Iran's Cyber Retaliation Has Arrived — And State Government Is in the Crosshairs

Public Sector

Published on

March 16, 2026

Table of Contents

What CIOs and CISOs of State Agencies Need to Know This Week About Converging Threats to Government IT, Critical Infrastructure, and Citizen Data The threat environment facing U.S. state government IT organizations shifted materially in the first two weeks of March 2026. What was previously a strategic warning about Iranian retaliatory cyber operations following Operation Epic Fury (February 28) has now become confirmed, multi-vector offensive activity — with U.S. airports, banks, medical technology companies, and software firms already compromised. Simultaneously, CISA issued an emergency directive over actively exploited Cisco SD-WAN vulnerabilities, Google patched two zero-day Chrome flaws under active exploitation, and a new phishing-as-a-service platform emerged that defeats multi-factor authentication on Microsoft 365. For state CIOs and CISOs, the convergence is stark: the same infrastructure types your agencies operate — enterprise IT, building management systems, airports, citizen-facing web services — are being actively targeted by nation-state actors and criminal operators right now. This post covers what changed, who is behind it, what to expect next, and exactly what your teams should do about it — organized by urgency. <h2>What Changed: The Week of March 3–15, 2026</h2> Seven developments in the past two weeks fundamentally altered the risk calculus for state government IT: <ol> <li>Iran's MuddyWater breached a U.S. airport, bank, and software company using a new custom backdoor called Dindoor — confirming that Iranian intelligence operations have moved from posturing to active network penetration of U.S. entities.</li> <li>The pro-Iranian group Handala executed a devastating wiper attack on Stryker Corporation, claiming 200,000 devices were erased. This is the same group that previously weaponized Microsoft Intune (MDM) to deploy wipers — a technique directly relevant to any organization using Intune for endpoint management.</li> <li>CISA issued Emergency Directive ED 26-03 over two actively exploited Cisco Catalyst SD-WAN Manager vulnerabilities (CVE-2026-20122 and CVE-2026-20128), with exploitation attributed to "highly sophisticated" actors.</li> <li>Google released an emergency Chrome 146 update patching two zero-day vulnerabilities (in the Skia graphics engine and V8 JavaScript engine) under active exploitation — affecting every Chrome browser on every state employee workstation.</li> <li>A new phishing-as-a-service platform called "Starkiller" emerged as the successor to the recently dismantled Tycoon2FA, featuring live adversary-in-the-middle reverse proxying and OAuth device code abuse that bypasses MFA — including conditional access policies that rely on device compliance.</li> <li>Ransomware groups Qilin and Interlock continue to actively target government entities, with Interlock deploying AI-generated malware variants and recent municipal incidents in Connecticut underscoring that state and local government remains a primary ransomware target.</li> <li>CISA published five ICS/BMS advisories in a single week covering Honeywell, Trane, Siemens, and Ignition SCADA systems — all commonly deployed in state government facilities — signaling elevated risk to operational technology environments.</li> </ol> <h2>Threat Timeline                                    </h2> <table> <tbody> <tr> <td> Date </td> <td> Event </td> <td> Significance </td> </tr> <tr> <td> 2026-02-19 </td> <td> Starkiller PhaaS platform identified by Abnormal AI; reported by Dark Reading, Krebs on Security </td> <td> Successor to Tycoon2FA with MFA-bypass capabilities targeting Microsoft 365 </td> </tr> <tr> <td> 2026-02-25 </td> <td> Cisco publishes advisories for CVE-2026-20122 and CVE-2026-20128 </td> <td> SD-WAN Manager API file overwrite and credential exposure vulnerabilities </td> </tr> <tr> <td> 2026-02-26 </td> <td> CISA