Critical Vulnerabilities and Novel Attack Techniques Threaten State Government Networks

Public Sector

Published on

July 8, 2026

Table of Contents

Threat Assessment Level: ELEVATED Elevated from GUARDED. Two actively exploited critical vulnerabilities directly affecting state government infrastructure, a novel Microsoft 365 credential theft technique, and expanding Chinese APT relay networks collectively compress the risk window for state agencies. <h2> Introduction </h2> State government IT leaders face a convergence of threats this week that demands immediate executive attention. CISA added two critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on July 7 — one scoring a perfect CVSS 10.0 — both targeting software commonly deployed across state agencies. Simultaneously, a new credential theft toolset renders traditional phishing defenses ineffective against Microsoft 365 environments, and Chinese intelligence services are expanding infrastructure that could silently conscript state networking equipment into espionage relay networks. This is not a theoretical risk assessment. Active exploitation is confirmed. The decisions state CIOs and CISOs make in the next 48–72 hours will determine whether their agencies become the next headline. <h2> What Changed </h2> <table> <thead> <tr> <th> Development </th> <th> Why It Matters for State Government </th> </tr> </thead> <tbody> <tr> <td> CVE-2026-48282 (Adobe ColdFusion, CVSS 10.0) added to CISA KEV — active exploitation confirmed </td> <td> State agencies widely use legacy ColdFusion applications for citizen-facing services. Unauthenticated RCE with no user interaction required. </td> </tr> <tr> <td> CVE-2026-48908 (Joomla SP Page Builder, CVSS 9.8) added to CISA KEV — active exploitation confirmed </td> <td> Multiple state agencies use Joomla with SP Page Builder for public portals. Unauthenticated file upload leads to webshell deployment. </td> </tr> <tr> <td> DEBULL toolset disclosed — abuses Microsoft OAuth device-code flow to steal M365 tokens </td> <td> State M365/Entra ID tenants are exposed. Victims interact with legitimate Microsoft URLs, bypassing URL-based phishing detection and user training. </td> </tr> <tr> <td> UAT-7810 (China-nexus) expands ORB relay network with new malware (LONGLEASH, DOGLEASH, JARLEASH) </td> <td> Targets Ruckus wireless routers. State field office equipment could be silently recruited as espionage relay nodes. </td> </tr> <tr> <td> Volt Typhoon / Salt Typhoon (China-nexus) maintain confirmed pre-positioning in U.S. critical infrastructure and government networks </td> <td> No new indicators this cycle, but known long-term persistent access via living-off-the-land techniques remains an active, unresolved threat to state agencies. </td> </tr> <tr> <td> 7 critical Ubiquiti UniFi OS vulnerabilities patched (lead CVE-2026-50746, CVSS 10.0) </td> <td> 100,000+ exposed instances globally. Russian GRU has historically targeted Ubiquiti devices. </td> </tr> <tr> <td> 7 ICS advisories from CISA covering Hitachi Energy, Siemens, and Digi International </td> <td> Digi PortServer authentication bypass directly relevant to water/wastewater SCADA serial-to-IP converters. </td> </tr> <tr> <td> Canada CSE annual report confirms ransomware remains the #1 disruptive cyber threat to government </td> <td> Coordinated law enforcement action disrupted 10 major RaaS groups — temporary suppression expected, not elimination. </td> </tr> </tbody> </table> <h2> Threat Timeline </h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Significance </th> </tr> </thead> <tbody> <tr> <td> 12 June 2026 </td> <td> VOID MANTICORE (Iranian IRGC) breaches California water utility </td> <td> Confirmed destructive nation-state capability against U.S. critical infrastructure </td> </tr> <tr> <td> 1 July 2026 </td> <td> CVE-2026-45659 (SharePoint RCE, CVSS 8.8) added to CISA KEV; China-nexus exploitation confirmed </td> <td> Active exploitation of collaboration platforms used by state agencies </td> </tr> <tr> <td> 6–7 July 2026 </td> <td> DragonForce Cartel (590 victims, 284 U.S.) and AiLock RaaS (42 victims) maintain high-tempo operations </td> <td> Government and public institutions explicitly targeted </td> </tr> <tr> <td> 7 July 2026 </td> <td> CVE-2026-48282 (ColdFusion CVSS 10.0) and CVE-2026-48908 (Joomla CVSS 9.8) added to CISA KEV </td> <td> Both