and OneDrive credentials. Key indicators of this campaign: <ul> <li> Domains follow patterns like login-microsoft-office365.df.r.appspot[.]com, outlook-office365-signin.el.r.appspot[.]com, and sharepoint-secure-online.df.r.appspot[.]com </li> <li> Typosquatting variants: mlcrosoft-0nedrive-portal, logln-micr0s0ft-0nline, outlook-0ffice365-0nline </li> <li> Hosted on legitimate cloud infrastructure to bypass domain reputation filters </li> </ul> SOC Action: Update web proxy and CASB policies to flag *.r.appspot.com URLs containing Microsoft/Office365/SharePoint keywords in the subdomain. These are not legitimate Microsoft services. <h2> Bottom Line </h2> The threat landscape facing state government networks is intensifying across multiple vectors simultaneously. The combination of a CVSS 10.0 vulnerability in WAN backbone infrastructure, purpose-built government cloud credential harvesting, and persistent nation-state pre-positioning creates a compound risk that exceeds any single threat in isolation. The window between vulnerability disclosure and active exploitation continues to shrink. CVE-2026-20182's predecessor was weaponized within weeks. The TeamPCP supply chain worm is already harvesting credentials from government-restricted cloud zones. These are not future risks — they are present-tense operational realities. Three decisions for state IT leadership today: <ul> <li> Confirm your SD-WAN is patched. Call your network team. Get a definitive answer within 24 hours. This is your inter-agency communications backbone. </li> </ul> <ul> <li> Audit your software supply chain. If your developers use npm or PyPI packages from any of the 170+ compromised libraries, assume credential exposure and rotate keys immediately. </li> </ul> <ul> <li> Hunt, don't just monitor. Volt Typhoon's silence is not absence. ClickFix bypasses email security. Supply chain worms don't trigger perimeter alerts. Your SOC needs to be actively hunting, not waiting for alerts. </li> </ul> The adversaries are not waiting. Neither should you. Published 2026-05-15 by the Anomali CTI Desk. For questions or additional IOC feeds, contact your Anomali representative or access indicators directly via Anomali ThreatStream Next-Gen.

FEATURED RESOURCES

May 22, 2026

Anomali Cyber Watch

Iran's Cyber Arsenal Is Reloading: What CISOs Must Know About the Post-Decapitation Threat Window

May 22, 2026

Anomali Cyber Watch

Public Sector

When Your Mobile Device Manager Becomes the Attacker's Backdoor: Urgent Threats Facing State Government Networks

May 21, 2026

Anomali Cyber Watch

Iranian Cyber Operations Escalate to Military Psychological Warfare as Ceasefire Talks Stall

Explore All