issues initial Emergency Directive ED 26-03 for Cisco SD-WAN </td> <td> Federal agencies ordered to patch; signals severity for all government users </td> </tr> <tr> <td> 2026-02-28 </td> <td> Operation Epic Fury — U.S. kinetic strikes on Iranian IRGC targets </td> <td> Triggers retaliatory cyber posture from Iranian state and proxy actors </td> </tr> <tr> <td> 2026-03-03 </td> <td> FBI issues reminder to critical infrastructure organizations on Iranian retaliation </td> <td> State governments explicitly named as potential targets </td> </tr> <tr> <td> 2026-03-05 </td> <td> MuddyWater breaches U.S. bank, airport, non-profit, and software company using Dindoor backdoor </td> <td> Confirmed Iranian espionage operations inside U.S. networks </td> </tr> <tr> <td> 2026-03-10 </td> <td> CISA publishes ICS advisories for Honeywell IQ4x BMS, Trane Tracer, Siemens SIMATIC, Ignition SCADA </td> <td> Five ICS/BMS advisories in one week — all common in state government facilities </td> </tr> <tr> <td> 2026-03-11 </td> <td> Handala wiper attack on Stryker Corporation; 200,000 devices claimed wiped </td> <td> Escalation of Iranian destructive operations against U.S.-allied companies </td> </tr> <tr> <td> 2026-03-12 </td> <td> CISA issues supplemental hunt-and-hardening guidance for Cisco SD-WAN </td> <td> Confirms "widely exploited" status; nation-state attribution implied </td> </tr> <tr> <td> 2026-03-13 </td> <td> Google releases emergency Chrome 146 update for two actively exploited zero-days </td> <td> All Chrome-based browsers on state endpoints require immediate patching </td> </tr> <tr> <td> 2026-03-15 </td> <td> GovTech reports: "New Federal Strategies, Rising Risk From Iran Top Cyber Themes" </td> <td> Public-sector conference confirms Iranian cyber threat as top government concern </td> </tr> </tbody> </table> <h2>Threat Analysis</h2> <h3>1. Iranian Multi-Vector Retaliation: Three Actor Groups, One Strategic Objective</h3> The Iranian cyber threat to U.S. state government has matured from theoretical to operational. Three distinct Iranian actor groups are now conducting confirmed operations against U.S. targets: MuddyWater (aliases: Mango Sandstorm, Static Kitten, TA450, Seedworm, MERCURY, Boggy Serpens, COBALT ULSTER, Earth Vetala, TEMP.Zagros) — Iran's Ministry of Intelligence and Security (MOIS) espionage unit. MuddyWater's deployment of the Dindoor backdoor (also tracked as Tsundere) into U.S. networks — including an airport, which is often a state or local government entity — represents a direct threat to state IT environments. MuddyWater is known for targeting government, energy, financial services, aerospace, defense, education, and telecommunications sectors across 45+ countries. Their signature tradecraft includes heavy use of PowerShell, living-off-the-land techniques, and custom C2 infrastructure. Handala (aliases: Void Manticore, Banished Kitten, Storm-842, Red Sandstorm, UNC5203, KarMa, HomeLandJustice) — An MOIS-affiliated destructive operations group operating under the cover of pro-Palestinian hacktivism. Their malware arsenal includes the Handala Wiper (MBR-based), CaddyWiper, ZeroCleare, and a newer AI-assisted PowerShell wiper. They also deploy the commercial infostealer Rhadamanthys. The Stryker attack demonstrates their willingness and capability to inflict mass destruction on U.S.-allied organizations. Their documented technique of weaponizing Microsoft Intune to deploy wipers is particularly alarming for any organization using MDM for endpoint management. The broader Iranian cyber apparatus — Intelligence reporting describes a systematic framework within Iranian cyber operations where espionage teams (such as APT34/OilRig, affiliated with MOIS) establish initial access, then hand off victims to destruction teams (Handala/Banished Kitten, MOIS-affiliated) for wiper deployment and psychological operations. This "access-then-destroy" pipeline means that a quiet espionage intrusion today could become a destructive wiper attack tomorrow. Why