Network Appliances Under Siege: State Government IT Faces Maximum-Severity Exploitation Wave

Anomali Threat Research

Published on

April 20, 2026

Table of Contents

Threat Assessment Level: ELEVATED (Trending HIGH) Previous assessment: ELEVATED (stable). Elevated trending HIGH due to confirmed active exploitation of a CVSS 10.0 vulnerability in Cisco Catalyst SD-WAN targeting government, expansion of Ivanti EPMM exploitation to a second distinct campaign, and emergence of a new ransomware family (REDBIKE) targeting government via SonicWall appliances. <h2>Executive Summary              </h2> A strategic shift is underway in how adversaries breach government networks. The dominant initial access vector is no longer phishing — it is direct exploitation of internet-facing network appliances. This week, four separate exploitation campaigns target perimeter devices commonly deployed across state and local government: Cisco SD-WAN, Ivanti EPMM, BeyondTrust, and SonicWall. The single most urgent finding: CVE-2026-20127, a CVSS 10.0 authentication bypass in Cisco Catalyst SD-WAN, is being actively exploited against government targets. Successful exploitation grants an attacker administrative control over the entire SD-WAN fabric — the ability to reroute traffic, create covert tunnels, or sever connectivity across your wide-area network. If your state operates Cisco Catalyst SD-WAN infrastructure, this is a drop-everything patching event. <h2>What Changed                          </h2> <table> <thead> <tr> <th> Development </th> <th> Why It Matters </th> </tr> </thead> <tbody> <tr> <td> Cisco SD-WAN CVE-2026-20127 (CVSS 10.0) confirmed exploited against government </td> <td> Attacker gains NETCONF access to manipulate entire network fabric — not just one host, but all routing and segmentation </td> </tr> <tr> <td> Ivanti EPMM exploitation expands — second distinct campaign confirmed </td> <td> Two independent actor groups now exploiting CVE-2026-1281 and CVE-2026-1340 against government targets across 6+ countries </td> </tr> <tr> <td> REDBIKE ransomware emerges via SonicWall exploitation </td> <td> New ransomware family explicitly targeting government, using network appliance compromise rather than phishing for initial access </td> </tr> <tr> <td> BeyondTrust CVE-2026-1731 (CVSS 9.8) exploitation confirmed with Meterpreter payload </td> <td> Active exploitation of privileged remote access infrastructure delivering post-exploitation tooling directly into government environments </td> </tr> <tr> <td> BlueNoroff (DPRK) registers fresh C2 domains mimicking Zoom/Teams/Meet </td> <td> Social engineering campaign likely imminent — credential harvesting via fake video conference invitations </td> </tr> <tr> <td> Iranian espionage campaign active across 17 countries </td> <td> Government, energy, and utilities targeted with custom backdoors and legitimate remote access tools </td> </tr> <tr> <td> DPRK Axios NPM supply chain compromise confirmed across 13 countries </td> <td> Software supply chain attack affecting healthcare and other sectors; malicious NPM packages delivering DPRK-linked payloads </td> </tr> <tr> <td> 4 new ICS/SCADA advisories from CISA </td> <td> Includes Anviz biometric access control systems used in government facilities and Horner PLCs common in municipal water/wastewater </td> </tr> </tbody> </table> <h2>Threat Timeline                       </h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Severity </th> </tr> </thead> <tbody> <tr> <td> 2026-04-13 </td> <td> CISA adds 7 vulnerabilities to Known Exploited Vulnerabilities catalog </td> <td> HIGH </td> </tr> <tr> <td> 2026-04-14 </td> <td> CISA adds 2 additional KEV entries </td> <td> HIGH </td> </tr> <tr> <td> 2026-04-15 </td> <td> REDBIKE ransomware campaign via SonicWall updated — government in target list </td> <td> HIGH </td> </tr> <tr> <td> 2026-04-15 </td> <td> Volt Typhoon intelligence last updated — activity ongoing </td> <td> HIGH </td> </tr> <tr> <td> 2026-04-16 </td> <td> CISA adds Ivanti EPMM CVE-2026-1281/1340 to KEV </td> <td> CRITICAL </td> </tr> <tr> <td> 2026-04-16 </td> <td> CISA publishes 4 ICS advisories (AVEVA, Horner, Delta, Anviz) </td> <td> MEDIUM-HIGH </td> </tr> <tr> <td> 2026-04-17 </td> <td> BeyondTrust CVE-2026-1731 exploitation confirmed with Meterpreter payload </td> <td> CRITICAL </td> </tr> <tr> <td> 2026-04-17 </td> <td> APT28 (Russian GRU) generates fresh attack infrastructure </td> <td> HIGH </td> </tr> <tr> <td> 2026-04-18 </td> <td> APT28 infrastructure activity continues </td> <td> HIGH </td> </tr> <tr> <td> 2026-04-19 </td> <td> Cisco SD-WAN CVE-2026-20127 exploitation campaign targeting government confirmed </td> <td> CRITICAL </td> </tr> <tr> <td> 2026-04-19 </td> <td> Second Ivanti EPMM exploitation campaign identified (6 countries, multiple verticals) </td> <td> CRITICAL </td> </tr> <tr> <td> 2026-04-19 </td> <td> Iranian espionage campaign updated — 17 countries, government/energy/utilities </td> <td> HIGH </td> </tr> <tr> <td> 2026-04-19 </td> <td> DPRK Axios NPM supply chain compromise confirmed (13 countries) </td> <td> HIGH </td> </tr> <tr> <td> 2026-04-20 </td> <td> BlueNoroff C2 domains observed: fake Zoom/Teams/Meet infrastructure </td> <td> HIGH </td> </tr> </tbody> </table> <h2>Key Threat Analysis                    </h2> <h3>1. Cisco Catalyst SD-WAN: The Maximum-Severity Network Takeover (CVE-2026-20127)</h3> CVSS 10.0 | CISA KEV Listed | Active Exploitation Against Government CVE-2026-20127 is an authentication bypass in Cisco Catalyst SD-WAN Controller (vSmart) and SD-WAN Manager (vManage). An unauthenticated remote attacker can obtain admin-level access and manipulate NETCONF/network configuration for the entire SD-WAN overlay. This is not a typical “get a shell on one box” vulnerability. Exploitation grants the ability to: <ul> <li>Reroute all traffic through attacker-controlled infrastructure</li> <li>Create covert tunnels bypassing all security controls</li> <li>Disrupt connectivity across the entire wide-area network</li> <li>Modify network segmentation to access previously isolated systems</li> </ul> The capability profile — network infrastructure manipulation for pre-positioning — is precisely what Volt Typhoon (Chinese state-sponsored) has been documented pursuing with SOHO routers and edge devices. While the current campaign is attributed to “unknown motivations,” the government-specific targeting and network fabric manipulation capability are consistent with Chinese APT pre-positioning tradecraft. ATT&CK: T1190, T1078, T1565.002, T1599 <h3>2. Ivanti EPMM: Two Campaigns, Two Actor Groups (CVE-2026-1281, CVE-2026-1340)</h3> CVSS 9.8 each | CISA KEV Listed | Active Exploitation Two independent campaigns are now confirmed exploiting Ivanti Endpoint Manager Mobile: <ul> <li>Campaign 1: Targeting financial services and government across 4 countries</li> <li>Campaign 2: Targeting automotive, commercial, financial services, government, manufacturing, and transportation across 6 countries</li> </ul> Both CVEs enable unauthenticated remote code execution via code injection. Ivanti EPMM manages mobile device fleets — compromise grants access to device configurations, credentials, and potentially the ability to push malicious profiles to managed devices. For state agencies using Ivanti EPMM to manage employee mobile devices, these vulnerabilities represent a path to mass credential theft and device compromise. ATT&CK: T1190, T1059, T1078 <h3>3. REDBIKE Ransomware: New Family, Familiar Playbook</h3> A previously untracked ransomware family called REDBIKE is being deployed through exploitation of SonicWall VPN appliances. Government is explicitly listed as a target vertical. This follows the broader trend of ransomware operators abandoning phishing in favor of network appliance exploitation — the same pattern seen with BeyondTrust and Ivanti. SonicWall devices are widely deployed across state agencies and county governments, often managed by third-party MSPs. The REDBIKE campaign joins an already crowded ransomware landscape targeting state/local government: DragonForce, Qilin, Rhysida, Medusa, INC Ransom/Lynx, NightSpire, SafePay, Everest, and AiLock all maintain government in their target verticals. ATT&CK: T1190, T1133, T1486, T1490 <h3>4. BlueNoroff (DPRK): Fake Meeting Infrastructure Going Live</h3> Three fresh command-and-control domains were observed mimicking video conferencing platforms: <ul> <li>web04meet[.]top</li> <li>web12teams[.]com</li> <li>web21zoom[.]com</li> </ul> BlueNoroff (a sub-group of North Korea’s Lazarus Group) is known for financially motivated attacks and social