Silent Killers: macOS EDR Bypass, Fortinet Credential Harvesting, and a Record ICS Advisory Surge Threaten State Government Networks

Public Sector

Published on

June 25, 2026

Table of Contents

Threat Assessment Level: ELEVATED (Unchanged from prior cycle; escalation to HIGH possible within 72 hours if Cisco UCM exploitation scales against state agencies or Fortinet credential abuse produces confirmed state government intrusions.) <h2> Introduction </h2> State government IT leaders face a convergence of threats this week that demands immediate attention. A newly disclosed macOS vulnerability can silently disable your endpoint detection and response (EDR) agents from a standard user account. CISA has issued a second update confirming that nation-state actors continue harvesting credentials from Fortinet devices across government networks. And in a single 24-hour window, seven industrial control system advisories dropped — the highest volume we've observed in recent memory. Meanwhile, the actors behind the FortiBleed campaign (430,000+ compromised devices, 110 million+ stolen credentials), Iranian IRGC-affiliated intrusions into U.S. water utilities, and Chinese state-sponsored pre-positioning in government networks remain active threats from prior weeks. None of these have been resolved — they've simply gone quiet, which is not the same as gone. This brief translates today's intelligence into decisions you can make before close of business. <h2> What Changed </h2> <table> <thead> <tr> <th> Development </th> <th> Why It Matters for State Government </th> </tr> </thead> <tbody> <tr> <td> CVE-2026-39118 — macOS XPC privilege escalation disables CrowdStrike Falcon and Kandji MDM from a standard user account </td> <td> Any compromised macOS endpoint in your fleet can have its security tooling silently removed before data theft or ransomware deployment </td> </tr> <tr> <td> CISA updates Fortinet credential alert (22 June) — confirms continued government targeting </td> <td> If any FortiGate management interface was ever internet-exposed, assume credentials are compromised </td> </tr> <tr> <td> CVE-2026-20230 (Cisco UCM) confirmed actively exploited against government (24 June) — unauthenticated root access via WebDialer </td> <td> State VoIP infrastructure at immediate risk; patch or restrict access before end of day </td> </tr> <tr> <td> VOID MANTICORE (Iran-affiliated) breaches California water utility (12 June) </td> <td> Demonstrates Iranian capability against U.S. critical infrastructure; state water systems at elevated risk </td> </tr> <tr> <td> Salt Typhoon refreshes SNAPPYBEE loader C2 infrastructure targeting U.S. government (23 June) </td> <td> Chinese state-sponsored pre-positioning remains active; federal-interconnected state networks are lateral-movement targets </td> </tr> <tr> <td> 4 new CISA KEV entries including CVE-2025-67038 (Lantronix EDS5000, CVSS 9.8) </td> <td> Unauthenticated command injection in serial-to-Ethernet devices common in building automation and OT environments </td> </tr> <tr> <td> 7 ICS advisories in 24 hours — Siemens (×4), ABB, Hubbell, B&R </td> <td> Record single-day volume; affects SCADA/DCS products in state-overseen utility environments </td> </tr> <tr> <td> NETSUPPORT RAT delivered via fake Microsoft Teams advertisements targeting government </td> <td> Second independent delivery campaign for this RAT family against government — it's becoming the commodity tool of choice </td> </tr> <tr> <td> Post-Quantum Executive Order (23 June) </td> <td> Federal mandate with direct implications for state systems interconnected with federal partners </td> </tr> <tr> <td> SASE/TIC 3.0 guidance published by CISA (24 June) </td> <td> Architecture blueprint for state agencies modernizing network security </td> </tr> </tbody> </table> <h2> Threat Timeline </h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Relevance </th> </tr> </thead> <tbody> <tr> <td> 12 June 2026 </td> <td> VOID MANTICORE (IRGC-affiliated) breaches California water utility </td> <td> Demonstrates Iranian capability against U.S. critical infrastructure; state water systems at risk </td> </tr> <tr> <td> 17–18 June 2026 </td> <td> UNC5435 (Russia-nexus) publishes 73,932 FortiGate admin credentials; later confirmed at 430,000+ devices </td> <td> Any state