Critical ColdFusion Vulnerability, New Phishing-as-a-Service Platform, and Russian Infrastructure Refresh Demand Immediate State Government Action

Public Sector

Published on

July 10, 2026

Table of Contents

Threat Assessment Level: ELEVATED Unchanged from prior cycle. Two CVSS-critical vulnerabilities now on CISA's Known Exploited Vulnerabilities catalog, a new commoditized phishing platform targeting Microsoft 365, and fresh APT28 command-and-control infrastructure collectively sustain an elevated posture for state government networks. <h2> Executive Summary </h2> State government IT leaders face a convergence of threats this week that demand coordinated, time-bound action. A maximum-severity Adobe ColdFusion vulnerability (CVE-2026-48282, CVSS 10.0) is being actively exploited and sits squarely in the legacy application stack many state agencies still maintain. Simultaneously, a new phishing-as-a-service kit called Forg365 has lowered the barrier for Microsoft 365 credential theft to $400/month on Telegram — making every state employee's Entra ID account a viable target for low-skill operators. Russian military intelligence (APT28) has refreshed its command-and-control infrastructure, confirming continued interest in government targets. And seven ICS/OT advisories in three days signal elevated risk to state-managed critical infrastructure. This is not a theoretical threat landscape. These are active exploitation campaigns with confirmed victims, public proof-of-concept code, and commodity tooling that puts sophisticated attacks within reach of criminal affiliates. <h2> What Changed </h2> <table> <thead> <tr> <th> Date </th> <th> Development </th> <th> Significance </th> </tr> </thead> <tbody> <tr> <td> 2026-07-07 </td> <td> CISA added CVE-2026-48282 (Adobe ColdFusion, CVSS 10.0) to the KEV catalog </td> <td> Active exploitation confirmed; federal BOD compliance deadline triggered </td> </tr> <tr> <td> 2026-07-07 </td> <td> CISA added CVE-2026-48908 (SP Page Builder for Joomla, CVSS 9.8) to the KEV catalog </td> <td> Unauthenticated RCE on state Joomla-based public portals; active exploitation confirmed </td> </tr> <tr> <td> 2026-07-09 </td> <td> Three CISA ICS advisories published: Schneider Electric PowerChute, Schneider Easergy MiCOM Px40, OpenPLC v3 </td> <td> State-managed data centers (UPS) and power substations affected </td> </tr> <tr> <td> 2026-07-09 </td> <td> CVE-2026-50656 "RoguePlanet" patched by Microsoft </td> <td> Defender privilege escalation with public PoC enabling SYSTEM access; patch validation required </td> </tr> <tr> <td> 2026-07-10 </td> <td> Forg365 PhaaS platform disclosed by ZeroBEC researchers </td> <td> Device-code phishing + AiTM session hijacking packaged for mass operator adoption </td> </tr> <tr> <td> 2026-07-10 </td> <td> APT28 C2 IP 152.32.174[.]171 confirmed active (confidence 96%) </td> <td> Russian government-targeting infrastructure refreshed in Hong Kong </td> </tr> <tr> <td> 2026-07-10 </td> <td> "HalluSquatting" technique disclosed — AI hallucinated package names weaponized </td> <td> New supply chain vector affecting agencies using AI coding assistants </td> </tr> <tr> <td> 2026-07-10 </td> <td> ModHeader browser extension (1.6M installs) flagged as malware </td> <td> Credential/session data exfiltration risk on managed state endpoints </td> </tr> </tbody> </table> <h2> Threat Timeline </h2> <table> <thead> <tr> <th> Date </th> <th> Actor / Campaign </th> <th> Event </th> <th> Impact to State Gov </th> </tr> </thead> <tbody> <tr> <td> 2026-06-12 </td> <td> VOID MANTICORE (Iran/IRGC) </td> <td> Confirmed breach of California water utility </td> <td> Demonstrated destructive capability against U.S. critical infrastructure </td> </tr> <tr> <td> 2026-07-07 </td> <td> Unknown (multiple actors) </td> <td> CVE-2026-48282 added to CISA KEV </td> <td> Legacy ColdFusion applications in state agencies at critical risk </td> </tr> <tr> <td> 2026-07-07 </td> <td> Unknown </td> <td> CVE-2026-48908 added to CISA KEV </td> <td> State Joomla-based public portals vulnerable to unauthenticated RCE </td> </tr> <tr> <td> 2026-07-09 </td> <td> N/A (vendor disclosure) </td> <td> Schneider Electric + OpenPLC ICS advisories </td> <td> State data center UPS systems and power grid relays require patching </td> </tr> <tr> <td> 2026-07-09 </td> <td> Microsoft </td> <td> CVE-2026-50656 "RoguePlanet" patched </td> <td> Defender privilege escalation with public PoC — SYSTEM access </td> </tr> <tr> <td> 2026-07-10 </td> <td> APT28 (Russia/GRU) </td> <td> Fresh C2 infrastructure confirmed active </td> <td> Continued Russian targeting of government networks </td> </tr> <tr> <td> 2026-07-10 </td> <td> Criminal (Telegram-distributed) </td> <td> Forg365 PhaaS platform launched </td> <td> M365 credential theft commoditized at $400/month </td> </tr> <tr> <td> 2026-07-10 </td> <td> UNATTRIBUTED </td> <td> HalluSquatting technique published </td> <td> AI-assisted development pipelines become supply chain attack surface </td> </tr> </tbody> </table> <h2> Key Threat Analysis </h2> <h3> 1. CVE-2026-48282 — Adobe ColdFusion Path Traversal to RCE (CVSS 10.0) </h3> This is the highest-priority vulnerability for state agencies this cycle. Adobe ColdFusion remains embedded in legacy state government applications — citizen portals, permitting systems, and internal workflow tools built over the past two decades. CVE-2026-48282 allows unauthenticated remote code execution via path traversal with no user interaction required. <ul> <li> Affected versions: ColdFusion 2025.9 and earlier, ColdFusion 2023.20 and earlier </li> <li> Exploitation status: Active — confirmed in CISA KEV catalog </li> <li> Patch: APSB26-68 (ColdFusion 2025.10+ or 2023.21+) </li> <li> CISA BOD compliance deadline: Approximately July 21, 2026 (14 days from KEV listing) </li> </ul> Why this matters for state government: Many agencies maintain ColdFusion applications that cannot be quickly patched due to custom code dependencies, change management processes, or vendor support constraints. If patching is not feasible within 72 hours, network isolation or WAF virtual patching must be authorized as interim controls. <h3> 2. Forg365 — Commoditized Microsoft 365 Credential Theft </h3> Forg365 represents the maturation of the phishing-as-a-service ecosystem into a single-console platform that combines: <ul> <li> Device-code phishing — abuses Microsoft's OAuth device authorization flow to capture tokens without triggering traditional phishing page detection </li> <li> Adversary-in-the-middle (AiTM) — real-time session hijacking that defeats standard MFA </li> <li> AI-generated lures — automated creation of convincing phishing content </li> <li> Token vaulting — persistent access via stolen OAuth tokens and a browser extension ("ForgCookie") that refreshes Microsoft SSO cookies </li> </ul> At $400/month on Telegram, this puts nation-state-grade credential theft capability in the hands of any criminal affiliate. State agencies running Microsoft 365 and Entra ID — which is effectively all of them — face a direct threat. Key insight: The convergence of device-code phishing (previously seen in DEBULL campaigns) and AiTM techniques into a single commodity platform means that conditional access policies restricting device-code flows are now the single most important control for protecting state M365 environments. If device-code flows are unrestricted, MFA provides no protection against this class of attack. <h3> 3. APT28 Infrastructure Refresh — Continued Russian Government Targeting </h3> A high-confidence (96%) APT28-attributed IP address was confirmed active on July 10: <ul> <li> IP: 152.32.174[.]171 </li> <li> ASN: 135377 (UCloud Information Technology, Hong Kong) </li> <li> Tags: Phishing, Command Injection, Invalid File Access </li> </ul> This infrastructure refresh, combined with a confirmed Russian attack on a UK local government council (also reported July 10), reinforces that Russian military intelligence continues to actively target government IT