engineering via fake meeting invitations. The naming convention strongly suggests an imminent campaign using fake video conference links to deliver malware or harvest credentials. State government employees — particularly those in finance, procurement, and executive roles — are likely targets for this type of social engineering. ATT&CK: T1566.002, T1204.001, T1071.001, T1583.001 <h3>5. Iranian Espionage: Broad and Persistent</h3> A suspected Iranian espionage campaign is targeting government, energy, telecommunications, and utilities across 17 countries using custom backdoors alongside legitimate remote access tools. This tradecraft is consistent with MuddyWater (Iranian MOIS) operations. Separately, CyberAv3ngers (IRGC-CEC) continues exploiting Rockwell PLCs at U.S. water facilities, and MuddyWater has deployed a blockchain-based C2 framework called “ChainShell” against government targets — making attribution more difficult through decentralized infrastructure. ATT&CK: T1219, T1059.001, T1105, T1078, T1071.001 <h3>6. ICS/SCADA: Municipal Infrastructure at Risk</h3> Four new CISA ICS advisories affect systems common in state and local government: <table> <thead> <tr> <th> Advisory </th> <th> Product </th> <th> Relevance to State Government </th> </tr> </thead> <tbody> <tr> <td> ICSA-26-106-04 </td> <td> AVEVA Pipeline Simulation </td> <td> Pipeline infrastructure oversight </td> </tr> <tr> <td> ICSA-26-106-02 </td> <td> Horner Cscape / XL4/XL7 PLC </td> <td> Municipal water/wastewater, building automation </td> </tr> <tr> <td> ICSA-26-106-01 </td> <td> Delta Electronics ASDA-Soft </td> <td> Manufacturing, building automation </td> </tr> <tr> <td> ICSA-26-106-03 </td> <td> Anviz Biometric Access Control </td> <td> State government physical security installations </td> </tr> </tbody> </table> The Anviz advisory is particularly concerning — vulnerabilities allow reconnaissance and capture/decryption of sensitive data from biometric access control and time-attendance systems installed in government buildings. <h2>Predictive Analysis                    </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Timeframe </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> Additional exploitation campaigns emerge for CVE-2026-20127 (Cisco SD-WAN) as PoC code circulates </td> <td> >70% </td> <td> 7–14 days </td> <td> Maximum severity + government targeting + CISA KEV listing drives rapid weaponization </td> </tr> <tr> <td> BlueNoroff fake meeting domains used in targeted spearphishing against government/financial sector </td> <td> 40–60% </td> <td> 7–14 days </td> <td> Infrastructure is fresh (observed 2026-04-20); BlueNoroff historically moves quickly from infrastructure setup to campaign launch </td> </tr> <tr> <td> REDBIKE ransomware expands targeting as SonicWall exploitation techniques are shared in criminal forums </td> <td> 40–60% </td> <td> 14–30 days </td> <td> Ransomware operators routinely share/sell initial access; SonicWall is ubiquitous in government </td> </tr> <tr> <td> Unattributed Cisco SD-WAN campaign attributed to Chinese APT (Volt Typhoon or affiliate) </td> <td> 25–40% </td> <td> 30–60 days </td> <td> Capability profile matches Volt Typhoon; attribution typically lags exploitation by weeks </td> </tr> <tr> <td> Ransomware incident at a U.S. state or local government agency via network appliance exploitation </td> <td> >60% </td> <td> 30 days </td> <td> Multiple active campaigns (REDBIKE, INC Ransom, DragonForce) targeting government via appliance exploitation; attack surface is large and patch velocity is typically slow </td> </tr> </tbody> </table> <h2>SOC Operational Guidance                  </h2> <h3>Immediate Detection Priorities</h3> Hunt Hypothesis 1: Cisco SD-WAN Unauthorized Access <ul> <li>ATT&CK: T1190, T1078, T1565.002, T1599</li> <li>What to look for: Unexpected NETCONF sessions to vSmart/vManage controllers, new admin accounts created on SD-WAN management plane, configuration changes not matching change management tickets, unusual routing policy modifications</li> <li>Detection: Alert on any vManage/vSmart authentication events from non-whitelisted IPs; monitor NETCONF audit logs for configuration pushes outside maintenance windows</li> <li>Investigation: If Cisco SD-WAN is deployed, immediately audit all admin accounts and recent configuration changes. Compare running config against last known-good baseline.