FortiBleed, APT28, and Industrialized Ransomware: A Perfect Storm Targeting State Government Infrastructure

Public Sector

Published on

July 3, 2026

Table of Contents

Threat Assessment Level: ELEVATED (Raised from GUARDED. Escalation to HIGH possible within 72 hours if FortiBleed credential exploitation expands to confirmed state government victims or a new ransomware incident materializes against public-sector targets.) <h2> Introduction </h2> State government IT leaders face a convergence of threats this week that demands immediate executive attention. A Russian-speaking criminal crew has compromised credentials for over 86,000 Fortinet firewalls globally — the same platform many state agencies rely on for perimeter defense and VPN access. Simultaneously, Russia's GRU (APT28) has deployed fresh malware tooling targeting government networks, a new ransomware partnership is industrializing supply-chain attacks against developer infrastructure, and Microsoft 365 environments are absorbing 81 million login attacks in a two-week window. This is not theoretical. CISA has added a new SharePoint remote code execution vulnerability to its Known Exploited Vulnerabilities catalog with confirmed exploitation against state agency infrastructure. The question for state CIOs and CISOs is not whether these threats are relevant — it's whether your teams can respond fast enough. <h2> What Changed </h2> <ul> <li> FortiBleed (18 Jun): CISA and UK NCSC issued emergency guidance after 86,644 Fortinet firewalls were found compromised; credentials already used to deploy INC and Lynx ransomware. </li> <li> APT28 FrameLoader (3 Jul): CrowdStrike published fresh IOCs for a new GRU loader malware actively targeting government networks. </li> <li> Vect + TeamPCP Ransomware Partnership (3 Jul): FBI FLASH confirmed supply-chain credential theft from CI/CD pipelines now feeds directly into ransomware operations. </li> <li> SharePoint RCE CVE-2026-45659 (1 Jul): Added to CISA KEV with confirmed exploitation against state agency infrastructure; CVSS 8.8. </li> <li> M365 Mass Credential Spray (3 Jul): 81 million login attempts across 64 organizations in 14 days; some MFA bypasses confirmed. </li> <li> ICS Advisories (30 Jun): CISA published 7 simultaneous advisories covering Delta Electronics PLCs and Schneider Electric RTUs in water/wastewater environments. </li> <li> APT29 Credential Harvesting (26 Jun): CISA/FBI advisory on senior officials targeted via personal messaging apps. </li> <li> VOID MANTICORE California Water Breach (12 Jun): Iranian nation-state actor attributed to breach of California water utility, confirming active targeting of U.S. state critical infrastructure. </li> </ul> <h3> Detailed Timeline </h3> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Significance </th> </tr> </thead> <tbody> <tr> <td> 1 Jul 2026 </td> <td> CVE-2026-45659 (SharePoint RCE) added to CISA KEV </td> <td> Confirmed exploitation against state agencies; CVSS 8.8 </td> </tr> <tr> <td> 30 Jun 2026 </td> <td> CISA published 7 simultaneous ICS advisories </td> <td> Delta Electronics PLCs and Schneider Electric RTUs in water/wastewater </td> </tr> <tr> <td> 26 Jun 2026 </td> <td> CISA/FBI advisory on APT29 credential harvesting </td> <td> Senior officials targeted via personal messaging apps </td> </tr> <tr> <td> 18 Jun 2026 </td> <td> CISA + UK NCSC emergency FortiBleed guidance </td> <td> 86,644 Fortinet firewalls compromised; credential rotation urged </td> </tr> <tr> <td> 12 Jun 2026 </td> <td> California water utility breach attributed to VOID MANTICORE (IRGC) </td> <td> Iranian nation-state targeting U.S. state critical infrastructure </td> </tr> <tr> <td> 3 Jul 2026 </td> <td> FBI FLASH + Sophos: Vect + TeamPCP ransomware partnership </td> <td> Supply-chain credential theft now feeds directly into ransomware operations </td> </tr> <tr> <td> 3 Jul 2026 </td> <td> APT28/FANCY BEAR fresh "FrameLoader" malware IOCs published </td> <td> New loader malware attributed to Russia's GRU Unit 26165 </td> </tr> <tr> <td> 3 Jul 2026 </td> <td> 81 million M365 login attacks in 14 days reported </td> <td> Azure CLI password spray campaign bypassing MFA in some cases </td> </tr> </tbody> </table> <h2> Key Threat Analysis </h2> <h3> 1. FortiBleed: Your Perimeter Is the Supply Chain Now </h3> A Russian-speaking criminal crew has been operating since February 2026, harvesting administrator and VPN credentials from 86,644 Fortinet firewalls across 194 countries — approximately 50% of the internet-facing FortiGate fleet. Their methodology is industrial: <ul> <li> Configuration file exfiltration from exposed or previously breached devices </li> <li> SHA-256 hash cracking on a 45-GPU cluster </li> <li> A bespoke "FortiGate Sniffer" implant intercepting SSL VPN authentication in real-time </li> <li> A searchable database of compromised credentials organized by country, industry, and revenue </li> </ul> The downstream impact is already confirmed: compromised FortiBleed credentials have been used to deploy INC and Lynx ransomware against victims. Why this matters for state government: If any state FortiGate device was running legacy SHA-256 password hashes (pre-FortiOS 7.4.8), those credentials may already be in the attacker's database. The attacker uses valid credentials — there is no exploit signature to detect, no IOC to block. Your firewall becomes the adversary's front door. <h3> 2. APT28/FANCY BEAR: Fresh Government-Targeting Malware </h3> CrowdStrike published high-confidence IOCs on 3 July 2026 for a new loader malware family called FrameLoader , attributed to APT28 (Russia's GRU Unit 26165). This actor has a documented history of targeting government networks, election infrastructure, and political organizations. Key IOCs: <ul> <li> SHA-256: 732fc1a6fad524e205764e54b1b1599b43fffe39099218d91e6a9811cefd5a24 </li> <li> MD5: 94ca87772e2dce058ba2aed04a739110 </li> <li> SHA-1: 225a43c6277568cb059a05f207619a9db093b660 </li> </ul> This represents fresh tooling — not recycled infrastructure — indicating active operational tempo against government targets. <h3> 3. Vect + TeamPCP: Ransomware Meets Supply-Chain Compromise </h3> The FBI issued a FLASH warning on 3 July 2026 confirming that ransomware group Vect has partnered with TeamPCP (associated with "The Com" cybercriminal community). TeamPCP specializes in compromising developer tools — Trivy, npm packages, GitHub Actions — and stealing credentials from CI/CD pipelines. Those credentials now feed directly into Vect's ransomware-as-a-service operation. Confirmed malware families: CanisterWorm, SANDCLOCK, Mini Shai-Hulud, Miasma Key IOCs: <ul> <li> eb6eb4154b03ec73218727dc643d26f4e14dfda2438112926bb5daf37ae8bcdb (Mini Shai-Hulud) </li> <li> 4066781fa830224c8bbcc3aa005a396657f9c8f9016f9a64ad44a9d7f5f45e34 (Mini Shai-Hulud variant) </li> <li> 80a3d2877813968ef847ae73b5eeeb70b9435254e74d7f07d8cf4057f0a710ac (supply-chain artifact) </li> <li> 6f933d00b7d05678eb43c90963a80b8947c4ae6830182f89df31da9f568fea95 (supply-chain artifact) </li> </ul> Any state agency with developers using npm, GitHub Actions, or Trivy in their CI/CD pipelines is in the target set. <h3> 4. CVE-2026-45659: SharePoint Under Active Exploitation </h3> This deserialization-of-untrusted-data vulnerability (CVSS 8.8) allows an authorized attacker to execute arbitrary code on SharePoint servers. CISA added it to the KEV catalog on 1 July 2026 with confirmed exploitation against state agency infrastructure. This is the second SharePoint KEV in recent weeks, following CVE-2025-53770. <h3> 5. Microsoft 365 Mass Credential Spray </h3> A coordinated Azure CLI password spray campaign generated 81 million+ login attempts across 64 organizations in 14 days. Some attacks successfully bypassed MFA. State agencies relying on Microsoft 365 and Entra ID (Azure AD) for employee authentication — particularly service principals and automation accounts that may lack MFA — are directly exposed. <h2> Predictive Analysis </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Timeframe </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> Ransomware deployment against state/local government using FortiBleed-sourced credentials </td> <td> HIGH (75-85%) </td> <td> 7-14 days </td> <td> Confirmed INC/Lynx deployments via FortiBleed; government explicitly in target database </td> </tr> <tr> <td> APT28 FrameLoader used against U.S. state government network </td> <td> MODERATE (40-55%) </td> <td> 14-30 days </td> <td> Fresh tooling + historical APT28 government targeting; single-source attribution </td> </tr> <tr> <td> Supply-chain compromise of state CI/CD pipeline via TeamPCP/Vect </td> <td> MODERATE (35-50%) </td> <td> 30 days </td> <td> FBI-confirmed partnership; state dev teams use npm/GitHub; no confirmed state victim yet </td> </tr> <tr> <td> Second SharePoint zero-day or mass exploitation wave </td> <td> MODERATE-HIGH (55-65%) </td> <td> 7-14 days </td> <td> Two SharePoint