this matters for state government: State agencies operate the same categories of infrastructure being actively targeted — airports, building management systems, enterprise IT with Microsoft 365 and Intune, VPN concentrators, and SCADA/ICS for water and transportation. The FBI's March 3 reminder explicitly named state governments as potential targets for Iranian retaliation. <h3>2. Cisco SD-WAN: Emergency Directive With Nation-State Implications</h3> CISA's Emergency Directive ED 26-03 addresses two vulnerabilities in Cisco Catalyst SD-WAN Manager that are under active exploitation: <table> <tbody> <tr> <td> CVE </td> <td> CVSS </td> <td> Description </td> <td> Risk </td> </tr> <tr> <td> CVE-2026-20128 </td> <td> 7.5 (HIGH) </td> <td> Data Collection Agent credential file exposure — allows authenticated attacker to read DCA passwords and pivot to other systems </td> <td> Lateral movement enabler </td> </tr> <tr> <td> CVE-2026-20122 </td> <td> 5.4 (MEDIUM) </td> <td> API file overwrite — allows authenticated attacker to overwrite arbitrary files and gain vmanage privileges </td> <td> Privilege escalation </td> </tr> </tbody> </table> While the individual CVSS scores appear moderate, the chained exploitation of these vulnerabilities by "highly sophisticated" actors (SecurityWeek's characterization) suggests nation-state-level operations. The CISA emergency directive — a tool reserved for the most urgent threats — applies to federal agencies but signals the severity for all government users. Systems running Cisco Catalyst SD-WAN Manager below version 20.18 are affected. <h3>3. Chrome Zero-Days: Universal Endpoint Exposure</h3> Google's emergency Chrome 146 release (version 146.0.7680.75/76) patches two zero-day vulnerabilities under active exploitation: <ul> <li>Skia graphics engine flaw — enables remote code execution within the browser sandbox</li> <li>V8 JavaScript engine flaw — enables sensitive information disclosure</li> </ul> With Chrome as the dominant browser across government endpoints, every state employee workstation is a potential attack surface. These vulnerabilities enable drive-by compromise (MITRE ATT&CK T1189) — a user simply visiting a malicious or compromised website can be exploited without any additional interaction. <h3>4. Starkiller PhaaS: MFA Is No Longer Enough</h3> The Europol-led takedown of the Tycoon2FA phishing platform in early March created a temporary disruption in the adversary-in-the-middle (AitM) phishing ecosystem. That gap has already been filled. Starkiller, documented by Krebs on Security, Dark Reading, and Abnormal AI, offers: <ul> <li>Live reverse proxying of real login pages (not static clones) — making phishing pages virtually indistinguishable from legitimate ones</li> <li>Real-time MFA token interception — capturing and replaying session cookies as users authenticate</li> <li>OAuth device code abuse — a technique that hijacks Microsoft 365 accounts by exploiting the device code authentication flow, bypassing conditional access policies that rely on device compliance</li> </ul> For state agencies running Microsoft 365 and Azure AD (Entra ID), the OAuth device code vector is particularly dangerous. Many state tenants rely on conditional access policies that check device compliance — Starkiller's OAuth abuse circumvents this entirely. <h3>5. Ransomware: Qilin and Interlock Continue Targeting Government</h3> The Qilin ransomware operation (also tracked as AGENDA, AGENDA.RUST) continues to target government, healthcare, manufacturing, and transportation sectors. Qilin claimed Tulsa International Airport in February and was linked to over 1,000 breaches in 2025. The Interlock ransomware group (tracked via Hive0163) is deploying AI-generated malware variants (Slopoly) that lower the barrier for less-skilled operators. Recent municipal ransomware incidents in Connecticut (New Britain, Meriden) underscore that state and local government remains a primary target. <h3>6. ICS/Building Management: Five CISA Advisories in One Week</h3> The week of March 10 saw an unusual concentration of CISA ICS advisories affecting systems commonly deployed in state government facilities: <table> <tbody> <tr> <td> System </td> <td> Advisory </td> <td> Relevance to State Government </td> </tr> <tr> <td> Honeywell IQ4x BMS </td> <td> ICSA-26-069-03 </td> <td> Building automation controllers in state office buildings </td> </tr> <tr> <td> Trane Tracer HVAC </td> <td> CISA ICS advisory </td> <td> HVAC management in state facilities </td> </tr> <tr> <td> Siemens SIMATIC </td> <td> CISA ICS advisory </td> <td> Industrial control systems in state-operated utilities </td> </tr> <tr> <td> Siemens RUGGEDCOM APE1808 </td> <td> CISA ICS advisory </td> <td> References FortiOS vulnerabilities in industrial products </td> </tr> <tr> <td> Ignition SCADA </td> <td> CISA ICS advisory </td> <td> SCADA systems for water/wastewater treatment </td> </tr> </tbody> </table> State agencies operating water treatment facilities, building management systems, or transportation infrastructure should treat these advisories as high-priority. <h2>Predictive Analysis: What to Expect in the Next 14–30 Days</h2> <table> <tbody> <tr> <td> Scenario </td> <td> Probability </td> <td> Basis </td> </tr> <tr> <td> Additional Iranian retaliatory cyber operations against U.S. government and critical infrastructure entities </td> <td> 70% </td> <td> Three Iranian actor groups already active; FBI warning issued; Operation Epic Fury escalation trajectory </td> </tr> <tr> <td> Starkiller PhaaS campaigns targeting government Microsoft 365 tenants within 30 days </td> <td> 60% </td> <td> Platform is commercially available; Tycoon2FA customer base migrating; government M365 tenants are high-value targets </td> </tr> <tr> <td> Cisco SD-WAN exploitation attributed to a nation-state actor within 14 days </td> <td> 50% </td> <td> CISA emergency directive language and "highly sophisticated" characterization suggest classified attribution exists </td> </tr> <tr> <td> Wiper attack against a U.S. state or local government entity within 30 days </td> <td> 40% </td> <td> Handala's expanding target scope (from Israel-focused to U.S. companies); MDM-based deployment technique applicable to any Intune environment </td> </tr> <tr> <td> Exploitation of ICS/BMS vulnerabilities in state government facilities </td> <td> 30% </td> <td> Five advisories in one week; Iranian actors have demonstrated OT interest; but exploitation requires specialized access </td> </tr> </tbody> </table> <h2>SOC Operational Guidance</h2> <h3>Priority Hunting Hypotheses</h3> <table> <tbody> <tr> <td> # </td> <td> Hypothesis </td> <td> ATT&CK Technique </td> <td> Data Source </td> <td> Priority </td> </tr> <tr> <td> 1 </td> <td> Iranian actors have established persistence via PowerShell-based backdoors (Dindoor/Tsundere pattern) </td> <td> T1059.001 (PowerShell), T1071.001 (Web C2), T1105 (Ingress Tool Transfer) </td> <td> EDR telemetry, PowerShell script block logging, proxy logs </td> <td> CRITICAL </td> </tr> <tr> <td> 2 </td> <td> Adversary has abused OAuth device code flow to hijack M365 accounts </td> <td> T1528 (Steal Application Access Token), T1078.004 (Cloud Accounts) </td> <td> Azure AD sign-in logs — filter for deviceCode grant type from unexpected geolocations </td> <td> HIGH </td> </tr> <tr> <td> 3 </td> <td> MDM (Intune) has been used to deploy unauthorized applications or scripts </td> <td> T1072 (Software Deployment Tools), T1078 (Valid Accounts) </td> <td> Intune audit logs, application deployment history, compliance policy changes </td> <td> HIGH </td> </tr> <tr> <td> 4 </td> <td> Cisco SD-WAN Manager API has been accessed by unauthorized users or from unexpected IPs </td> <td> T1190 (Exploit Public-Facing Application), T1552.001 (Credentials in Files) </td> <td> SD-WAN Manager access logs, API audit trails </td> <td> HIGH </td> </tr> <tr> <td> 5 </td> <td> Session cookie replay from non-standard geolocations indicating AitM phishing success </td> <td> T1539 (Steal