</li> </ul> Hunt Hypothesis 2: Ivanti EPMM Exploitation <ul> <li>ATT&CK: T1190, T1059, T1078</li> <li>What to look for: Unexpected processes spawned by Ivanti EPMM application server, web shell artifacts, new device enrollment policies pushed without authorization, anomalous API calls to EPMM management interface</li> <li>Detection: Monitor Ivanti EPMM access logs for exploitation signatures; alert on command execution from web application context</li> <li>Investigation: Review all EPMM-managed device policies for unauthorized modifications; check for new admin accounts</li> </ul> Hunt Hypothesis 3: SonicWall VPN Compromise (REDBIKE precursor) <ul> <li>ATT&CK: T1190, T1133, T1486, T1490</li> <li>What to look for: Unusual VPN session durations, VPN connections from anomalous geolocations, lateral movement following VPN authentication, volume shadow copy deletion, backup system access</li> <li>Detection: Correlate SonicWall VPN authentication logs with impossible travel analysis; alert on post-VPN lateral movement to backup infrastructure</li> <li>Investigation: Audit SonicWall firmware versions across all deployments; check for indicators of pre-ransomware staging (Cobalt Strike beacons, credential dumping)</li> </ul> Hunt Hypothesis 4: BlueNoroff Social Engineering <ul> <li>ATT&CK: T1566.002, T1204.001, T1071.001</li> <li>What to look for: DNS queries or web proxy hits to fake meeting domains; calendar invitations from external senders with links to non-standard video conferencing URLs; executable downloads following meeting link clicks</li> <li>Detection: DNS/proxy blocking and alerting for known C2 domains (see IOC table below); email gateway rules flagging meeting invitations with URLs containing “web##meet/teams/zoom” patterns</li> <li>Investigation: If any employee clicked a suspicious meeting link, isolate endpoint and check for persistence mechanisms</li> </ul> <h3>IOC Blocking Table</h3> <table> <thead> <tr> <th> IOC </th> <th> Type </th> <th> Context </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> web04meet[.]top </td> <td> Domain </td> <td> BlueNoroff (DPRK) C2 — fake meeting infrastructure </td> <td> Block at DNS/proxy; alert on historical lookups </td> </tr> <tr> <td> web12teams[.]com </td> <td> Domain </td> <td> BlueNoroff (DPRK) C2 — fake Teams impersonation </td> <td> Block at DNS/proxy; alert on historical lookups </td> </tr> <tr> <td> web21zoom[.]com </td> <td> Domain </td> <td> BlueNoroff (DPRK) C2 — fake Zoom impersonation </td> <td> Block at DNS/proxy; alert on historical lookups </td> </tr> <tr> <td> rvtootsacad[.]com </td> <td> Domain </td> <td> UNC2465 / DARKSIDE precursor activity </td> <td> Block at DNS/proxy; monitor for resolution attempts </td> </tr> <tr> <td> a.erforias[.]cam </td> <td> Domain </td> <td> APT infrastructure — high severity </td> <td> Block at DNS/proxy </td> </tr> </tbody> </table> <h3>ATT&CK Technique Coverage Check</h3> <table> <thead> <tr> <th> Technique </th> <th> Name </th> <th> Relevant Campaign </th> <th> Detection Status </th> </tr> </thead> <tbody> <tr> <td> T1190 </td> <td> Exploit Public-Facing Application </td> <td> Cisco SD-WAN, Ivanti EPMM, SonicWall, BeyondTrust </td> <td> Priority 1 — ensure appliance logs are collected and monitored </td> </tr> <tr> <td> T1078 </td> <td> Valid Accounts </td> <td> Post-exploitation across all campaigns </td> <td> Monitor for new privileged accounts, impossible travel </td> </tr> <tr> <td> T1133 </td> <td> External Remote Services </td> <td> SonicWall/REDBIKE </td> <td> VPN log analysis, geo-anomaly detection </td> </tr> <tr> <td> T1566.002 </td> <td> Spearphishing Link </td> <td> BlueNoroff fake meetings </td> <td> Email gateway + DNS blocking </td> </tr> <tr> <td> T1219 </td> <td> Remote Access Software </td> <td> Iranian espionage </td> <td> Monitor for unauthorized RMM tool installations </td> </tr> <tr> <td> T1486 </td> <td> Data Encrypted for Impact </td> <td> REDBIKE ransomware </td> <td> Canary files, volume shadow copy monitoring </td> </tr> <tr> <td> T1490 </td> <td> Inhibit System Recovery </td> <td> REDBIKE ransomware </td> <td> Alert on backup deletion, VSS manipulation </td> </tr> <tr> <td> T1565.002 </td> <td> Transmitted Data Manipulation </td> <td> Cisco