actively exploited; both present in state agency environments </td> </tr> <tr> <td> 7 July 2026 </td> <td> DEBULL device-code flow toolset reported </td> <td> Novel M365 credential theft technique bypasses traditional defenses </td> </tr> <tr> <td> 7 July 2026 </td> <td> Cisco Talos publishes UAT-7810 ORB network expansion research </td> <td> China-nexus group recruiting network devices as espionage relay infrastructure </td> </tr> <tr> <td> 7 July 2026 </td> <td> Ubiquiti patches 7 critical vulnerabilities (CVSS 10.0 lead) </td> <td> 100,000+ globally exposed instances; historical GRU targeting of Ubiquiti </td> </tr> <tr> <td> 7 July 2026 </td> <td> CISA publishes 7 ICS advisories including Digi International auth bypass </td> <td> Serial-to-IP converters in SCADA environments vulnerable </td> </tr> </tbody> </table> <h2> Key Threat Analysis </h2> <h3> 1. Adobe ColdFusion: CVSS 10.0 Under Active Exploitation (CVE-2026-48282) </h3> This is the highest-priority item for any state agency running ColdFusion. The vulnerability enables unauthenticated remote code execution via path traversal — no user interaction, no credentials required. CISA's KEV addition confirms active exploitation in the wild. Why state government is uniquely exposed: ColdFusion legacy applications persist across state agencies for tax processing, licensing portals, benefits administration, and internal workflows. These applications often lack modern WAF protection and may not be inventoried in centralized asset management systems. Affected versions: ColdFusion 2025.9, 2023.20, and all earlier releases. Relevant ATT&CK techniques: T1190 (Exploit Public-Facing Application), T1059.001 (PowerShell execution post-compromise), T1083 (File and Directory Discovery) <h3> 2. Joomla SP Page Builder: Webshell Deployment at Scale (CVE-2026-48908) </h3> An unauthenticated arbitrary file upload vulnerability in the SP Page Builder extension for Joomla allows attackers to deploy PHP webshells on any vulnerable instance. With a CVSS of 9.8 and confirmed active exploitation, this represents an immediate risk to state agencies using Joomla for public-facing websites. Relevant ATT&CK techniques: T1190 (Exploit Public-Facing Application), T1505.003 (Web Shell persistence), T1059.001 (Command execution) <h3> 3. DEBULL: A Class Break in Phishing Defense </h3> The DEBULL toolset represents a fundamentally different phishing paradigm. It abuses Microsoft's legitimate OAuth device-code authentication flow — a mechanism designed for devices without browsers (smart TVs, IoT). The attack works as follows: <ol> <li> Attacker initiates a device-code flow request to Microsoft </li> <li> Victim receives a phishing lure containing only a short alphanumeric code </li> <li> Victim navigates to microsoft.com/devicelogin (a legitimate Microsoft URL) and enters the code </li> <li> Victim completes MFA normally — because it IS a real Microsoft authentication </li> <li> Attacker receives the victim's access token, gaining persistent access to email, SharePoint, and OneDrive </li> </ol> Why traditional defenses fail: Email security gateways look for malicious URLs — there are none. Security awareness training teaches employees to verify the URL is legitimate — it IS legitimate. MFA is not bypassed — it's completed by the victim. This requires a control-plane response (conditional access policy restricting device-code flow), not a user-education response. Relevant ATT&CK techniques: T1528 (Steal Application Access Token), T1078.004 (Valid Accounts: Cloud), T1114.002 (Remote Email Collection), T1550.001 (Application Access Token lateral movement) <h3> 4. UAT-7810: China Builds Espionage Relay Networks from Your Routers </h3> Chinese APT group UAT-7810 operates a specialized function within China's cyber ecosystem: building Operational Relay Box (ORB) networks. These are compromised network devices — specifically Ruckus wireless routers — that serve as relay infrastructure for other Chinese APT groups (including UAT-5918) to conduct espionage operations. New malware families disclosed by Cisco Talos: <ul> <li> LONGLEASH — successor to SHORTLEASH, primary implant </li> <li> DOGLEASH — Linux shellcode execution framework </li> <li> JARLEASH — Java-based file management and FTP capability </li> </ul> Payloads are compiled for MIPS, ARM, and x64 architectures, indicating broad