agency running FortiGate with exposed management must assume compromise </td> </tr> <tr> <td> 22 June 2026 </td> <td> CISA issues second Fortinet update confirming continued government targeting </td> <td> Validates ongoing exploitation — not a one-time dump </td> </tr> <tr> <td> 23 June 2026 </td> <td> Salt Typhoon refreshes SNAPPYBEE loader C2 infrastructure targeting U.S. government </td> <td> Chinese state-sponsored pre-positioning remains active </td> </tr> <tr> <td> 23 June 2026 </td> <td> Post-Quantum Executive Order signed </td> <td> Compliance clock starts for federal-interconnected state systems </td> </tr> <tr> <td> 23 June 2026 </td> <td> 4 new CISA KEV entries including CVE-2025-67038 (CVSS 9.8) </td> <td> Mandatory patching timeline triggered </td> </tr> <tr> <td> 23 June 2026 </td> <td> 7 ICS advisories published (Siemens, ABB, Hubbell, B&R) </td> <td> Highest single-day OT advisory volume in recent tracking </td> </tr> <tr> <td> 24 June 2026 </td> <td> CVE-2026-20230 (Cisco UCM) confirmed actively exploited against government </td> <td> Unauthenticated root access via WebDialer — state VoIP infrastructure at risk </td> </tr> <tr> <td> 24 June 2026 </td> <td> CISA publishes SASE/TIC 3.0 guidance </td> <td> Architecture planning document for state network modernization </td> </tr> <tr> <td> 25 June 2026 </td> <td> CVE-2026-39118 (macOS XPC EDR/MDM bypass) disclosed </td> <td> CrowdStrike Falcon and Kandji MDM confirmed vulnerable; patch available </td> </tr> </tbody> </table> <h2> Key Threat Analysis </h2> <h3> 1. macOS EDR Bypass Creates Ransomware Kill Chain (CVE-2026-39118) </h3> XM Cyber disclosed a technique that exploits macOS XPC inter-process communication to allow a standard user — not an administrator — to unload EDR agents and MDM profiles. The attack works by tampering with a legitimate application to inherit its trusted CDHash, then calling privileged helper functions that the operating system trusts implicitly. Confirmed impact: CrowdStrike Falcon (full agent unload) and Kandji MDM (profile removal). Why this matters for state government: Executive offices, communications teams, and creative departments commonly run macOS. If any of these endpoints are compromised — even at a standard user level via phishing — the attacker can blind your security team before deploying ransomware or exfiltrating data. This creates a kill chain: local privilege escalation → EDR disable → credential dump → lateral movement → ransomware deployment. No in-the-wild exploitation has been confirmed yet, but the technique is fully documented and reproducible. <h3> 2. Fortinet Credential Harvesting — Government Confirmed as Target </h3> CISA's second update to its Fortinet alert removes any ambiguity: nation-state actors are actively harvesting credentials from internet-exposed FortiGate management interfaces, and government is an explicitly named target sector . This follows the FortiBleed campaign attributed to Russia-nexus actor UNC5435, which exposed 430,000+ devices and over 110 million credentials. The risk is not theoretical. If your FortiGate management plane was ever internet-accessible — even briefly — assume those credentials are in adversary hands. Credential rotation alone is insufficient if the underlying exposure hasn't been remediated. <h3> 3. Record ICS/OT Advisory Volume Signals Expanding Attack Surface </h3> Seven ICS advisories in a single day across four major vendors: <table> <thead> <tr> <th> Vendor </th> <th> Product </th> <th> Risk </th> </tr> </thead> <tbody> <tr> <td> Hubbell </td> <td> Aclara Metrum </td> <td> Cellular web interface manipulation, device disruption </td> </tr> <tr> <td> Siemens </td> <td> WinCC Certificate Manager </td> <td> Key material extraction </td> </tr> <tr> <td> ABB </td> <td> Freelance Security Lock </td> <td> OS function access bypass </td> </tr> <tr> <td> Siemens </td> <td> SINEC INS </td> <td> Multiple vulnerabilities (pre-V1.0 SP2 Update 6) </td> </tr> <tr> <td> B&R </td> <td> Multiple products </td> <td> Linux kernel vulnerabilities in shipped products </td> </tr> <tr> <td> Siemens </td> <td> SIPROTEC 5 </td> <td> Arbitrary file upload via DIGSI5 protocol </td> </tr> <tr> <td> Siemens </td> <td> Products using OpenSSL </td> <td> Stack buffer overflow (DoS/RCE) </td> </tr> </tbody> </table> State