Edge Appliances Under Siege, Iran Escalates, Supply Chains Fracture: What State CISOs Must Do This Week

Public Sector

Published on

March 30, 2026

Table of Contents

Threat Assessment Level: ELEVATED-HIGH Two actively exploited zero-days in Citrix and F5 appliances, an Iranian state actor breaching the FBI Director’s personal email, and a supply chain attack spanning nine open-source ecosystems — this is the threat picture facing state government IT leaders on March 30, 2026. The federal safety net is thinner than ever. The time for self-reliance is now. <h2>Introduction                            </h2> The past week has delivered a convergence of threats that should command the full attention of every state government CIO and CISO. Critical network appliances that form the backbone of state remote access and application delivery — Citrix NetScaler and F5 BIG-IP — are under active exploitation today. Iran’s intelligence services have escalated from corporate destruction to targeting the personal accounts of the nation’s top law enforcement official. A single threat actor’s supply chain campaign has now poisoned packages across nine software ecosystems. And the phishing platform responsible for the majority of credential theft attempts against Microsoft 365 environments is back online, fully operational, just weeks after a coordinated law enforcement takedown. All of this is unfolding against a backdrop of significantly diminished federal cybersecurity capacity. CISA has confirmed it is operating in reactive-only mode following the departure of approximately 1,000 staff, with proactive threat hunting and emergency directive issuance effectively suspended. For state governments, the message is unambiguous: you are increasingly on your own. This briefing translates the latest intelligence into concrete actions for state agency IT leadership. Every finding is tied to a specific vulnerability, actor, or campaign — and every recommendation tells you exactly what to do, who should do it, and how fast. <h2>What Changed This Week</h2> The threat level has been adjusted from ELEVATED (prior cycle, March 29) to ELEVATED-HIGH. The escalation is driven by three specific developments, compounding a broader set of ongoing threats across all major fronts: <ol> <li>CVE-2026-3055 (Citrix NetScaler) transitioned from reconnaissance activity to confirmed in-the-wild exploitation between March 27 and March 30. Proof-of-concept code is now public. This vulnerability is on a direct trajectory to become the next “CitrixBleed” — the 2023 vulnerability that ransomware operators weaponized within days of public disclosure.</li> <li>CVE-2025-53521 (F5 BIG-IP APM) was reclassified by F5 from denial-of-service to critical remote code execution (CVSS 9.8). Attackers are actively deploying webshells on unpatched devices. CISA’s Known Exploited Vulnerabilities (KEV) patch deadline is today, March 30.</li> <li>Handala/Void Manticore (Iran/IRGC) breached FBI Director Kash Patel’s personal email on March 27, publishing personal data and photographs. This represents a significant escalation in Iranian willingness to directly target senior U.S. government officials — and a warning to any state official with a public profile.</li> </ol> These developments compound ongoing threats that have not abated: <ol> <li>TeamPCP supply chain campaign has expanded to a ninth software ecosystem (Telnyx Python SDK), with 470+ repositories and 1,900+ packages now confirmed compromised. State agencies with any CI/CD or DevOps capability are directly exposed.</li> <li>Tycoon2FA adversary-in-the-middle phishing platform has fully reconstituted after its March 4 takedown, demonstrating that law enforcement disruption alone cannot neutralize phishing-as-a-service infrastructure. Traditional MFA provides no protection against this platform.</li> <li>Ransomware continues at record pace against government targets, with three simultaneous local government incidents active this week (Foster City CA, Jackson County IN, Aroostook Mental Health Center ME). A new group, XP95, has emerged with demonstrated government-targeting capability.</li> <li>OT/ICS vulnerabilities in building management and water systems were disclosed via seven CISA ICS advisories (March 24–26), including WAGO industrial switches and Schneider Electric EcoStruxure DCS — both commonly deployed in state-managed facilities.