device targeting. The unique risk for state government: If state networking equipment is recruited into an ORB network, the state becomes unwitting infrastructure in espionage operations against third parties. This creates reputational and potentially legal liability beyond traditional breach scenarios. The compromised device may show no performance degradation — the state would never know without proactive monitoring. Relevant ATT&CK techniques: T1584.005 (Compromise Infrastructure: Botnet), T1190 (Exploit Public-Facing Application), T1090.003 (Multi-hop Proxy) <h3> 5. Ubiquiti UniFi OS: Seven Critical Vulnerabilities, 100K+ Exposed Instances </h3> Ubiquiti patched seven critical vulnerabilities led by CVE-2026-50746 (CVSS 10.0, command injection). Affected products include UniFi Connect, Talk, Access, and Protect. Censys identifies over 100,000 exposed instances globally, with approximately 50,000 in the United States. Historical context: Russian GRU previously weaponized Ubiquiti devices via the Moobot botnet. CISA mandated 3-day patching for earlier UniFi flaws. The combination of massive exposure, trivial exploitation, and nation-state interest makes rapid weaponization highly likely. <h3> 6. Persistent Nation-State Pre-Positioning: Volt Typhoon and Salt Typhoon </h3> While no new indicators emerged this cycle for Volt Typhoon or Salt Typhoon (both China-nexus), their known pre-positioning in U.S. critical infrastructure — including government networks — remains an active concern. These groups specialize in living-off-the-land (LOTL) techniques that evade traditional detection. Silence from these actors is not reassuring; it is consistent with their operational methodology of maintaining long-term persistent access without triggering alerts. <h3> 7. Ransomware: Suppressed but Not Eliminated </h3> The Canada CSE annual report confirms that coordinated law enforcement action disrupted 10 major ransomware-as-a-service groups. This likely explains the temporary lull in new government-targeting ransomware incidents. However, historical precedent shows these groups reconstitute within 30–60 days, often under new branding. DragonForce Cartel (590 total victims, 284 in the U.S.), AiLock RaaS (42 victims), and Play ransomware remain active threats to state and local government. <h2> Predictive Analysis </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Timeframe </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> Exploitation attempts against CVE-2026-48282 hit state ColdFusion instances </td> <td> 75% </td> <td> 72 hours </td> <td> KEV confirmation + public PoC availability + legacy state deployments </td> </tr> <tr> <td> Ubiquiti CVEs weaponized in the wild </td> <td> 50% </td> <td> 7 days </td> <td> CISA's prior 3-day mandate pattern for UniFi flaws + massive attack surface </td> </tr> <tr> <td> Ransomware incident affecting a U.S. state or local government entity </td> <td> 65–75% </td> <td> 14 days </td> <td> Operationalized FortiBleed credentials + RaaS affiliate reconstitution </td> </tr> <tr> <td> DEBULL or similar device-code flow tools used against government M365 tenants </td> <td> 30% </td> <td> 14 days </td> <td> Novel technique still in early adoption; government is high-value target </td> </tr> <tr> <td> Suppressed RaaS groups reconstitute under new branding </td> <td> 40% </td> <td> 30–60 days </td> <td> Historical pattern following law enforcement disruption </td> </tr> <tr> <td> State network devices recruited into Chinese ORB infrastructure (undetected) </td> <td> 25% </td> <td> 30 days </td> <td> UAT-7810 actively expanding; Ruckus/Ubiquiti present in state environments </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Detection Priorities </h3> <ol> <li> Device-Code Flow Abuse (DEBULL) </li> </ol> <ul> <li> What to monitor: Entra ID sign-in logs for grant_type=urn:ietf:params:oauth:grant-type:device_code </li> <li> Hunting hypothesis: Legitimate device-code flow usage in a state agency should be near-zero (it's designed for browserless devices). Any spike in device-code authentications — especially from user accounts rather than service principals — indicates potential compromise. </li> <li> Detection logic: Alert on device-code flow authentications where: (a) the user has never used this flow before, (b) the source IP is outside expected ranges, or (c) volume exceeds baseline by >2 standard deviations. </li> <li> ATT&CK: T1528, T1078.004 </li> </ul> <ol start="2"> <li> ColdFusion Exploitation (CVE-2026-48282) </li> </ol> <ul> <li> What to monitor: Web server logs for path traversal patterns (../, ..