KEVs in rapid succession indicates active research/exploitation campaign </td> </tr> <tr> <td> Volt Typhoon / Salt Typhoon re-emergence in state critical infrastructure </td> <td> MODERATE (40-50%) </td> <td> 30-60 days </td> <td> Absence of indicators is anomalous given prior pre-positioning activity; may indicate improved OPSEC </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Detection Priorities </h3> <table> <thead> <tr> <th> ATT&CK Technique </th> <th> What to Hunt </th> <th> Detection Logic </th> </tr> </thead> <tbody> <tr> <td> T1078 (Valid Accounts) </td> <td> FortiBleed credential abuse </td> <td> FortiGate admin login from new source IP + config download within 60 min; VPN auth from anomalous geolocation </td> </tr> <tr> <td> T1110.003 (Password Spraying) </td> <td> M365 mass spray </td> <td> >50 failed logins per service principal/hour in Entra ID audit logs; successful auth immediately following spray pattern </td> </tr> <tr> <td> T1133 (External Remote Services) </td> <td> SSL VPN abuse </td> <td> VPN sessions from IPs not in historical baseline; concurrent sessions from same credential at different geolocations </td> </tr> <tr> <td> T1190 (Exploit Public-Facing App) </td> <td> SharePoint exploitation </td> <td> Unexpected process spawning from w3wp.exe on SharePoint servers; deserialization error patterns in ULS logs </td> </tr> <tr> <td> T1195.002 (Supply Chain Compromise) </td> <td> TeamPCP artifacts </td> <td> Unexpected npm package installations; GitHub Actions running from non-pinned references; presence of Mini Shai-Hulud hashes </td> </tr> <tr> <td> T1040 (Network Sniffing) </td> <td> FortiGate Sniffer implant </td> <td> Unexpected processes on FortiGate devices; configuration exports not initiated by known administrators </td> </tr> <tr> <td> T1059.001 (PowerShell) </td> <td> Post-exploitation </td> <td> Encoded PowerShell execution on SharePoint servers; PowerShell downloading from external URLs on endpoints </td> </tr> </tbody> </table> <h3> Hunting Hypotheses </h3> <ol> <li> "Are our Fortinet credentials already compromised?" — Query FortiGate logs for admin logins from IP addresses outside your known management subnets in the past 90 days. Cross-reference with any configuration backup/export events. </li> <li> "Is anyone spraying our Entra ID?" — Pull Entra ID sign-in logs for the past 14 days. Filter for >10 failed attempts per unique username per hour. Look for service principals with no MFA enforcement. </li> <li> "Has our CI/CD pipeline been poisoned?" — Audit npm package-lock.json files across all state repositories for packages not in your approved dependency list. Check GitHub Actions workflow files for uses: references pointing to tags rather than commit SHAs. </li> </ol> <h3> IOC Blocking Table </h3> <table> <thead> <tr> <th> Type </th> <th> Value </th> <th> Attribution </th> </tr> </thead> <tbody> <tr> <td> SHA-256 </td> <td> 732fc1a6fad524e205764e54b1b1599b43fffe39099218d91e6a9811cefd5a24 </td> <td> APT28 FrameLoader </td> </tr> <tr> <td> MD5 </td> <td> 94ca87772e2dce058ba2aed04a739110 </td> <td> APT28 tooling </td> </tr> <tr> <td> SHA-1 </td> <td> 225a43c6277568cb059a05f207619a9db093b660 </td> <td> APT28 tooling </td> </tr> <tr> <td> SHA-256 </td> <td> eb6eb4154b03ec73218727dc643d26f4e14dfda2438112926bb5daf37ae8bcdb </td> <td> Mini Shai-Hulud (TeamPCP/Vect) </td> </tr> <tr> <td> SHA-256 </td> <td> 4066781fa830224c8bbcc3aa005a396657f9c8f9016f9a64ad44a9d7f5f45e34 </td> <td> Mini Shai-Hulud variant </td> </tr> <tr> <td> SHA-256 </td> <td> 80a3d2877813968ef847ae73b5eeeb70b9435254e74d7f07d8cf4057f0a710ac </td> <td> TeamPCP supply-chain artifact </td> </tr> <tr> <td> SHA-256 </td> <td> 6f933d00b7d05678eb43c90963a80b8947c4ae6830182f89df31da9f568fea95 </td> <td> TeamPCP supply-chain artifact </td> </tr> </tbody> </table> Additional IOCs available via Anomali ThreatStream Next-Gen and partner feeds. <h2> Sector-Specific Defensive Priorities </h2> <h3> Government (State & Local Agencies) </h3> <ul> <li> Priority 1: Emergency Fortinet credential rotation across all agencies. Verify FortiOS version ≥ 7.4.8 (PBKDF2 hashing). Any device on older firmware must be treated as compromised. </li> <li> Priority 2: Patch SharePoint for CVE-2026-45659 within CISA BOD 22-01 timelines. On-premises SharePoint farms are the primary target. </li> <li> Priority 3: Enforce DMARC p=reject on all state .gov domains. Research shows 17% of U.S. government domains have zero email authentication — this