</li> </ol> <h2>Threat Timeline: March 4–30, 2026</h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Threat Category </th> </tr> </thead> <tbody> <tr> <td> Mar 4 </td> <td> Microsoft/Europol take down Tycoon2FA phishing infrastructure </td> <td> Credential Theft </td> </tr> <tr> <td> Mar 12 </td> <td> Handala/Void Manticore claims wiper attack on Stryker Corp (200K+ systems) </td> <td> Iranian Destructive Ops </td> </tr> <tr> <td> Mar 19 </td> <td> DOJ seizes Handala website infrastructure </td> <td> Law Enforcement Action </td> </tr> <tr> <td> Mar 23 </td> <td> Tycoon2FA confirmed fully operational again despite takedown </td> <td> Credential Theft </td> </tr> <tr> <td> Mar 24–26 </td> <td> CISA publishes 7 ICS advisories including WAGO switches, Schneider Electric DCS </td> <td> OT/ICS Vulnerability </td> </tr> <tr> <td> Mar 25 </td> <td> CISA confirms reactive-only operations after ~1,000 staff departures </td> <td> Federal Capacity Degradation </td> </tr> <tr> <td> Mar 25 </td> <td> Ransomware hits Aroostook Mental Health Center (ME) — attributed to Qilin </td> <td> Ransomware / Government </td> </tr> <tr> <td> Mar 27 </td> <td> Handala breaches FBI Director Kash Patel’s personal email </td> <td> Iranian Espionage/Doxing </td> </tr> <tr> <td> Mar 27 </td> <td> Jackson County (IN) Sheriff’s Office ransomware — full IT rebuild required </td> <td> Ransomware / Government </td> </tr> <tr> <td> Mar 28 </td> <td> CISA adds CVE-2025-53521 (F5 BIG-IP) to KEV catalog </td> <td> Critical Vulnerability </td> </tr> <tr> <td> Mar 29 </td> <td> XP95 ransomware group hits Statistics South Africa </td> <td> Ransomware / Government </td> </tr> <tr> <td> Mar 30 </td> <td> CVE-2026-3055 (Citrix NetScaler) exploitation confirmed in the wild </td> <td> Critical Vulnerability </td> </tr> <tr> <td> Mar 30 </td> <td> TeamPCP supply chain attack expands to Telnyx Python SDK (9th ecosystem) </td> <td> Supply Chain Compromise </td> </tr> <tr> <td> Mar 30 </td> <td> Foster City (CA) ransomware recovery still ongoing </td> <td> Ransomware / Government </td> </tr> </tbody> </table> <h2>Key Threat Analysis                     </h2> <h3>1. Edge Appliance Exploitation: The Defining Threat Pattern of 2026</h3> The pattern is now undeniable. In Q1 2026 alone, the following edge appliances — all commonly deployed in state government environments — have been actively exploited: <ul> <li>Citrix NetScaler ADC/Gateway — CVE-2026-3055 (CVSS 9.3, active exploitation as of March 30)</li> <li>F5 BIG-IP APM — CVE-2025-53521 (CVSS 9.8, active webshell deployment)</li> <li>Cisco SD-WAN — CVE-2026-20127 (active exploitation, CISA emergency directive)</li> <li>Ivanti EPMM — CVE-2026-1281 and CVE-2026-1340 (widespread government exploitation)</li> <li>Fortinet FortiOS — CVE-2025-32756 (active exploitation earlier this quarter)</li> </ul> State government networks rely on these products for VDI delivery, remote access, agency interconnection, mobile device management, and perimeter security. Each exploited appliance gives attackers a foothold inside the network perimeter, bypassing firewalls and endpoint detection entirely. CVE-2026-3055 (Citrix NetScaler) is particularly dangerous. Attackers send crafted SAML authentication requests to the /saml/login endpoint, deliberately omitting the AssertionConsumerServiceURL field. This triggers a memory overread that leaks sensitive data — including credentials and session tokens — via the NSC_TASS cookie. Only appliances configured as SAML Identity Providers are affected, but in state environments where NetScaler handles federated authentication for multiple agencies, the blast radius could be enormous. Three independent research teams (WatchTowr, Defused, and Citrix’s own advisory) have confirmed the exploitation method. CVE-2025-53521 (F5 BIG-IP APM) was initially disclosed as a denial-of-service issue but has been reclassified as full remote code execution. Attackers are deploying webshells on unpatched devices, establishing persistent backdoor access. Any BIG-IP APM virtual server with access policies configured is vulnerable. ATT&CK Techniques: T1190 (Exploit Public-Facing Application), T1505.003 (Web Shell), T1552.001 (Unsecured Credentials), T1005 (Data from Local System) <h3>2. Iranian State Operations: From Corporate Destruction to Targeting Senior Officials</h3> Handala, now formally confirmed by the U.S. government as a cover name for Void Manticore — an Iranian state-sponsored threat actor operating under the Islamic Revolutionary Guard Corps (IRGC) — has conducted a rapid escalation campaign: <ul> <li>March 12: Claimed a wiper attack against Stryker Corporation, asserting 200,000+ systems destroyed</li> <li>March 19: DOJ seized Handala’s website infrastructure</li> <li>March 27: Retaliated by breaching FBI Director Kash Patel’s personal email, publishing personal data and photographs</li> </ul> This escalation pattern — from corporate targets to the personal accounts of the nation’s senior law enforcement official — signals that Iranian cyber operations have entered a new phase of boldness. The willingness to directly target and dox a cabinet-level official suggests that state government leaders, particularly those involved in critical infrastructure oversight, sanctions enforcement, or Iran-related policy, should consider themselves potential targets. Handala is not operating in isolation. Intelligence indicates a multi-layered Iranian cyber campaign under coordinated direction: - Handala/Void Manticore (IRGC): Destructive operations and doxing - MuddyWater (MOIS): Network intrusion and espionage (currently quiet — which may indicate retooling, not cessation) - UNC5203: OT/ICS pre-positioning against critical infrastructure ATT&CK Techniques: T1078 (Valid Accounts), T1114.002 (Remote Email Collection), T1485 (Data Destruction), T1567 (Exfiltration Over Web Service) <h3>3. TeamPCP Supply Chain Campaign: Nine Ecosystems and Counting</h3> The TeamPCP supply chain attack has expanded to its ninth software ecosystem with the compromise of the Telnyx Python SDK (670,000+ monthly downloads). Malicious versions 4.87.1 and 4.87.2 were uploaded to PyPI containing a WAV audio file that uses steganography to hide an executable payload. The payload exfiltrates session keys using RSA encryption matching previous TeamPCP operations. The campaign’s full scope now includes: PyPI, NPM, Docker Hub, Kubernetes, OpenVSX, GitHub Actions (Trivy), LiteLLM, and Telnyx. GitGuardian has identified 470+ repositories running malicious Trivy GitHub Actions and 1,900+ packages with compromised LiteLLM dependencies. For state agencies with any software development, DevOps, or CI/CD pipeline capability — including custom application development, data analytics platforms, or automated infrastructure management — this campaign represents a direct threat. Traditional vulnerability scanning will not detect compromised dependencies; you need package integrity verification, version pinning to known-good hashes, and SBOM auditing. ATT&CK Techniques: T1195.001 (Supply Chain Compromise), T1059.006 (Python Execution), T1027.009 (Obfuscated Files — Steganography), T1552.001 (Credential Theft — Session Keys) <h3>4. Tycoon2FA: The Phishing Platform That Won’t Stay Down</h3> The Tycoon2FA phishing-as-a-service platform — which accounted for 62% of phishing attempts blocked by Microsoft by mid-2025 and generated 30+ million malicious emails in a single month — has fully resumed operations despite the March 4 Microsoft/Europol takedown. The platform intercepts live authentication sessions to capture credentials, one-time passcodes, and active session cookies, bypassing MFA entirely. This is a strategic signal, not just a tactical one. Law enforcement takedowns of phishing infrastructure are proving insufficient when platforms can reconstitute within weeks. State governments that rely on traditional MFA (SMS codes, authenticator app push notifications) as their primary defense against credential theft are operating with a false sense of security. Only phishing-resistant authentication — FIDO2 security keys and passkeys — defeats adversary-in-the-middle attacks. ATT&CK Techniques: T1557 (Adversary-in-the-Middle), T1539 (Steal Web Session Cookie), T1566.002 (Spearphishing Link) <h3>5. Ransomware Continues to Hammer Government at Record Pace</h3> Three simultaneous local government ransomware incidents are active as of this week: <ul> <li>Foster City, CA — still offline, recovery ongoing</li> <li>Jackson County, IN Sheriff’s Office (March 27) — full IT environment rebuild required</li> <li>Aroostook Mental Health Center, ME — attributed to Qilin, a Russia-based ransomware-as-a-service operation</li> </ul> A new group, XP95, has emerged with demonstrated government-targeting capability, hitting Statistics South Africa (March 29) and previously breaching Gauteng Province (3.8 TB exfiltrated). XP95 demands ransoms in the $100K–$300K range — lower than major RaaS operations but still devastating for government budgets. The ransomware ecosystem — including Qilin, Akira, Play, Medusa, and LockBit5 — continues to explicitly target government and public services. With CISA unable to issue emergency directives or conduct proactive threat hunting, state governments must assume they are the first and last line of defense. <h3>6. OT/ICS: Building Management and Water Systems at Risk</h3> CISA published seven ICS advisories between March 24–26. Two are directly relevant to state government operations: <ul> <li>WAGO Industrial Managed Switches (ICSA-26-085-01): An unauthenticated remote attacker can exploit a hidden CLI function to escape the restricted interface, achieving full system compromise. WAGO switches are commonly deployed in building automation and water/wastewater systems — both of which fall under state government responsibility.