Ransomware Cartels, SharePoint Zero-Day Exploitation, and ICS Vulnerabilities Converge on State Government Networks

Public Sector

Published on

July 7, 2026

Table of Contents

Threat Assessment Level: ELEVATED Maintained from prior cycle. While the July 4th holiday weekend passed without a confirmed state government ransomware incident, the underlying threat conditions remain dangerous: an actively exploited SharePoint vulnerability, industrialized ransomware operations targeting government, and new ICS advisories affecting water/wastewater infrastructure demand sustained vigilance. <h2> Introduction </h2> State government IT leaders face a compounding threat environment this week. A critical Microsoft SharePoint vulnerability (CVE-2026-45659) is now confirmed under active exploitation and listed on CISA's Known Exploited Vulnerabilities catalog — directly threatening the document management and collaboration systems that underpin state agency operations. Simultaneously, ransomware groups with explicit government-targeting mandates continue posting victims at an accelerating pace, and six new CISA ICS advisories affect equipment deployed in state water treatment and data center infrastructure. This brief provides actionable intelligence for state CIOs and CISOs navigating these concurrent threats, with specific defensive priorities for each critical sector under state government purview. <h2> What Changed </h2> <table> <thead> <tr> <th> Development </th> <th> Why It Matters for State Government </th> </tr> </thead> <tbody> <tr> <td> CVE-2026-45659 added to CISA KEV (Jul 1) </td> <td> SharePoint deserialization RCE (CVSS 8.8) is actively exploited. State SharePoint farms — especially hybrid deployments — are directly in the crosshairs. China-nexus exploitation confirmed. </td> </tr> <tr> <td> AiLock ransomware posts US education victim (Jul 7) </td> <td> 42 total victims, 22 in the US. Government-public-services is a listed target industry. Education sector targeting demonstrates willingness to hit public institutions. </td> </tr> <tr> <td> DragonForce cartel continues high-tempo operations (Jul 6) </td> <td> 590 total victims, 284 in the US. 80% affiliate revenue share model is industrializing ransomware at scale. Government explicitly listed as target vertical. </td> </tr> <tr> <td> 6 CISA ICS advisories including Schneider Electric RTU (Jun 30–Jul 2) </td> <td> Schneider Electric EasyLogic T150 and Saitel DP RTU vulnerabilities directly affect state water/wastewater SCADA. StoneFly Storage Concentrator allows arbitrary command execution. </td> </tr> <tr> <td> Active Cobalt Strike C2 on US hosting (Jul 7) </td> <td> Four validated command-and-control servers on US infrastructure (ASN 139659 Lucidacloud pattern) — pre-positioned for intrusion operations. </td> </tr> <tr> <td> APT28 CHOPSTICK.V2 malware updated; nation-state pre-positioning ongoing (Jun 7 / ongoing) </td> <td> Russian GRU tooling updated in Anomali ThreatStream Next-Gen; China-nexus Volt Typhoon and Salt Typhoon maintain low-visibility pre-positioning doctrine against US government targets. </td> </tr> <tr> <td> AI agent prompt injection documented in the wild (Jul 7) </td> <td> First confirmed financial exploitation via indirect prompt injection on public websites. Directly relevant as state agencies deploy M365 Copilot and citizen-facing AI assistants. </td> </tr> </tbody> </table> <h2> Threat Timeline </h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Actor/Group </th> <th> Impact </th> </tr> </thead> <tbody> <tr> <td> Jun 12 </td> <td> California water utility breach confirmed </td> <td> VOID MANTICORE (Iranian IRGC) </td> <td> Nation-state destructive capability against US critical infrastructure </td> </tr> <tr> <td> Jun 17 </td> <td> FortiBleed campaign compromises 73,000+ Fortinet devices </td> <td> Unknown (credentials sold to INC, Lynx ransomware) </td> <td> Perimeter credential theft operationalized by ransomware groups </td> </tr> <tr> <td> Jun 30 </td> <td> CISA ICS advisories: Schneider Electric, Mitsubishi, StoneFly, B&R </td> <td> N/A (vendor vulnerabilities) </td> <td> State water/wastewater SCADA and data center infrastructure exposed </td> </tr> <tr> <td> Jul 