%2f, ..%252f) targeting ColdFusion endpoints; unexpected process spawning from ColdFusion service accounts (cfusion, coldfusion); new files in webroot directories. </li> <li> Hunting hypothesis: If ColdFusion instances are internet-facing, assume scanning has already occurred. Hunt for evidence of successful exploitation: webshells, reverse shells, or reconnaissance commands executed under the ColdFusion service context. </li> <li> ATT&CK: T1190, T1059.001, T1083 </li> </ul> <ol start="3"> <li> Joomla Webshell Deployment (CVE-2026-48908) </li> </ol> <ul> <li> What to monitor: File integrity monitoring on Joomla webroot directories; HTTP POST requests to SP Page Builder's uploadcustomicon endpoint; new .php files created in upload directories. </li> <li> Hunting hypothesis: Scan all Joomla instances for recently created PHP files in non-standard locations. Any PHP file created after June 2026 in upload/icon directories warrants immediate investigation. </li> <li> ATT&CK: T1190, T1505.003 </li> </ul> <ol start="4"> <li> ORB Network Recruitment (UAT-7810) </li> </ol> <ul> <li> What to monitor: Unexpected outbound connections from Ruckus APs and Ubiquiti devices to non-vendor IPs; firmware integrity changes; new scheduled tasks or cron jobs on network devices; DNS queries from infrastructure devices to unusual domains. </li> <li> Hunting hypothesis: Network devices should have predictable communication patterns (NTP, firmware updates, management plane). Any outbound connection to non-whitelisted destinations — particularly on non-standard ports — from a Ruckus or Ubiquiti device indicates potential ORB recruitment. </li> <li> ATT&CK: T1584.005, T1090.003 </li> </ul> <ol start="5"> <li> Volt Typhoon / Salt Typhoon LOTL Activity </li> </ol> <ul> <li> What to monitor: Anomalous use of native administration tools (ntdsutil, netsh, wmic, PowerShell) on network infrastructure; new local accounts on edge devices; scheduled tasks created outside change windows; VPN authentication from unexpected geographic locations. </li> <li> Hunting hypothesis: These actors avoid custom malware. Hunt for legitimate tool usage at unusual times, from unusual accounts, or targeting unusual systems. Focus on Cisco SD-WAN and Fortinet edge devices. </li> <li> ATT&CK: T1059.001, T1053.005, T1078 </li> </ul> <h3> Indicators to Block/Monitor </h3> IOCs associated with the campaigns discussed in this report — including file hashes, IP addresses, and additional domains — are available through Anomali ThreatStream Next-Gen and partner feeds. Analysts should query ThreatStream Next-Gen for indicators tagged to UAT-7810, DEBULL, CVE-2026-48282, CVE-2026-48908, and CVE-2026-50746 for the most current and verified blocking lists. Contact your Anomali account team for access or to request a curated indicator export for your SIEM/EDR platform. <h2> Sector-Specific Defensive Priorities </h2> <h3> Financial Services (State Treasury, Revenue, Tax Systems) </h3> <ul> <li> Primary risk: ColdFusion exploitation (CVE-2026-48282). Tax processing and revenue applications frequently run on legacy ColdFusion. A compromise could expose taxpayer PII/financial data and disrupt revenue collection. </li> <li> Action: Emergency patch all ColdFusion instances supporting financial applications. Deploy WAF rules blocking path traversal patterns. Implement network segmentation isolating ColdFusion servers from databases containing taxpayer records. </li> <li> Secondary risk: DEBULL M365 token theft targeting finance staff with access to payment systems and wire transfer approvals. </li> </ul> <h3> Energy (State Energy Office, Grid Coordination, Utility Oversight) </h3> <ul> <li> Primary risk: ICS vulnerabilities in Hitachi Energy e-mesh EMS (buffer overflow) and PROMOD V (insecure HTTP). States coordinating with utilities on grid operations may have these systems in their environment or connected networks. </li> <li> Action: Verify whether Hitachi Energy products are deployed in state-coordinated energy management. Apply vendor patches. Ensure SCADA/EMS systems are air-gapped or segmented from enterprise IT networks. </li> <li> Secondary