Web Session Cookie), T1557 (Adversary-in-the-Middle) </td> <td> Azure AD sign-in logs — impossible travel, token replay detection </td> <td> MEDIUM </td> </tr> </tbody> </table> <h3>Prioritized IOCs for Monitoring</h3> MuddyWater C2 Infrastructure (historical, high-confidence — monitor for any connection attempts): <table> <tbody> <tr> <td> IOC </td> <td> Type </td> <td> Context </td> <td> Confidence </td> </tr> <tr> <td> 193.109.120[.]59 </td> <td> IPv4 </td> <td> MuddyWater/DarkBeatC2 infrastructure (BlueVPS, Estonia) </td> <td> High </td> </tr> <tr> <td> 5.252.23[.]52 </td> <td> IPv4 </td> <td> MuddyWater/DarkBeatC2 infrastructure (Stark Industries, Slovakia) </td> <td> High </td> </tr> </tbody> </table> Malware families to detect: <ul> <li>Dindoor / Tsundere (ThreatStream ID: 900997) — MuddyWater's new custom backdoor. Request full IOC package from your threat intelligence provider.</li> <li>Handala Wiper — MBR-based wiper; CaddyWiper; ZeroCleare — known Handala/Void Manticore destructive tools</li> <li>Rhadamanthys — commercial infostealer deployed by Handala for credential harvesting</li> <li>Slopoly — AI-generated malware variant associated with Hive0163/Interlock ransomware operations</li> </ul> Domains to block: <ul> <li>handala-hack[.]to — Handala data leak site</li> <li>handala-alert[.]to — Handala news/propaganda site</li> <li>handala-redwanted[.]to — Handala targeting/doxing site</li> </ul> <h3>Detection Engineering Priorities</h3> <ol> <li>Azure AD / Entra ID: Create alerts for OAuth device code authentication (grant_type=urn:ietf:params:oauth:grant-type:device_code) from any user not explicitly authorized for device code flow. Correlate with impossible travel and new device registrations.</li> <li>PowerShell monitoring: Ensure Script Block Logging (Event ID 4104) and Module Logging are enabled. Alert on obfuscated PowerShell execution, encoded commands (-enc), and download cradles (Invoke-WebRequest, Net.WebClient).</li> <li>Intune/MDM: Monitor for new application deployments, compliance policy modifications, and configuration profile changes outside of approved change windows.</li> <li>Network edge: Monitor Cisco SD-WAN Manager API access logs for unusual file operations, credential file access, and authentication from unexpected sources.</li> <li>Chrome version compliance: Use your endpoint management platform to verify Chrome 146.0.7680.75+ deployment across all managed endpoints. Flag any endpoints running older versions as non-compliant.</li> </ol> <h2>Sector-Specific Defensive Priorities</h2> <h3>State Government Agencies (Executive Branch IT)</h3> <ul> <li>Immediate: Block OAuth device code flow in Entra ID conditional access unless explicitly required by specific applications. Audit the last 30 days of device code authentications.</li> <li>Immediate: Push Chrome 146 to all managed endpoints via SCCM/Intune within 48 hours.</li> <li>7-day: Conduct retroactive SIEM hunt for MuddyWater/Dindoor indicators (PowerShell-based C2, connections to known MuddyWater infrastructure).</li> <li>7-day: Verify Intune hardening — restrict application deployment to approved administrators only; enable BitLocker recovery key escrow; audit compliance policy change history.</li> <li>30-day: Conduct tabletop exercise for Iranian wiper scenario targeting state IT via MDM or VPN compromise.</li> </ul> <h3>Financial Services (State Treasury, Revenue, Payment Processing)</h3> <ul> <li>Immediate: Alert on Starkiller-pattern AitM phishing — session cookie replay, impossible travel in M365 sign-in logs.</li> <li>7-day: Review third-party payment processor security posture (BridgePay-type vendor risk). Ransomware attacks on payment vendors can disrupt state revenue collection.</li> <li>7-day: Hunt for MuddyWater indicators — a U.S. bank was among confirmed Dindoor victims.</li> <li>30-day: Evaluate FIDO2/passkey deployment for high-privilege financial system accounts.