systems at all levels. State agencies managing election infrastructure, law enforcement databases, and critical infrastructure oversight are priority targets. <h3> 4. ICS/OT Advisory Surge — Seven Advisories in Three Days </h3> The July 7–9 period saw an above-average volume of ICS advisories affecting products commonly deployed in state-managed facilities: <table> <thead> <tr> <th> Advisory </th> <th> Product </th> <th> Relevance </th> </tr> </thead> <tbody> <tr> <td> ICSA-26-190-02 </td> <td> Schneider Electric PowerChute Serial Shutdown </td> <td> State data center UPS management </td> </tr> <tr> <td> ICSA-26-190-03 </td> <td> Schneider Electric Easergy MiCOM Px40 </td> <td> Power grid substation protective relays </td> </tr> <tr> <td> ICSA-26-190-01 </td> <td> OpenPLC v3 </td> <td> Open-source PLC runtime in smaller utilities </td> </tr> <tr> <td> Additional </td> <td> Siemens SINEC OS, Hitachi PROMOD V, Hydro-Québec, Labcenter Proteus </td> <td> Various critical infrastructure applications </td> </tr> </tbody> </table> Combined with the confirmed VOID MANTICORE breach of a California water utility on June 12, this advisory volume underscores that state-managed OT environments face both vulnerability exposure and demonstrated adversary intent. <h3> 5. HalluSquatting — AI Development Tools as Supply Chain Attack Surface </h3> A newly disclosed technique called "HalluSquatting" weaponizes a known weakness in AI coding assistants: when tools like GitHub Copilot or ChatGPT hallucinate package names that don't exist, attackers can register those names and populate them with malicious code. Any developer who follows the AI's recommendation and runs pip install or npm install unknowingly pulls attacker-controlled code into their application. State government relevance: As agencies adopt AI coding assistants to accelerate development and address staffing shortages, this creates a new supply chain attack surface that bypasses traditional security controls. No phishing, no social engineering — just a developer trusting their AI tool's recommendation. <h3> 6. Notable Absences — What's Missing Is Also Signal </h3> <ul> <li> Volt Typhoon / Salt Typhoon (China): No new indicators this cycle despite active clusters tracking Chinese pre-positioning in U.S. government networks. Silence from a known active adversary warrants continued vigilance, not complacency. </li> <li> Play ransomware: No new government victim disclosures since July 7. A 3-day gap is within normal operational tempo but bears monitoring given Play's confirmed government targeting. </li> <li> SCATTERED SPIDER (UNC3944/Octo Tempest): Extended quiet period (60+ days). This group's social engineering and vishing capabilities against Entra ID environments remain a latent threat that may resurface under new aliases. </li> <li> Ransomware ecosystem broadly: The anomalous quiet period in ransomware victim claims noted in prior cycles persists. This may indicate active pre-encryption dwell time rather than reduced threat activity — organizations should not lower their guard. </li> </ul> <h2> Predictive Analysis </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Timeframe </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> Exploitation attempts against CVE-2026-48282 accelerate against state ColdFusion instances </td> <td> HIGH (85%) </td> <td> 7–14 days </td> <td> KEV listing publicizes vulnerability; active exploitation already confirmed; state agencies known to run legacy ColdFusion </td> </tr> <tr> <td> Forg365 adopted by criminal affiliates for state government credential theft campaigns </td> <td> HIGH (75%) </td> <td> 14–30 days </td> <td> $400/month Telegram distribution model enables rapid adoption; M365 is universal target </td> </tr> <tr> <td> APT28 phishing campaign leveraging 152.32.174[.]171 infrastructure targets U.S. government entities </td> <td> MODERATE (60%) </td> <td> 7–21 days </td> <td> Fresh infrastructure typically deployed ahead of campaigns; government targeting confirmed </td> </tr> <tr> <td> HalluSquatting technique used in targeted supply chain attack against government developer </td> <td> MODERATE (45%) </td> <td> 30–90 days </td> <td> Technique is public; requires attacker to identify hallucinated packages specific to government tooling </td> </tr> <tr> <td> Ransomware operator (Play, AiLock, or successor) deploys against state agency after extended dwell </td> <td> MODERATE (55%) </td> <td> 14–30 days </td> <td> Quiet period in claims may indicate active operations; state government remains high-value target </td> </tr> <tr> <td> VOID MANTICORE or affiliated Iranian actor targets additional U.S. water/energy utility </td> <td> MODERATE (50%) </td> <td> 30–60 days </td> <td> Demonstrated capability (June 12 breach); geopolitical tensions sustained </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Immediate Detection Priorities </h3> <ol> <li> Adobe ColdFusion Exploitation (CVE-2026-48282) </li> </ol> <ul> <li> ATT&CK: T1190 (Exploit Public-Facing Application), T1059.003 (Windows Command Shell), T1083 (File and Directory Discovery) </li> <li> Hunt hypothesis: Adversaries are scanning for and exploiting ColdFusion instances via path traversal payloads. Look for unusual child processes spawned by coldfusion.exe or cfusion.exe, unexpected file writes outside webroot, and directory traversal patterns (../) in web server logs. </li> <li> Detection: Alert on any cmd.exe or powershell.exe process spawned by ColdFusion service accounts. Monitor WAF logs for path traversal attempts targeting /CFIDE/ and /cf_scripts/ paths. </li> </ul> <ol start="2"> <li> Device-Code Phishing / Forg365 (M365 Token Theft) </li> </ol> <ul> <li> ATT&CK: T1566.002 (Spearphishing Link), T1539 (Steal Web Session Cookie), T1528 (Steal Application Access Token), T1111 (MFA Interception) </li> <li> Hunt hypothesis: Operators using Forg365 will generate device-code authentication requests from residential ISPs (Comcast/Xfinity observed) targeting administrative accounts. Look for Microsoft Authentication Broker events where the requesting IP geolocation doesn't match the user's normal location. </li> <li> Detection: Monitor Entra ID sign-in logs for deviceCode authentication flows. Alert when device-code grants occur from ISPs inconsistent with organizational VPN/office ranges. Flag any OAuth token refresh activity from browser extensions not in the approved inventory. </li> </ul> <ol start="3"> <li> APT28 C2 Communication </li> </ol> <ul> <li> ATT&CK: T1071.001 (Web Protocols), T1566 (Phishing), T1059 (Command and Scripting Interpreter) </li> <li> Hunt hypothesis: Compromised endpoints may beacon to APT28 infrastructure. Search network logs (firewall, proxy, DNS) for any connection to 152.32.174[.]171 or ASN 135377 (UCloud HK). </li> <li> Detection: Block and alert on the IOC. Retroactively search 90 days of network telemetry for historical connections. Any hit warrants full incident investigation. </li> </ul> <ol start="4"> <li> Joomla Web Shell Deployment (CVE-2026-48908) </li> </ol> <ul> <li> ATT&CK: T1190 (Exploit Public-Facing Application), T1505.003 (Web Shell), T1059.001 (PowerShell) </li> <li> Hunt hypothesis: Attackers exploiting SP Page Builder upload arbitrary PHP files that function as web shells. Look for new .php files in Joomla upload directories, unexpected outbound connections from web servers, and PHP processes spawning system commands. </li> <li> Detection: File integrity monitoring on Joomla webroot directories. Alert on any PHP file creation in /media/, /tmp/, or plugin upload paths. </li> </ul> <ol start="5"> <li> Malicious Browser Extensions (ModHeader) </li> </ol> <ul> <li> ATT&CK: T1176 (Browser Extensions) </li> <li> Hunt hypothesis: The ModHeader extension (1.6 million installs) has been flagged as malware. State endpoints with this extension installed may be exfiltrating session data. </li> <li> Detection: Query endpoint management (Intune, SCCM, Chrome Enterprise) for extension IDs idgpnmonknjnojddfkpgkljpfnnfcklj (Chrome) and