</li> <li>Schneider Electric EcoStruxure Foxboro DCS (ICSA-26-083-02): Vulnerability in distributed control system software affecting workstations and servers used in water treatment and process control environments.</li> </ul> No active exploitation has been reported for these vulnerabilities, but the combination of Chinese APT pre-positioning in critical infrastructure (Volt Typhoon, Salt Typhoon — currently quiet in public reporting but confirmed active by CSIS) and newly disclosed OT vulnerabilities creates a window of elevated risk. ATT&CK Techniques: T0831 (ICS: Manipulation of Control), T0836 (ICS: Modify Parameter), T1190 (Exploit Public-Facing Application) <h3>7. Emerging Threat: “Prompt Poaching” — AI Conversation Exfiltration</h3> A novel attack vector has been identified: malicious Chrome browser extensions designed to silently monitor and exfiltrate users’ conversations with AI platforms (ChatGPT, Claude, Gemini). As state employees increasingly use AI tools for policy drafting, data analysis, and document summarization, any sensitive data pasted into these platforms can be captured by a compromised extension and sent to attackers. This is a new category of data loss risk that most state agencies have not yet addressed in policy or technical controls. <h2>Predictive Analysis: What Comes Next</h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> CVE-2026-3055 (Citrix) exploitation escalates rapidly; ransomware operators weaponize within days, following the CitrixBleed playbook </td> <td> >80% (HIGH) </td> <td> PoC code is public; exploitation confirmed by 3 independent sources; ransomware groups historically weaponize Citrix vulns within 5–7 days </td> </tr> <tr> <td> Additional open-source packages compromised in TeamPCP campaign </td> <td> 50–70% (MODERATE) </td> <td> Campaign has expanded to 9 ecosystems with no signs of slowing; attacker infrastructure and TTPs are well-established </td> </tr> <tr> <td> Handala/Void Manticore conducts additional retaliatory operations against U.S. targets </td> <td> 50–70% (MODERATE) </td> <td> Pattern of escalation following DOJ seizure; demonstrated capability and willingness to target senior officials </td> </tr> <tr> <td> A U.S. state or local government entity is hit by ransomware within 7 days </td> <td> 30–50% (LOW-MODERATE) </td> <td> Record pace of government-targeting attacks; three simultaneous incidents active; CISA capacity degraded </td> </tr> <tr> <td> Chinese APTs (Volt Typhoon/Salt Typhoon) are exploiting Citrix/F5 vulnerabilities without public attribution </td> <td> 30–50% (LOW-MODERATE) </td> <td> Confirmed ongoing pre-positioning per CSIS; these actors historically exploit edge appliances; current absence in reporting may reflect stealth, not inactivity </td> </tr> </tbody> </table> <h2>SOC Operational Guidance              </h2> <h3>Detection Priorities</h3> Priority 1 — Citrix NetScaler CVE-2026-3055 Exploitation - Hunt Hypothesis: Attackers are sending malformed SAML requests to NetScaler appliances configured as SAML Identity Providers, leaking credentials via oversized NSC_TASS cookies. - What to Monitor: - HTTP POST requests to /saml/login endpoints on NetScaler appliances - SAMLRequest payloads missing the AssertionConsumerServiceURL field - NSC_TASS cookie values with anomalous length (significantly larger than normal session cookies — memory leak indicator) - Any authentication anomalies following NetScaler SAML sessions (credential reuse from leaked data) - ATT&CK: T1190, T1005, T1552.001 - Detection Logic: Alert on any SAMLRequest to NetScaler that lacks AssertionConsumerServiceURL. Baseline normal NSC_TASS cookie sizes and alert on values exceeding 2x the baseline. Priority 2 — F5 BIG-IP Webshell Detection - Hunt Hypothesis: Attackers have deployed webshells on unpatched BIG-IP APM devices to maintain persistent access. - What to Monitor: - New or modified files in BIG-IP web-accessible directories (/usr/local/www/, /var/local/ucs/) - Unexpected outbound connections from BIG-IP management interfaces - Process execution anomalies on BIG-IP (shell spawning from httpd or tmm processes) - ATT&CK: T1190, T1059.004, T1505.003 - Action: If any unpatched BIG-IP APM instance is discovered, assume compromise. Conduct forensic review before patching. Priority 3 — Tycoon2FA / AiTM Session Hijacking - Hunt Hypothesis: Adversary-in-the-middle phishing is capturing M365 session cookies, enabling attackers to bypass MFA and access mailboxes, SharePoint, and Teams. - What to Monitor: - Azure AD sign-in logs: look for impossible travel (same session token used from two geographically distant IPs) - Conditional Access policy bypasses: sessions from non-compliant or unmanaged devices - New inbox rules created shortly after authentication (T1114.003 — common post-compromise action) - OAuth app consent grants from user accounts (T1550.001) - ATT&CK: T1557, T1539, T1566.002 - Defensive Guidance: Enable Continuous Access Evaluation (CAE) in Azure AD. Deploy token binding where supported. Require managed/compliant device for M365 access via Conditional Access. Priority 4 — Supply Chain Indicators (TeamPCP) - Hunt Hypothesis: Compromised Python packages or GitHub Actions in state CI/CD pipelines are exfiltrating credentials and session tokens. - What to Monitor: - Package manager logs for installation of telnyx==4.87.1 or telnyx==4.87.2 - GitHub Actions workflows referencing Trivy actions pinned to version tags (not commit SHAs) - Outbound network connections from CI/CD runners to unexpected destinations - WAV files in package dependencies (steganographic payload delivery) - ATT&CK: T1195.001, T1059.006, T1027.009, T1552.001 - Action: If compromised packages were ever installed, treat as full credential compromise. Rotate all secrets. Priority 5 — Prompt Poaching / Malicious Browser Extensions - Hunt Hypothesis: Unauthorized browser extensions are exfiltrating state employee conversations with AI platforms. - What to Monitor: - Chrome extension installation events (Windows Event Log or endpoint telemetry) - Extensions requesting permissions to chatgpt.com, claude.ai, gemini.google.com - Outbound data transfers from browser processes to unknown domains - ATT&CK: T1176 (Browser Extensions), T1005 (Data from Local System) <h3>Blocking Guidance</h3> IOCs for the campaigns discussed in this report are available through Anomali ThreatStream and partner feeds. For the TeamPCP supply chain campaign specifically, block or quarantine the following package versions in your artifact repositories: - telnyx==4.87.1 (PyPI) - telnyx==4.87.2 (PyPI) Pin all GitHub Actions to commit SHAs rather than version tags to prevent future supply chain injection. For all other campaign IOCs (IP addresses, domains, file hashes), refer to Anomali ThreatStream for the latest defanged indicators and blocking rules aligned to your security stack. <h2>Sector-Specific Defensive Priorities</h2> <h3>Financial Services (State Treasury, Revenue, Tax Systems)</h3> State revenue and tax systems process SSNs, bank account numbers, and tax filings for every resident. These systems are prime targets for both ransomware extortion and nation-state espionage. <ul> <li>Immediate: Verify that all Citrix NetScaler instances serving tax filing portals or revenue applications are patched against CVE-2026-3055. Tax season infrastructure is a high-value target.</li> <li>7-Day: Audit M365 conditional access policies for treasury and revenue staff. Enforce managed-device-only access and enable CAE to counter Tycoon2FA session hijacking.</li> <li>30-Day: Assess feasibility of FIDO2/passkey deployment for finance and revenue personnel as a pilot for phishing-resistant authentication.</li> </ul> <h3>Energy (State-Managed Utilities, Grid Coordination)</h3> State energy offices coordinate with utilities and may manage grid-adjacent systems. Chinese APT pre-positioning (Volt Typhoon) specifically targets energy infrastructure. <ul> <li>Immediate: Audit all F5 BIG-IP instances in energy-related networks. Webshell deployment on these devices could provide attackers with persistent access to energy management systems.</li> <li>7-Day: Review OT network segmentation for any Schneider Electric EcoStruxure or WAGO deployments in energy facilities. Ensure no direct internet connectivity to control systems.</li> <li>30-Day: Conduct tabletop exercise simulating a coordinated Iranian cyber-physical attack (Handala wiper + OT manipulation) against state energy infrastructure. Test incident response coordination with utility partners.