</li> </ul> <h3>Energy & Water Utilities (State-Operated or Overseen)</h3> <ul> <li>Immediate: Inventory all Honeywell IQ4x BMS controllers, Trane Tracer HVAC systems, Siemens SIMATIC PLCs, and Ignition SCADA deployments. Apply CISA ICS advisory mitigations.</li> <li>7-day: Verify network segmentation between IT and OT environments. Iranian actors conducting pre-positioning operations target the IT/OT boundary.</li> <li>7-day: Review FortiOS versions on any FortiGate appliances protecting OT networks — the Siemens RUGGEDCOM advisory references FortiOS vulnerabilities in industrial products.</li> <li>30-day: Evaluate dedicated OT threat intelligence subscription (e.g., Dragos WorldView) to close visibility gaps in industrial control system threats.</li> </ul> <h3>Healthcare (State Medicaid, Public Health, State Hospitals)</h3> <ul> <li>Immediate: The Handala wiper attack on Stryker Corporation (medical technology) demonstrates that healthcare-adjacent organizations are in the Iranian target set. Review MDM security posture for any state health agency using Intune.</li> <li>7-day: Ensure Qilin/AGENDA ransomware detection signatures are current — healthcare is a primary Qilin target sector.</li> <li>7-day: Audit PII repositories (Medicaid, public health records) for access anomalies — these datasets are high-value targets for both espionage and ransomware operators.</li> <li>30-day: Review incident response plans for destructive attack scenarios (wiper, not just ransomware).</li> </ul> <h3>Aviation & Transportation (State DOT, State-Managed Airports)</h3> <ul> <li>Immediate: MuddyWater's confirmed breach of a U.S. airport makes this sector a top priority. Hunt for Dindoor/Tsundere indicators in airport and DOT network environments.</li> <li>7-day: Review Cisco SD-WAN deployments in transportation management systems. If running SD-WAN Manager below version 20.18, initiate emergency patching.</li> <li>7-day: Audit VPN access logs for transportation management and traffic control systems — credential theft targeting VPN infrastructure is an active threat.</li> <li>30-day: Assess physical security implications of cyber compromise to transportation SCADA systems (traffic management, bridge controls, tunnel ventilation).</li> </ul> <h2>Prioritized Defense Recommendations      </h2> <h3>🔴 Immediate (24–48 Hours)</h3> <table> <tbody> <tr> <td> # </td> <td> Action </td> <td> Owner </td> <td> Why Now </td> </tr> <tr> <td> 1 </td> <td> Push Chrome 146.0.7680.75/76 to all managed endpoints </td> <td> Endpoint Engineering </td> <td> Two zero-days under active exploitation; every Chrome browser is exposed </td> </tr> <tr> <td> 2 </td> <td> Audit Cisco SD-WAN Manager version; emergency patch to 20.18+ if below </td> <td> Network Engineering </td> <td> CISA Emergency Directive ED 26-03; CVE-2026-20122 and CVE-2026-20128 under active exploitation </td> </tr> <tr> <td> 3 </td> <td> Block OAuth device code flow in Azure AD/Entra ID conditional access </td> <td> IAM / Cloud Security </td> <td> Starkiller PhaaS actively abusing this flow to bypass MFA on Microsoft 365 </td> </tr> <tr> <td> 4 </td> <td> Verify VMware Aria Operations patching (if deployed) </td> <td> Infrastructure </td> <td> CVE-2026-22719 (CVSS 8.1, command injection) added to CISA KEV </td> </tr> </tbody> </table> <h3>🟠 7-Day Actions</h3> <table> <tbody> <tr> <td> # </td> <td> Action </td> <td> Owner </td> <td> Why This Week </td> </tr> <tr> <td> 5 </td> <td> Hunt for MuddyWater/Dindoor indicators across SIEM and EDR </td> <td> SOC / Threat Hunt </td> <td> Confirmed breaches of U.S. airport, bank, and software company; state agencies are in the target aperture </td> </tr> <tr> <td> 6 </td> <td> Harden Intune MDM against unauthorized deployments </td> <td> Endpoint Engineering </td> <td> Handala's documented technique of weaponizing Intune for wiper deployment </td> </tr> <tr> <td> 7 </td> <td> Inventory and patch ICS/BMS systems (Honeywell IQ4x, Trane Tracer, Siemens SIMATIC, Ignition SCADA) </td> <td> Facilities / OT Security </td> <td> Five CISA ICS advisories in one week affecting common state government