enables every phishing campaign we track. </li> <li> Priority 4: Audit Entra ID for service principals without MFA. These are the primary targets of Azure CLI password spray campaigns. </li> </ul> <h3> Financial Services (State Treasury, Revenue, Benefits Systems) </h3> <ul> <li> Priority 1: Monitor for credential-based access to financial systems via VPN. FortiBleed credentials sorted by "revenue" means high-value financial targets are prioritized by attackers. </li> <li> Priority 2: Implement conditional access policies requiring compliant devices for access to treasury and payment systems. </li> <li> Priority 3: Review wire transfer and payment authorization workflows for susceptibility to business email compromise enabled by weak email authentication. </li> </ul> <h3> Energy (State-Regulated Utilities, Grid Operations) </h3> <ul> <li> Priority 1: Apply ICS advisories for Schneider Electric Saitel DP RTUs and Delta Electronics DVP12SE PLCs deployed in state-regulated facilities. </li> <li> Priority 2: Hunt for Volt Typhoon pre-positioning indicators (T1078 + T1072) in OT network segments. The absence of recent indicators is anomalous and may indicate improved adversary OPSEC rather than reduced targeting. </li> <li> Priority 3: Segment SCADA/ICS networks from enterprise IT. The VOID MANTICORE California water breach demonstrates that nation-states are actively targeting state water infrastructure. </li> </ul> <h3> Healthcare (State Health Agencies, Medicaid Systems) </h3> <ul> <li> Priority 1: Healthcare scored second-worst (after government) in global email security research. Enforce DMARC and implement anti-spoofing controls on all health agency domains. </li> <li> Priority 2: Ransomware groups explicitly target healthcare for maximum extortion leverage. Ensure offline backups of Medicaid enrollment, EHR, and benefits systems are tested and current. </li> <li> Priority 3: Monitor for TeamPCP/Vect supply-chain indicators in any custom healthcare application CI/CD pipelines. </li> </ul> <h3> Aviation & Logistics (State DOT, Transit Authorities) </h3> <ul> <li> Priority 1: ICS/SCADA systems in transit and transportation are in the Volt Typhoon target set. Conduct asset inventory of PLCs and RTUs against current CISA ICS advisories. </li> <li> Priority 2: Fortinet devices protecting transportation management centers must be prioritized for FortiBleed credential rotation. </li> <li> Priority 3: Supply-chain integrity for fleet management and logistics software — audit third-party integrations for indicators of compromise. </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Within 24 Hours) </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> IT Operations </td> <td> Verify ALL state FortiGate devices run FortiOS 7.4.8+ with PBKDF2 password hashing. Rotate every admin and VPN credential. Kill all active SSL VPN sessions and force re-authentication. Restrict management interfaces to internal-only access. </td> </tr> <tr> <td> 2 </td> <td> SOC </td> <td> Deploy EDR blocks for APT28 FrameLoader and TeamPCP/Vect hashes listed in the IOC table above. </td> </tr> <tr> <td> 3 </td> <td> SOC </td> <td> Implement detection for Azure CLI password spray: alert on >50 failed logins per service principal per hour in Entra ID, especially when followed by successful authentication. </td> </tr> <tr> <td> 4 </td> <td> SOC </td> <td> Create behavioral alert: "FortiGate admin login from new source IP + configuration export within 60 minutes." This catches valid-credential attacks that bypass IOC-based detection. </td> </tr> </tbody> </table> <h3> 7-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> IT Operations </td> <td> Patch SharePoint for CVE-2026-45659 (CVSS 8.8, CISA KEV). If patching is delayed, deploy WAF rules blocking deserialization payloads on SharePoint endpoints. </td> </tr> <tr> <td> 2 </td> <td> DevOps </td> <td> Audit all npm dependencies and GitHub Actions in state CI/CD pipelines. Pin all Actions to commit SHAs (not version tags). Scan for the 108 malicious packages identified in the TeamPCP/PolinRider campaign. </td> </tr> <tr> <td> 3 </td> <td> IT Operations </td> <td> Enforce DMARC p=reject on all state email domains. Audit SPF, DKIM, and MTA-STS configuration. Any domain at p=none is effectively unprotected against spoofing. </td> </tr> <tr> <td> 4 </td> <td> Identity Team </td> <td> Audit all Entra ID service principals and automation accounts for MFA enforcement. Implement conditional access