1 </td> <td> CVE-2026-45659 added to CISA KEV catalog </td> <td> China-nexus (assessed) </td> <td> Active exploitation of SharePoint — government confirmed as target </td> </tr> <tr> <td> Jul 2 </td> <td> Additional ICS advisories: satellite terminals, IoT </td> <td> N/A </td> <td> Expanded OT attack surface </td> </tr> <tr> <td> Jul 4 </td> <td> Play ransomware updates operations </td> <td> Play RaaS </td> <td> Government targeting maintained through holiday weekend </td> </tr> <tr> <td> Jul 6 </td> <td> DragonForce posts new victims </td> <td> DragonForce Cartel </td> <td> 590 total victims; US government remains primary target vertical </td> </tr> <tr> <td> Jul 7 </td> <td> AiLock posts US education victim </td> <td> AiLock RaaS </td> <td> Public institution targeting; 42 victims and accelerating </td> </tr> <tr> <td> Jul 7 </td> <td> AI agent prompt injection exploitation documented </td> <td> Unattributed (research) </td> <td> Emerging attack class for enterprise AI deployments </td> </tr> </tbody> </table> <h2> Key Threat Analysis </h2> <h3> 1. CVE-2026-45659: SharePoint Under Active Nation-State Exploitation </h3> This is the most immediately actionable threat for state agencies. CVE-2026-45659 is a deserialization vulnerability in Microsoft SharePoint that allows an authorized attacker to execute arbitrary code over the network. With a CVSS score of 8.8 and confirmed active exploitation, this vulnerability enables: <ul> <li> Initial access via exploitation of internet-facing SharePoint farms (T1190) </li> <li> Code execution via PowerShell post-exploitation (T1059.001) </li> <li> Persistence via web shell deployment — a hallmark of China-nexus SharePoint campaigns (T1505.003) </li> </ul> This is the third SharePoint deserialization CVE tracked in connection with China-nexus operations (alongside CVE-2025-53770). State government SharePoint deployments — particularly those with hybrid Azure AD/Entra ID integration — represent a convergence point where nation-state espionage meets vulnerability management failure. Bottom line: If your SharePoint Server farms have not applied the June 2026 cumulative update, you are operating with a confirmed exploited vulnerability on infrastructure that stores agency documents, citizen data, and inter-agency communications. <h3> 2. Ransomware: Industrialized and Government-Focused </h3> Three ransomware-as-a-service operations pose direct, named threats to state government: DragonForce Cartel — 590 victims, 284 in the US. Operates an 80% affiliate revenue share model that incentivizes volume. Uses commodity tools (Advanced IP Scanner, PingCastle, SoftPerfect NetScan, Mimikatz) that are detectable but require behavioral analytics beyond signature matching. Government-public-services is an explicitly listed target industry. AiLock — 42 victims, 22 in the US. Uses hybrid ChaCha20/NTRUEncrypt encryption with a 72-hour contact deadline. Threatens regulatory reporting to data protection authorities as additional extortion leverage. Today's US education sector victim demonstrates willingness to target public institutions with limited security budgets — a profile that matches many state agencies. Play — Updated operations through the July 4th holiday weekend, maintaining government targeting. Previously confirmed in state/local government incidents. Probability assessment: Based on the operational tempo of these three groups, their explicit government targeting, and the expanded attack surface from FortiBleed credential exposure, we assess a 65–75% probability of a ransomware incident affecting a US state or local government entity within the next 14 days. <h3> 3. ICS/SCADA: Direct Threats to State Water and Utilities Infrastructure </h3> Six CISA ICS advisories published between June 30 and July 2 affect equipment categories deployed in state government operational technology environments: <ul> <li> Schneider Electric EasyLogic T150 and Saitel DP RTU — unauthorized access and sensitive information exposure in remote terminal units used in water treatment and distribution </li> <li> Schneider Electric EcoStruxure IT Data Center Expert — vulnerability in data center management platforms </li> <li> StoneFly