opgbiafapkbbnbnjcdomjaghbckfkglc (Edge). Remove and investigate any endpoints where found. </li> </ul> <h3> Hunting Queries to Prioritize </h3> <table> <thead> <tr> <th> Priority </th> <th> Hunt </th> <th> Data Source </th> <th> ATT&CK </th> </tr> </thead> <tbody> <tr> <td> Critical </td> <td> ColdFusion child process anomalies </td> <td> EDR telemetry </td> <td> T1190, T1059.003 </td> </tr> <tr> <td> Critical </td> <td> Device-code auth from residential ISPs to admin accounts </td> <td> Entra ID sign-in logs </td> <td> T1528, T1111 </td> </tr> <tr> <td> High </td> <td> Connections to 152.32.174[.]171 </td> <td> Firewall/proxy logs </td> <td> T1071.001 </td> </tr> <tr> <td> High </td> <td> New PHP files in Joomla upload directories </td> <td> File integrity monitoring </td> <td> T1505.003 </td> </tr> <tr> <td> High </td> <td> ModHeader extension presence </td> <td> Endpoint management </td> <td> T1176 </td> </tr> <tr> <td> Medium </td> <td> Unusual pip install or npm install of unrecognized packages </td> <td> Developer workstation logs </td> <td> T1195.001 </td> </tr> </tbody> </table> <h2> Sector-Specific Defensive Priorities </h2> <h3> Financial Services (State Treasury, Revenue, Payroll Systems) </h3> <ul> <li> Primary threat: Forg365 credential theft targeting finance team M365 accounts for BEC/payment redirection </li> <li> Action: Enforce conditional access policies that block device-code authentication flows for accounts with access to financial systems. Require phishing-resistant MFA (FIDO2/Windows Hello) for all treasury and payroll administrators. </li> <li> Monitor: Entra ID sign-in logs for finance department accounts authenticating via device-code flow or from unexpected geolocations. </li> </ul> <h3> Energy (State-Regulated Utilities, Grid Oversight) </h3> <ul> <li> Primary threat: Schneider Electric Easergy MiCOM Px40 vulnerabilities in substation protective relays; VOID MANTICORE demonstrated destructive capability against water utility </li> <li> Action: Coordinate with regulated utilities to confirm Schneider advisory (ICSA-26-190-03) patch status. Verify network segmentation between IT and OT environments. Ensure protective relay firmware is current. </li> <li> Monitor: Anomalous commands to protective relay systems; unexpected remote access to SCADA/EMS networks. </li> </ul> <h3> Healthcare (Medicaid, Public Health, State Hospitals) </h3> <ul> <li> Primary threat: Ransomware operators (Play, AiLock) targeting healthcare data; ColdFusion vulnerabilities in legacy health portal applications </li> <li> Action: Prioritize ColdFusion patching for any health-related applications processing PHI. Validate offline backup integrity for Medicaid enrollment and claims systems. Review ransomware playbook with 4-hour RTO requirement for patient-facing systems. </li> <li> Monitor: Unusual data staging or exfiltration patterns from health databases; ColdFusion exploitation indicators. </li> </ul> <h3> Government (Executive Agencies, Law Enforcement, Elections) </h3> <ul> <li> Primary threat: APT28 credential theft and espionage; Forg365 targeting government M365 tenants; ransomware targeting government for political leverage </li> <li> Action: Block APT28 IOC immediately. Restrict device-code flows in Entra ID conditional access. Brief election security teams on Russian infrastructure refresh. Ensure law enforcement database access requires phishing-resistant MFA. </li> <li> Monitor: All authentication anomalies for privileged accounts; any connection to known APT28 infrastructure; lateral movement indicators in Active Directory. </li> </ul> <h3> Aviation / Logistics (State DOT, Port Authorities, Transit) </h3> <ul> <li> Primary threat: Chinese pre-positioning (Volt Typhoon/Salt Typhoon) in transportation infrastructure; ICS vulnerabilities in traffic management and transit SCADA systems </li> <li> Action: Conduct network segmentation audit between corporate IT and operational technology in transit/DOT environments. Review remote access policies for