agencies that oversee water treatment, transportation, and energy utilities should treat this as a coordinated disclosure event requiring immediate patch assessment. Additionally, CVE-2025-67038 (Lantronix EDS5000, CVSS 9.8) — an unauthenticated OS command injection in a serial-to-Ethernet device common in building automation — is now on CISA's KEV list with confirmed active exploitation. <h3> 4. NETSUPPORT RAT: Two Campaigns, One Target — Government </h3> Two independent delivery campaigns now target government employees with NETSUPPORT RAT: <ul> <li> ClickFix social engineering (previously tracked) </li> <li> Fake Microsoft Teams advertisements (newly identified) </li> </ul> The convergence of two separate campaigns using the same malware family against the same target sector indicates NETSUPPORT is becoming the commodity remote access tool of choice for government-targeting actors. The confirmed C2 domain is bksnb[.]com. <h3> 5. Nation-State Actors: Quiet Does Not Mean Safe </h3> <table> <thead> <tr> <th> Actor </th> <th> Affiliation </th> <th> Last Observed Activity </th> <th> Current Assessment </th> </tr> </thead> <tbody> <tr> <td> VOID MANTICORE </td> <td> Iran (IRGC) </td> <td> 12 June — California water utility breach </td> <td> Capability demonstrated against U.S. critical infrastructure </td> </tr> <tr> <td> UNC5435 </td> <td> Russia-nexus </td> <td> 17–18 June — FortiBleed credential dump </td> <td> Credentials still being exploited per CISA 22 June update </td> </tr> <tr> <td> Salt Typhoon </td> <td> China (state-sponsored) </td> <td> 23 June — SNAPPYBEE C2 refresh </td> <td> Active pre-positioning in U.S. government networks </td> </tr> <tr> <td> Volt Typhoon </td> <td> China (state-sponsored) </td> <td> Extended quiet period </td> <td> Living-off-the-land actors deliberately minimize observable activity; absence is expected tradecraft </td> </tr> <tr> <td> APT29 </td> <td> Russia (SVR) </td> <td> 22 June — last ThreatStream Next-Gen update </td> <td> Possible retooling or operational pause </td> </tr> </tbody> </table> Critical point: Volt Typhoon's silence is by design . These actors pre-position using legitimate tools (valid accounts, native system utilities) specifically to avoid detection. The absence of indicators is not evidence of absence. <h2> Predictive Analysis </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability (30-day) </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> Ransomware group weaponizes CVE-2026-39118 macOS EDR bypass as pre-encryption step </td> <td> 60% </td> <td> Technique is fully documented, trivial to implement, and directly enables the "blind then encrypt" playbook already used by Gentlemen RaaS (GentleKiller) on Windows </td> </tr> <tr> <td> State government FortiGate credentials from FortiBleed campaign used for initial access in targeted intrusion </td> <td> 70% </td> <td> 430K+ devices compromised; CISA confirms continued government targeting; credential-based access is the lowest-friction entry point </td> </tr> <tr> <td> NETSUPPORT RAT infection in state agency via fake Teams/ClickFix campaign </td> <td> 55% </td> <td> Two active delivery campaigns specifically targeting government; Microsoft Teams is ubiquitous in state IT </td> </tr> <tr> <td> Exploitation of Lantronix EDS5000 (CVE-2025-67038) in state building automation </td> <td> 40% </td> <td> Confirmed active exploitation; device is common in facilities management but may not be present in all state environments </td> </tr> <tr> <td> Salt Typhoon or Volt Typhoon activity detected in state government network </td> <td> 35% </td> <td> Active C2 refresh indicates ongoing operations; state .gov interconnections with federal systems create lateral paths </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Detection Priorities </h3> <table> <thead> <tr> <th> Priority </th> <th> What to Monitor </th> <th> ATT&CK Technique </th> <th> Detection Logic </th> </tr> </thead> <tbody> <tr> <td> CRITICAL </td> <td> macOS system extension unload events </td> <td> T1562.001 (Impair Defenses) </td> <td> Alert on systemextensionsctl uninstall or es_event_type_t: ES_EVENT_TYPE_NOTIFY_PROC_EXEC matching EDR/MDM binary paths being terminated by non-admin processes </td> </tr> <tr> <td> CRITICAL </td> <td> FortiGate management plane