Storage Concentrator — arbitrary command execution in storage infrastructure </li> <li> XZ Utils vulnerability impacting B&R Products — supply chain library compromise affecting industrial automation </li> </ul> These advisories arrive in the context of the June 12 VOID MANTICORE breach of a California water utility — demonstrating that nation-state actors are actively targeting the same infrastructure categories now shown to have exploitable vulnerabilities. <h3> 4. Nation-State Pre-Positioning: Quiet Does Not Mean Absent </h3> China-nexus actors (Volt Typhoon, Salt Typhoon) have produced no new indicators this cycle — but their operational doctrine is specifically designed to avoid detection during pre-positioning phases. The CVE-2026-45659 SharePoint exploitation is assessed as China-nexus activity, representing the visible tip of likely broader operations. APT28 (Russian GRU) — CHOPSTICK.V2 malware updated in ThreatStream Next-Gen (Jun 7). Active campaigns against US government targets confirmed in prior cycles. VOID MANTICORE (Iranian IRGC) — The June 12 California water utility breach remains the most significant confirmed destructive operation against US critical infrastructure this quarter. <h3> 5. Emerging: AI Agent Prompt Injection as Enterprise Attack Vector </h3> Zscaler research published today documents real-world websites using SEO poisoning combined with hidden CSS elements to inject malicious instructions into AI agent context windows. Four of 26 tested LLMs executed unauthorized cryptocurrency payments. While current targeting focuses on developers and cryptocurrency users, the attack methodology directly applies to: <ul> <li> M365 Copilot deployments browsing internal and external content </li> <li> State-deployed citizen service chatbots with web access </li> <li> Custom AI agents with action capabilities (API calls, data retrieval) </li> </ul> This is not a theoretical risk — it is documented in-the-wild exploitation that will scale to enterprise targets. <h2> Predictive Analysis </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Timeframe </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> Ransomware incident affecting a US state/local government entity </td> <td> 65–75% </td> <td> Next 14 days </td> <td> DragonForce (590 victims), AiLock (42 victims), Play all actively targeting government; FortiBleed credentials operationalized </td> </tr> <tr> <td> Exploitation of CVE-2026-45659 against a state SharePoint farm </td> <td> 50–60% </td> <td> Next 30 days </td> <td> CISA KEV confirmation, China-nexus attribution, state agencies historically slow to patch on-premises SharePoint </td> </tr> <tr> <td> ICS/SCADA reconnaissance or exploitation attempt against state water infrastructure </td> <td> 40–50% </td> <td> Next 30 days </td> <td> VOID MANTICORE precedent + new Schneider Electric RTU vulnerabilities + Volt Typhoon pre-positioning doctrine </td> </tr> <tr> <td> AI agent manipulation incident in enterprise environment </td> <td> 25–35% </td> <td> Next 60 days </td> <td> Documented in-the-wild technique, rapid enterprise AI adoption, limited security controls on agent actions </td> </tr> <tr> <td> Nation-state data exfiltration via SharePoint web shell (undetected) </td> <td> 30–40% </td> <td> May already be occurring </td> <td> China-nexus exploitation confirmed; web shells are designed for persistent, low-visibility access </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Immediate Blocking Actions </h3> Block the following validated C2 infrastructure at perimeter firewalls, proxies, and EDR: <table> <thead> <tr> <th> IOC </th> <th> Type </th> <th> Context </th> <th> Confidence </th> </tr> </thead> <tbody> <tr> <td> 38.147.172[.]196 </td> <td> IPv4 </td> <td> Cobalt Strike BEACON C2 (Lucidacloud ASN 139659, port 8800) </td> <td> 92% </td> </tr> <tr> <td> 68.64.178[.]130 </td> <td> IPv4 </td> <td> Cobalt Strike BEACON C2 (Lucidacloud ASN 139659, port 80) </td> <td> 96% </td> </tr> <tr> <td> 23.179.248[.]205 </td> <td> IPv4 </td> <td> Malware C2 Server (Cloudflare London ASN 209242) </td> <td> 87% </td> </tr> <tr> <td> 181.224.24[.]125 </td> <td> IPv4 </td> <td> Validated active C2 (Master Da Web ASN 