</li> </ul> <h3>Healthcare (State Health Agencies, Medicaid Systems, Public Health)</h3> State health agencies manage Medicaid data, public health surveillance systems, and vital records. The Aroostook Mental Health Center ransomware attack (attributed to Qilin) demonstrates that healthcare-adjacent government entities are active targets. <ul> <li>Immediate: Confirm backup integrity for all health agency systems. Ensure offline/immutable backups exist for Medicaid claims processing, vital records, and public health databases.</li> <li>7-Day: Review vendor remote access tools (ConnectWise ScreenConnect, etc.) used by health IT managed service providers. Ensure all are patched and that access is logged and monitored. Kimsuky (DPRK) has previously exploited ScreenConnect for government credential theft.</li> <li>30-Day: Assess health agency exposure to Tycoon2FA. Healthcare staff are frequent phishing targets due to high email volume and time pressure. Prioritize phishing-resistant MFA for health agency accounts with access to protected health information.</li> </ul> <h3>Government (Executive Branch Agencies, Elections, Public Safety)</h3> State executive branch agencies are the primary target for both ransomware operators and nation-state actors seeking PII, policy intelligence, or infrastructure access. <ul> <li>Immediate: Patch Citrix NetScaler and F5 BIG-IP across all agencies. These appliances often serve as the single point of remote access for thousands of state employees — compromise means network-wide exposure.</li> <li>7-Day: Brief agency heads and senior officials on the Handala/FBI Director breach. Officials with public profiles should review personal email security: enable hardware security keys, audit recovery options, and separate personal from official communications.</li> <li>30-Day: Evaluate state SOC self-sufficiency given CISA’s degraded capacity. Increase engagement with MS-ISAC. Consider whether current staffing and tooling can sustain 24/7 monitoring without federal augmentation during a major incident.</li> </ul> <h3>Aviation / Logistics (State DOT, Airports, Port Authorities)</h3> State departments of transportation manage traffic control systems, airport coordination, and logistics infrastructure that intersects with federal critical infrastructure designations. <ul> <li>Immediate: Audit Cisco SD-WAN deployments connecting DOT field offices and traffic management centers. CVE-2026-20127 is under active exploitation and CISA has issued an emergency directive.</li> <li>7-Day: Review WAGO industrial switch deployments in traffic control and building management systems per ICSA-26-085-01. The hidden CLI escape vulnerability allows unauthenticated full system compromise.</li> <li>30-Day: Map all OT/ICS assets in transportation infrastructure and establish a vulnerability management program specific to operational technology. Many state DOTs lack visibility into their OT attack surface.</li> </ul> <h2>Prioritized Defense Recommendations</h2> <h3>IMMEDIATE (Within 24 Hours)</h3> <table> <thead> <tr> <th> Priority </th> <th> Responsible Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> IT Operations </td> <td> Patch all Citrix NetScaler ADC/Gateway to versions 14.1-66.59+ or 13.1-62.23+. Verify SAML IDP configuration. If patching requires downtime, deploy Global Deny List signatures on 14.1-60.52+ builds as interim mitigation. (CVE-2026-3055) </td> </tr> <tr> <td> 2 </td> <td> IT Operations </td> <td> Patch all F5 BIG-IP APM instances immediately — CISA KEV deadline is today. Before patching, scan for webshells in web-accessible directories. If webshells are found, initiate incident response before remediation. (CVE-2025-53521) </td> </tr> <tr> <td> 3 </td> <td> SOC </td> <td> Deploy detection rules for malformed SAMLRequest payloads to /saml/login (missing AssertionConsumerServiceURL) and anomalous NSC_TASS cookie sizes on NetScaler appliances. (CVE-2026-3055) </td> </tr> <tr> <td> 4 </td> <td> DevOps / IT Operations </td> <td> Audit all Python dependencies in CI/CD pipelines for telnyx==4.87.1 or 4.87.2, compromised LiteLLM packages, and Trivy GitHub Actions pinned to version tags. If any compromised versions were installed, rotate ALL credentials, API keys, SSH keys, and session tokens immediately. (TeamPCP) </td> </tr> </tbody> </table> <h3>7-DAY</h3> <table> <thead> <tr> <th> Priority </th> <th> Responsible Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 5 </td> <td> IT Operations / Endpoint </td> <td> Implement