access from unexpected sources </td> <td> T1133 (External Remote Services), T1078 (Valid Accounts) </td> <td> Audit all FortiGate admin logins; alert on logins from non-whitelisted IPs; correlate with known compromised credential lists </td> </tr> <tr> <td> HIGH </td> <td> DNS queries to bksnb[.]com </td> <td> T1219 (Remote Access Software) </td> <td> Block at DNS/proxy; hunt in 30-day DNS logs for historical resolution </td> </tr> <tr> <td> HIGH </td> <td> NetSupportManager network traffic patterns </td> <td> T1219 (Remote Access Software) </td> <td> Detect NetSupport's characteristic HTTP beacon pattern (typically port 443 with distinctive User-Agent strings) </td> </tr> <tr> <td> HIGH </td> <td> Cisco UCM WebDialer access attempts </td> <td> T1190 (Exploit Public-Facing Application) </td> <td> Monitor for unauthenticated requests to WebDialer endpoints; alert on any successful authentication bypass indicators (CVE-2026-20230) </td> </tr> <tr> <td> MEDIUM </td> <td> XPC service manipulation on macOS </td> <td> T1574.002 (Hijack Execution Flow) </td> <td> Monitor for new XPC service registrations or modifications to existing service plists by non-system processes </td> </tr> <tr> <td> MEDIUM </td> <td> Lantronix device HTTP RPC calls </td> <td> T1190 (Exploit Public-Facing Application) </td> <td> If Lantronix EDS5000 devices exist in environment, monitor for anomalous HTTP RPC traffic patterns </td> </tr> </tbody> </table> <h3> Hunting Hypotheses </h3> <ol> <li> Hypothesis: Compromised FortiGate credentials have already been used for VPN access to state networks. </li> <ul> <li> Hunt: Query VPN authentication logs for FortiGate-managed connections from unusual geolocations or at unusual hours over the past 30 days. Cross-reference with the FortiBleed exposure window (17 June onward). </li> <li> Techniques: T1078.004 (Cloud Accounts), T1133 (External Remote Services) </li> </ul> <li> Hypothesis: NETSUPPORT RAT is already present on state endpoints delivered via prior ClickFix or malvertising campaigns. </li> <ul> <li> Hunt: Search for client32.exe or NetSupport-related registry keys (HKLM\SOFTWARE\NetSupport). Query proxy logs for HTTP beacons to known NetSupport C2 patterns. </li> <li> Techniques: T1219 (Remote Access Software), T1105 (Ingress Tool Transfer) </li> </ul> <li> Hypothesis: Volt Typhoon has pre-positioned in state network using living-off-the-land techniques. </li> <ul> <li> Hunt: Audit scheduled tasks, WMI subscriptions, and service installations created by accounts that also authenticated via VPN or external remote services. Look for legitimate admin tools (PsExec, WMIC, PowerShell remoting) used from unexpected source hosts. </li> <li> Techniques: T1078 (Valid Accounts), T1072 (Software Deployment Tools), T1053 (Scheduled Task/Job) </li> </ul> </ol> <h3> Blocking Actions </h3> Block the following at your DNS resolver, web proxy, and firewall: <table> <thead> <tr> <th> IOC </th> <th> Type </th> <th> Context </th> </tr> </thead> <tbody> <tr> <td> bksnb[.]com </td> <td> Domain </td> <td> NETSUPPORT RAT C2 (confidence 85) </td> </tr> <tr> <td> zauber-edgecb61leise[.]icu </td> <td> Domain </td> <td> Malicious infrastructure </td> </tr> <tr> <td> samtpfotchensnezhok9566leisegepard[.]sbs </td> <td> Domain </td> <td> Malicious infrastructure </td> </tr> <tr> <td> dentalfaxgate[.]vip </td> <td> Domain </td> <td> Malicious infrastructure </td> </tr> <tr> <td> backupsupport[.]comxa[.]com </td> <td> Domain </td> <td> RAT C2 infrastructure </td> </tr> <tr> <td> ewaehhmrqh[.]ws </td> <td> Domain </td> <td> Malicious infrastructure </td> </tr> <tr> <td> 176.116.165[.]207 </td> <td> IPv4 </td> <td> Threat infrastructure </td> </tr> <tr> <td> 124.71.175[.]215 </td> <td> IPv4 </td> <td> Threat infrastructure </td> </tr> <tr> <td> 31.170.160[.]209 </td> <td> IPv4 </td> <td> Threat infrastructure </td> </tr> </tbody> </table> Additional IOCs available via Anomali ThreatStream Next-Gen. <h2> Sector-Specific Defensive Priorities </h2> <h3> Government (State Agencies) </h3> <ul> <li> Immediate: Verify CrowdStrike Falcon macOS sensor is patched against CVE-2026-39118 across all executive and departmental macOS endpoints </li> <li> Immediate: Audit all Fortinet management interfaces — confirm zero internet exposure; rotate all admin credentials regardless