risk: Volt Typhoon pre-positioning in energy infrastructure for potential disruption during geopolitical crisis. </li> </ul> <h3> Healthcare (Medicaid, State Health Agencies, Public Health Systems) </h3> <ul> <li> Primary risk: Ransomware. Healthcare and public health agencies remain primary targets for DragonForce, AiLock, and Play ransomware groups. Medicaid systems containing PHI for millions of residents are high-value targets. </li> <li> Action: Validate offline backup integrity for Medicaid and vital records systems. Ensure incident response playbooks include healthcare-specific regulatory notification requirements (HIPAA, state breach notification). Test failover procedures for critical health systems. </li> <li> Secondary risk: M365 credential theft (DEBULL) targeting health agency staff with access to PHI. </li> </ul> <h3> Government (All Executive Branch Agencies) </h3> <ul> <li> Primary risk: Multi-vector. State agencies face simultaneous exposure to ColdFusion RCE, Joomla webshell deployment, M365 credential theft, and ransomware. The breadth of the attack surface — combined with budget-constrained patching cycles — creates compounding risk. </li> <li> Action: Prioritize patching by internet exposure: ColdFusion and Joomla instances facing the internet are highest priority. Restrict device-code flow in Entra ID tenant-wide. Ensure all agencies have reported their ColdFusion and Joomla inventories to the central security team. </li> <li> Secondary risk: Chinese APT pre-positioning (Volt Typhoon, Salt Typhoon) for potential disruption of government services during a geopolitical crisis. </li> </ul> <h3> Aviation / Logistics (State DOT, Airport Authorities, Port Operations) </h3> <ul> <li> Primary risk: ICS/OT vulnerabilities. Digi International PortServer authentication bypass affects serial-to-IP converters used in transportation SCADA (traffic management, bridge controls, port operations). Siemens RUGGEDCOM vulnerabilities affect industrial networking equipment common in transportation infrastructure. </li> <li> Action: Inventory Digi International and Siemens RUGGEDCOM devices in transportation infrastructure. Apply patches. Ensure OT networks are segmented from IT networks with monitored jump hosts for administrative access. </li> <li> Secondary risk: Ubiquiti vulnerabilities in airport/port facility networking equipment. ORB network recruitment of networking devices at transportation facilities. </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Within 48 Hours) </h3> <table> <thead> <tr> <th> Priority </th> <th> Responsible Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> IT Operations </td> <td> Patch Adobe ColdFusion to versions 2025.10+ / 2023.21+ across ALL agencies. CVE-2026-48282 is CVSS 10.0 with confirmed active exploitation. Inventory all ColdFusion instances including shadow IT deployments. </td> </tr> <tr> <td> 2 </td> <td> IT Operations </td> <td> Inventory and patch all Joomla instances with SP Page Builder extension. CVE-2026-48908 (CVSS 9.8) is actively exploited for webshell deployment. Disable uploadcustomicon functionality immediately if patch is unavailable. </td> </tr> <tr> <td> 3 </td> <td> Identity / SOC </td> <td> Restrict device-code flow in Entra ID conditional access policies. Block grant_type=urn:ietf:params:oauth:grant-type:device_code for all user accounts. Whitelist only verified service accounts that require it. </td> </tr> <tr> <td> 4 </td> <td> SOC </td> <td> Create detection alerts for device-code flow authentications from unexpected locations, devices, or user accounts in Entra ID sign-in logs. </td> </tr> <tr> <td> 5 </td> <td> Executive / IR </td> <td> Pre-authorize emergency patching windows for ColdFusion and Joomla across all agencies. Communicate to agency heads that downtime for patching is authorized and expected. </td> </tr> </tbody> </table> <h3> 7-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Responsible Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 6 </td> <td> IT Operations </td> <td> Update all Ubiquiti UniFi OS devices to latest firmware. Audit internet-exposed UniFi management interfaces using Censys/Shodan. Segment management interfaces to dedicated VLAN unreachable from the internet. </td> </tr> <tr> <td> 7 </td> <td> Network Operations </td> <td> Inventory Ruckus wireless access points across all state