Chrome extension allowlist policy via Group Policy or Intune. Block extensions requesting content access to AI platforms (chatgpt.com, claude.ai, gemini.google.com). (Prompt Poaching) </td> </tr> <tr> <td> 6 </td> <td> SOC / Identity </td> <td> Harden M365 against Tycoon2FA. Deploy conditional access policies requiring compliant/managed devices. Enable Continuous Access Evaluation (CAE) and token binding in Azure AD. Review and restrict OAuth app consent. </td> </tr> <tr> <td> 7 </td> <td> IT Operations / OT </td> <td> Patch WAGO industrial managed switches per ICSA-26-085-01. Audit Schneider Electric EcoStruxure Foxboro DCS installations per ICSA-26-083-02. Verify OT network segmentation prevents direct internet access to these devices. </td> </tr> <tr> <td> 8 </td> <td> Executive / HR </td> <td> Brief senior officials and agency heads on the Handala/FBI Director email breach. Advise review of personal account security: enable hardware security keys, audit account recovery options, remove personal data from public profiles. </td> </tr> </tbody> </table> <h3>30-DAY</h3> <table> <thead> <tr> <th> Priority </th> <th> Responsible Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 9 </td> <td> CISO / Executive </td> <td> Brief executive leadership on CISA capacity degradation. With ~1,000 staff departed and further cuts proposed, plan for reduced federal cyber support. Evaluate MS-ISAC engagement, consider increasing state SOC self-sufficiency, and assess whether current staffing supports 24/7 operations during a major incident. </td> </tr> <tr> <td> 10 </td> <td> CISO / Policy </td> <td> Commission assessment of state agency AI tool usage. Establish policies governing what data may be entered into AI platforms, mandate approved tools only, and address browser extension risks. </td> </tr> <tr> <td> 11 </td> <td> CISO / Architecture </td> <td> Launch an edge appliance hardening sprint. Inventory all Citrix, F5, Cisco, Ivanti, and Fortinet appliances across agencies. Establish a 48-hour emergency patching SLA for edge devices with critical CVEs. This is the single highest-ROI security investment for Q2 2026. </td> </tr> <tr> <td> 12 </td> <td> DevOps / Security </td> <td> Implement software supply chain integrity controls. Require package pinning to known-good hashes, mandate SBOM generation for all custom applications, and pin all GitHub Actions to commit SHAs. Traditional vulnerability scanning does not detect supply chain poisoning. </td> </tr> <tr> <td> 13 </td> <td> CISO / Identity </td> <td> Develop a FIDO2/passkey deployment roadmap. Traditional MFA is no longer sufficient against AiTM phishing. Prioritize phishing-resistant authentication for high-value accounts (finance, health, executive, IT admin) in Q2, with agency-wide rollout planned for Q3–Q4. </td> </tr> </tbody> </table> <h2>The Bottom Line                        </h2> The threat environment facing state government IT has shifted materially in the past week. Two critical edge appliance vulnerabilities are being exploited right now against the same classes of devices that state agencies depend on for remote access and application delivery. Iran’s IRGC is demonstrating that no U.S. official is beyond their reach. A supply chain attack is expanding faster than defenders can audit their dependencies. And the most prolific phishing platform in the world has shrugged off a coordinated international takedown. Meanwhile, the federal cybersecurity apparatus that state governments have relied on for emergency support, threat intelligence sharing, and incident response augmentation is operating at diminished capacity — and may shrink further. This is not a week for monitoring. This is a week for action. Confirm your Citrix and F5 patching status before close of business today. Audit your CI/CD pipelines for compromised packages. Start the conversation about phishing-resistant authentication. And begin planning for a future where your state SOC is the primary — not secondary — line of defense. The threats are specific. The vulnerabilities are known. The clock is running.

FEATURED RESOURCES

March 30, 2026

Anomali Cyber Watch

When Ceasefires Don’t Apply to Cyberspace: 30 Days Into the Iran Cyber War, the Threat Has Never Been Higher

March 30, 2026

Public Sector

Anomali Cyber Watch

Edge Appliances Under Siege, Iran Escalates, Supply Chains Fracture: What State CISOs Must Do This Week

March 27, 2026

Anomali Cyber Watch

When the Bombs Pause, the Hackers Don't: Iran's Cyber War Enters Its Most Dangerous Phase

Explore All