270564) </td> <td> 89% </td> </tr> <tr> <td> 45.135.232[.]195 </td> <td> IPv4 </td> <td> DragonForce infrastructure </td> <td> High </td> </tr> </tbody> </table> Additional IOCs for the campaigns discussed in this report are available through ThreatStream Next-Gen and partner feeds. <h3> Detection Engineering Priorities </h3> <table> <thead> <tr> <th> ATT&CK Technique </th> <th> Detection Approach </th> <th> Priority </th> </tr> </thead> <tbody> <tr> <td> T1190 — Exploit Public-Facing Application </td> <td> Monitor SharePoint ULS logs for deserialization exceptions; alert on unexpected .aspx file creation in SharePoint web directories </td> <td> CRITICAL </td> </tr> <tr> <td> T1505.003 — Web Shell </td> <td> Hunt for new .aspx/.asmx files in SharePoint hive directories; monitor IIS worker process (w3wp.exe) spawning cmd.exe or PowerShell </td> <td> CRITICAL </td> </tr> <tr> <td> T1059.001 — PowerShell </td> <td> Alert on PowerShell execution by IIS application pool identities; monitor for encoded commands from web server contexts </td> <td> HIGH </td> </tr> <tr> <td> T1486 — Data Encrypted for Impact </td> <td> Volume shadow copy deletion (vssadmin, wmic); mass file rename operations; ransomware canary files </td> <td> HIGH </td> </tr> <tr> <td> T1562.001 — Disable/Modify Tools </td> <td> Monitor for EDR service stops, tamper protection disablement, Windows Defender exclusion additions </td> <td> HIGH </td> </tr> <tr> <td> T1071.001 — Web Protocol C2 </td> <td> TLS connections to Lucidacloud ASN 139659 on non-standard ports (8800); beaconing pattern detection </td> <td> HIGH </td> </tr> <tr> <td> T1083 — File and Directory Discovery </td> <td> Advanced IP Scanner, PingCastle, SoftPerfect NetScan execution by non-IT-admin accounts </td> <td> MEDIUM </td> </tr> </tbody> </table> <h3> Hunting Hypotheses </h3> <ol> <li> SharePoint Web Shell Hunt: Search for .aspx files created in SharePoint virtual directories after Jul 1 that were not part of a sanctioned deployment. Correlate with IIS logs showing POST requests to unusual paths. </li> <li> Cobalt Strike Beacon Detection: Network traffic analysis for HTTP/HTTPS beaconing to ASN 139659 (Lucidacloud) with regular callback intervals. Check DNS logs for resolution of infrastructure in the 38.147.172.0/24 and 68.64.178.0/24 ranges. </li> <li> Pre-Ransomware Reconnaissance: Alert on PingCastle.exe, Advanced IP Scanner, or SoftPerfect NetScan execution outside of scheduled IT administration windows or by accounts not in privileged IT groups. </li> <li> Credential Theft Pipeline: Monitor for Mimikatz indicators (lsass.exe memory access by non-security tools), DCSync operations, and Kerberoasting activity — these are the DragonForce playbook precursors to encryption. </li> <li> ICS/SCADA Anomaly: Baseline normal communication patterns to Schneider Electric EasyLogic and Saitel DP RTU devices. Alert on new source IPs communicating with RTU management interfaces or firmware update attempts outside maintenance windows. </li> </ol> <h2> Sector-Specific Defensive Priorities </h2> <h3> Financial Services (State Treasury, Revenue, Benefits Systems) </h3> <ul> <li> Primary threat: Ransomware targeting financial data for double extortion; credential theft enabling wire fraud </li> <li> Key action: Ensure Oracle EBS and financial processing systems are segmented from general network; verify backup integrity for tax and benefits databases </li> <li> Detection focus: Unusual database queries against citizen financial records; lateral movement from compromised endpoints toward EBS application servers </li> <li> Regulatory note: AiLock's threat to report victims to data protection authorities adds regulatory extortion pressure to financial data custodians </li> </ul> <h3> Energy (State-Managed Utilities, Grid Coordination) </h3> <ul> <li> Primary threat: Nation-state pre-positioning (Volt Typhoon doctrine); ICS vulnerability exploitation </li> <li> Key action: Review Schneider Electric EasyLogic T150 and Saitel DP RTU firmware against ICSA-26-181-04; verify OT network segmentation from IT </li> <li> Detection focus: New connections to RTU management interfaces; firmware update attempts outside maintenance windows; DNS queries from