SD-WAN </td> <td> NETCONF audit logging, config baseline comparison </td> </tr> <tr> <td> T1599 </td> <td> Network Boundary Bridging </td> <td> Cisco SD-WAN </td> <td> Routing table monitoring, unexpected tunnel creation </td> </tr> </tbody> </table> <h2>Sector-Specific Defensive Priorities</h2> <h3>Financial Services (State Treasury, Revenue, Procurement)</h3> <ul> <li>Primary threat: BlueNoroff credential harvesting via fake meeting invitations; Ivanti EPMM exploitation for mobile device access to financial systems</li> <li>Action: Brief finance and procurement staff on fake video conference social engineering; ensure mobile devices accessing financial systems are managed through patched EPMM instances; implement transaction verification procedures that don’t rely solely on email/mobile approval</li> </ul> <h3>Energy (State Energy Regulatory Agencies, Utility Oversight)</h3> <ul> <li>Primary threat: Iranian espionage campaign targeting energy/utilities across 17 countries; CyberAv3ngers targeting water facility PLCs; AVEVA pipeline simulation advisory</li> <li>Action: Coordinate with regulated utilities on Iranian APT indicators; verify that SCADA/ICS systems under state oversight have applied relevant CISA advisories; ensure OT networks are segmented from IT networks with monitored jump boxes</li> </ul> <h3>Healthcare (State Health Agencies, Medicaid Systems)</h3> <ul> <li>Primary threat: INC Ransom/Lynx confirmed hitting NHS hospital (public healthcare analog); DPRK Axios NPM supply chain compromise targeting healthcare sector</li> <li>Action: Verify that healthcare-adjacent state systems (Medicaid, public health databases) have offline backup capability tested within the last 30 days; audit NPM dependencies in any custom web applications; ensure ransomware playbooks include healthcare data breach notification procedures</li> </ul> <h3>Government (All State Agencies)</h3> <ul> <li>Primary threat: Cisco SD-WAN exploitation (CVE-2026-20127) — network fabric takeover; Ivanti EPMM exploitation — mobile fleet compromise; REDBIKE ransomware via SonicWall; Iranian and Russian espionage</li> <li>Action: Emergency patch verification for Cisco SD-WAN, Ivanti EPMM, BeyondTrust, and SonicWall across all agencies; implement management-plane access restrictions on all network infrastructure; activate heightened monitoring for lateral movement and privilege escalation</li> </ul> <h3>Aviation/Logistics (State DOT, Port Authorities, Transit)</h3> <ul> <li>Primary threat: Ivanti EPMM Campaign 2 explicitly targets transportation sector; Cisco SD-WAN exploitation could disrupt transit network connectivity; Delta Electronics ASDA-Soft advisory affects servo drives in transportation automation</li> <li>Action: Verify that transportation management systems are not accessible via compromised SD-WAN fabric; audit Ivanti EPMM deployments managing field worker mobile devices; review Delta Electronics servo drive deployments in transit automation systems</li> </ul> <h2>Prioritized Defense Recommendations</h2> <h3>IMMEDIATE (Within 24 Hours)</h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> IT Operations </td> <td> Verify patch status of ALL Cisco Catalyst SD-WAN Controller (vSmart) and SD-WAN Manager (vManage) instances for CVE-2026-20127. If unpatched: restrict management plane access to trusted IPs only, enable NETCONF audit logging, and compare running configuration against last known-good baseline. </td> </tr> <tr> <td> 2 </td> <td> IT Operations </td> <td> Confirm Ivanti EPMM instances are patched for CVE-2026-1281 and CVE-2026-1340. Two distinct exploitation campaigns now target government. If EPMM is internet-facing and unpatched, take offline pending emergency patching. </td> </tr> <tr> <td> 3 </td> <td> SOC </td> <td> Block BlueNoroff C2 domains (web04meet[.]top, web12teams[.]com, web21zoom[.]com, rvtootsacad[.]com, a.erforias[.]cam) at DNS resolvers and web proxies. Run retroactive DNS query analysis for any historical resolution attempts. </td> </tr> <tr> <td> 4 </td> <td> IT Operations </td> <td> Verify BeyondTrust Remote Support and Privileged Remote Access patched for CVE-2026-1731 (CVSS 9.8, confirmed exploitation with Meterpreter payload delivery). </td> </tr> </tbody> </table> <h3>7-DAY</h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 5 </td> <td> IT Operations </td> <td> Audit all SonicWall VPN appliance firmware versions across state agencies and county deployments. REDBIKE ransomware is actively exploiting SonicWall for government targeting. Coordinate with MSP vendors managing SonicWall devices for downstream agencies. </td> </tr> <tr> <td> 6 </td> <td> Physical Security / IT Ops </td> <td> Inventory all Anviz biometric access control systems in state facilities. CISA advisory ICSA-26-106-03 warns of data capture/decryption vulnerabilities. Isolate Anviz devices from production networks pending vendor patch. </td> </tr> <tr> <td> 7 </td> <td> SOC </td> <td> Deploy hunting queries for unauthorized NETCONF sessions, new admin account creation on network infrastructure, and configuration changes outside maintenance windows. </td> </tr> <tr> <td> 8 </td> <td> Security Awareness </td> <td> Issue targeted advisory to finance, procurement, and executive staff regarding fake video conference invitation social engineering (BlueNoroff campaign). Include examples of suspicious domain patterns. </td> </tr> </tbody> </table> <h3>30-DAY</h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 9 </td> <td> CISO </td> <td> Commission a network appliance attack surface assessment. Catalog all internet-facing SonicWall, Fortinet, Ivanti, BeyondTrust, and Cisco SD-WAN instances across state and county networks. The dominant initial access trend is now perimeter appliance exploitation — defensive investment must shift accordingly. </td> </tr> <tr> <td> 10 </td> <td> CISO </td> <td> Establish network appliance patch SLA — critical CVEs on internet-facing appliances patched within 48 hours, not the 30-day window acceptable for endpoints. </td> </tr> <tr> <td> 11 </td> <td> IR Team </td> <td> Update ransomware incident response playbooks to account for network appliance initial access (not just phishing). Include SonicWall, Ivanti, and BeyondTrust compromise scenarios with specific forensic evidence locations. </td> </tr> <tr> <td> 12 </td> <td> CISO / CIO </td> <td> Evaluate SD-WAN architecture resilience — if Cisco Catalyst SD-WAN is deployed, assess whether a compromised controller could be used for traffic interception or network-wide disruption. Consider management plane segmentation and out-of-band management access. </td> </tr> </tbody> </table> <h2>Bottom Line                                     </h2> The data is unambiguous: adversaries have moved from your inbox to your network edge. Four of the five most critical active campaigns target perimeter appliances — Cisco SD-WAN, Ivanti EPMM, BeyondTrust, and SonicWall. These devices often sit outside the visibility of endpoint detection tools, are patched on slower cycles than workstations, and when compromised, grant access that bypasses every downstream security control. For state government IT leaders, this demands three strategic responses: <ol> <li>Treat network appliance patching with the same urgency as zero-day endpoint patching. A CVSS 10.0 on your SD-WAN controller is more dangerous than a CVSS 10.0 on a single workstation — it affects your entire network fabric.</li> <li>Maintain a real-time inventory of every internet-facing appliance with its firmware version. You cannot patch what you cannot find. Many state agencies have SonicWall or Fortinet devices deployed by MSPs that don’t appear in centralized asset inventories.</li> <li>Assume your perimeter will be breached and invest in detection of post-exploitation lateral movement. Network segmentation, privileged access monitoring, and backup integrity verification are your last lines of defense when an appliance is compromised.</li> </ol> The threat actors — from Volt Typhoon pre-positioning in network infrastructure to REDBIKE ransomware operators exploiting SonicWall — have already adapted their playbooks. Your defensive posture must adapt with equal urgency.

FEATURED RESOURCES

April 20, 2026

Anomali Cyber Watch

Iran’s Cyber War Didn’t Stop When the Bombs Did — Why the Ceasefire Is the Most Dangerous Phase Yet

April 20, 2026

Anomali Cyber Watch

Public Sector

Network Appliances Under Siege: State Government IT Faces Maximum-Severity Exploitation Wave

April 14, 2026

Anomali Cyber Watch

When Silence Is the Loudest Warning: Iran's Cyber Operations Enter a Dangerous New Phase

Explore All