facilities. Verify firmware currency. Monitor for unexpected outbound connections (indicator of UAT-7810 ORB recruitment). </td> </tr> <tr> <td> 8 </td> <td> OT / SCADA Teams </td> <td> Audit Digi International PortServer TS and Digi One SP IA serial-to-IP converters in water/wastewater and transportation SCADA environments. Apply vendor patches for authentication bypass vulnerability. </td> </tr> <tr> <td> 9 </td> <td> SOC </td> <td> Establish baseline for device-code flow usage across state M365 tenant. Export 30 days of Entra ID sign-in logs filtered to this grant type. Create anomaly detection rule. </td> </tr> <tr> <td> 10 </td> <td> IR / Legal </td> <td> Review and update incident response playbooks to account for: (a) ColdFusion webshell scenarios, (b) M365 token theft without traditional phishing indicators, (c) discovery that state devices are part of foreign espionage relay infrastructure. </td> </tr> </tbody> </table> <h3> 30-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Responsible Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 11 </td> <td> CISO / SOC </td> <td> Commission proactive threat hunt for Volt Typhoon / Salt Typhoon living-off-the-land indicators across Cisco SD-WAN, Fortinet edge devices, and network infrastructure. Focus on anomalous admin account usage and scheduled task creation. </td> </tr> <tr> <td> 12 </td> <td> Security Awareness </td> <td> Develop training module on device-code flow phishing. Employees must understand that legitimate Microsoft URLs can be weaponized if they didn't initiate the authentication request. </td> </tr> <tr> <td> 13 </td> <td> CISO / Architecture </td> <td> Develop ColdFusion sunset roadmap. Today's CVSS 10.0 KEV validates what has been a persistent risk. Begin planning migration of legacy ColdFusion applications to modern, supported frameworks. </td> </tr> <tr> <td> 14 </td> <td> Network Architecture </td> <td> Implement network device integrity monitoring for all Ruckus, Ubiquiti, and Cisco equipment. Establish firmware hash baselines and alert on unauthorized changes. This addresses both ORB recruitment and Volt Typhoon pre-positioning. </td> </tr> <tr> <td> 15 </td> <td> CISO / Budget </td> <td> Evaluate ransomware readiness posture given expected RaaS group reconstitution within 30–60 days. Validate backup integrity, test restoration procedures, and confirm cyber insurance coverage and notification procedures. </td> </tr> </tbody> </table> <h2> Bottom Line </h2> The threat environment facing state government networks has materially intensified. Two CISA KEV additions targeting software deployed across state agencies, a novel credential theft technique that defeats existing phishing defenses, confirmed Chinese APT pre-positioning via living-off-the-land techniques, and active ORB network expansion create a compressed and multi-front decision window. The ColdFusion patching decision is binary: patch within 48 hours or accept significant probability of compromise. There is no middle ground when a CVSS 10.0 vulnerability with confirmed active exploitation targets production systems. The DEBULL device-code flow technique signals a broader shift — adversaries are moving to attack patterns where every component the user sees is legitimate. Policy-level controls (conditional access restrictions) must replace reliance on user vigilance. The ORB network expansion introduces a risk category many state leaders have not yet considered: your infrastructure being used as a weapon against others without your knowledge. Proactive network device monitoring is no longer optional. The decisions made this week — on patching authority, conditional access policy, and threat hunting investment — will determine whether your state is reading about the next government breach or responding to one. Published 8 July 2026 | Anomali CTI Desk For questions or additional context, contact your Anomali account team.

FEATURED RESOURCES

July 8, 2026

Anomali Cyber Watch

Iran Conflict Cyber Escalation: AI-Autonomous Ransomware Emerges as Critical Infrastructure Faces Coordinated Threat Surge

July 8, 2026

Anomali Cyber Watch

Public Sector

Critical Vulnerabilities and Novel Attack Techniques Threaten State Government Networks

July 7, 2026

Anomali Cyber Watch

Iranian Cyber Operations Enter Critical Retaliation Window Following Khamenei Funeral

Explore All