OT segments to internet </li> <li> Context: VOID MANTICORE's June 12 water utility breach demonstrates this is not theoretical — destructive attacks on US utilities are confirmed operational </li> </ul> <h3> Healthcare (State Health Agencies, Medicaid Systems) </h3> <ul> <li> Primary threat: Ransomware targeting PHI for extortion; supply chain risk via medical device software (OFFIS DCMTK vulnerability in ICS advisories) </li> <li> Key action: Verify medical imaging and DICOM systems are patched against DCMTK vulnerabilities; ensure PHI databases have offline backup copies </li> <li> Detection focus: Mass file access patterns against health records; lateral movement toward Medicaid claims processing systems </li> <li> Regulatory note: HIPAA breach notification timelines create additional pressure during ransomware incidents — pre-position legal and communications teams </li> </ul> <h3> Government (Executive, Legislative, Judicial, Elections) </h3> <ul> <li> Primary threat: SharePoint exploitation (CVE-2026-45659) for espionage and document theft; ransomware for political leverage </li> <li> Key action: Patch SharePoint immediately; audit SharePoint permissions for overly broad access; hunt for web shells in SharePoint directories </li> <li> Detection focus: Unusual SharePoint API calls; new .aspx files in web directories; PowerShell execution by IIS worker processes; document exfiltration patterns </li> <li> Context: China-nexus actors specifically target government SharePoint for intelligence collection. Legislative and judicial systems contain sensitive deliberative materials attractive to espionage actors. </li> </ul> <h3> Aviation/Logistics (State DOT, Port Authorities, Transit Systems) </h3> <ul> <li> Primary threat: ICS/SCADA exploitation affecting traffic management and transit control systems; ransomware disrupting logistics operations </li> <li> Key action: Audit StoneFly Storage Concentrator deployments (arbitrary command execution); verify network segmentation between IT and OT for transit control systems </li> <li> Detection focus: Anomalous commands to traffic management controllers; unauthorized access to transit SCADA interfaces; storage system administrative access from unexpected sources </li> <li> Supply chain: XZ Utils vulnerability affecting B&R industrial automation products may impact embedded systems in transportation infrastructure </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Within 24 Hours) </h3> <table> <thead> <tr> <th> Action </th> <th> Owner </th> <th> Rationale </th> </tr> </thead> <tbody> <tr> <td> Verify and apply June 2026 cumulative update to all SharePoint Server farms for CVE-2026-45659 </td> <td> IT Operations </td> <td> CISA KEV, active exploitation confirmed, CVSS 8.8 </td> </tr> <tr> <td> Block C2 IPs at perimeter: 38.147.172[.]196, 68.64.178[.]130, 23.179.248[.]205, 181.224.24[.]125, 45.135.232[.]195 </td> <td> SOC / Network Ops </td> <td> Validated active Cobalt Strike and DragonForce infrastructure </td> </tr> <tr> <td> Hunt for web shells in SharePoint virtual directories (new .aspx files created after Jul 1) </td> <td> SOC / Threat Hunt </td> <td> China-nexus exploitation may have already established persistence </td> </tr> <tr> <td> Confirm ransomware incident response playbook is current and key personnel are reachable </td> <td> CISO / IR Team </td> <td> 65–75% probability of state/local gov ransomware incident within 14 days </td> </tr> </tbody> </table> <h3> 7-DAY </h3> <table> <thead> <tr> <th> Action </th> <th> Owner </th> <th> Rationale </th> </tr> </thead> <tbody> <tr> <td> Review Schneider Electric EasyLogic T150 and Saitel DP RTU firmware against ICSA-26-181-04 </td> <td> Facilities / OT Teams </td> <td> Direct relevance to state water/wastewater SCADA infrastructure </td> </tr> <tr> <td> Deploy behavioral detections for Advanced IP Scanner, PingCastle, SoftPerfect NetScan, and Mimikatz execution by non-admin accounts </td> <td> SOC / Detection Engineering </td> <td> DragonForce pre-encryption reconnaissance toolkit </td> </tr> <tr> <td> Assess AI agent/copilot deployments for indirect prompt injection exposure; implement content filtering on agent web browsing </td> <td> Security