of perceived exposure status </li> <li> 7-Day: Implement conditional access policies requiring phishing-resistant MFA for all VPN and remote access, eliminating credential-only authentication paths </li> <li> 30-Day: Begin post-quantum cryptographic inventory for all systems interconnecting with federal partners per new Executive Order </li> </ul> <h3> Financial Services (State Treasury, Revenue, Retirement Systems) </h3> <ul> <li> Immediate: Hunt for NETSUPPORT RAT indicators in environments processing citizen financial data (tax systems, payment portals) </li> <li> 7-Day: Review Cisco UCM deployments in call centers handling sensitive financial information; apply CVE-2026-20230 mitigations </li> <li> 30-Day: Assess SASE/TIC 3.0 applicability for segmenting citizen-facing financial portals from internal administrative networks </li> </ul> <h3> Energy (State-Overseen Utilities) </h3> <ul> <li> Immediate: Distribute ICS advisory details to utility operators for Siemens SIPROTEC 5 (protection relays) and WinCC (HMI/SCADA) </li> <li> 7-Day: Inventory Lantronix EDS5000 devices in substation and generation facility networks; isolate any internet-connected units pending patch </li> <li> 30-Day: Establish standing monthly OT patch review meeting aligned to Siemens disclosure cycle; include ABB and Hubbell products </li> </ul> <h3> Healthcare (State Health Agencies, Medicaid Systems) </h3> <ul> <li> Immediate: Prioritize macOS EDR bypass patching — healthcare environments often have mixed OS fleets with macOS in clinical and administrative roles </li> <li> 7-Day: Validate that Fortinet devices protecting health data networks (HIPAA-regulated) have no exposed management interfaces and credentials are rotated </li> <li> 30-Day: Assess ransomware resilience specifically for Medicaid claims processing systems — the quiet period in ransomware activity historically precedes targeting surges </li> </ul> <h3> Aviation/Logistics (State DOT, Port Authorities) </h3> <ul> <li> Immediate: Assess Hubbell Aclara Metrum exposure in transportation infrastructure (traffic management, toll systems) </li> <li> 7-Day: Review B&R automation products in logistics and port operations for Linux kernel vulnerabilities disclosed in this cycle </li> <li> 30-Day: Conduct tabletop exercise simulating Volt Typhoon-style pre-positioning in transportation SCADA — test detection and response for living-off-the-land techniques </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Within 24 Hours) </h3> <table> <thead> <tr> <th> Action </th> <th> Owner </th> </tr> </thead> <tbody> <tr> <td> Verify CrowdStrike Falcon macOS sensor includes XPC bypass mitigation for CVE-2026-39118; confirm all macOS endpoints updated </td> <td> Endpoint Engineering </td> </tr> <tr> <td> Deploy detection for macOS system extension unload events (T1562.001) — alert on any EDR/MDM process termination by non-admin users </td> <td> SOC / Detection Engineering </td> </tr> <tr> <td> Validate ALL Fortinet FortiGate management interfaces are not internet-accessible; rotate all admin credentials on any device that was ever exposed </td> <td> Network Operations </td> </tr> <tr> <td> Block bksnb[.]com and associated C2 domains (see IOC table above) at DNS and web proxy </td> <td> SOC / Network Security </td> </tr> <tr> <td> Confirm Cisco UCM WebDialer is patched or access-restricted per CVE-2026-20230 mitigations </td> <td> Unified Communications Team </td> </tr> </tbody> </table> <h3> 7-DAY </h3> <table> <thead> <tr> <th> Action </th> <th> Owner </th> </tr> </thead> <tbody> <tr> <td> Hunt for NETSUPPORT RAT artifacts across all endpoints (registry keys, client32.exe, beacon patterns) — 30-day lookback </td> <td> SOC / Threat Hunting </td> </tr> <tr> <td> Inventory Lantronix EDS5000 devices across state facilities; isolate internet-connected units; apply CVE-2025-67038 patch </td> <td> Facilities / OT Security </td> </tr> <tr> <td> Review CISA SASE/TIC 3.0 guidance; schedule IT leadership briefing on zero trust migration implications </td> <td> CISO / Enterprise Architecture </td> </tr> <tr> <td> Distribute ICS advisory package to all utility operators under state oversight; request patch status within 14 days </td> <td> OT Security / Utility Coordination </td> </tr> <tr> <td> Conduct FortiGate VPN authentication log