systems </td> </tr> <tr> <td> 8 </td> <td> Review and restrict Intune application deployment permissions </td> <td> IAM / Endpoint </td> <td> Limit deployment rights to named administrators; enable deployment approval workflows </td> </tr> <tr> <td> 9 </td> <td> Audit Azure AD sign-in logs for AitM indicators </td> <td> SOC </td> <td> Session cookie replay, impossible travel, unexpected device code authentications </td> </tr> </tbody> </table> <h3>🟡 30-Day Actions</h3> <table> <tbody> <tr> <td> # </td> <td> Action </td> <td> Owner </td> <td> Why This Month </td> </tr> <tr> <td> 10 </td> <td> Conduct Iranian wiper/espionage tabletop exercise </td> <td> CISO Office / IR Team </td> <td> Three Iranian actor groups conducting confirmed operations against U.S. targets; state government is in the target set </td> </tr> <tr> <td> 11 </td> <td> Evaluate FIDO2/passkey deployment for high-privilege accounts </td> <td> IAM </td> <td> Phishing-resistant MFA is the only strategic countermeasure to AitM phishing (Starkiller and successors) </td> </tr> <tr> <td> 12 </td> <td> Assess OT threat intelligence coverage </td> <td> CTI / CISO Office </td> <td> Five ICS advisories with minimal supplementary intelligence; dedicated OT intel feed needed </td> </tr> <tr> <td> 13 </td> <td> Review MSP and third-party vendor security posture </td> <td> Vendor Management </td> <td> ConnectWise 2026 MSP Threat Report warns identity abuse is redefining MSP risk; Black Kite reports 136 verified supply chain breaches in 2025 with 5x downstream impact </td> </tr> <tr> <td> 14 </td> <td> Brief state agency heads on Iranian cyber threat </td> <td> CIO / CISO </td> <td> Executive awareness is essential for rapid decision-making if a destructive attack occurs </td> </tr> </tbody> </table> <h3>Executive / IR Preparedness</h3> <ul> <li>Decision pre-authorization: Obtain advance approval from agency leadership for emergency patching windows and network segment isolation — so that when (not if) an incident occurs, the SOC can act without waiting for authorization.</li> <li>IR retainer validation: Confirm your incident response retainer is active and that your IR provider has current network diagrams, contact trees, and escalation procedures.</li> <li>Communication plan: Prepare draft public communications for a destructive cyber incident affecting citizen services. The Stryker attack took thousands of employees offline — a similar attack on state systems would immediately affect millions of residents.</li> <li>Federal coordination: Despite ongoing CISA budget constraints and leadership transitions, maintain active communication with your CISA regional office and FBI field office. The FBI's March 3 reminder to critical infrastructure organizations is an invitation to engage.</li> </ul> <h2>The Bottom Line</h2> The convergence of Iranian retaliatory operations, actively exploited network infrastructure vulnerabilities, browser zero-days, and MFA-defeating phishing platforms creates a threat environment that demands immediate, coordinated action from state government IT leadership. This is not a drill. Iranian state actors have already breached a U.S. airport, a bank, and a software company. A pro-Iranian group has already wiped 200,000 devices at a major U.S. corporation using MDM — the same technology your agencies use to manage endpoints. CISA has issued an emergency directive for network infrastructure that many state agencies rely on. The three decisions that matter most right now: <ol> <li>Authorize emergency patching for Chrome and Cisco SD-WAN — today, not next maintenance window.</li> <li>Block OAuth device code flow in your Microsoft 365 environment — before Starkiller campaigns reach your users.</li> <li>Start planning for a destructive attack — tabletop an Iranian wiper scenario within 30 days, because the actors, tools, and motivation are all in place.</li> </ol> The threat actors are not waiting. Neither should you.

FEATURED RESOURCES

March 16, 2026

Public Sector

Anomali Cyber Watch