Architecture </td> <td> Documented in-the-wild exploitation; state AI adoption accelerating </td> </tr> <tr> <td> Verify FortiGate firmware is current and rotate all administrative credentials </td> <td> IT Operations </td> <td> FortiBleed campaign (73,000+ devices) credentials confirmed operationalized by ransomware groups </td> </tr> <tr> <td> Add DragonForce MD5 hashes to EDR blocklist: 3a514e164db30acdb3063eb79a23aa4f, f0410358a0d9dbd0dff3113d9c744ca7, 99be93aa4c34b39fedcd37663c34511f, 2dd7cd2bf15eec7d62689435fca9c49c </td> <td> SOC </td> <td> Known DragonForce tooling indicators </td> </tr> </tbody> </table> <h3> 30-DAY </h3> <table> <thead> <tr> <th> Action </th> <th> Owner </th> <th> Rationale </th> </tr> </thead> <tbody> <tr> <td> Audit StoneFly Storage Concentrator deployments for arbitrary command execution vulnerability (ICSA-26-181-06) </td> <td> IT Operations / Storage </td> <td> Critical storage infrastructure at risk </td> </tr> <tr> <td> Evaluate SharePoint Online migration for remaining on-premises farms </td> <td> Security Architecture / CIO </td> <td> Reduce attack surface from recurring SharePoint Server deserialization vulnerabilities </td> </tr> <tr> <td> Establish manual legislative monitoring process (congress.gov, NCSL, CISA directives) </td> <td> CTI / Policy Team </td> <td> Automated feeds degraded 7+ days; cybersecurity legislation visibility gap </td> </tr> <tr> <td> Commission tabletop exercise simulating simultaneous ransomware + ICS incident </td> <td> CISO / IR Team </td> <td> Dual-threat scenario increasingly plausible given current actor capabilities </td> </tr> <tr> <td> Implement network segmentation audit for OT/SCADA environments with focus on Schneider Electric and StoneFly systems </td> <td> Network Architecture </td> <td> ICS advisories reveal exploitable gaps; segmentation is primary compensating control </td> </tr> </tbody> </table> <h3> Executive / IR Preparedness </h3> <ul> <li> Pre-position legal counsel for ransomware negotiation and breach notification scenarios (HIPAA, state privacy laws) </li> <li> Validate cyber insurance coverage against current ransomware demands (AiLock uses regulatory reporting threats as additional leverage) </li> <li> Confirm communication channels between IT security and facilities/utilities teams managing SCADA infrastructure — these teams must be reachable within 1 hour during an ICS incident </li> <li> Brief agency heads on the 65–75% ransomware probability assessment — ensure political leadership understands the risk posture and has approved response authorities </li> </ul> <h2> Bottom Line </h2> The convergence of an actively exploited SharePoint vulnerability, industrialized ransomware operations with explicit government targeting, and new ICS vulnerabilities affecting state water infrastructure creates a threat environment that demands immediate action — not next quarter's planning cycle. The July 4th holiday weekend passed without a confirmed state government incident. That is not reassurance — it is borrowed time. DragonForce has 590 victims. AiLock hit a US educational institution today. Play updated operations through the holiday. The question is not whether state government will be targeted, but whether your defenses will hold when it happens. Patch SharePoint. Block the C2 infrastructure. Hunt for web shells. Verify your ICS segmentation. Test your incident response plan. Do it today. Published 2026-07-07 by the Anomali CTI Desk. For IOC feeds, detection signatures, and additional context, contact your ThreatStream Next-Gen representative.

FEATURED RESOURCES

July 7, 2026

Anomali Cyber Watch

Iranian Cyber Operations Enter Critical Retaliation Window Following Khamenei Funeral

July 7, 2026

Anomali Cyber Watch

Public Sector

Ransomware Cartels, SharePoint Zero-Day Exploitation, and ICS Vulnerabilities Converge on State Government Networks

July 6, 2026

Threat Intelligence Platform

SIEM

Threat Intelligence Platform vs SIEM: What Changes as SIEM Modernization Closes the Gap

Learn the differences between threat intelligence platforms and SIEMs, how they work together, and why modern SOC teams use both to improve detection and response.

Explore All