review — 30-day lookback for anomalous access patterns post-FortiBleed </td> <td> SOC / Identity Team </td> </tr> </tbody> </table> <h3> 30-DAY </h3> <table> <thead> <tr> <th> Action </th> <th> Owner </th> </tr> </thead> <tbody> <tr> <td> Initiate post-quantum cryptographic inventory — identify all RSA/ECC systems interconnecting with federal partners; assign project owner </td> <td> CISO / Enterprise Architecture </td> </tr> <tr> <td> Audit all Siemens WinCC, SINEC INS, and SIPROTEC 5 deployments in state-overseen utility SCADA environments; coordinate patch scheduling </td> <td> OT Security </td> </tr> <tr> <td> Establish monthly OT patch review cadence aligned to vendor disclosure cycles (Siemens, ABB, Schneider) </td> <td> OT Security / Change Management </td> </tr> <tr> <td> Conduct tabletop exercise: "Ransomware actor uses macOS EDR bypass as initial disablement step" — test detection, containment, and recovery </td> <td> CISO / IR Team </td> </tr> <tr> <td> Evaluate OSINT collection capability — current intelligence blind spot (5 days degraded) reduces threat visibility; approve alternative provider or accept risk </td> <td> CISO </td> </tr> </tbody> </table> <h3> Executive / IR Preparedness </h3> <table> <thead> <tr> <th> Action </th> <th> Owner </th> <th> Timeline </th> </tr> </thead> <tbody> <tr> <td> Brief agency CIOs on FortiBleed exposure risk and macOS EDR bypass — frame as "your security tools can be silently disabled" </td> <td> CISO </td> <td> This week </td> </tr> <tr> <td> Update incident response playbook to include "EDR agent tampered/unloaded" scenario with macOS-specific procedures </td> <td> IR Team </td> <td> 7 days </td> </tr> <tr> <td> Request risk acceptance decision on degraded OSINT collection capability — 5 days without open-source intelligence correlation </td> <td> CISO </td> <td> 48 hours </td> </tr> <tr> <td> Engage CrowdStrike TAM to confirm state-specific exposure to CVE-2026-39118 and obtain detection content </td> <td> Security Operations </td> <td> This week </td> </tr> </tbody> </table> <h2> Bottom Line </h2> The threat landscape facing state government this week is defined by a dangerous pattern: adversaries are systematically targeting the tools we rely on for defense. An EDR bypass that works from a standard user account. Credential harvesting from the firewalls protecting our perimeters. Pre-positioning by nation-state actors designed to be invisible until activation. The seven ICS advisories in a single day are not routine — they represent an expanding attack surface in the operational technology that underpins the services citizens depend on. Three decisions require your attention today: <ol> <li> Confirm your macOS EDR agents are patched. CVE-2026-39118 turns every unpatched macOS endpoint into a potential blind spot. Verify with your endpoint team before end of day. </li> <li> Validate your Fortinet exposure. CISA has now issued two updates confirming government targeting. If you haven't rotated credentials and confirmed no management interface exposure, you are operating on borrowed time. </li> <li> Decide on your intelligence collection gap. Five days without OSINT correlation capability means we cannot fully validate threats or confirm their absence. Accept the risk formally or approve the fix. </li> </ol> The quiet periods — in ransomware activity, in Volt Typhoon operations, in APT29 campaigns — are not reassurance. They are the sound of adversaries selecting targets, staging infrastructure, and waiting for the moment of maximum impact. Act on what you can control today. The window between disclosure and exploitation continues to shrink. Published 25 June 2026 | Anomali CTI Desk For IOC feeds and machine-readable intelligence, contact your Anomali ThreatStream Next-Gen representative.

FEATURED RESOURCES

June 25, 2026

Anomali Cyber Watch

Iran's Cyber Arsenal Is Loaded: What CISOs Must Know as Negotiations and Kinetic Operations Collide

June 25, 2026

Anomali Cyber Watch

Public Sector

Silent Killers: macOS EDR Bypass, Fortinet Credential Harvesting, and a Record ICS Advisory Surge Threaten State Government Networks

June 24, 2026

Anomali Cyber Watch

Iran Conflict Cyber Operations Reach Inflection Point: Banking Attacks, FortiBleed at Scale, and a New Space Sector Battleground

Explore All