third-party maintenance of traffic management systems. Confirm no OpenPLC v3 deployments in traffic signal or transit control systems. </li> <li> Monitor: Unusual outbound connections from OT network segments; living-off-the-land techniques (LOLBins) on systems managing transportation infrastructure. </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Within 24 Hours) </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> IT Operations </td> <td> Patch or isolate all Adobe ColdFusion instances. CVE-2026-48282 (CVSS 10.0) is actively exploited and on CISA KEV. Target versions: 2025.10+ or 2023.21+ per APSB26-68. If patching is blocked by dependencies, implement WAF virtual patching rules blocking path traversal patterns and/or network-isolate ColdFusion servers from internet-facing access. </td> </tr> <tr> <td> 2 </td> <td> SOC </td> <td> Block APT28 C2 IP 152.32.174[.]171 at perimeter firewall, proxy, and DNS sinkhole. Add to EDR watchlist. Retroactively search 90 days of network logs for any historical connection. </td> </tr> <tr> <td> 3 </td> <td> Identity/SOC </td> <td> Create detection for OAuth device-code phishing in Entra ID. Alert on device-code authentication grants from residential ISPs or geolocations inconsistent with user profiles, especially for privileged accounts. </td> </tr> <tr> <td> 4 </td> <td> CISO </td> <td> Decision required: If ColdFusion cannot be patched within 72 hours, authorize emergency network isolation or WAF virtual patching. Document risk acceptance if neither is feasible. </td> </tr> </tbody> </table> <h3> 7-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 5 </td> <td> IT Operations </td> <td> Audit and patch all Joomla instances running SP Page Builder. CVE-2026-48908 (CVSS 9.8) enables unauthenticated RCE. Remove the plugin if not actively required. </td> </tr> <tr> <td> 6 </td> <td> IT Operations / OT </td> <td> Review Schneider Electric deployments — PowerChute Serial Shutdown (data center UPS) and Easergy MiCOM Px40 (substations). Apply patches per ICSA-26-190-02 and ICSA-26-190-03. Coordinate with utility partners. </td> </tr> <tr> <td> 7 </td> <td> SOC / Endpoint </td> <td> Audit and block malicious browser extensions. Remove ModHeader (Chrome ID: idgpnmonknjnojddfkpgkljpfnnfcklj, Edge ID: opgbiafapkbbnbnjcdomjaghbckfkglc) from all managed endpoints. Investigate any endpoints where it was present. </td> </tr> <tr> <td> 8 </td> <td> Identity </td> <td> Restrict device-code authentication flows in Entra ID conditional access policies. Limit to managed devices only, or block entirely for administrative accounts. This is the single highest-leverage control against Forg365 and similar PhaaS platforms. </td> </tr> <tr> <td> 9 </td> <td> SOC </td> <td> Validate Microsoft Defender patching for CVE-2026-50656 "RoguePlanet." Confirm all endpoints have received the July update that addresses this privilege escalation vulnerability with public PoC. </td> </tr> </tbody> </table> <h3> 30-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 10 </td> <td> DevOps / AppSec </td> <td> Implement package verification policy for AI-assisted development. Require manual review of any AI-suggested package name not already in the approved internal registry before installation. Address the HalluSquatting supply chain vector. </td> </tr> <tr> <td> 11 </td> <td> CISO / IR </td> <td> Update ransomware incident response playbook to account for extended dwell-time scenarios. The current quiet period in ransomware claims may indicate pre-encryption positioning. Validate that detection covers data staging (T1074), credential dumping (T1003), and lateral movement (T1021) — not just encryption events. </td> </tr> <tr> <td> 12 </td> <td> OT Security </td> <td> Conduct network segmentation validation between IT and OT environments in all state-managed facilities (data centers, utilities, transportation). Confirm that ICS advisory patching cadence meets a 30-day SLA for non-critical advisories. </td> </tr> <tr> <td> 13 </td> <td> CISO </td> <td> Commission phishing simulation using device-code flow technique to baseline organizational susceptibility. Use results to justify conditional access policy tightening and user awareness training focused on OAuth consent prompts. </td> </tr> <tr> <td> 14 </td> <td> IT Operations </td> <td> Develop ColdFusion application modernization roadmap. CVE-2026-48282 is the second critical ColdFusion vulnerability this year. Legacy ColdFusion applications represent persistent, recurring risk that patching alone cannot sustainably address. </td> </tr> </tbody> </table> <h2> IOC Blocking Table </h2> The following IOCs are confirmed from intelligence collection and should be actioned immediately: Editor's note: Two SHA-256 hashes attributed to LIGHTNINGSPIDER/Satacom that appeared in a prior draft were removed — both were malformed (63 hex characters rather than the required 64) and could not be verified against source intelligence. The remaining IOCs below are confirmed valid. <table> <thead> <tr> <th> Type </th> <th> Value </th> <th> Context </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> IPv4 </td> <td> 152.32.174[.]171 </td> <td> APT28 C2 infrastructure (ASN 135377, UCloud HK) </td> <td> Block at firewall, proxy, DNS; add to EDR watchlist </td> </tr> <tr> <td> SHA-1 </td> <td> f852a611076dc58dd89e7871581782a220c2991b </td> <td> Associated malware sample </td> <td> Block in EDR/AV policy </td> </tr> <tr> <td> SHA-1 </td> <td> d3a22c5ab83fa414add7b431b2d39a92d3783751 </td> <td> Associated malware sample </td> <td> Block in EDR/AV policy </td> </tr> <tr> <td> MD5 </td> <td> 74f71baadfd62df36698019a639e3d89 </td> <td> Associated malware sample </td> <td> Block in EDR/AV policy </td> </tr> <tr> <td> Browser Ext </td> <td> idgpnmonknjnojddfkpgkljpfnnfcklj (Chrome) </td> <td> ModHeader — flagged as malware (1.6M installs) </td> <td> Block via browser management policy </td> </tr> <tr> <td> Browser Ext </td> <td> opgbiafapkbbnbnjcdomjaghbckfkglc (Edge) </td> <td> ModHeader — flagged as malware </td> <td> Block via browser management policy </td> </tr> </tbody> </table> Additional IOCs for the campaigns discussed in this report are available through Anomali ThreatStream Next-Gen and partner feeds. <h2> Bottom Line </h2> The threat environment facing state government IT systems this week is defined by speed of commoditization . What required nation-state resources two years ago — AiTM phishing, device-code token theft, ICS exploitation — is now available as a service for $400/month or published as proof-of-concept code within days of patch release. The window between vulnerability disclosure and active exploitation against government targets continues to compress. Three actions will determine whether your agency is ahead of or behind the threat curve this week: <ol> <li> Patch ColdFusion now. Not next sprint. Not after change advisory board. Now — or isolate it today and patch tomorrow. CVSS 10.0 with active exploitation and a CISA deadline is not a risk acceptance conversation; it's an incident prevention conversation. </li> <li> Restrict device-code flows in Entra ID. This single conditional access policy change neutralizes Forg365, DEBULL, and the entire class of device-code phishing attacks that bypass MFA. It costs nothing and can be implemented in hours. </li> <li> Confirm your OT segmentation is real. Seven ICS advisories in three days, plus a confirmed Iranian destructive attack on a U.S. water utility, means the question is not whether state-managed infrastructure will be targeted — it's whether your segmentation will hold when it is. </li> </ol> The adversaries are not waiting. Neither should you. Anomali CTI Desk | July 10, 2026 For questions or additional context on any finding in this report, contact your Anomali intelligence team.

FEATURED RESOURCES

July 10, 2026

Anomali Cyber Watch

Iranian Cyber Operations Reach Inflection Point: FortiBleed Pipeline Weaponized, Multi-Actor Convergence Accelerates

July 10, 2026

Anomali Cyber Watch

Public Sector