policies requiring phishing-resistant authentication for privileged operations. </td> </tr> </tbody> </table> <h3> 30-DAY (Strategic) </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> CISO </td> <td> Commission assessment of state Fortinet fleet exposure to FortiBleed. Cross-reference device serial numbers against Fortinet's customer notification list. Evaluate migration to FIDO2/phishing-resistant MFA for all VPN access. </td> </tr> <tr> <td> 2 </td> <td> CISO </td> <td> Initiate architectural review: FortiBleed proves perimeter appliances are a supply-chain dependency, not just a security control. Zero-trust principles must extend to the perimeter devices themselves. </td> </tr> <tr> <td> 3 </td> <td> CIO </td> <td> Fund replacement for degraded open-source intelligence feeds. Legislative and regulatory monitoring (cybersecurity mandates, CISA directives) has been effectively blind for over 130 days — this is a strategic risk. </td> </tr> <tr> <td> 4 </td> <td> IR Team </td> <td> Update incident response playbooks to address credential-based initial access where no exploit signature exists. Tabletop exercise: "FortiBleed credentials used to deploy ransomware on state network — how do we detect and contain?" </td> </tr> </tbody> </table> <h2> The Bigger Picture: Three Architectural Shifts </h2> <ol> <li> Credentials are the new exploit. Three of this week's five major events target credentials rather than software vulnerabilities. The threat landscape is shifting from "patch faster" to "assume credentials are compromised." Detection must pivot from IOC/signature matching to behavioral anomaly detection on identity systems. </li> <li> Perimeter appliances are supply-chain dependencies. FortiBleed demonstrates that your firewall is not just a security control — it's a trust anchor. When that trust is violated at industrial scale, the entire security architecture built on top of it fails silently. Zero-trust cannot stop at the application layer. </li> <li> Ransomware is industrializing. The Vect + TeamPCP partnership represents specialization and vertical integration in the criminal ecosystem. One group steals developer credentials through supply-chain attacks; another deploys ransomware using those credentials. State government — with its political visibility, citizen data, and budget constraints — is explicitly in the target set. </li> </ol> <h2> Bottom Line </h2> Five concurrent threat fronts are converging on state government infrastructure simultaneously: FortiBleed credential theft already enabling ransomware deployment, fresh APT28 tooling in active use against government targets, an FBI-confirmed ransomware-supply-chain partnership, a CISA-confirmed SharePoint RCE under active exploitation, and an 81-million-attempt credential spray campaign bypassing MFA. No single control closes all five gaps. The highest-leverage action available today is emergency Fortinet credential rotation — it directly addresses the threat most likely to result in ransomware encryption of state systems within the next two weeks. All other actions in this report should be sequenced behind that priority. <h2> Closing </h2> The window between intelligence and exploitation is narrowing. FortiBleed credentials are already being used for ransomware deployment. APT28 has fresh tooling in the field. A confirmed SharePoint RCE is being exploited against state agencies today. The decisions required this week are not comfortable ones. Emergency credential rotation will cause temporary VPN disruption. Patching SharePoint may require maintenance windows. Auditing CI/CD pipelines will consume developer time. But the alternative — discovering your Fortinet credentials in a ransomware operator's database after encryption begins — is categorically worse. Act on the FortiBleed credential rotation today. Everything else follows from whether your perimeter is still yours. Anomali CTI Desk | 3 July 2026 For questions or additional IOC feeds, contact your Anomali account team or access indicators directly via ThreatStream Next-Gen.

FEATURED RESOURCES

July 3, 2026

Anomali Cyber Watch

Iranian Cyber Operations Reach Sustained Pre-Positioning Tempo: What CISOs Must Know Now

July 3, 2026

Anomali Cyber Watch

Public Sector

FortiBleed, APT28, and Industrialized Ransomware: A Perfect Storm Targeting State Government Infrastructure

July 2, 2026

Anomali Cyber Watch

Iran's Cyber War Machine Hits Triple Speed: What CISOs Must Do Now

Explore All